net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2016  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_NAN,
  60         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  61 };
  62
  63 static const struct genl_multicast_group nl80211_mcgrps[] = {
  64         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  65         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  66         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  67         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  68         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  69         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  70 #ifdef CONFIG_NL80211_TESTMODE
  71         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  72 #endif
  73 };
  74
  75 /* returns ERR_PTR values */
  76 static struct wireless_dev *
  77 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  78 {
  79         struct cfg80211_registered_device *rdev;
  80         struct wireless_dev *result = NULL;
  81         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  82         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  83         u64 wdev_id;
  84         int wiphy_idx = -1;
  85         int ifidx = -1;
  86
  87         ASSERT_RTNL();
  88
  89         if (!have_ifidx && !have_wdev_id)
  90                 return ERR_PTR(-EINVAL);
  91
  92         if (have_ifidx)
  93                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  94         if (have_wdev_id) {
  95                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  96                 wiphy_idx = wdev_id >> 32;
  97         }
  98
  99         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 100                 struct wireless_dev *wdev;
 101
 102                 if (wiphy_net(&rdev->wiphy) != netns)
 103                         continue;
 104
 105                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 106                         continue;
 107
 108                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 109                         if (have_ifidx && wdev->netdev &&
 110                             wdev->netdev->ifindex == ifidx) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 115                                 result = wdev;
 116                                 break;
 117                         }
 118                 }
 119
 120                 if (result)
 121                         break;
 122         }
 123
 124         if (result)
 125                 return result;
 126         return ERR_PTR(-ENODEV);
 127 }
 128
 129 static struct cfg80211_registered_device *
 130 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 131 {
 132         struct cfg80211_registered_device *rdev = NULL, *tmp;
 133         struct net_device *netdev;
 134
 135         ASSERT_RTNL();
 136
 137         if (!attrs[NL80211_ATTR_WIPHY] &&
 138             !attrs[NL80211_ATTR_IFINDEX] &&
 139             !attrs[NL80211_ATTR_WDEV])
 140                 return ERR_PTR(-EINVAL);
 141
 142         if (attrs[NL80211_ATTR_WIPHY])
 143                 rdev = cfg80211_rdev_by_wiphy_idx(
 144                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 145
 146         if (attrs[NL80211_ATTR_WDEV]) {
 147                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 148                 struct wireless_dev *wdev;
 149                 bool found = false;
 150
 151                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 152                 if (tmp) {
 153                         /* make sure wdev exists */
 154                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 155                                 if (wdev->identifier != (u32)wdev_id)
 156                                         continue;
 157                                 found = true;
 158                                 break;
 159                         }
 160
 161                         if (!found)
 162                                 tmp = NULL;
 163
 164                         if (rdev && tmp != rdev)
 165                                 return ERR_PTR(-EINVAL);
 166                         rdev = tmp;
 167                 }
 168         }
 169
 170         if (attrs[NL80211_ATTR_IFINDEX]) {
 171                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 172
 173                 netdev = __dev_get_by_index(netns, ifindex);
 174                 if (netdev) {
 175                         if (netdev->ieee80211_ptr)
 176                                 tmp = wiphy_to_rdev(
 177                                         netdev->ieee80211_ptr->wiphy);
 178                         else
 179                                 tmp = NULL;
 180
 181                         /* not wireless device -- return error */
 182                         if (!tmp)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         /* mismatch -- return error */
 186                         if (rdev && tmp != rdev)
 187                                 return ERR_PTR(-EINVAL);
 188
 189                         rdev = tmp;
 190                 }
 191         }
 192
 193         if (!rdev)
 194                 return ERR_PTR(-ENODEV);
 195
 196         if (netns != wiphy_net(&rdev->wiphy))
 197                 return ERR_PTR(-ENODEV);
 198
 199         return rdev;
 200 }
 201
 202 /*
 203  * This function returns a pointer to the driver
 204  * that the genl_info item that is passed refers to.
 205  *
 206  * The result of this can be a PTR_ERR and hence must
 207  * be checked with IS_ERR() for errors.
 208  */
 209 static struct cfg80211_registered_device *
 210 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 211 {
 212         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 213 }
 214
 215 /* policy for the attributes */
 216 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 217         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 219                                       .len = 20-1 },
 220         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 221
 222         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 223         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 224         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 225         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 226         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 227
 228         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 232         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 233         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 234
 235         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 236         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 237         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 238
 239         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 240         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 241
 242         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 243         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 244                                     .len = WLAN_MAX_KEY_LEN },
 245         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 246         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 247         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 248         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 249         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 250
 251         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 252         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 253         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 254                                        .len = IEEE80211_MAX_DATA_LEN },
 255         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 256                                        .len = IEEE80211_MAX_DATA_LEN },
 257         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 258         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 259         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 260         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 261                                                .len = NL80211_MAX_SUPP_RATES },
 262         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 263         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 264         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 265         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 266                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 267         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 268
 269         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 270         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 271
 272         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 274         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 275         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 276                                            .len = NL80211_MAX_SUPP_RATES },
 277         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 278
 279         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 280         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 281
 282         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 283
 284         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 285         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 286                               .len = IEEE80211_MAX_DATA_LEN },
 287         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 289
 290         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 291                                 .len = IEEE80211_MAX_SSID_LEN },
 292         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 293         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 294         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 296         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 297         [NL80211_ATTR_STA_FLAGS2] = {
 298                 .len = sizeof(struct nl80211_sta_flag_update),
 299         },
 300         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 302         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 303         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 304         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 305         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 306         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 307         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 308         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 309                                  .len = WLAN_PMKID_LEN },
 310         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 311         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 312         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 313         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 314                                  .len = IEEE80211_MAX_DATA_LEN },
 315         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 316         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 317         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 318         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 319         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 320         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 322         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 323         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 324         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 325         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 326         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 330         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 331         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 332         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 334         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 335                                          .len = IEEE80211_MAX_DATA_LEN },
 336         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 337                                          .len = IEEE80211_MAX_DATA_LEN },
 338         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 340         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 343         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 347         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 349                                       .len = IEEE80211_MAX_DATA_LEN },
 350         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 351         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 353                 .len = NL80211_HT_CAPABILITY_LEN
 354         },
 355         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 356         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 357         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 358         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 359         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 360         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 361         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 362         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 363         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 364         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 365         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 366         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 367         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 368         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 369         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 370         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 371         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 372                 .len = NL80211_VHT_CAPABILITY_LEN,
 373         },
 374         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 376                                   .len = IEEE80211_MAX_DATA_LEN },
 377         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 378         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 379         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 380         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 381         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 384         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 385         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 386         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 387         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 388         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 389         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 390         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 391                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 392         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 393         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 394         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 395         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 397         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 398         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 399         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 400         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 401         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 402         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 403         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 404         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 405         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 406         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 407         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 408         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 409         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 410         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 411                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 412         },
 413         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 414         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 415         [NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
 416         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 417 };
 418
 419 /* policy for the key attributes */
 420 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 421         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 422         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 423         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 424         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 425         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 426         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 427         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 428         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 429 };
 430
 431 /* policy for the key default flags */
 432 static const struct nla_policy
 433 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 434         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 435         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 436 };
 437
 438 /* policy for WoWLAN attributes */
 439 static const struct nla_policy
 440 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 441         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 442         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 443         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 444         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 445         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 446         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 447         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 448         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 449         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 450         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 451 };
 452
 453 static const struct nla_policy
 454 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 455         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 456         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 457         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 458         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 459         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 460         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 461         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 462                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 463         },
 464         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 465                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 466         },
 467         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 468         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 469         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 470 };
 471
 472 /* policy for coalesce rule attributes */
 473 static const struct nla_policy
 474 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 475         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 476         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 477         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 478 };
 479
 480 /* policy for GTK rekey offload attributes */
 481 static const struct nla_policy
 482 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 483         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 484         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 485         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 486 };
 487
 488 static const struct nla_policy
 489 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 490         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 491                                                  .len = IEEE80211_MAX_SSID_LEN },
 492         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 493 };
 494
 495 static const struct nla_policy
 496 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 497         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 498         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 499 };
 500
 501 static const struct nla_policy
 502 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 503         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 504         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 505         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 506                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 507         },
 508 };
 509
 510 /* policy for NAN function attributes */
 511 static const struct nla_policy
 512 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 513         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 514         [NL80211_NAN_FUNC_SERVICE_ID] = { .type = NLA_BINARY,
 515                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 516         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 517         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 518         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 519         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 520         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 521         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 522         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 523         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 524         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 525                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 526         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 527         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 528         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 529         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 530         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 531 };
 532
 533 /* policy for Service Response Filter attributes */
 534 static const struct nla_policy
 535 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 536         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 537         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 538                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 539         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 540         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 541 };
 542
 543 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 544                                      struct netlink_callback *cb,
 545                                      struct cfg80211_registered_device **rdev,
 546                                      struct wireless_dev **wdev)
 547 {
 548         int err;
 549
 550         rtnl_lock();
 551
 552         if (!cb->args[0]) {
 553                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 554                                   genl_family_attrbuf(&nl80211_fam),
 555                                   nl80211_fam.maxattr, nl80211_policy);
 556                 if (err)
 557                         goto out_unlock;
 558
 559                 *wdev = __cfg80211_wdev_from_attrs(
 560                                         sock_net(skb->sk),
 561                                         genl_family_attrbuf(&nl80211_fam));
 562                 if (IS_ERR(*wdev)) {
 563                         err = PTR_ERR(*wdev);
 564                         goto out_unlock;
 565                 }
 566                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 567                 /* 0 is the first index - add 1 to parse only once */
 568                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 569                 cb->args[1] = (*wdev)->identifier;
 570         } else {
 571                 /* subtract the 1 again here */
 572                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 573                 struct wireless_dev *tmp;
 574
 575                 if (!wiphy) {
 576                         err = -ENODEV;
 577                         goto out_unlock;
 578                 }
 579                 *rdev = wiphy_to_rdev(wiphy);
 580                 *wdev = NULL;
 581
 582                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 583                         if (tmp->identifier == cb->args[1]) {
 584                                 *wdev = tmp;
 585                                 break;
 586                         }
 587                 }
 588
 589                 if (!*wdev) {
 590                         err = -ENODEV;
 591                         goto out_unlock;
 592                 }
 593         }
 594
 595         return 0;
 596  out_unlock:
 597         rtnl_unlock();
 598         return err;
 599 }
 600
 601 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 602 {
 603         rtnl_unlock();
 604 }
 605
 606 /* IE validation */
 607 static bool is_valid_ie_attr(const struct nlattr *attr)
 608 {
 609         const u8 *pos;
 610         int len;
 611
 612         if (!attr)
 613                 return true;
 614
 615         pos = nla_data(attr);
 616         len = nla_len(attr);
 617
 618         while (len) {
 619                 u8 elemlen;
 620
 621                 if (len < 2)
 622                         return false;
 623                 len -= 2;
 624
 625                 elemlen = pos[1];
 626                 if (elemlen > len)
 627                         return false;
 628
 629                 len -= elemlen;
 630                 pos += 2 + elemlen;
 631         }
 632
 633         return true;
 634 }
 635
 636 /* message building helper */
 637 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 638                                    int flags, u8 cmd)
 639 {
 640         /* since there is no private header just add the generic one */
 641         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 642 }
 643
 644 static int nl80211_msg_put_channel(struct sk_buff *msg,
 645                                    struct ieee80211_channel *chan,
 646                                    bool large)
 647 {
 648         /* Some channels must be completely excluded from the
 649          * list to protect old user-space tools from breaking
 650          */
 651         if (!large && chan->flags &
 652             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 653                 return 0;
 654
 655         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 656                         chan->center_freq))
 657                 goto nla_put_failure;
 658
 659         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 660             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 661                 goto nla_put_failure;
 662         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 663                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 664                         goto nla_put_failure;
 665                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 666                         goto nla_put_failure;
 667         }
 668         if (chan->flags & IEEE80211_CHAN_RADAR) {
 669                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 670                         goto nla_put_failure;
 671                 if (large) {
 672                         u32 time;
 673
 674                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 675
 676                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 677                                         chan->dfs_state))
 678                                 goto nla_put_failure;
 679                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 680                                         time))
 681                                 goto nla_put_failure;
 682                         if (nla_put_u32(msg,
 683                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 684                                         chan->dfs_cac_ms))
 685                                 goto nla_put_failure;
 686                 }
 687         }
 688
 689         if (large) {
 690                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 691                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 692                         goto nla_put_failure;
 693                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 694                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 695                         goto nla_put_failure;
 696                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 697                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 698                         goto nla_put_failure;
 699                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 700                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 701                         goto nla_put_failure;
 702                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 703                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 704                         goto nla_put_failure;
 705                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 706                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 707                         goto nla_put_failure;
 708                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 709                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 710                         goto nla_put_failure;
 711                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 712                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 713                         goto nla_put_failure;
 714         }
 715
 716         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 717                         DBM_TO_MBM(chan->max_power)))
 718                 goto nla_put_failure;
 719
 720         return 0;
 721
 722  nla_put_failure:
 723         return -ENOBUFS;
 724 }
 725
 726 /* netlink command implementations */
 727
 728 struct key_parse {
 729         struct key_params p;
 730         int idx;
 731         int type;
 732         bool def, defmgmt;
 733         bool def_uni, def_multi;
 734 };
 735
 736 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 737 {
 738         struct nlattr *tb[NL80211_KEY_MAX + 1];
 739         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 740                                    nl80211_key_policy);
 741         if (err)
 742                 return err;
 743
 744         k->def = !!tb[NL80211_KEY_DEFAULT];
 745         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 746
 747         if (k->def) {
 748                 k->def_uni = true;
 749                 k->def_multi = true;
 750         }
 751         if (k->defmgmt)
 752                 k->def_multi = true;
 753
 754         if (tb[NL80211_KEY_IDX])
 755                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 756
 757         if (tb[NL80211_KEY_DATA]) {
 758                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 759                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 760         }
 761
 762         if (tb[NL80211_KEY_SEQ]) {
 763                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 764                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 765         }
 766
 767         if (tb[NL80211_KEY_CIPHER])
 768                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 769
 770         if (tb[NL80211_KEY_TYPE]) {
 771                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 772                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 773                         return -EINVAL;
 774         }
 775
 776         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 777                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 778
 779                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 780                                        tb[NL80211_KEY_DEFAULT_TYPES],
 781                                        nl80211_key_default_policy);
 782                 if (err)
 783                         return err;
 784
 785                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 786                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 787         }
 788
 789         return 0;
 790 }
 791
 792 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 793 {
 794         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 795                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 796                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 797         }
 798
 799         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 800                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 801                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 802         }
 803
 804         if (info->attrs[NL80211_ATTR_KEY_IDX])
 805                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 806
 807         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 808                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 809
 810         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 811         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 812
 813         if (k->def) {
 814                 k->def_uni = true;
 815                 k->def_multi = true;
 816         }
 817         if (k->defmgmt)
 818                 k->def_multi = true;
 819
 820         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 821                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 822                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 823                         return -EINVAL;
 824         }
 825
 826         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 827                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 828                 int err = nla_parse_nested(
 829                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 830                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 831                                 nl80211_key_default_policy);
 832                 if (err)
 833                         return err;
 834
 835                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 836                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 837         }
 838
 839         return 0;
 840 }
 841
 842 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 843 {
 844         int err;
 845
 846         memset(k, 0, sizeof(*k));
 847         k->idx = -1;
 848         k->type = -1;
 849
 850         if (info->attrs[NL80211_ATTR_KEY])
 851                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 852         else
 853                 err = nl80211_parse_key_old(info, k);
 854
 855         if (err)
 856                 return err;
 857
 858         if (k->def && k->defmgmt)
 859                 return -EINVAL;
 860
 861         if (k->defmgmt) {
 862                 if (k->def_uni || !k->def_multi)
 863                         return -EINVAL;
 864         }
 865
 866         if (k->idx != -1) {
 867                 if (k->defmgmt) {
 868                         if (k->idx < 4 || k->idx > 5)
 869                                 return -EINVAL;
 870                 } else if (k->def) {
 871                         if (k->idx < 0 || k->idx > 3)
 872                                 return -EINVAL;
 873                 } else {
 874                         if (k->idx < 0 || k->idx > 5)
 875                                 return -EINVAL;
 876                 }
 877         }
 878
 879         return 0;
 880 }
 881
 882 static struct cfg80211_cached_keys *
 883 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 884                        struct nlattr *keys, bool *no_ht)
 885 {
 886         struct key_parse parse;
 887         struct nlattr *key;
 888         struct cfg80211_cached_keys *result;
 889         int rem, err, def = 0;
 890         bool have_key = false;
 891
 892         nla_for_each_nested(key, keys, rem) {
 893                 have_key = true;
 894                 break;
 895         }
 896
 897         if (!have_key)
 898                 return NULL;
 899
 900         result = kzalloc(sizeof(*result), GFP_KERNEL);
 901         if (!result)
 902                 return ERR_PTR(-ENOMEM);
 903
 904         result->def = -1;
 905
 906         nla_for_each_nested(key, keys, rem) {
 907                 memset(&parse, 0, sizeof(parse));
 908                 parse.idx = -1;
 909
 910                 err = nl80211_parse_key_new(key, &parse);
 911                 if (err)
 912                         goto error;
 913                 err = -EINVAL;
 914                 if (!parse.p.key)
 915                         goto error;
 916                 if (parse.idx < 0 || parse.idx > 3)
 917                         goto error;
 918                 if (parse.def) {
 919                         if (def)
 920                                 goto error;
 921                         def = 1;
 922                         result->def = parse.idx;
 923                         if (!parse.def_uni || !parse.def_multi)
 924                                 goto error;
 925                 } else if (parse.defmgmt)
 926                         goto error;
 927                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 928                                                      parse.idx, false, NULL);
 929                 if (err)
 930                         goto error;
 931                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 932                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 933                         err = -EINVAL;
 934                         goto error;
 935                 }
 936                 result->params[parse.idx].cipher = parse.p.cipher;
 937                 result->params[parse.idx].key_len = parse.p.key_len;
 938                 result->params[parse.idx].key = result->data[parse.idx];
 939                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 940
 941                 /* must be WEP key if we got here */
 942                 if (no_ht)
 943                         *no_ht = true;
 944         }
 945
 946         if (result->def < 0) {
 947                 err = -EINVAL;
 948                 goto error;
 949         }
 950
 951         return result;
 952  error:
 953         kfree(result);
 954         return ERR_PTR(err);
 955 }
 956
 957 static int nl80211_key_allowed(struct wireless_dev *wdev)
 958 {
 959         ASSERT_WDEV_LOCK(wdev);
 960
 961         switch (wdev->iftype) {
 962         case NL80211_IFTYPE_AP:
 963         case NL80211_IFTYPE_AP_VLAN:
 964         case NL80211_IFTYPE_P2P_GO:
 965         case NL80211_IFTYPE_MESH_POINT:
 966                 break;
 967         case NL80211_IFTYPE_ADHOC:
 968         case NL80211_IFTYPE_STATION:
 969         case NL80211_IFTYPE_P2P_CLIENT:
 970                 if (!wdev->current_bss)
 971                         return -ENOLINK;
 972                 break;
 973         case NL80211_IFTYPE_UNSPECIFIED:
 974         case NL80211_IFTYPE_OCB:
 975         case NL80211_IFTYPE_MONITOR:
 976         case NL80211_IFTYPE_NAN:
 977         case NL80211_IFTYPE_P2P_DEVICE:
 978         case NL80211_IFTYPE_WDS:
 979         case NUM_NL80211_IFTYPES:
 980                 return -EINVAL;
 981         }
 982
 983         return 0;
 984 }
 985
 986 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 987                                                         struct nlattr *tb)
 988 {
 989         struct ieee80211_channel *chan;
 990
 991         if (tb == NULL)
 992                 return NULL;
 993         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 994         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 995                 return NULL;
 996         return chan;
 997 }
 998
 999 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1000 {
1001         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1002         int i;
1003
1004         if (!nl_modes)
1005                 goto nla_put_failure;
1006
1007         i = 0;
1008         while (ifmodes) {
1009                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1010                         goto nla_put_failure;
1011                 ifmodes >>= 1;
1012                 i++;
1013         }
1014
1015         nla_nest_end(msg, nl_modes);
1016         return 0;
1017
1018 nla_put_failure:
1019         return -ENOBUFS;
1020 }
1021
1022 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1023                                           struct sk_buff *msg,
1024                                           bool large)
1025 {
1026         struct nlattr *nl_combis;
1027         int i, j;
1028
1029         nl_combis = nla_nest_start(msg,
1030                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1031         if (!nl_combis)
1032                 goto nla_put_failure;
1033
1034         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1035                 const struct ieee80211_iface_combination *c;
1036                 struct nlattr *nl_combi, *nl_limits;
1037
1038                 c = &wiphy->iface_combinations[i];
1039
1040                 nl_combi = nla_nest_start(msg, i + 1);
1041                 if (!nl_combi)
1042                         goto nla_put_failure;
1043
1044                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1045                 if (!nl_limits)
1046                         goto nla_put_failure;
1047
1048                 for (j = 0; j < c->n_limits; j++) {
1049                         struct nlattr *nl_limit;
1050
1051                         nl_limit = nla_nest_start(msg, j + 1);
1052                         if (!nl_limit)
1053                                 goto nla_put_failure;
1054                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1055                                         c->limits[j].max))
1056                                 goto nla_put_failure;
1057                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1058                                                 c->limits[j].types))
1059                                 goto nla_put_failure;
1060                         nla_nest_end(msg, nl_limit);
1061                 }
1062
1063                 nla_nest_end(msg, nl_limits);
1064
1065                 if (c->beacon_int_infra_match &&
1066                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1067                         goto nla_put_failure;
1068                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1069                                 c->num_different_channels) ||
1070                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1071                                 c->max_interfaces))
1072                         goto nla_put_failure;
1073                 if (large &&
1074                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1075                                 c->radar_detect_widths) ||
1076                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1077                                 c->radar_detect_regions)))
1078                         goto nla_put_failure;
1079
1080                 nla_nest_end(msg, nl_combi);
1081         }
1082
1083         nla_nest_end(msg, nl_combis);
1084
1085         return 0;
1086 nla_put_failure:
1087         return -ENOBUFS;
1088 }
1089
1090 #ifdef CONFIG_PM
1091 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1092                                         struct sk_buff *msg)
1093 {
1094         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1095         struct nlattr *nl_tcp;
1096
1097         if (!tcp)
1098                 return 0;
1099
1100         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1101         if (!nl_tcp)
1102                 return -ENOBUFS;
1103
1104         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1105                         tcp->data_payload_max))
1106                 return -ENOBUFS;
1107
1108         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1109                         tcp->data_payload_max))
1110                 return -ENOBUFS;
1111
1112         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1113                 return -ENOBUFS;
1114
1115         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1116                                 sizeof(*tcp->tok), tcp->tok))
1117                 return -ENOBUFS;
1118
1119         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1120                         tcp->data_interval_max))
1121                 return -ENOBUFS;
1122
1123         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1124                         tcp->wake_payload_max))
1125                 return -ENOBUFS;
1126
1127         nla_nest_end(msg, nl_tcp);
1128         return 0;
1129 }
1130
1131 static int nl80211_send_wowlan(struct sk_buff *msg,
1132                                struct cfg80211_registered_device *rdev,
1133                                bool large)
1134 {
1135         struct nlattr *nl_wowlan;
1136
1137         if (!rdev->wiphy.wowlan)
1138                 return 0;
1139
1140         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1141         if (!nl_wowlan)
1142                 return -ENOBUFS;
1143
1144         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1145              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1146             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1147              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1148             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1149              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1150             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1151              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1152             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1153              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1154             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1155              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1156             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1157              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1158             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1159              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1160                 return -ENOBUFS;
1161
1162         if (rdev->wiphy.wowlan->n_patterns) {
1163                 struct nl80211_pattern_support pat = {
1164                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1165                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1166                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1167                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1168                 };
1169
1170                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1171                             sizeof(pat), &pat))
1172                         return -ENOBUFS;
1173         }
1174
1175         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1176             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1177                         rdev->wiphy.wowlan->max_nd_match_sets))
1178                 return -ENOBUFS;
1179
1180         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1181                 return -ENOBUFS;
1182
1183         nla_nest_end(msg, nl_wowlan);
1184
1185         return 0;
1186 }
1187 #endif
1188
1189 static int nl80211_send_coalesce(struct sk_buff *msg,
1190                                  struct cfg80211_registered_device *rdev)
1191 {
1192         struct nl80211_coalesce_rule_support rule;
1193
1194         if (!rdev->wiphy.coalesce)
1195                 return 0;
1196
1197         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1198         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1199         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1200         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1201         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1202         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1203
1204         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1205                 return -ENOBUFS;
1206
1207         return 0;
1208 }
1209
1210 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1211                                       struct ieee80211_supported_band *sband)
1212 {
1213         struct nlattr *nl_rates, *nl_rate;
1214         struct ieee80211_rate *rate;
1215         int i;
1216
1217         /* add HT info */
1218         if (sband->ht_cap.ht_supported &&
1219             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1220                      sizeof(sband->ht_cap.mcs),
1221                      &sband->ht_cap.mcs) ||
1222              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1223                          sband->ht_cap.cap) ||
1224              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1225                         sband->ht_cap.ampdu_factor) ||
1226              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1227                         sband->ht_cap.ampdu_density)))
1228                 return -ENOBUFS;
1229
1230         /* add VHT info */
1231         if (sband->vht_cap.vht_supported &&
1232             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1233                      sizeof(sband->vht_cap.vht_mcs),
1234                      &sband->vht_cap.vht_mcs) ||
1235              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1236                          sband->vht_cap.cap)))
1237                 return -ENOBUFS;
1238
1239         /* add bitrates */
1240         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1241         if (!nl_rates)
1242                 return -ENOBUFS;
1243
1244         for (i = 0; i < sband->n_bitrates; i++) {
1245                 nl_rate = nla_nest_start(msg, i);
1246                 if (!nl_rate)
1247                         return -ENOBUFS;
1248
1249                 rate = &sband->bitrates[i];
1250                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1251                                 rate->bitrate))
1252                         return -ENOBUFS;
1253                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1254                     nla_put_flag(msg,
1255                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1256                         return -ENOBUFS;
1257
1258                 nla_nest_end(msg, nl_rate);
1259         }
1260
1261         nla_nest_end(msg, nl_rates);
1262
1263         return 0;
1264 }
1265
1266 static int
1267 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1268                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1269 {
1270         u16 stypes;
1271         struct nlattr *nl_ftypes, *nl_ifs;
1272         enum nl80211_iftype ift;
1273         int i;
1274
1275         if (!mgmt_stypes)
1276                 return 0;
1277
1278         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1279         if (!nl_ifs)
1280                 return -ENOBUFS;
1281
1282         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1283                 nl_ftypes = nla_nest_start(msg, ift);
1284                 if (!nl_ftypes)
1285                         return -ENOBUFS;
1286                 i = 0;
1287                 stypes = mgmt_stypes[ift].tx;
1288                 while (stypes) {
1289                         if ((stypes & 1) &&
1290                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1291                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1292                                 return -ENOBUFS;
1293                         stypes >>= 1;
1294                         i++;
1295                 }
1296                 nla_nest_end(msg, nl_ftypes);
1297         }
1298
1299         nla_nest_end(msg, nl_ifs);
1300
1301         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1302         if (!nl_ifs)
1303                 return -ENOBUFS;
1304
1305         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1306                 nl_ftypes = nla_nest_start(msg, ift);
1307                 if (!nl_ftypes)
1308                         return -ENOBUFS;
1309                 i = 0;
1310                 stypes = mgmt_stypes[ift].rx;
1311                 while (stypes) {
1312                         if ((stypes & 1) &&
1313                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1314                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1315                                 return -ENOBUFS;
1316                         stypes >>= 1;
1317                         i++;
1318                 }
1319                 nla_nest_end(msg, nl_ftypes);
1320         }
1321         nla_nest_end(msg, nl_ifs);
1322
1323         return 0;
1324 }
1325
1326 struct nl80211_dump_wiphy_state {
1327         s64 filter_wiphy;
1328         long start;
1329         long split_start, band_start, chan_start, capa_start;
1330         bool split;
1331 };
1332
1333 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1334                               enum nl80211_commands cmd,
1335                               struct sk_buff *msg, u32 portid, u32 seq,
1336                               int flags, struct nl80211_dump_wiphy_state *state)
1337 {
1338         void *hdr;
1339         struct nlattr *nl_bands, *nl_band;
1340         struct nlattr *nl_freqs, *nl_freq;
1341         struct nlattr *nl_cmds;
1342         enum nl80211_band band;
1343         struct ieee80211_channel *chan;
1344         int i;
1345         const struct ieee80211_txrx_stypes *mgmt_stypes =
1346                                 rdev->wiphy.mgmt_stypes;
1347         u32 features;
1348
1349         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1350         if (!hdr)
1351                 return -ENOBUFS;
1352
1353         if (WARN_ON(!state))
1354                 return -EINVAL;
1355
1356         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1357             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1358                            wiphy_name(&rdev->wiphy)) ||
1359             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1360                         cfg80211_rdev_list_generation))
1361                 goto nla_put_failure;
1362
1363         if (cmd != NL80211_CMD_NEW_WIPHY)
1364                 goto finish;
1365
1366         switch (state->split_start) {
1367         case 0:
1368                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1369                                rdev->wiphy.retry_short) ||
1370                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1371                                rdev->wiphy.retry_long) ||
1372                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1373                                 rdev->wiphy.frag_threshold) ||
1374                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1375                                 rdev->wiphy.rts_threshold) ||
1376                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1377                                rdev->wiphy.coverage_class) ||
1378                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1379                                rdev->wiphy.max_scan_ssids) ||
1380                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1381                                rdev->wiphy.max_sched_scan_ssids) ||
1382                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1383                                 rdev->wiphy.max_scan_ie_len) ||
1384                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1385                                 rdev->wiphy.max_sched_scan_ie_len) ||
1386                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1387                                rdev->wiphy.max_match_sets) ||
1388                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1389                                 rdev->wiphy.max_sched_scan_plans) ||
1390                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1391                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1392                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1393                                 rdev->wiphy.max_sched_scan_plan_iterations))
1394                         goto nla_put_failure;
1395
1396                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1397                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1398                         goto nla_put_failure;
1399                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1400                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1401                         goto nla_put_failure;
1402                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1403                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1404                         goto nla_put_failure;
1405                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1406                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1407                         goto nla_put_failure;
1408                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1409                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1410                         goto nla_put_failure;
1411                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1412                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1413                         goto nla_put_failure;
1414                 state->split_start++;
1415                 if (state->split)
1416                         break;
1417         case 1:
1418                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1419                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1420                             rdev->wiphy.cipher_suites))
1421                         goto nla_put_failure;
1422
1423                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1424                                rdev->wiphy.max_num_pmkids))
1425                         goto nla_put_failure;
1426
1427                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1428                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1429                         goto nla_put_failure;
1430
1431                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1432                                 rdev->wiphy.available_antennas_tx) ||
1433                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1434                                 rdev->wiphy.available_antennas_rx))
1435                         goto nla_put_failure;
1436
1437                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1438                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1439                                 rdev->wiphy.probe_resp_offload))
1440                         goto nla_put_failure;
1441
1442                 if ((rdev->wiphy.available_antennas_tx ||
1443                      rdev->wiphy.available_antennas_rx) &&
1444                     rdev->ops->get_antenna) {
1445                         u32 tx_ant = 0, rx_ant = 0;
1446                         int res;
1447
1448                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1449                         if (!res) {
1450                                 if (nla_put_u32(msg,
1451                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1452                                                 tx_ant) ||
1453                                     nla_put_u32(msg,
1454                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1455                                                 rx_ant))
1456                                         goto nla_put_failure;
1457                         }
1458                 }
1459
1460                 state->split_start++;
1461                 if (state->split)
1462                         break;
1463         case 2:
1464                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1465                                         rdev->wiphy.interface_modes))
1466                                 goto nla_put_failure;
1467                 state->split_start++;
1468                 if (state->split)
1469                         break;
1470         case 3:
1471                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1472                 if (!nl_bands)
1473                         goto nla_put_failure;
1474
1475                 for (band = state->band_start;
1476                      band < NUM_NL80211_BANDS; band++) {
1477                         struct ieee80211_supported_band *sband;
1478
1479                         sband = rdev->wiphy.bands[band];
1480
1481                         if (!sband)
1482                                 continue;
1483
1484                         nl_band = nla_nest_start(msg, band);
1485                         if (!nl_band)
1486                                 goto nla_put_failure;
1487
1488                         switch (state->chan_start) {
1489                         case 0:
1490                                 if (nl80211_send_band_rateinfo(msg, sband))
1491                                         goto nla_put_failure;
1492                                 state->chan_start++;
1493                                 if (state->split)
1494                                         break;
1495                         default:
1496                                 /* add frequencies */
1497                                 nl_freqs = nla_nest_start(
1498                                         msg, NL80211_BAND_ATTR_FREQS);
1499                                 if (!nl_freqs)
1500                                         goto nla_put_failure;
1501
1502                                 for (i = state->chan_start - 1;
1503                                      i < sband->n_channels;
1504                                      i++) {
1505                                         nl_freq = nla_nest_start(msg, i);
1506                                         if (!nl_freq)
1507                                                 goto nla_put_failure;
1508
1509                                         chan = &sband->channels[i];
1510
1511                                         if (nl80211_msg_put_channel(
1512                                                         msg, chan,
1513                                                         state->split))
1514                                                 goto nla_put_failure;
1515
1516                                         nla_nest_end(msg, nl_freq);
1517                                         if (state->split)
1518                                                 break;
1519                                 }
1520                                 if (i < sband->n_channels)
1521                                         state->chan_start = i + 2;
1522                                 else
1523                                         state->chan_start = 0;
1524                                 nla_nest_end(msg, nl_freqs);
1525                         }
1526
1527                         nla_nest_end(msg, nl_band);
1528
1529                         if (state->split) {
1530                                 /* start again here */
1531                                 if (state->chan_start)
1532                                         band--;
1533                                 break;
1534                         }
1535                 }
1536                 nla_nest_end(msg, nl_bands);
1537
1538                 if (band < NUM_NL80211_BANDS)
1539                         state->band_start = band + 1;
1540                 else
1541                         state->band_start = 0;
1542
1543                 /* if bands & channels are done, continue outside */
1544                 if (state->band_start == 0 && state->chan_start == 0)
1545                         state->split_start++;
1546                 if (state->split)
1547                         break;
1548         case 4:
1549                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1550                 if (!nl_cmds)
1551                         goto nla_put_failure;
1552
1553                 i = 0;
1554 #define CMD(op, n)                                                      \
1555                  do {                                                   \
1556                         if (rdev->ops->op) {                            \
1557                                 i++;                                    \
1558                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1559                                         goto nla_put_failure;           \
1560                         }                                               \
1561                 } while (0)
1562
1563                 CMD(add_virtual_intf, NEW_INTERFACE);
1564                 CMD(change_virtual_intf, SET_INTERFACE);
1565                 CMD(add_key, NEW_KEY);
1566                 CMD(start_ap, START_AP);
1567                 CMD(add_station, NEW_STATION);
1568                 CMD(add_mpath, NEW_MPATH);
1569                 CMD(update_mesh_config, SET_MESH_CONFIG);
1570                 CMD(change_bss, SET_BSS);
1571                 CMD(auth, AUTHENTICATE);
1572                 CMD(assoc, ASSOCIATE);
1573                 CMD(deauth, DEAUTHENTICATE);
1574                 CMD(disassoc, DISASSOCIATE);
1575                 CMD(join_ibss, JOIN_IBSS);
1576                 CMD(join_mesh, JOIN_MESH);
1577                 CMD(set_pmksa, SET_PMKSA);
1578                 CMD(del_pmksa, DEL_PMKSA);
1579                 CMD(flush_pmksa, FLUSH_PMKSA);
1580                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1581                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1582                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1583                 CMD(mgmt_tx, FRAME);
1584                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1585                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1586                         i++;
1587                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1588                                 goto nla_put_failure;
1589                 }
1590                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1591                     rdev->ops->join_mesh) {
1592                         i++;
1593                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1594                                 goto nla_put_failure;
1595                 }
1596                 CMD(set_wds_peer, SET_WDS_PEER);
1597                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1598                         CMD(tdls_mgmt, TDLS_MGMT);
1599                         CMD(tdls_oper, TDLS_OPER);
1600                 }
1601                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1602                         CMD(sched_scan_start, START_SCHED_SCAN);
1603                 CMD(probe_client, PROBE_CLIENT);
1604                 CMD(set_noack_map, SET_NOACK_MAP);
1605                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1606                         i++;
1607                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1608                                 goto nla_put_failure;
1609                 }
1610                 CMD(start_p2p_device, START_P2P_DEVICE);
1611                 CMD(set_mcast_rate, SET_MCAST_RATE);
1612 #ifdef CONFIG_NL80211_TESTMODE
1613                 CMD(testmode_cmd, TESTMODE);
1614 #endif
1615                 if (state->split) {
1616                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1617                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1618                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1619                                 CMD(channel_switch, CHANNEL_SWITCH);
1620                         CMD(set_qos_map, SET_QOS_MAP);
1621                         if (rdev->wiphy.features &
1622                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1623                                 CMD(add_tx_ts, ADD_TX_TS);
1624                 }
1625                 /* add into the if now */
1626 #undef CMD
1627
1628                 if (rdev->ops->connect || rdev->ops->auth) {
1629                         i++;
1630                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1631                                 goto nla_put_failure;
1632                 }
1633
1634                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1635                         i++;
1636                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1637                                 goto nla_put_failure;
1638                 }
1639
1640                 nla_nest_end(msg, nl_cmds);
1641                 state->split_start++;
1642                 if (state->split)
1643                         break;
1644         case 5:
1645                 if (rdev->ops->remain_on_channel &&
1646                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1647                     nla_put_u32(msg,
1648                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1649                                 rdev->wiphy.max_remain_on_channel_duration))
1650                         goto nla_put_failure;
1651
1652                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1653                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1654                         goto nla_put_failure;
1655
1656                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1657                         goto nla_put_failure;
1658                 state->split_start++;
1659                 if (state->split)
1660                         break;
1661         case 6:
1662 #ifdef CONFIG_PM
1663                 if (nl80211_send_wowlan(msg, rdev, state->split))
1664                         goto nla_put_failure;
1665                 state->split_start++;
1666                 if (state->split)
1667                         break;
1668 #else
1669                 state->split_start++;
1670 #endif
1671         case 7:
1672                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1673                                         rdev->wiphy.software_iftypes))
1674                         goto nla_put_failure;
1675
1676                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1677                                                    state->split))
1678                         goto nla_put_failure;
1679
1680                 state->split_start++;
1681                 if (state->split)
1682                         break;
1683         case 8:
1684                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1685                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1686                                 rdev->wiphy.ap_sme_capa))
1687                         goto nla_put_failure;
1688
1689                 features = rdev->wiphy.features;
1690                 /*
1691                  * We can only add the per-channel limit information if the
1692                  * dump is split, otherwise it makes it too big. Therefore
1693                  * only advertise it in that case.
1694                  */
1695                 if (state->split)
1696                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1697                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1698                         goto nla_put_failure;
1699
1700                 if (rdev->wiphy.ht_capa_mod_mask &&
1701                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1702                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1703                             rdev->wiphy.ht_capa_mod_mask))
1704                         goto nla_put_failure;
1705
1706                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1707                     rdev->wiphy.max_acl_mac_addrs &&
1708                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1709                                 rdev->wiphy.max_acl_mac_addrs))
1710                         goto nla_put_failure;
1711
1712                 /*
1713                  * Any information below this point is only available to
1714                  * applications that can deal with it being split. This
1715                  * helps ensure that newly added capabilities don't break
1716                  * older tools by overrunning their buffers.
1717                  *
1718                  * We still increment split_start so that in the split
1719                  * case we'll continue with more data in the next round,
1720                  * but break unconditionally so unsplit data stops here.
1721                  */
1722                 state->split_start++;
1723                 break;
1724         case 9:
1725                 if (rdev->wiphy.extended_capabilities &&
1726                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1727                              rdev->wiphy.extended_capabilities_len,
1728                              rdev->wiphy.extended_capabilities) ||
1729                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1730                              rdev->wiphy.extended_capabilities_len,
1731                              rdev->wiphy.extended_capabilities_mask)))
1732                         goto nla_put_failure;
1733
1734                 if (rdev->wiphy.vht_capa_mod_mask &&
1735                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1736                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1737                             rdev->wiphy.vht_capa_mod_mask))
1738                         goto nla_put_failure;
1739
1740                 state->split_start++;
1741                 break;
1742         case 10:
1743                 if (nl80211_send_coalesce(msg, rdev))
1744                         goto nla_put_failure;
1745
1746                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1747                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1748                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1749                         goto nla_put_failure;
1750
1751                 if (rdev->wiphy.max_ap_assoc_sta &&
1752                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1753                                 rdev->wiphy.max_ap_assoc_sta))
1754                         goto nla_put_failure;
1755
1756                 state->split_start++;
1757                 break;
1758         case 11:
1759                 if (rdev->wiphy.n_vendor_commands) {
1760                         const struct nl80211_vendor_cmd_info *info;
1761                         struct nlattr *nested;
1762
1763                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1764                         if (!nested)
1765                                 goto nla_put_failure;
1766
1767                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1768                                 info = &rdev->wiphy.vendor_commands[i].info;
1769                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1770                                         goto nla_put_failure;
1771                         }
1772                         nla_nest_end(msg, nested);
1773                 }
1774
1775                 if (rdev->wiphy.n_vendor_events) {
1776                         const struct nl80211_vendor_cmd_info *info;
1777                         struct nlattr *nested;
1778
1779                         nested = nla_nest_start(msg,
1780                                                 NL80211_ATTR_VENDOR_EVENTS);
1781                         if (!nested)
1782                                 goto nla_put_failure;
1783
1784                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1785                                 info = &rdev->wiphy.vendor_events[i];
1786                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1787                                         goto nla_put_failure;
1788                         }
1789                         nla_nest_end(msg, nested);
1790                 }
1791                 state->split_start++;
1792                 break;
1793         case 12:
1794                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1795                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1796                                rdev->wiphy.max_num_csa_counters))
1797                         goto nla_put_failure;
1798
1799                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1800                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1801                         goto nla_put_failure;
1802
1803                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1804                             sizeof(rdev->wiphy.ext_features),
1805                             rdev->wiphy.ext_features))
1806                         goto nla_put_failure;
1807
1808                 if (rdev->wiphy.bss_select_support) {
1809                         struct nlattr *nested;
1810                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1811
1812                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1813                         if (!nested)
1814                                 goto nla_put_failure;
1815
1816                         i = 0;
1817                         while (bss_select_support) {
1818                                 if ((bss_select_support & 1) &&
1819                                     nla_put_flag(msg, i))
1820                                         goto nla_put_failure;
1821                                 i++;
1822                                 bss_select_support >>= 1;
1823                         }
1824                         nla_nest_end(msg, nested);
1825                 }
1826
1827                 state->split_start++;
1828                 break;
1829         case 13:
1830                 if (rdev->wiphy.num_iftype_ext_capab &&
1831                     rdev->wiphy.iftype_ext_capab) {
1832                         struct nlattr *nested_ext_capab, *nested;
1833
1834                         nested = nla_nest_start(msg,
1835                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1836                         if (!nested)
1837                                 goto nla_put_failure;
1838
1839                         for (i = state->capa_start;
1840                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1841                                 const struct wiphy_iftype_ext_capab *capab;
1842
1843                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1844
1845                                 nested_ext_capab = nla_nest_start(msg, i);
1846                                 if (!nested_ext_capab ||
1847                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1848                                                 capab->iftype) ||
1849                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1850                                             capab->extended_capabilities_len,
1851                                             capab->extended_capabilities) ||
1852                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1853                                             capab->extended_capabilities_len,
1854                                             capab->extended_capabilities_mask))
1855                                         goto nla_put_failure;
1856
1857                                 nla_nest_end(msg, nested_ext_capab);
1858                                 if (state->split)
1859                                         break;
1860                         }
1861                         nla_nest_end(msg, nested);
1862                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1863                                 state->capa_start = i + 1;
1864                                 break;
1865                         }
1866                 }
1867
1868                 /* done */
1869                 state->split_start = 0;
1870                 break;
1871         }
1872  finish:
1873         genlmsg_end(msg, hdr);
1874         return 0;
1875
1876  nla_put_failure:
1877         genlmsg_cancel(msg, hdr);
1878         return -EMSGSIZE;
1879 }
1880
1881 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1882                                     struct netlink_callback *cb,
1883                                     struct nl80211_dump_wiphy_state *state)
1884 {
1885         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1886         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1887                               tb, nl80211_fam.maxattr, nl80211_policy);
1888         /* ignore parse errors for backward compatibility */
1889         if (ret)
1890                 return 0;
1891
1892         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1893         if (tb[NL80211_ATTR_WIPHY])
1894                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1895         if (tb[NL80211_ATTR_WDEV])
1896                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1897         if (tb[NL80211_ATTR_IFINDEX]) {
1898                 struct net_device *netdev;
1899                 struct cfg80211_registered_device *rdev;
1900                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1901
1902                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1903                 if (!netdev)
1904                         return -ENODEV;
1905                 if (netdev->ieee80211_ptr) {
1906                         rdev = wiphy_to_rdev(
1907                                 netdev->ieee80211_ptr->wiphy);
1908                         state->filter_wiphy = rdev->wiphy_idx;
1909                 }
1910         }
1911
1912         return 0;
1913 }
1914
1915 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1916 {
1917         int idx = 0, ret;
1918         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1919         struct cfg80211_registered_device *rdev;
1920
1921         rtnl_lock();
1922         if (!state) {
1923                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1924                 if (!state) {
1925                         rtnl_unlock();
1926                         return -ENOMEM;
1927                 }
1928                 state->filter_wiphy = -1;
1929                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1930                 if (ret) {
1931                         kfree(state);
1932                         rtnl_unlock();
1933                         return ret;
1934                 }
1935                 cb->args[0] = (long)state;
1936         }
1937
1938         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1939                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1940                         continue;
1941                 if (++idx <= state->start)
1942                         continue;
1943                 if (state->filter_wiphy != -1 &&
1944                     state->filter_wiphy != rdev->wiphy_idx)
1945                         continue;
1946                 /* attempt to fit multiple wiphy data chunks into the skb */
1947                 do {
1948                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1949                                                  skb,
1950                                                  NETLINK_CB(cb->skb).portid,
1951                                                  cb->nlh->nlmsg_seq,
1952                                                  NLM_F_MULTI, state);
1953                         if (ret < 0) {
1954                                 /*
1955                                  * If sending the wiphy data didn't fit (ENOBUFS
1956                                  * or EMSGSIZE returned), this SKB is still
1957                                  * empty (so it's not too big because another
1958                                  * wiphy dataset is already in the skb) and
1959                                  * we've not tried to adjust the dump allocation
1960                                  * yet ... then adjust the alloc size to be
1961                                  * bigger, and return 1 but with the empty skb.
1962                                  * This results in an empty message being RX'ed
1963                                  * in userspace, but that is ignored.
1964                                  *
1965                                  * We can then retry with the larger buffer.
1966                                  */
1967                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1968                                     !skb->len && !state->split &&
1969                                     cb->min_dump_alloc < 4096) {
1970                                         cb->min_dump_alloc = 4096;
1971                                         state->split_start = 0;
1972                                         rtnl_unlock();
1973                                         return 1;
1974                                 }
1975                                 idx--;
1976                                 break;
1977                         }
1978                 } while (state->split_start > 0);
1979                 break;
1980         }
1981         rtnl_unlock();
1982
1983         state->start = idx;
1984
1985         return skb->len;
1986 }
1987
1988 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1989 {
1990         kfree((void *)cb->args[0]);
1991         return 0;
1992 }
1993
1994 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1995 {
1996         struct sk_buff *msg;
1997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1998         struct nl80211_dump_wiphy_state state = {};
1999
2000         msg = nlmsg_new(4096, GFP_KERNEL);
2001         if (!msg)
2002                 return -ENOMEM;
2003
2004         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2005                                info->snd_portid, info->snd_seq, 0,
2006                                &state) < 0) {
2007                 nlmsg_free(msg);
2008                 return -ENOBUFS;
2009         }
2010
2011         return genlmsg_reply(msg, info);
2012 }
2013
2014 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2015         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2016         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2017         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2018         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2019         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2020 };
2021
2022 static int parse_txq_params(struct nlattr *tb[],
2023                             struct ieee80211_txq_params *txq_params)
2024 {
2025         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2026             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2027             !tb[NL80211_TXQ_ATTR_AIFS])
2028                 return -EINVAL;
2029
2030         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2031         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2032         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2033         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2034         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2035
2036         if (txq_params->ac >= NL80211_NUM_ACS)
2037                 return -EINVAL;
2038
2039         return 0;
2040 }
2041
2042 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2043 {
2044         /*
2045          * You can only set the channel explicitly for WDS interfaces,
2046          * all others have their channel managed via their respective
2047          * "establish a connection" command (connect, join, ...)
2048          *
2049          * For AP/GO and mesh mode, the channel can be set with the
2050          * channel userspace API, but is only stored and passed to the
2051          * low-level driver when the AP starts or the mesh is joined.
2052          * This is for backward compatibility, userspace can also give
2053          * the channel in the start-ap or join-mesh commands instead.
2054          *
2055          * Monitors are special as they are normally slaved to
2056          * whatever else is going on, so they have their own special
2057          * operation to set the monitor channel if possible.
2058          */
2059         return !wdev ||
2060                 wdev->iftype == NL80211_IFTYPE_AP ||
2061                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2062                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2063                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2064 }
2065
2066 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2067                                  struct genl_info *info,
2068                                  struct cfg80211_chan_def *chandef)
2069 {
2070         u32 control_freq;
2071
2072         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2073                 return -EINVAL;
2074
2075         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2076
2077         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2078         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2079         chandef->center_freq1 = control_freq;
2080         chandef->center_freq2 = 0;
2081
2082         /* Primary channel not allowed */
2083         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2084                 return -EINVAL;
2085
2086         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2087                 enum nl80211_channel_type chantype;
2088
2089                 chantype = nla_get_u32(
2090                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2091
2092                 switch (chantype) {
2093                 case NL80211_CHAN_NO_HT:
2094                 case NL80211_CHAN_HT20:
2095                 case NL80211_CHAN_HT40PLUS:
2096                 case NL80211_CHAN_HT40MINUS:
2097                         cfg80211_chandef_create(chandef, chandef->chan,
2098                                                 chantype);
2099                         break;
2100                 default:
2101                         return -EINVAL;
2102                 }
2103         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2104                 chandef->width =
2105                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2106                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2107                         chandef->center_freq1 =
2108                                 nla_get_u32(
2109                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2110                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2111                         chandef->center_freq2 =
2112                                 nla_get_u32(
2113                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2114         }
2115
2116         if (!cfg80211_chandef_valid(chandef))
2117                 return -EINVAL;
2118
2119         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2120                                      IEEE80211_CHAN_DISABLED))
2121                 return -EINVAL;
2122
2123         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2124              chandef->width == NL80211_CHAN_WIDTH_10) &&
2125             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2126                 return -EINVAL;
2127
2128         return 0;
2129 }
2130
2131 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2132                                  struct net_device *dev,
2133                                  struct genl_info *info)
2134 {
2135         struct cfg80211_chan_def chandef;
2136         int result;
2137         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2138         struct wireless_dev *wdev = NULL;
2139
2140         if (dev)
2141                 wdev = dev->ieee80211_ptr;
2142         if (!nl80211_can_set_dev_channel(wdev))
2143                 return -EOPNOTSUPP;
2144         if (wdev)
2145                 iftype = wdev->iftype;
2146
2147         result = nl80211_parse_chandef(rdev, info, &chandef);
2148         if (result)
2149                 return result;
2150
2151         switch (iftype) {
2152         case NL80211_IFTYPE_AP:
2153         case NL80211_IFTYPE_P2P_GO:
2154                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2155                                                    iftype)) {
2156                         result = -EINVAL;
2157                         break;
2158                 }
2159                 if (wdev->beacon_interval) {
2160                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2161                             !(rdev->wiphy.features &
2162                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2163                                 result = -EBUSY;
2164                                 break;
2165                         }
2166
2167                         /* Only allow dynamic channel width changes */
2168                         if (chandef.chan != wdev->preset_chandef.chan) {
2169                                 result = -EBUSY;
2170                                 break;
2171                         }
2172                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2173                         if (result)
2174                                 break;
2175                 }
2176                 wdev->preset_chandef = chandef;
2177                 result = 0;
2178                 break;
2179         case NL80211_IFTYPE_MESH_POINT:
2180                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2181                 break;
2182         case NL80211_IFTYPE_MONITOR:
2183                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2184                 break;
2185         default:
2186                 result = -EINVAL;
2187         }
2188
2189         return result;
2190 }
2191
2192 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2193 {
2194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2195         struct net_device *netdev = info->user_ptr[1];
2196
2197         return __nl80211_set_channel(rdev, netdev, info);
2198 }
2199
2200 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2201 {
2202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2203         struct net_device *dev = info->user_ptr[1];
2204         struct wireless_dev *wdev = dev->ieee80211_ptr;
2205         const u8 *bssid;
2206
2207         if (!info->attrs[NL80211_ATTR_MAC])
2208                 return -EINVAL;
2209
2210         if (netif_running(dev))
2211                 return -EBUSY;
2212
2213         if (!rdev->ops->set_wds_peer)
2214                 return -EOPNOTSUPP;
2215
2216         if (wdev->iftype != NL80211_IFTYPE_WDS)
2217                 return -EOPNOTSUPP;
2218
2219         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2220         return rdev_set_wds_peer(rdev, dev, bssid);
2221 }
2222
2223 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2224 {
2225         struct cfg80211_registered_device *rdev;
2226         struct net_device *netdev = NULL;
2227         struct wireless_dev *wdev;
2228         int result = 0, rem_txq_params = 0;
2229         struct nlattr *nl_txq_params;
2230         u32 changed;
2231         u8 retry_short = 0, retry_long = 0;
2232         u32 frag_threshold = 0, rts_threshold = 0;
2233         u8 coverage_class = 0;
2234
2235         ASSERT_RTNL();
2236
2237         /*
2238          * Try to find the wiphy and netdev. Normally this
2239          * function shouldn't need the netdev, but this is
2240          * done for backward compatibility -- previously
2241          * setting the channel was done per wiphy, but now
2242          * it is per netdev. Previous userland like hostapd
2243          * also passed a netdev to set_wiphy, so that it is
2244          * possible to let that go to the right netdev!
2245          */
2246
2247         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2248                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2249
2250                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2251                 if (netdev && netdev->ieee80211_ptr)
2252                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2253                 else
2254                         netdev = NULL;
2255         }
2256
2257         if (!netdev) {
2258                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2259                                                   info->attrs);
2260                 if (IS_ERR(rdev))
2261                         return PTR_ERR(rdev);
2262                 wdev = NULL;
2263                 netdev = NULL;
2264                 result = 0;
2265         } else
2266                 wdev = netdev->ieee80211_ptr;
2267
2268         /*
2269          * end workaround code, by now the rdev is available
2270          * and locked, and wdev may or may not be NULL.
2271          */
2272
2273         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2274                 result = cfg80211_dev_rename(
2275                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2276
2277         if (result)
2278                 return result;
2279
2280         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2281                 struct ieee80211_txq_params txq_params;
2282                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2283
2284                 if (!rdev->ops->set_txq_params)
2285                         return -EOPNOTSUPP;
2286
2287                 if (!netdev)
2288                         return -EINVAL;
2289
2290                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2291                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2292                         return -EINVAL;
2293
2294                 if (!netif_running(netdev))
2295                         return -ENETDOWN;
2296
2297                 nla_for_each_nested(nl_txq_params,
2298                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2299                                     rem_txq_params) {
2300                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2301                                            nla_data(nl_txq_params),
2302                                            nla_len(nl_txq_params),
2303                                            txq_params_policy);
2304                         if (result)
2305                                 return result;
2306                         result = parse_txq_params(tb, &txq_params);
2307                         if (result)
2308                                 return result;
2309
2310                         result = rdev_set_txq_params(rdev, netdev,
2311                                                      &txq_params);
2312                         if (result)
2313                                 return result;
2314                 }
2315         }
2316
2317         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2318                 result = __nl80211_set_channel(
2319                         rdev,
2320                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2321                         info);
2322                 if (result)
2323                         return result;
2324         }
2325
2326         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2327                 struct wireless_dev *txp_wdev = wdev;
2328                 enum nl80211_tx_power_setting type;
2329                 int idx, mbm = 0;
2330
2331                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2332                         txp_wdev = NULL;
2333
2334                 if (!rdev->ops->set_tx_power)
2335                         return -EOPNOTSUPP;
2336
2337                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2338                 type = nla_get_u32(info->attrs[idx]);
2339
2340                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2341                     (type != NL80211_TX_POWER_AUTOMATIC))
2342                         return -EINVAL;
2343
2344                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2345                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2346                         mbm = nla_get_u32(info->attrs[idx]);
2347                 }
2348
2349                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2350                 if (result)
2351                         return result;
2352         }
2353
2354         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2355             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2356                 u32 tx_ant, rx_ant;
2357
2358                 if ((!rdev->wiphy.available_antennas_tx &&
2359                      !rdev->wiphy.available_antennas_rx) ||
2360                     !rdev->ops->set_antenna)
2361                         return -EOPNOTSUPP;
2362
2363                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2364                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2365
2366                 /* reject antenna configurations which don't match the
2367                  * available antenna masks, except for the "all" mask */
2368                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2369                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2370                         return -EINVAL;
2371
2372                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2373                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2374
2375                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2376                 if (result)
2377                         return result;
2378         }
2379
2380         changed = 0;
2381
2382         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2383                 retry_short = nla_get_u8(
2384                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2385                 if (retry_short == 0)
2386                         return -EINVAL;
2387
2388                 changed |= WIPHY_PARAM_RETRY_SHORT;
2389         }
2390
2391         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2392                 retry_long = nla_get_u8(
2393                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2394                 if (retry_long == 0)
2395                         return -EINVAL;
2396
2397                 changed |= WIPHY_PARAM_RETRY_LONG;
2398         }
2399
2400         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2401                 frag_threshold = nla_get_u32(
2402                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2403                 if (frag_threshold < 256)
2404                         return -EINVAL;
2405
2406                 if (frag_threshold != (u32) -1) {
2407                         /*
2408                          * Fragments (apart from the last one) are required to
2409                          * have even length. Make the fragmentation code
2410                          * simpler by stripping LSB should someone try to use
2411                          * odd threshold value.
2412                          */
2413                         frag_threshold &= ~0x1;
2414                 }
2415                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2416         }
2417
2418         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2419                 rts_threshold = nla_get_u32(
2420                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2421                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2422         }
2423
2424         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2425                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2426                         return -EINVAL;
2427
2428                 coverage_class = nla_get_u8(
2429                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2430                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2431         }
2432
2433         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2434                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2435                         return -EOPNOTSUPP;
2436
2437                 changed |= WIPHY_PARAM_DYN_ACK;
2438         }
2439
2440         if (changed) {
2441                 u8 old_retry_short, old_retry_long;
2442                 u32 old_frag_threshold, old_rts_threshold;
2443                 u8 old_coverage_class;
2444
2445                 if (!rdev->ops->set_wiphy_params)
2446                         return -EOPNOTSUPP;
2447
2448                 old_retry_short = rdev->wiphy.retry_short;
2449                 old_retry_long = rdev->wiphy.retry_long;
2450                 old_frag_threshold = rdev->wiphy.frag_threshold;
2451                 old_rts_threshold = rdev->wiphy.rts_threshold;
2452                 old_coverage_class = rdev->wiphy.coverage_class;
2453
2454                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2455                         rdev->wiphy.retry_short = retry_short;
2456                 if (changed & WIPHY_PARAM_RETRY_LONG)
2457                         rdev->wiphy.retry_long = retry_long;
2458                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2459                         rdev->wiphy.frag_threshold = frag_threshold;
2460                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2461                         rdev->wiphy.rts_threshold = rts_threshold;
2462                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2463                         rdev->wiphy.coverage_class = coverage_class;
2464
2465                 result = rdev_set_wiphy_params(rdev, changed);
2466                 if (result) {
2467                         rdev->wiphy.retry_short = old_retry_short;
2468                         rdev->wiphy.retry_long = old_retry_long;
2469                         rdev->wiphy.frag_threshold = old_frag_threshold;
2470                         rdev->wiphy.rts_threshold = old_rts_threshold;
2471                         rdev->wiphy.coverage_class = old_coverage_class;
2472                         return result;
2473                 }
2474         }
2475         return 0;
2476 }
2477
2478 static inline u64 wdev_id(struct wireless_dev *wdev)
2479 {
2480         return (u64)wdev->identifier |
2481                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2482 }
2483
2484 static int nl80211_send_chandef(struct sk_buff *msg,
2485                                 const struct cfg80211_chan_def *chandef)
2486 {
2487         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2488                 return -EINVAL;
2489
2490         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2491                         chandef->chan->center_freq))
2492                 return -ENOBUFS;
2493         switch (chandef->width) {
2494         case NL80211_CHAN_WIDTH_20_NOHT:
2495         case NL80211_CHAN_WIDTH_20:
2496         case NL80211_CHAN_WIDTH_40:
2497                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2498                                 cfg80211_get_chandef_type(chandef)))
2499                         return -ENOBUFS;
2500                 break;
2501         default:
2502                 break;
2503         }
2504         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2505                 return -ENOBUFS;
2506         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2507                 return -ENOBUFS;
2508         if (chandef->center_freq2 &&
2509             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2510                 return -ENOBUFS;
2511         return 0;
2512 }
2513
2514 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2515                               struct cfg80211_registered_device *rdev,
2516                               struct wireless_dev *wdev, bool removal)
2517 {
2518         struct net_device *dev = wdev->netdev;
2519         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2520         void *hdr;
2521
2522         if (removal)
2523                 cmd = NL80211_CMD_DEL_INTERFACE;
2524
2525         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2526         if (!hdr)
2527                 return -1;
2528
2529         if (dev &&
2530             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2531              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2532                 goto nla_put_failure;
2533
2534         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2535             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2536             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2537                               NL80211_ATTR_PAD) ||
2538             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2539             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2540                         rdev->devlist_generation ^
2541                         (cfg80211_rdev_list_generation << 2)))
2542                 goto nla_put_failure;
2543
2544         if (rdev->ops->get_channel) {
2545                 int ret;
2546                 struct cfg80211_chan_def chandef;
2547
2548                 ret = rdev_get_channel(rdev, wdev, &chandef);
2549                 if (ret == 0) {
2550                         if (nl80211_send_chandef(msg, &chandef))
2551                                 goto nla_put_failure;
2552                 }
2553         }
2554
2555         if (rdev->ops->get_tx_power) {
2556                 int dbm, ret;
2557
2558                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2559                 if (ret == 0 &&
2560                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2561                                 DBM_TO_MBM(dbm)))
2562                         goto nla_put_failure;
2563         }
2564
2565         if (wdev->ssid_len) {
2566                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2567                         goto nla_put_failure;
2568         }
2569
2570         genlmsg_end(msg, hdr);
2571         return 0;
2572
2573  nla_put_failure:
2574         genlmsg_cancel(msg, hdr);
2575         return -EMSGSIZE;
2576 }
2577
2578 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2579 {
2580         int wp_idx = 0;
2581         int if_idx = 0;
2582         int wp_start = cb->args[0];
2583         int if_start = cb->args[1];
2584         int filter_wiphy = -1;
2585         struct cfg80211_registered_device *rdev;
2586         struct wireless_dev *wdev;
2587
2588         rtnl_lock();
2589         if (!cb->args[2]) {
2590                 struct nl80211_dump_wiphy_state state = {
2591                         .filter_wiphy = -1,
2592                 };
2593                 int ret;
2594
2595                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2596                 if (ret)
2597                         return ret;
2598
2599                 filter_wiphy = state.filter_wiphy;
2600
2601                 /*
2602                  * if filtering, set cb->args[2] to +1 since 0 is the default
2603                  * value needed to determine that parsing is necessary.
2604                  */
2605                 if (filter_wiphy >= 0)
2606                         cb->args[2] = filter_wiphy + 1;
2607                 else
2608                         cb->args[2] = -1;
2609         } else if (cb->args[2] > 0) {
2610                 filter_wiphy = cb->args[2] - 1;
2611         }
2612
2613         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2614                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2615                         continue;
2616                 if (wp_idx < wp_start) {
2617                         wp_idx++;
2618                         continue;
2619                 }
2620
2621                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2622                         continue;
2623
2624                 if_idx = 0;
2625
2626                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2627                         if (if_idx < if_start) {
2628                                 if_idx++;
2629                                 continue;
2630                         }
2631                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2632                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2633                                                rdev, wdev, false) < 0) {
2634                                 goto out;
2635                         }
2636                         if_idx++;
2637                 }
2638
2639                 wp_idx++;
2640         }
2641  out:
2642         rtnl_unlock();
2643
2644         cb->args[0] = wp_idx;
2645         cb->args[1] = if_idx;
2646
2647         return skb->len;
2648 }
2649
2650 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2651 {
2652         struct sk_buff *msg;
2653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2654         struct wireless_dev *wdev = info->user_ptr[1];
2655
2656         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2657         if (!msg)
2658                 return -ENOMEM;
2659
2660         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2661                                rdev, wdev, false) < 0) {
2662                 nlmsg_free(msg);
2663                 return -ENOBUFS;
2664         }
2665
2666         return genlmsg_reply(msg, info);
2667 }
2668
2669 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2670         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2671         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2672         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2673         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2674         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2675         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2676 };
2677
2678 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2679 {
2680         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2681         int flag;
2682
2683         *mntrflags = 0;
2684
2685         if (!nla)
2686                 return -EINVAL;
2687
2688         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2689                              nla, mntr_flags_policy))
2690                 return -EINVAL;
2691
2692         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2693                 if (flags[flag])
2694                         *mntrflags |= (1<<flag);
2695
2696         return 0;
2697 }
2698
2699 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2700                                struct net_device *netdev, u8 use_4addr,
2701                                enum nl80211_iftype iftype)
2702 {
2703         if (!use_4addr) {
2704                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2705                         return -EBUSY;
2706                 return 0;
2707         }
2708
2709         switch (iftype) {
2710         case NL80211_IFTYPE_AP_VLAN:
2711                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2712                         return 0;
2713                 break;
2714         case NL80211_IFTYPE_STATION:
2715                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2716                         return 0;
2717                 break;
2718         default:
2719                 break;
2720         }
2721
2722         return -EOPNOTSUPP;
2723 }
2724
2725 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2726 {
2727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2728         struct vif_params params;
2729         int err;
2730         enum nl80211_iftype otype, ntype;
2731         struct net_device *dev = info->user_ptr[1];
2732         u32 _flags, *flags = NULL;
2733         bool change = false;
2734
2735         memset(&params, 0, sizeof(params));
2736
2737         otype = ntype = dev->ieee80211_ptr->iftype;
2738
2739         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2740                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2741                 if (otype != ntype)
2742                         change = true;
2743                 if (ntype > NL80211_IFTYPE_MAX)
2744                         return -EINVAL;
2745         }
2746
2747         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2748                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2749
2750                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2751                         return -EINVAL;
2752                 if (netif_running(dev))
2753                         return -EBUSY;
2754
2755                 wdev_lock(wdev);
2756                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2757                              IEEE80211_MAX_MESH_ID_LEN);
2758                 wdev->mesh_id_up_len =
2759                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2760                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2761                        wdev->mesh_id_up_len);
2762                 wdev_unlock(wdev);
2763         }
2764
2765         if (info->attrs[NL80211_ATTR_4ADDR]) {
2766                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2767                 change = true;
2768                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2769                 if (err)
2770                         return err;
2771         } else {
2772                 params.use_4addr = -1;
2773         }
2774
2775         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2776                 if (ntype != NL80211_IFTYPE_MONITOR)
2777                         return -EINVAL;
2778                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2779                                           &_flags);
2780                 if (err)
2781                         return err;
2782
2783                 flags = &_flags;
2784                 change = true;
2785         }
2786
2787         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2788                 const u8 *mumimo_groups;
2789                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2790
2791                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2792                         return -EOPNOTSUPP;
2793
2794                 mumimo_groups =
2795                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2796
2797                 /* bits 0 and 63 are reserved and must be zero */
2798                 if ((mumimo_groups[0] & BIT(7)) ||
2799                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
2800                         return -EINVAL;
2801
2802                 memcpy(params.vht_mumimo_groups, mumimo_groups,
2803                        VHT_MUMIMO_GROUPS_DATA_LEN);
2804                 change = true;
2805         }
2806
2807         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2808                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2809
2810                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2811                         return -EOPNOTSUPP;
2812
2813                 nla_memcpy(params.macaddr,
2814                            info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR],
2815                            ETH_ALEN);
2816                 change = true;
2817         }
2818
2819         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2820             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2821                 return -EOPNOTSUPP;
2822
2823         if (change)
2824                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2825         else
2826                 err = 0;
2827
2828         if (!err && params.use_4addr != -1)
2829                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2830
2831         return err;
2832 }
2833
2834 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2835 {
2836         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2837         struct vif_params params;
2838         struct wireless_dev *wdev;
2839         struct sk_buff *msg;
2840         int err;
2841         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2842         u32 flags;
2843
2844         /* to avoid failing a new interface creation due to pending removal */
2845         cfg80211_destroy_ifaces(rdev);
2846
2847         memset(&params, 0, sizeof(params));
2848
2849         if (!info->attrs[NL80211_ATTR_IFNAME])
2850                 return -EINVAL;
2851
2852         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2853                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2854                 if (type > NL80211_IFTYPE_MAX)
2855                         return -EINVAL;
2856         }
2857
2858         if (!rdev->ops->add_virtual_intf ||
2859             !(rdev->wiphy.interface_modes & (1 << type)))
2860                 return -EOPNOTSUPP;
2861
2862         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2863              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2864             info->attrs[NL80211_ATTR_MAC]) {
2865                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2866                            ETH_ALEN);
2867                 if (!is_valid_ether_addr(params.macaddr))
2868                         return -EADDRNOTAVAIL;
2869         }
2870
2871         if (info->attrs[NL80211_ATTR_4ADDR]) {
2872                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2873                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2874                 if (err)
2875                         return err;
2876         }
2877
2878         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2879                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2880                                   &flags);
2881
2882         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2883             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2884                 return -EOPNOTSUPP;
2885
2886         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2887         if (!msg)
2888                 return -ENOMEM;
2889
2890         wdev = rdev_add_virtual_intf(rdev,
2891                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2892                                 NET_NAME_USER, type, err ? NULL : &flags,
2893                                 &params);
2894         if (WARN_ON(!wdev)) {
2895                 nlmsg_free(msg);
2896                 return -EPROTO;
2897         } else if (IS_ERR(wdev)) {
2898                 nlmsg_free(msg);
2899                 return PTR_ERR(wdev);
2900         }
2901
2902         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2903                 wdev->owner_nlportid = info->snd_portid;
2904
2905         switch (type) {
2906         case NL80211_IFTYPE_MESH_POINT:
2907                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2908                         break;
2909                 wdev_lock(wdev);
2910                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2911                              IEEE80211_MAX_MESH_ID_LEN);
2912                 wdev->mesh_id_up_len =
2913                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2914                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2915                        wdev->mesh_id_up_len);
2916                 wdev_unlock(wdev);
2917                 break;
2918         case NL80211_IFTYPE_NAN:
2919         case NL80211_IFTYPE_P2P_DEVICE:
2920                 /*
2921                  * P2P Device and NAN do not have a netdev, so don't go
2922                  * through the netdev notifier and must be added here
2923                  */
2924                 mutex_init(&wdev->mtx);
2925                 INIT_LIST_HEAD(&wdev->event_list);
2926                 spin_lock_init(&wdev->event_lock);
2927                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2928                 spin_lock_init(&wdev->mgmt_registrations_lock);
2929
2930                 wdev->identifier = ++rdev->wdev_id;
2931                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2932                 rdev->devlist_generation++;
2933                 break;
2934         default:
2935                 break;
2936         }
2937
2938         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2939                                rdev, wdev, false) < 0) {
2940                 nlmsg_free(msg);
2941                 return -ENOBUFS;
2942         }
2943
2944         /*
2945          * For wdevs which have no associated netdev object (e.g. of type
2946          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
2947          * For all other types, the event will be generated from the
2948          * netdev notifier
2949          */
2950         if (!wdev->netdev)
2951                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
2952
2953         return genlmsg_reply(msg, info);
2954 }
2955
2956 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2957 {
2958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2959         struct wireless_dev *wdev = info->user_ptr[1];
2960
2961         if (!rdev->ops->del_virtual_intf)
2962                 return -EOPNOTSUPP;
2963
2964         /*
2965          * If we remove a wireless device without a netdev then clear
2966          * user_ptr[1] so that nl80211_post_doit won't dereference it
2967          * to check if it needs to do dev_put(). Otherwise it crashes
2968          * since the wdev has been freed, unlike with a netdev where
2969          * we need the dev_put() for the netdev to really be freed.
2970          */
2971         if (!wdev->netdev)
2972                 info->user_ptr[1] = NULL;
2973
2974         return rdev_del_virtual_intf(rdev, wdev);
2975 }
2976
2977 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2978 {
2979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2980         struct net_device *dev = info->user_ptr[1];
2981         u16 noack_map;
2982
2983         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2984                 return -EINVAL;
2985
2986         if (!rdev->ops->set_noack_map)
2987                 return -EOPNOTSUPP;
2988
2989         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2990
2991         return rdev_set_noack_map(rdev, dev, noack_map);
2992 }
2993
2994 struct get_key_cookie {
2995         struct sk_buff *msg;
2996         int error;
2997         int idx;
2998 };
2999
3000 static void get_key_callback(void *c, struct key_params *params)
3001 {
3002         struct nlattr *key;
3003         struct get_key_cookie *cookie = c;
3004
3005         if ((params->key &&
3006              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3007                      params->key_len, params->key)) ||
3008             (params->seq &&
3009              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3010                      params->seq_len, params->seq)) ||
3011             (params->cipher &&
3012              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3013                          params->cipher)))
3014                 goto nla_put_failure;
3015
3016         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3017         if (!key)
3018                 goto nla_put_failure;
3019
3020         if ((params->key &&
3021              nla_put(cookie->msg, NL80211_KEY_DATA,
3022                      params->key_len, params->key)) ||
3023             (params->seq &&
3024              nla_put(cookie->msg, NL80211_KEY_SEQ,
3025                      params->seq_len, params->seq)) ||
3026             (params->cipher &&
3027              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3028                          params->cipher)))
3029                 goto nla_put_failure;
3030
3031         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3032                 goto nla_put_failure;
3033
3034         nla_nest_end(cookie->msg, key);
3035
3036         return;
3037  nla_put_failure:
3038         cookie->error = 1;
3039 }
3040
3041 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3042 {
3043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3044         int err;
3045         struct net_device *dev = info->user_ptr[1];
3046         u8 key_idx = 0;
3047         const u8 *mac_addr = NULL;
3048         bool pairwise;
3049         struct get_key_cookie cookie = {
3050                 .error = 0,
3051         };
3052         void *hdr;
3053         struct sk_buff *msg;
3054
3055         if (info->attrs[NL80211_ATTR_KEY_IDX])
3056                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3057
3058         if (key_idx > 5)
3059                 return -EINVAL;
3060
3061         if (info->attrs[NL80211_ATTR_MAC])
3062                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3063
3064         pairwise = !!mac_addr;
3065         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3066                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3067
3068                 if (kt >= NUM_NL80211_KEYTYPES)
3069                         return -EINVAL;
3070                 if (kt != NL80211_KEYTYPE_GROUP &&
3071                     kt != NL80211_KEYTYPE_PAIRWISE)
3072                         return -EINVAL;
3073                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3074         }
3075
3076         if (!rdev->ops->get_key)
3077                 return -EOPNOTSUPP;
3078
3079         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3080                 return -ENOENT;
3081
3082         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3083         if (!msg)
3084                 return -ENOMEM;
3085
3086         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3087                              NL80211_CMD_NEW_KEY);
3088         if (!hdr)
3089                 goto nla_put_failure;
3090
3091         cookie.msg = msg;
3092         cookie.idx = key_idx;
3093
3094         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3095             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3096                 goto nla_put_failure;
3097         if (mac_addr &&
3098             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3099                 goto nla_put_failure;
3100
3101         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3102                            get_key_callback);
3103
3104         if (err)
3105                 goto free_msg;
3106
3107         if (cookie.error)
3108                 goto nla_put_failure;
3109
3110         genlmsg_end(msg, hdr);
3111         return genlmsg_reply(msg, info);
3112
3113  nla_put_failure:
3114         err = -ENOBUFS;
3115  free_msg:
3116         nlmsg_free(msg);
3117         return err;
3118 }
3119
3120 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3121 {
3122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3123         struct key_parse key;
3124         int err;
3125         struct net_device *dev = info->user_ptr[1];
3126
3127         err = nl80211_parse_key(info, &key);
3128         if (err)
3129                 return err;
3130
3131         if (key.idx < 0)
3132                 return -EINVAL;
3133
3134         /* only support setting default key */
3135         if (!key.def && !key.defmgmt)
3136                 return -EINVAL;
3137
3138         wdev_lock(dev->ieee80211_ptr);
3139
3140         if (key.def) {
3141                 if (!rdev->ops->set_default_key) {
3142                         err = -EOPNOTSUPP;
3143                         goto out;
3144                 }
3145
3146                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3147                 if (err)
3148                         goto out;
3149
3150                 err = rdev_set_default_key(rdev, dev, key.idx,
3151                                                  key.def_uni, key.def_multi);
3152
3153                 if (err)
3154                         goto out;
3155
3156 #ifdef CONFIG_CFG80211_WEXT
3157                 dev->ieee80211_ptr->wext.default_key = key.idx;
3158 #endif
3159         } else {
3160                 if (key.def_uni || !key.def_multi) {
3161                         err = -EINVAL;
3162                         goto out;
3163                 }
3164
3165                 if (!rdev->ops->set_default_mgmt_key) {
3166                         err = -EOPNOTSUPP;
3167                         goto out;
3168                 }
3169
3170                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3171                 if (err)
3172                         goto out;
3173
3174                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3175                 if (err)
3176                         goto out;
3177
3178 #ifdef CONFIG_CFG80211_WEXT
3179                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3180 #endif
3181         }
3182
3183  out:
3184         wdev_unlock(dev->ieee80211_ptr);
3185
3186         return err;
3187 }
3188
3189 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3190 {
3191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3192         int err;
3193         struct net_device *dev = info->user_ptr[1];
3194         struct key_parse key;
3195         const u8 *mac_addr = NULL;
3196
3197         err = nl80211_parse_key(info, &key);
3198         if (err)
3199                 return err;
3200
3201         if (!key.p.key)
3202                 return -EINVAL;
3203
3204         if (info->attrs[NL80211_ATTR_MAC])
3205                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3206
3207         if (key.type == -1) {
3208                 if (mac_addr)
3209                         key.type = NL80211_KEYTYPE_PAIRWISE;
3210                 else
3211                         key.type = NL80211_KEYTYPE_GROUP;
3212         }
3213
3214         /* for now */
3215         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3216             key.type != NL80211_KEYTYPE_GROUP)
3217                 return -EINVAL;
3218
3219         if (!rdev->ops->add_key)
3220                 return -EOPNOTSUPP;
3221
3222         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3223                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3224                                            mac_addr))
3225                 return -EINVAL;
3226
3227         wdev_lock(dev->ieee80211_ptr);
3228         err = nl80211_key_allowed(dev->ieee80211_ptr);
3229         if (!err)
3230                 err = rdev_add_key(rdev, dev, key.idx,
3231                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3232                                     mac_addr, &key.p);
3233         wdev_unlock(dev->ieee80211_ptr);
3234
3235         return err;
3236 }
3237
3238 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3239 {
3240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3241         int err;
3242         struct net_device *dev = info->user_ptr[1];
3243         u8 *mac_addr = NULL;
3244         struct key_parse key;
3245
3246         err = nl80211_parse_key(info, &key);
3247         if (err)
3248                 return err;
3249
3250         if (info->attrs[NL80211_ATTR_MAC])
3251                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3252
3253         if (key.type == -1) {
3254                 if (mac_addr)
3255                         key.type = NL80211_KEYTYPE_PAIRWISE;
3256                 else
3257                         key.type = NL80211_KEYTYPE_GROUP;
3258         }
3259
3260         /* for now */
3261         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3262             key.type != NL80211_KEYTYPE_GROUP)
3263                 return -EINVAL;
3264
3265         if (!rdev->ops->del_key)
3266                 return -EOPNOTSUPP;
3267
3268         wdev_lock(dev->ieee80211_ptr);
3269         err = nl80211_key_allowed(dev->ieee80211_ptr);
3270
3271         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3272             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3273                 err = -ENOENT;
3274
3275         if (!err)
3276                 err = rdev_del_key(rdev, dev, key.idx,
3277                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3278                                    mac_addr);
3279
3280 #ifdef CONFIG_CFG80211_WEXT
3281         if (!err) {
3282                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3283                         dev->ieee80211_ptr->wext.default_key = -1;
3284                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3285                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3286         }
3287 #endif
3288         wdev_unlock(dev->ieee80211_ptr);
3289
3290         return err;
3291 }
3292
3293 /* This function returns an error or the number of nested attributes */
3294 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3295 {
3296         struct nlattr *attr;
3297         int n_entries = 0, tmp;
3298
3299         nla_for_each_nested(attr, nl_attr, tmp) {
3300                 if (nla_len(attr) != ETH_ALEN)
3301                         return -EINVAL;
3302
3303                 n_entries++;
3304         }
3305
3306         return n_entries;
3307 }
3308
3309 /*
3310  * This function parses ACL information and allocates memory for ACL data.
3311  * On successful return, the calling function is responsible to free the
3312  * ACL buffer returned by this function.
3313  */
3314 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3315                                                 struct genl_info *info)
3316 {
3317         enum nl80211_acl_policy acl_policy;
3318         struct nlattr *attr;
3319         struct cfg80211_acl_data *acl;
3320         int i = 0, n_entries, tmp;
3321
3322         if (!wiphy->max_acl_mac_addrs)
3323                 return ERR_PTR(-EOPNOTSUPP);
3324
3325         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3326                 return ERR_PTR(-EINVAL);
3327
3328         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3329         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3330             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3331                 return ERR_PTR(-EINVAL);
3332
3333         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3334                 return ERR_PTR(-EINVAL);
3335
3336         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3337         if (n_entries < 0)
3338                 return ERR_PTR(n_entries);
3339
3340         if (n_entries > wiphy->max_acl_mac_addrs)
3341                 return ERR_PTR(-ENOTSUPP);
3342
3343         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3344                       GFP_KERNEL);
3345         if (!acl)
3346                 return ERR_PTR(-ENOMEM);
3347
3348         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3349                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3350                 i++;
3351         }
3352
3353         acl->n_acl_entries = n_entries;
3354         acl->acl_policy = acl_policy;
3355
3356         return acl;
3357 }
3358
3359 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3360 {
3361         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3362         struct net_device *dev = info->user_ptr[1];
3363         struct cfg80211_acl_data *acl;
3364         int err;
3365
3366         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3367             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3368                 return -EOPNOTSUPP;
3369
3370         if (!dev->ieee80211_ptr->beacon_interval)
3371                 return -EINVAL;
3372
3373         acl = parse_acl_data(&rdev->wiphy, info);
3374         if (IS_ERR(acl))
3375                 return PTR_ERR(acl);
3376
3377         err = rdev_set_mac_acl(rdev, dev, acl);
3378
3379         kfree(acl);
3380
3381         return err;
3382 }
3383
3384 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3385                            u8 *rates, u8 rates_len)
3386 {
3387         u8 i;
3388         u32 mask = 0;
3389
3390         for (i = 0; i < rates_len; i++) {
3391                 int rate = (rates[i] & 0x7f) * 5;
3392                 int ridx;
3393
3394                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3395                         struct ieee80211_rate *srate =
3396                                 &sband->bitrates[ridx];
3397                         if (rate == srate->bitrate) {
3398                                 mask |= 1 << ridx;
3399                                 break;
3400                         }
3401                 }
3402                 if (ridx == sband->n_bitrates)
3403                         return 0; /* rate not found */
3404         }
3405
3406         return mask;
3407 }
3408
3409 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3410                                u8 *rates, u8 rates_len,
3411                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3412 {
3413         u8 i;
3414
3415         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3416
3417         for (i = 0; i < rates_len; i++) {
3418                 int ridx, rbit;
3419
3420                 ridx = rates[i] / 8;
3421                 rbit = BIT(rates[i] % 8);
3422
3423                 /* check validity */
3424                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3425                         return false;
3426
3427                 /* check availability */
3428                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3429                         mcs[ridx] |= rbit;
3430                 else
3431                         return false;
3432         }
3433
3434         return true;
3435 }
3436
3437 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3438 {
3439         u16 mcs_mask = 0;
3440
3441         switch (vht_mcs_map) {
3442         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3443                 break;
3444         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3445                 mcs_mask = 0x00FF;
3446                 break;
3447         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3448                 mcs_mask = 0x01FF;
3449                 break;
3450         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3451                 mcs_mask = 0x03FF;
3452                 break;
3453         default:
3454                 break;
3455         }
3456
3457         return mcs_mask;
3458 }
3459
3460 static void vht_build_mcs_mask(u16 vht_mcs_map,
3461                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3462 {
3463         u8 nss;
3464
3465         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3466                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3467                 vht_mcs_map >>= 2;
3468         }
3469 }
3470
3471 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3472                              struct nl80211_txrate_vht *txrate,
3473                              u16 mcs[NL80211_VHT_NSS_MAX])
3474 {
3475         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3476         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3477         u8 i;
3478
3479         if (!sband->vht_cap.vht_supported)
3480                 return false;
3481
3482         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3483
3484         /* Build vht_mcs_mask from VHT capabilities */
3485         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3486
3487         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3488                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3489                         mcs[i] = txrate->mcs[i];
3490                 else
3491                         return false;
3492         }
3493
3494         return true;
3495 }
3496
3497 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3498         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3499                                     .len = NL80211_MAX_SUPP_RATES },
3500         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3501                                 .len = NL80211_MAX_SUPP_HT_RATES },
3502         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3503         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3504 };
3505
3506 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3507                                          struct cfg80211_bitrate_mask *mask)
3508 {
3509         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3510         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3511         int rem, i;
3512         struct nlattr *tx_rates;
3513         struct ieee80211_supported_band *sband;
3514         u16 vht_tx_mcs_map;
3515
3516         memset(mask, 0, sizeof(*mask));
3517         /* Default to all rates enabled */
3518         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3519                 sband = rdev->wiphy.bands[i];
3520
3521                 if (!sband)
3522                         continue;
3523
3524                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3525                 memcpy(mask->control[i].ht_mcs,
3526                        sband->ht_cap.mcs.rx_mask,
3527                        sizeof(mask->control[i].ht_mcs));
3528
3529                 if (!sband->vht_cap.vht_supported)
3530                         continue;
3531
3532                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3533                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3534         }
3535
3536         /* if no rates are given set it back to the defaults */
3537         if (!info->attrs[NL80211_ATTR_TX_RATES])
3538                 goto out;
3539
3540         /* The nested attribute uses enum nl80211_band as the index. This maps
3541          * directly to the enum nl80211_band values used in cfg80211.
3542          */
3543         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3544         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3545                 enum nl80211_band band = nla_type(tx_rates);
3546                 int err;
3547
3548                 if (band < 0 || band >= NUM_NL80211_BANDS)
3549                         return -EINVAL;
3550                 sband = rdev->wiphy.bands[band];
3551                 if (sband == NULL)
3552                         return -EINVAL;
3553                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
3554                                 nla_len(tx_rates), nl80211_txattr_policy);
3555                 if (err)
3556                         return err;
3557                 if (tb[NL80211_TXRATE_LEGACY]) {
3558                         mask->control[band].legacy = rateset_to_mask(
3559                                 sband,
3560                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3561                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3562                         if ((mask->control[band].legacy == 0) &&
3563                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3564                                 return -EINVAL;
3565                 }
3566                 if (tb[NL80211_TXRATE_HT]) {
3567                         if (!ht_rateset_to_mask(
3568                                         sband,
3569                                         nla_data(tb[NL80211_TXRATE_HT]),
3570                                         nla_len(tb[NL80211_TXRATE_HT]),
3571                                         mask->control[band].ht_mcs))
3572                                 return -EINVAL;
3573                 }
3574                 if (tb[NL80211_TXRATE_VHT]) {
3575                         if (!vht_set_mcs_mask(
3576                                         sband,
3577                                         nla_data(tb[NL80211_TXRATE_VHT]),
3578                                         mask->control[band].vht_mcs))
3579                                 return -EINVAL;
3580                 }
3581                 if (tb[NL80211_TXRATE_GI]) {
3582                         mask->control[band].gi =
3583                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3584                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3585                                 return -EINVAL;
3586                 }
3587
3588                 if (mask->control[band].legacy == 0) {
3589                         /* don't allow empty legacy rates if HT or VHT
3590                          * are not even supported.
3591                          */
3592                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3593                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3594                                 return -EINVAL;
3595
3596                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3597                                 if (mask->control[band].ht_mcs[i])
3598                                         goto out;
3599
3600                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3601                                 if (mask->control[band].vht_mcs[i])
3602                                         goto out;
3603
3604                         /* legacy and mcs rates may not be both empty */
3605                         return -EINVAL;
3606                 }
3607         }
3608
3609 out:
3610         return 0;
3611 }
3612
3613 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3614                                    enum nl80211_band band,
3615                                    struct cfg80211_bitrate_mask *beacon_rate)
3616 {
3617         u32 count_ht, count_vht, i;
3618         u32 rate = beacon_rate->control[band].legacy;
3619
3620         /* Allow only one rate */
3621         if (hweight32(rate) > 1)
3622                 return -EINVAL;
3623
3624         count_ht = 0;
3625         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3626                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3627                         return -EINVAL;
3628                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3629                         count_ht++;
3630                         if (count_ht > 1)
3631                                 return -EINVAL;
3632                 }
3633                 if (count_ht && rate)
3634                         return -EINVAL;
3635         }
3636
3637         count_vht = 0;
3638         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3639                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3640                         return -EINVAL;
3641                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3642                         count_vht++;
3643                         if (count_vht > 1)
3644                                 return -EINVAL;
3645                 }
3646                 if (count_vht && rate)
3647                         return -EINVAL;
3648         }
3649
3650         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3651                 return -EINVAL;
3652
3653         if (rate &&
3654             !wiphy_ext_feature_isset(&rdev->wiphy,
3655                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3656                 return -EINVAL;
3657         if (count_ht &&
3658             !wiphy_ext_feature_isset(&rdev->wiphy,
3659                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3660                 return -EINVAL;
3661         if (count_vht &&
3662             !wiphy_ext_feature_isset(&rdev->wiphy,
3663                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3664                 return -EINVAL;
3665
3666         return 0;
3667 }
3668
3669 static int nl80211_parse_beacon(struct nlattr *attrs[],
3670                                 struct cfg80211_beacon_data *bcn)
3671 {
3672         bool haveinfo = false;
3673
3674         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3675             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3676             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3677             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3678                 return -EINVAL;
3679
3680         memset(bcn, 0, sizeof(*bcn));
3681
3682         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3683                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3684                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3685                 if (!bcn->head_len)
3686                         return -EINVAL;
3687                 haveinfo = true;
3688         }
3689
3690         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3691                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3692                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3693                 haveinfo = true;
3694         }
3695
3696         if (!haveinfo)
3697                 return -EINVAL;
3698
3699         if (attrs[NL80211_ATTR_IE]) {
3700                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3701                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3702         }
3703
3704         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3705                 bcn->proberesp_ies =
3706                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3707                 bcn->proberesp_ies_len =
3708                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3709         }
3710
3711         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3712                 bcn->assocresp_ies =
3713                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3714                 bcn->assocresp_ies_len =
3715                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3716         }
3717
3718         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3719                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3720                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3721         }
3722
3723         return 0;
3724 }
3725
3726 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3727                                    struct cfg80211_ap_settings *params)
3728 {
3729         struct wireless_dev *wdev;
3730         bool ret = false;
3731
3732         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3733                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3734                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3735                         continue;
3736
3737                 if (!wdev->preset_chandef.chan)
3738                         continue;
3739
3740                 params->chandef = wdev->preset_chandef;
3741                 ret = true;
3742                 break;
3743         }
3744
3745         return ret;
3746 }
3747
3748 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3749                                     enum nl80211_auth_type auth_type,
3750                                     enum nl80211_commands cmd)
3751 {
3752         if (auth_type > NL80211_AUTHTYPE_MAX)
3753                 return false;
3754
3755         switch (cmd) {
3756         case NL80211_CMD_AUTHENTICATE:
3757                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3758                     auth_type == NL80211_AUTHTYPE_SAE)
3759                         return false;
3760                 return true;
3761         case NL80211_CMD_CONNECT:
3762         case NL80211_CMD_START_AP:
3763                 /* SAE not supported yet */
3764                 if (auth_type == NL80211_AUTHTYPE_SAE)
3765                         return false;
3766                 return true;
3767         default:
3768                 return false;
3769         }
3770 }
3771
3772 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3773 {
3774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3775         struct net_device *dev = info->user_ptr[1];
3776         struct wireless_dev *wdev = dev->ieee80211_ptr;
3777         struct cfg80211_ap_settings params;
3778         int err;
3779
3780         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3781             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3782                 return -EOPNOTSUPP;
3783
3784         if (!rdev->ops->start_ap)
3785                 return -EOPNOTSUPP;
3786
3787         if (wdev->beacon_interval)
3788                 return -EALREADY;
3789
3790         memset(&params, 0, sizeof(params));
3791
3792         /* these are required for START_AP */
3793         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3794             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3795             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3796                 return -EINVAL;
3797
3798         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3799         if (err)
3800                 return err;
3801
3802         params.beacon_interval =
3803                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3804         params.dtim_period =
3805                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3806
3807         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3808         if (err)
3809                 return err;
3810
3811         /*
3812          * In theory, some of these attributes should be required here
3813          * but since they were not used when the command was originally
3814          * added, keep them optional for old user space programs to let
3815          * them continue to work with drivers that do not need the
3816          * additional information -- drivers must check!
3817          */
3818         if (info->attrs[NL80211_ATTR_SSID]) {
3819                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3820                 params.ssid_len =
3821                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3822                 if (params.ssid_len == 0 ||
3823                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3824                         return -EINVAL;
3825         }
3826
3827         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3828                 params.hidden_ssid = nla_get_u32(
3829                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3830                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3831                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3832                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3833                         return -EINVAL;
3834         }
3835
3836         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3837
3838         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3839                 params.auth_type = nla_get_u32(
3840                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3841                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3842                                              NL80211_CMD_START_AP))
3843                         return -EINVAL;
3844         } else
3845                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3846
3847         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3848                                       NL80211_MAX_NR_CIPHER_SUITES);
3849         if (err)
3850                 return err;
3851
3852         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3853                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3854                         return -EOPNOTSUPP;
3855                 params.inactivity_timeout = nla_get_u16(
3856                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3857         }
3858
3859         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3860                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3861                         return -EINVAL;
3862                 params.p2p_ctwindow =
3863                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3864                 if (params.p2p_ctwindow > 127)
3865                         return -EINVAL;
3866                 if (params.p2p_ctwindow != 0 &&
3867                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3868                         return -EINVAL;
3869         }
3870
3871         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3872                 u8 tmp;
3873
3874                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3875                         return -EINVAL;
3876                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3877                 if (tmp > 1)
3878                         return -EINVAL;
3879                 params.p2p_opp_ps = tmp;
3880                 if (params.p2p_opp_ps != 0 &&
3881                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3882                         return -EINVAL;
3883         }
3884
3885         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3886                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3887                 if (err)
3888                         return err;
3889         } else if (wdev->preset_chandef.chan) {
3890                 params.chandef = wdev->preset_chandef;
3891         } else if (!nl80211_get_ap_channel(rdev, &params))
3892                 return -EINVAL;
3893
3894         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3895                                            wdev->iftype))
3896                 return -EINVAL;
3897
3898         if (info->attrs[NL80211_ATTR_TX_RATES]) {
3899                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
3900                 if (err)
3901                         return err;
3902
3903                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
3904                                               &params.beacon_rate);
3905                 if (err)
3906                         return err;
3907         }
3908
3909         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3910                 params.smps_mode =
3911                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3912                 switch (params.smps_mode) {
3913                 case NL80211_SMPS_OFF:
3914                         break;
3915                 case NL80211_SMPS_STATIC:
3916                         if (!(rdev->wiphy.features &
3917                               NL80211_FEATURE_STATIC_SMPS))
3918                                 return -EINVAL;
3919                         break;
3920                 case NL80211_SMPS_DYNAMIC:
3921                         if (!(rdev->wiphy.features &
3922                               NL80211_FEATURE_DYNAMIC_SMPS))
3923                                 return -EINVAL;
3924                         break;
3925                 default:
3926                         return -EINVAL;
3927                 }
3928         } else {
3929                 params.smps_mode = NL80211_SMPS_OFF;
3930         }
3931
3932         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3933         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3934                 return -EOPNOTSUPP;
3935
3936         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3937                 params.acl = parse_acl_data(&rdev->wiphy, info);
3938                 if (IS_ERR(params.acl))
3939                         return PTR_ERR(params.acl);
3940         }
3941
3942         wdev_lock(wdev);
3943         err = rdev_start_ap(rdev, dev, &params);
3944         if (!err) {
3945                 wdev->preset_chandef = params.chandef;
3946                 wdev->beacon_interval = params.beacon_interval;
3947                 wdev->chandef = params.chandef;
3948                 wdev->ssid_len = params.ssid_len;
3949                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3950         }
3951         wdev_unlock(wdev);
3952
3953         kfree(params.acl);
3954
3955         return err;
3956 }
3957
3958 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3959 {
3960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3961         struct net_device *dev = info->user_ptr[1];
3962         struct wireless_dev *wdev = dev->ieee80211_ptr;
3963         struct cfg80211_beacon_data params;
3964         int err;
3965
3966         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3967             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3968                 return -EOPNOTSUPP;
3969
3970         if (!rdev->ops->change_beacon)
3971                 return -EOPNOTSUPP;
3972
3973         if (!wdev->beacon_interval)
3974                 return -EINVAL;
3975
3976         err = nl80211_parse_beacon(info->attrs, &params);
3977         if (err)
3978                 return err;
3979
3980         wdev_lock(wdev);
3981         err = rdev_change_beacon(rdev, dev, &params);
3982         wdev_unlock(wdev);
3983
3984         return err;
3985 }
3986
3987 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3988 {
3989         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3990         struct net_device *dev = info->user_ptr[1];
3991
3992         return cfg80211_stop_ap(rdev, dev, false);
3993 }
3994
3995 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3996         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3997         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3998         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3999         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4000         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4001         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4002 };
4003
4004 static int parse_station_flags(struct genl_info *info,
4005                                enum nl80211_iftype iftype,
4006                                struct station_parameters *params)
4007 {
4008         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4009         struct nlattr *nla;
4010         int flag;
4011
4012         /*
4013          * Try parsing the new attribute first so userspace
4014          * can specify both for older kernels.
4015          */
4016         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4017         if (nla) {
4018                 struct nl80211_sta_flag_update *sta_flags;
4019
4020                 sta_flags = nla_data(nla);
4021                 params->sta_flags_mask = sta_flags->mask;
4022                 params->sta_flags_set = sta_flags->set;
4023                 params->sta_flags_set &= params->sta_flags_mask;
4024                 if ((params->sta_flags_mask |
4025                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4026                         return -EINVAL;
4027                 return 0;
4028         }
4029
4030         /* if present, parse the old attribute */
4031
4032         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4033         if (!nla)
4034                 return 0;
4035
4036         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
4037                              nla, sta_flags_policy))
4038                 return -EINVAL;
4039
4040         /*
4041          * Only allow certain flags for interface types so that
4042          * other attributes are silently ignored. Remember that
4043          * this is backward compatibility code with old userspace
4044          * and shouldn't be hit in other cases anyway.
4045          */
4046         switch (iftype) {
4047         case NL80211_IFTYPE_AP:
4048         case NL80211_IFTYPE_AP_VLAN:
4049         case NL80211_IFTYPE_P2P_GO:
4050                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4051                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4052                                          BIT(NL80211_STA_FLAG_WME) |
4053                                          BIT(NL80211_STA_FLAG_MFP);
4054                 break;
4055         case NL80211_IFTYPE_P2P_CLIENT:
4056         case NL80211_IFTYPE_STATION:
4057                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4058                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4059                 break;
4060         case NL80211_IFTYPE_MESH_POINT:
4061                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4062                                          BIT(NL80211_STA_FLAG_MFP) |
4063                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4064         default:
4065                 return -EINVAL;
4066         }
4067
4068         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4069                 if (flags[flag]) {
4070                         params->sta_flags_set |= (1<<flag);
4071
4072                         /* no longer support new API additions in old API */
4073                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4074                                 return -EINVAL;
4075                 }
4076         }
4077
4078         return 0;
4079 }
4080
4081 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4082                                  int attr)
4083 {
4084         struct nlattr *rate;
4085         u32 bitrate;
4086         u16 bitrate_compat;
4087         enum nl80211_attrs rate_flg;
4088
4089         rate = nla_nest_start(msg, attr);
4090         if (!rate)
4091                 return false;
4092
4093         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4094         bitrate = cfg80211_calculate_bitrate(info);
4095         /* report 16-bit bitrate only if we can */
4096         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4097         if (bitrate > 0 &&
4098             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4099                 return false;
4100         if (bitrate_compat > 0 &&
4101             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4102                 return false;
4103
4104         switch (info->bw) {
4105         case RATE_INFO_BW_5:
4106                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4107                 break;
4108         case RATE_INFO_BW_10:
4109                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4110                 break;
4111         default:
4112                 WARN_ON(1);
4113                 /* fall through */
4114         case RATE_INFO_BW_20:
4115                 rate_flg = 0;
4116                 break;
4117         case RATE_INFO_BW_40:
4118                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4119                 break;
4120         case RATE_INFO_BW_80:
4121                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4122                 break;
4123         case RATE_INFO_BW_160:
4124                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4125                 break;
4126         }
4127
4128         if (rate_flg && nla_put_flag(msg, rate_flg))
4129                 return false;
4130
4131         if (info->flags & RATE_INFO_FLAGS_MCS) {
4132                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4133                         return false;
4134                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4135                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4136                         return false;
4137         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4138                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4139                         return false;
4140                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4141                         return false;
4142                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4143                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4144                         return false;
4145         }
4146
4147         nla_nest_end(msg, rate);
4148         return true;
4149 }
4150
4151 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4152                                int id)
4153 {
4154         void *attr;
4155         int i = 0;
4156
4157         if (!mask)
4158                 return true;
4159
4160         attr = nla_nest_start(msg, id);
4161         if (!attr)
4162                 return false;
4163
4164         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4165                 if (!(mask & BIT(i)))
4166                         continue;
4167
4168                 if (nla_put_u8(msg, i, signal[i]))
4169                         return false;
4170         }
4171
4172         nla_nest_end(msg, attr);
4173
4174         return true;
4175 }
4176
4177 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4178                                 u32 seq, int flags,
4179                                 struct cfg80211_registered_device *rdev,
4180                                 struct net_device *dev,
4181                                 const u8 *mac_addr, struct station_info *sinfo)
4182 {
4183         void *hdr;
4184         struct nlattr *sinfoattr, *bss_param;
4185
4186         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4187         if (!hdr)
4188                 return -1;
4189
4190         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4191             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4192             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4193                 goto nla_put_failure;
4194
4195         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4196         if (!sinfoattr)
4197                 goto nla_put_failure;
4198
4199 #define PUT_SINFO(attr, memb, type) do {                                \
4200         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4201         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4202             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4203                              sinfo->memb))                              \
4204                 goto nla_put_failure;                                   \
4205         } while (0)
4206 #define PUT_SINFO_U64(attr, memb) do {                                  \
4207         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4208             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4209                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4210                 goto nla_put_failure;                                   \
4211         } while (0)
4212
4213         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4214         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4215
4216         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4217                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4218             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4219                         (u32)sinfo->rx_bytes))
4220                 goto nla_put_failure;
4221
4222         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4223                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4224             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4225                         (u32)sinfo->tx_bytes))
4226                 goto nla_put_failure;
4227
4228         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4229         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4230         PUT_SINFO(LLID, llid, u16);
4231         PUT_SINFO(PLID, plid, u16);
4232         PUT_SINFO(PLINK_STATE, plink_state, u8);
4233         PUT_SINFO_U64(RX_DURATION, rx_duration);
4234
4235         switch (rdev->wiphy.signal_type) {
4236         case CFG80211_SIGNAL_TYPE_MBM:
4237                 PUT_SINFO(SIGNAL, signal, u8);
4238                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4239                 break;
4240         default:
4241                 break;
4242         }
4243         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4244                 if (!nl80211_put_signal(msg, sinfo->chains,
4245                                         sinfo->chain_signal,
4246                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4247                         goto nla_put_failure;
4248         }
4249         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4250                 if (!nl80211_put_signal(msg, sinfo->chains,
4251                                         sinfo->chain_signal_avg,
4252                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4253                         goto nla_put_failure;
4254         }
4255         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4256                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4257                                           NL80211_STA_INFO_TX_BITRATE))
4258                         goto nla_put_failure;
4259         }
4260         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4261                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4262                                           NL80211_STA_INFO_RX_BITRATE))
4263                         goto nla_put_failure;
4264         }
4265
4266         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4267         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4268         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4269         PUT_SINFO(TX_FAILED, tx_failed, u32);
4270         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4271         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4272         PUT_SINFO(LOCAL_PM, local_pm, u32);
4273         PUT_SINFO(PEER_PM, peer_pm, u32);
4274         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4275
4276         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4277                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4278                 if (!bss_param)
4279                         goto nla_put_failure;
4280
4281                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4282                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4283                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4284                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4285                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4286                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4287                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4288                                sinfo->bss_param.dtim_period) ||
4289                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4290                                 sinfo->bss_param.beacon_interval))
4291                         goto nla_put_failure;
4292
4293                 nla_nest_end(msg, bss_param);
4294         }
4295         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4296             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4297                     sizeof(struct nl80211_sta_flag_update),
4298                     &sinfo->sta_flags))
4299                 goto nla_put_failure;
4300
4301         PUT_SINFO_U64(T_OFFSET, t_offset);
4302         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4303         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4304         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4305
4306 #undef PUT_SINFO
4307 #undef PUT_SINFO_U64
4308
4309         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4310                 struct nlattr *tidsattr;
4311                 int tid;
4312
4313                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4314                 if (!tidsattr)
4315                         goto nla_put_failure;
4316
4317                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4318                         struct cfg80211_tid_stats *tidstats;
4319                         struct nlattr *tidattr;
4320
4321                         tidstats = &sinfo->pertid[tid];
4322
4323                         if (!tidstats->filled)
4324                                 continue;
4325
4326                         tidattr = nla_nest_start(msg, tid + 1);
4327                         if (!tidattr)
4328                                 goto nla_put_failure;
4329
4330 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4331         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4332             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4333                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4334                 goto nla_put_failure;                                   \
4335         } while (0)
4336
4337                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4338                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4339                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4340                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4341
4342 #undef PUT_TIDVAL_U64
4343                         nla_nest_end(msg, tidattr);
4344                 }
4345
4346                 nla_nest_end(msg, tidsattr);
4347         }
4348
4349         nla_nest_end(msg, sinfoattr);
4350
4351         if (sinfo->assoc_req_ies_len &&
4352             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4353                     sinfo->assoc_req_ies))
4354                 goto nla_put_failure;
4355
4356         genlmsg_end(msg, hdr);
4357         return 0;
4358
4359  nla_put_failure:
4360         genlmsg_cancel(msg, hdr);
4361         return -EMSGSIZE;
4362 }
4363
4364 static int nl80211_dump_station(struct sk_buff *skb,
4365                                 struct netlink_callback *cb)
4366 {
4367         struct station_info sinfo;
4368         struct cfg80211_registered_device *rdev;
4369         struct wireless_dev *wdev;
4370         u8 mac_addr[ETH_ALEN];
4371         int sta_idx = cb->args[2];
4372         int err;
4373
4374         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4375         if (err)
4376                 return err;
4377
4378         if (!wdev->netdev) {
4379                 err = -EINVAL;
4380                 goto out_err;
4381         }
4382
4383         if (!rdev->ops->dump_station) {
4384                 err = -EOPNOTSUPP;
4385                 goto out_err;
4386         }
4387
4388         while (1) {
4389                 memset(&sinfo, 0, sizeof(sinfo));
4390                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4391                                         mac_addr, &sinfo);
4392                 if (err == -ENOENT)
4393                         break;
4394                 if (err)
4395                         goto out_err;
4396
4397                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4398                                 NETLINK_CB(cb->skb).portid,
4399                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4400                                 rdev, wdev->netdev, mac_addr,
4401                                 &sinfo) < 0)
4402                         goto out;
4403
4404                 sta_idx++;
4405         }
4406
4407  out:
4408         cb->args[2] = sta_idx;
4409         err = skb->len;
4410  out_err:
4411         nl80211_finish_wdev_dump(rdev);
4412
4413         return err;
4414 }
4415
4416 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4417 {
4418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4419         struct net_device *dev = info->user_ptr[1];
4420         struct station_info sinfo;
4421         struct sk_buff *msg;
4422         u8 *mac_addr = NULL;
4423         int err;
4424
4425         memset(&sinfo, 0, sizeof(sinfo));
4426
4427         if (!info->attrs[NL80211_ATTR_MAC])
4428                 return -EINVAL;
4429
4430         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4431
4432         if (!rdev->ops->get_station)
4433                 return -EOPNOTSUPP;
4434
4435         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4436         if (err)
4437                 return err;
4438
4439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4440         if (!msg)
4441                 return -ENOMEM;
4442
4443         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4444                                  info->snd_portid, info->snd_seq, 0,
4445                                  rdev, dev, mac_addr, &sinfo) < 0) {
4446                 nlmsg_free(msg);
4447                 return -ENOBUFS;
4448         }
4449
4450         return genlmsg_reply(msg, info);
4451 }
4452
4453 int cfg80211_check_station_change(struct wiphy *wiphy,
4454                                   struct station_parameters *params,
4455                                   enum cfg80211_station_type statype)
4456 {
4457         if (params->listen_interval != -1 &&
4458             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4459                 return -EINVAL;
4460
4461         if (params->support_p2p_ps != -1 &&
4462             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4463                 return -EINVAL;
4464
4465         if (params->aid &&
4466             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4467             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4468                 return -EINVAL;
4469
4470         /* When you run into this, adjust the code below for the new flag */
4471         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4472
4473         switch (statype) {
4474         case CFG80211_STA_MESH_PEER_KERNEL:
4475         case CFG80211_STA_MESH_PEER_USER:
4476                 /*
4477                  * No ignoring the TDLS flag here -- the userspace mesh
4478                  * code doesn't have the bug of including TDLS in the
4479                  * mask everywhere.
4480                  */
4481                 if (params->sta_flags_mask &
4482                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4483                                   BIT(NL80211_STA_FLAG_MFP) |
4484                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4485                         return -EINVAL;
4486                 break;
4487         case CFG80211_STA_TDLS_PEER_SETUP:
4488         case CFG80211_STA_TDLS_PEER_ACTIVE:
4489                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4490                         return -EINVAL;
4491                 /* ignore since it can't change */
4492                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4493                 break;
4494         default:
4495                 /* disallow mesh-specific things */
4496                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4497                         return -EINVAL;
4498                 if (params->local_pm)
4499                         return -EINVAL;
4500                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4501                         return -EINVAL;
4502         }
4503
4504         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4505             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4506                 /* TDLS can't be set, ... */
4507                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4508                         return -EINVAL;
4509                 /*
4510                  * ... but don't bother the driver with it. This works around
4511                  * a hostapd/wpa_supplicant issue -- it always includes the
4512                  * TLDS_PEER flag in the mask even for AP mode.
4513                  */
4514                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4515         }
4516
4517         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4518             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4519                 /* reject other things that can't change */
4520                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4521                         return -EINVAL;
4522                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4523                         return -EINVAL;
4524                 if (params->supported_rates)
4525                         return -EINVAL;
4526                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4527                         return -EINVAL;
4528         }
4529
4530         if (statype != CFG80211_STA_AP_CLIENT &&
4531             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4532                 if (params->vlan)
4533                         return -EINVAL;
4534         }
4535
4536         switch (statype) {
4537         case CFG80211_STA_AP_MLME_CLIENT:
4538                 /* Use this only for authorizing/unauthorizing a station */
4539                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4540                         return -EOPNOTSUPP;
4541                 break;
4542         case CFG80211_STA_AP_CLIENT:
4543         case CFG80211_STA_AP_CLIENT_UNASSOC:
4544                 /* accept only the listed bits */
4545                 if (params->sta_flags_mask &
4546                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4547                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4548                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4549                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4550                                   BIT(NL80211_STA_FLAG_WME) |
4551                                   BIT(NL80211_STA_FLAG_MFP)))
4552                         return -EINVAL;
4553
4554                 /* but authenticated/associated only if driver handles it */
4555                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4556                     params->sta_flags_mask &
4557                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4558                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4559                         return -EINVAL;
4560                 break;
4561         case CFG80211_STA_IBSS:
4562         case CFG80211_STA_AP_STA:
4563                 /* reject any changes other than AUTHORIZED */
4564                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4565                         return -EINVAL;
4566                 break;
4567         case CFG80211_STA_TDLS_PEER_SETUP:
4568                 /* reject any changes other than AUTHORIZED or WME */
4569                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4570                                                BIT(NL80211_STA_FLAG_WME)))
4571                         return -EINVAL;
4572                 /* force (at least) rates when authorizing */
4573                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4574                     !params->supported_rates)
4575                         return -EINVAL;
4576                 break;
4577         case CFG80211_STA_TDLS_PEER_ACTIVE:
4578                 /* reject any changes */
4579                 return -EINVAL;
4580         case CFG80211_STA_MESH_PEER_KERNEL:
4581                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4582                         return -EINVAL;
4583                 break;
4584         case CFG80211_STA_MESH_PEER_USER:
4585                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4586                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4587                         return -EINVAL;
4588                 break;
4589         }
4590
4591         return 0;
4592 }
4593 EXPORT_SYMBOL(cfg80211_check_station_change);
4594
4595 /*
4596  * Get vlan interface making sure it is running and on the right wiphy.
4597  */
4598 static struct net_device *get_vlan(struct genl_info *info,
4599                                    struct cfg80211_registered_device *rdev)
4600 {
4601         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4602         struct net_device *v;
4603         int ret;
4604
4605         if (!vlanattr)
4606                 return NULL;
4607
4608         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4609         if (!v)
4610                 return ERR_PTR(-ENODEV);
4611
4612         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4613                 ret = -EINVAL;
4614                 goto error;
4615         }
4616
4617         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4618             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4619             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4620                 ret = -EINVAL;
4621                 goto error;
4622         }
4623
4624         if (!netif_running(v)) {
4625                 ret = -ENETDOWN;
4626                 goto error;
4627         }
4628
4629         return v;
4630  error:
4631         dev_put(v);
4632         return ERR_PTR(ret);
4633 }
4634
4635 static const struct nla_policy
4636 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4637         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4638         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4639 };
4640
4641 static int nl80211_parse_sta_wme(struct genl_info *info,
4642                                  struct station_parameters *params)
4643 {
4644         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4645         struct nlattr *nla;
4646         int err;
4647
4648         /* parse WME attributes if present */
4649         if (!info->attrs[NL80211_ATTR_STA_WME])
4650                 return 0;
4651
4652         nla = info->attrs[NL80211_ATTR_STA_WME];
4653         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4654                                nl80211_sta_wme_policy);
4655         if (err)
4656                 return err;
4657
4658         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4659                 params->uapsd_queues = nla_get_u8(
4660                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4661         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4662                 return -EINVAL;
4663
4664         if (tb[NL80211_STA_WME_MAX_SP])
4665                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4666
4667         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4668                 return -EINVAL;
4669
4670         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4671
4672         return 0;
4673 }
4674
4675 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4676                                       struct station_parameters *params)
4677 {
4678         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4679                 params->supported_channels =
4680                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4681                 params->supported_channels_len =
4682                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4683                 /*
4684                  * Need to include at least one (first channel, number of
4685                  * channels) tuple for each subband, and must have proper
4686                  * tuples for the rest of the data as well.
4687                  */
4688                 if (params->supported_channels_len < 2)
4689                         return -EINVAL;
4690                 if (params->supported_channels_len % 2)
4691                         return -EINVAL;
4692         }
4693
4694         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4695                 params->supported_oper_classes =
4696                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4697                 params->supported_oper_classes_len =
4698                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4699                 /*
4700                  * The value of the Length field of the Supported Operating
4701                  * Classes element is between 2 and 253.
4702                  */
4703                 if (params->supported_oper_classes_len < 2 ||
4704                     params->supported_oper_classes_len > 253)
4705                         return -EINVAL;
4706         }
4707         return 0;
4708 }
4709
4710 static int nl80211_set_station_tdls(struct genl_info *info,
4711                                     struct station_parameters *params)
4712 {
4713         int err;
4714         /* Dummy STA entry gets updated once the peer capabilities are known */
4715         if (info->attrs[NL80211_ATTR_PEER_AID])
4716                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4717         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4718                 params->ht_capa =
4719                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4720         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4721                 params->vht_capa =
4722                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4723
4724         err = nl80211_parse_sta_channel_info(info, params);
4725         if (err)
4726                 return err;
4727
4728         return nl80211_parse_sta_wme(info, params);
4729 }
4730
4731 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4732 {
4733         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4734         struct net_device *dev = info->user_ptr[1];
4735         struct station_parameters params;
4736         u8 *mac_addr;
4737         int err;
4738
4739         memset(&params, 0, sizeof(params));
4740
4741         if (!rdev->ops->change_station)
4742                 return -EOPNOTSUPP;
4743
4744         /*
4745          * AID and listen_interval properties can be set only for unassociated
4746          * station. Include these parameters here and will check them in
4747          * cfg80211_check_station_change().
4748          */
4749         if (info->attrs[NL80211_ATTR_STA_AID])
4750                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4751
4752         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4753                 params.listen_interval =
4754                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4755         else
4756                 params.listen_interval = -1;
4757
4758         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4759                 u8 tmp;
4760
4761                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4762                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4763                         return -EINVAL;
4764
4765                 params.support_p2p_ps = tmp;
4766         } else {
4767                 params.support_p2p_ps = -1;
4768         }
4769
4770         if (!info->attrs[NL80211_ATTR_MAC])
4771                 return -EINVAL;
4772
4773         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4774
4775         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4776                 params.supported_rates =
4777                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4778                 params.supported_rates_len =
4779                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4780         }
4781
4782         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4783                 params.capability =
4784                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4785                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4786         }
4787
4788         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4789                 params.ext_capab =
4790                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4791                 params.ext_capab_len =
4792                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4793         }
4794
4795         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4796                 return -EINVAL;
4797
4798         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4799                 params.plink_action =
4800                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4801                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4802                         return -EINVAL;
4803         }
4804
4805         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4806                 params.plink_state =
4807                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4808                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4809                         return -EINVAL;
4810                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4811                         params.peer_aid = nla_get_u16(
4812                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4813                         if (params.peer_aid > IEEE80211_MAX_AID)
4814                                 return -EINVAL;
4815                 }
4816                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4817         }
4818
4819         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4820                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4821                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4822
4823                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4824                     pm > NL80211_MESH_POWER_MAX)
4825                         return -EINVAL;
4826
4827                 params.local_pm = pm;
4828         }
4829
4830         /* Include parameters for TDLS peer (will check later) */
4831         err = nl80211_set_station_tdls(info, &params);
4832         if (err)
4833                 return err;
4834
4835         params.vlan = get_vlan(info, rdev);
4836         if (IS_ERR(params.vlan))
4837                 return PTR_ERR(params.vlan);
4838
4839         switch (dev->ieee80211_ptr->iftype) {
4840         case NL80211_IFTYPE_AP:
4841         case NL80211_IFTYPE_AP_VLAN:
4842         case NL80211_IFTYPE_P2P_GO:
4843         case NL80211_IFTYPE_P2P_CLIENT:
4844         case NL80211_IFTYPE_STATION:
4845         case NL80211_IFTYPE_ADHOC:
4846         case NL80211_IFTYPE_MESH_POINT:
4847                 break;
4848         default:
4849                 err = -EOPNOTSUPP;
4850                 goto out_put_vlan;
4851         }
4852
4853         /* driver will call cfg80211_check_station_change() */
4854         err = rdev_change_station(rdev, dev, mac_addr, &params);
4855
4856  out_put_vlan:
4857         if (params.vlan)
4858                 dev_put(params.vlan);
4859
4860         return err;
4861 }
4862
4863 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4864 {
4865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4866         int err;
4867         struct net_device *dev = info->user_ptr[1];
4868         struct station_parameters params;
4869         u8 *mac_addr = NULL;
4870         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4871                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4872
4873         memset(&params, 0, sizeof(params));
4874
4875         if (!rdev->ops->add_station)
4876                 return -EOPNOTSUPP;
4877
4878         if (!info->attrs[NL80211_ATTR_MAC])
4879                 return -EINVAL;
4880
4881         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4882                 return -EINVAL;
4883
4884         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4885                 return -EINVAL;
4886
4887         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4888             !info->attrs[NL80211_ATTR_PEER_AID])
4889                 return -EINVAL;
4890
4891         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4892         params.supported_rates =
4893                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4894         params.supported_rates_len =
4895                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4896         params.listen_interval =
4897                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4898
4899         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4900                 u8 tmp;
4901
4902                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4903                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4904                         return -EINVAL;
4905
4906                 params.support_p2p_ps = tmp;
4907         } else {
4908                 /*
4909                  * if not specified, assume it's supported for P2P GO interface,
4910                  * and is NOT supported for AP interface
4911                  */
4912                 params.support_p2p_ps =
4913                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4914         }
4915
4916         if (info->attrs[NL80211_ATTR_PEER_AID])
4917                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4918         else
4919                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4920         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4921                 return -EINVAL;
4922
4923         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4924                 params.capability =
4925                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4926                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4927         }
4928
4929         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4930                 params.ext_capab =
4931                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4932                 params.ext_capab_len =
4933                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4934         }
4935
4936         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4937                 params.ht_capa =
4938                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4939
4940         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4941                 params.vht_capa =
4942                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4943
4944         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4945                 params.opmode_notif_used = true;
4946                 params.opmode_notif =
4947                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4948         }
4949
4950         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4951                 params.plink_action =
4952                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4953                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4954                         return -EINVAL;
4955         }
4956
4957         err = nl80211_parse_sta_channel_info(info, &params);
4958         if (err)
4959                 return err;
4960
4961         err = nl80211_parse_sta_wme(info, &params);
4962         if (err)
4963                 return err;
4964
4965         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4966                 return -EINVAL;
4967
4968         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4969          * as userspace might just pass through the capabilities from the IEs
4970          * directly, rather than enforcing this restriction and returning an
4971          * error in this case.
4972          */
4973         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4974                 params.ht_capa = NULL;
4975                 params.vht_capa = NULL;
4976         }
4977
4978         /* When you run into this, adjust the code below for the new flag */
4979         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4980
4981         switch (dev->ieee80211_ptr->iftype) {
4982         case NL80211_IFTYPE_AP:
4983         case NL80211_IFTYPE_AP_VLAN:
4984         case NL80211_IFTYPE_P2P_GO:
4985                 /* ignore WME attributes if iface/sta is not capable */
4986                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4987                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4988                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4989
4990                 /* TDLS peers cannot be added */
4991                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4992                     info->attrs[NL80211_ATTR_PEER_AID])
4993                         return -EINVAL;
4994                 /* but don't bother the driver with it */
4995                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4996
4997                 /* allow authenticated/associated only if driver handles it */
4998                 if (!(rdev->wiphy.features &
4999                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5000                     params.sta_flags_mask & auth_assoc)
5001                         return -EINVAL;
5002
5003                 /* Older userspace, or userspace wanting to be compatible with
5004                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5005                  * and assoc flags in the mask, but assumes the station will be
5006                  * added as associated anyway since this was the required driver
5007                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5008                  * introduced.
5009                  * In order to not bother drivers with this quirk in the API
5010                  * set the flags in both the mask and set for new stations in
5011                  * this case.
5012                  */
5013                 if (!(params.sta_flags_mask & auth_assoc)) {
5014                         params.sta_flags_mask |= auth_assoc;
5015                         params.sta_flags_set |= auth_assoc;
5016                 }
5017
5018                 /* must be last in here for error handling */
5019                 params.vlan = get_vlan(info, rdev);
5020                 if (IS_ERR(params.vlan))
5021                         return PTR_ERR(params.vlan);
5022                 break;
5023         case NL80211_IFTYPE_MESH_POINT:
5024                 /* ignore uAPSD data */
5025                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5026
5027                 /* associated is disallowed */
5028                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5029                         return -EINVAL;
5030                 /* TDLS peers cannot be added */
5031                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5032                     info->attrs[NL80211_ATTR_PEER_AID])
5033                         return -EINVAL;
5034                 break;
5035         case NL80211_IFTYPE_STATION:
5036         case NL80211_IFTYPE_P2P_CLIENT:
5037                 /* ignore uAPSD data */
5038                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5039
5040                 /* these are disallowed */
5041                 if (params.sta_flags_mask &
5042                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5043                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5044                         return -EINVAL;
5045                 /* Only TDLS peers can be added */
5046                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5047                         return -EINVAL;
5048                 /* Can only add if TDLS ... */
5049                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5050                         return -EOPNOTSUPP;
5051                 /* ... with external setup is supported */
5052                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5053                         return -EOPNOTSUPP;
5054                 /*
5055                  * Older wpa_supplicant versions always mark the TDLS peer
5056                  * as authorized, but it shouldn't yet be.
5057                  */
5058                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5059                 break;
5060         default:
5061                 return -EOPNOTSUPP;
5062         }
5063
5064         /* be aware of params.vlan when changing code here */
5065
5066         err = rdev_add_station(rdev, dev, mac_addr, &params);
5067
5068         if (params.vlan)
5069                 dev_put(params.vlan);
5070         return err;
5071 }
5072
5073 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5074 {
5075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5076         struct net_device *dev = info->user_ptr[1];
5077         struct station_del_parameters params;
5078
5079         memset(&params, 0, sizeof(params));
5080
5081         if (info->attrs[NL80211_ATTR_MAC])
5082                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5083
5084         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5085             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5086             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5088                 return -EINVAL;
5089
5090         if (!rdev->ops->del_station)
5091                 return -EOPNOTSUPP;
5092
5093         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5094                 params.subtype =
5095                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5096                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5097                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5098                         return -EINVAL;
5099         } else {
5100                 /* Default to Deauthentication frame */
5101                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5102         }
5103
5104         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5105                 params.reason_code =
5106                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5107                 if (params.reason_code == 0)
5108                         return -EINVAL; /* 0 is reserved */
5109         } else {
5110                 /* Default to reason code 2 */
5111                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5112         }
5113
5114         return rdev_del_station(rdev, dev, &params);
5115 }
5116
5117 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5118                                 int flags, struct net_device *dev,
5119                                 u8 *dst, u8 *next_hop,
5120                                 struct mpath_info *pinfo)
5121 {
5122         void *hdr;
5123         struct nlattr *pinfoattr;
5124
5125         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5126         if (!hdr)
5127                 return -1;
5128
5129         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5130             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5131             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5132             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5133                 goto nla_put_failure;
5134
5135         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5136         if (!pinfoattr)
5137                 goto nla_put_failure;
5138         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5139             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5140                         pinfo->frame_qlen))
5141                 goto nla_put_failure;
5142         if (((pinfo->filled & MPATH_INFO_SN) &&
5143              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5144             ((pinfo->filled & MPATH_INFO_METRIC) &&
5145              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5146                          pinfo->metric)) ||
5147             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5148              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5149                          pinfo->exptime)) ||
5150             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5151              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5152                         pinfo->flags)) ||
5153             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5154              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5155                          pinfo->discovery_timeout)) ||
5156             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5157              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5158                         pinfo->discovery_retries)))
5159                 goto nla_put_failure;
5160
5161         nla_nest_end(msg, pinfoattr);
5162
5163         genlmsg_end(msg, hdr);
5164         return 0;
5165
5166  nla_put_failure:
5167         genlmsg_cancel(msg, hdr);
5168         return -EMSGSIZE;
5169 }
5170
5171 static int nl80211_dump_mpath(struct sk_buff *skb,
5172                               struct netlink_callback *cb)
5173 {
5174         struct mpath_info pinfo;
5175         struct cfg80211_registered_device *rdev;
5176         struct wireless_dev *wdev;
5177         u8 dst[ETH_ALEN];
5178         u8 next_hop[ETH_ALEN];
5179         int path_idx = cb->args[2];
5180         int err;
5181
5182         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5183         if (err)
5184                 return err;
5185
5186         if (!rdev->ops->dump_mpath) {
5187                 err = -EOPNOTSUPP;
5188                 goto out_err;
5189         }
5190
5191         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5192                 err = -EOPNOTSUPP;
5193                 goto out_err;
5194         }
5195
5196         while (1) {
5197                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5198                                       next_hop, &pinfo);
5199                 if (err == -ENOENT)
5200                         break;
5201                 if (err)
5202                         goto out_err;
5203
5204                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5205                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5206                                        wdev->netdev, dst, next_hop,
5207                                        &pinfo) < 0)
5208                         goto out;
5209
5210                 path_idx++;
5211         }
5212
5213  out:
5214         cb->args[2] = path_idx;
5215         err = skb->len;
5216  out_err:
5217         nl80211_finish_wdev_dump(rdev);
5218         return err;
5219 }
5220
5221 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5222 {
5223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5224         int err;
5225         struct net_device *dev = info->user_ptr[1];
5226         struct mpath_info pinfo;
5227         struct sk_buff *msg;
5228         u8 *dst = NULL;
5229         u8 next_hop[ETH_ALEN];
5230
5231         memset(&pinfo, 0, sizeof(pinfo));
5232
5233         if (!info->attrs[NL80211_ATTR_MAC])
5234                 return -EINVAL;
5235
5236         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5237
5238         if (!rdev->ops->get_mpath)
5239                 return -EOPNOTSUPP;
5240
5241         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5242                 return -EOPNOTSUPP;
5243
5244         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5245         if (err)
5246                 return err;
5247
5248         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5249         if (!msg)
5250                 return -ENOMEM;
5251
5252         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5253                                  dev, dst, next_hop, &pinfo) < 0) {
5254                 nlmsg_free(msg);
5255                 return -ENOBUFS;
5256         }
5257
5258         return genlmsg_reply(msg, info);
5259 }
5260
5261 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5262 {
5263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5264         struct net_device *dev = info->user_ptr[1];
5265         u8 *dst = NULL;
5266         u8 *next_hop = NULL;
5267
5268         if (!info->attrs[NL80211_ATTR_MAC])
5269                 return -EINVAL;
5270
5271         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5272                 return -EINVAL;
5273
5274         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5275         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5276
5277         if (!rdev->ops->change_mpath)
5278                 return -EOPNOTSUPP;
5279
5280         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5281                 return -EOPNOTSUPP;
5282
5283         return rdev_change_mpath(rdev, dev, dst, next_hop);
5284 }
5285
5286 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5287 {
5288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5289         struct net_device *dev = info->user_ptr[1];
5290         u8 *dst = NULL;
5291         u8 *next_hop = NULL;
5292
5293         if (!info->attrs[NL80211_ATTR_MAC])
5294                 return -EINVAL;
5295
5296         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5297                 return -EINVAL;
5298
5299         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5300         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5301
5302         if (!rdev->ops->add_mpath)
5303                 return -EOPNOTSUPP;
5304
5305         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5306                 return -EOPNOTSUPP;
5307
5308         return rdev_add_mpath(rdev, dev, dst, next_hop);
5309 }
5310
5311 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5312 {
5313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5314         struct net_device *dev = info->user_ptr[1];
5315         u8 *dst = NULL;
5316
5317         if (info->attrs[NL80211_ATTR_MAC])
5318                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5319
5320         if (!rdev->ops->del_mpath)
5321                 return -EOPNOTSUPP;
5322
5323         return rdev_del_mpath(rdev, dev, dst);
5324 }
5325
5326 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5327 {
5328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329         int err;
5330         struct net_device *dev = info->user_ptr[1];
5331         struct mpath_info pinfo;
5332         struct sk_buff *msg;
5333         u8 *dst = NULL;
5334         u8 mpp[ETH_ALEN];
5335
5336         memset(&pinfo, 0, sizeof(pinfo));
5337
5338         if (!info->attrs[NL80211_ATTR_MAC])
5339                 return -EINVAL;
5340
5341         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5342
5343         if (!rdev->ops->get_mpp)
5344                 return -EOPNOTSUPP;
5345
5346         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5347                 return -EOPNOTSUPP;
5348
5349         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5350         if (err)
5351                 return err;
5352
5353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5354         if (!msg)
5355                 return -ENOMEM;
5356
5357         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5358                                dev, dst, mpp, &pinfo) < 0) {
5359                 nlmsg_free(msg);
5360                 return -ENOBUFS;
5361         }
5362
5363         return genlmsg_reply(msg, info);
5364 }
5365
5366 static int nl80211_dump_mpp(struct sk_buff *skb,
5367                             struct netlink_callback *cb)
5368 {
5369         struct mpath_info pinfo;
5370         struct cfg80211_registered_device *rdev;
5371         struct wireless_dev *wdev;
5372         u8 dst[ETH_ALEN];
5373         u8 mpp[ETH_ALEN];
5374         int path_idx = cb->args[2];
5375         int err;
5376
5377         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5378         if (err)
5379                 return err;
5380
5381         if (!rdev->ops->dump_mpp) {
5382                 err = -EOPNOTSUPP;
5383                 goto out_err;
5384         }
5385
5386         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5387                 err = -EOPNOTSUPP;
5388                 goto out_err;
5389         }
5390
5391         while (1) {
5392                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5393                                     mpp, &pinfo);
5394                 if (err == -ENOENT)
5395                         break;
5396                 if (err)
5397                         goto out_err;
5398
5399                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5400                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5401                                        wdev->netdev, dst, mpp,
5402                                        &pinfo) < 0)
5403                         goto out;
5404
5405                 path_idx++;
5406         }
5407
5408  out:
5409         cb->args[2] = path_idx;
5410         err = skb->len;
5411  out_err:
5412         nl80211_finish_wdev_dump(rdev);
5413         return err;
5414 }
5415
5416 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5417 {
5418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5419         struct net_device *dev = info->user_ptr[1];
5420         struct wireless_dev *wdev = dev->ieee80211_ptr;
5421         struct bss_parameters params;
5422         int err;
5423
5424         memset(&params, 0, sizeof(params));
5425         /* default to not changing parameters */
5426         params.use_cts_prot = -1;
5427         params.use_short_preamble = -1;
5428         params.use_short_slot_time = -1;
5429         params.ap_isolate = -1;
5430         params.ht_opmode = -1;
5431         params.p2p_ctwindow = -1;
5432         params.p2p_opp_ps = -1;
5433
5434         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5435                 params.use_cts_prot =
5436                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5437         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5438                 params.use_short_preamble =
5439                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5440         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5441                 params.use_short_slot_time =
5442                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5443         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5444                 params.basic_rates =
5445                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5446                 params.basic_rates_len =
5447                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5448         }
5449         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5450                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5451         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5452                 params.ht_opmode =
5453                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5454
5455         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5456                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5457                         return -EINVAL;
5458                 params.p2p_ctwindow =
5459                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5460                 if (params.p2p_ctwindow < 0)
5461                         return -EINVAL;
5462                 if (params.p2p_ctwindow != 0 &&
5463                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5464                         return -EINVAL;
5465         }
5466
5467         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5468                 u8 tmp;
5469
5470                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5471                         return -EINVAL;
5472                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5473                 if (tmp > 1)
5474                         return -EINVAL;
5475                 params.p2p_opp_ps = tmp;
5476                 if (params.p2p_opp_ps &&
5477                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5478                         return -EINVAL;
5479         }
5480
5481         if (!rdev->ops->change_bss)
5482                 return -EOPNOTSUPP;
5483
5484         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5485             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5486                 return -EOPNOTSUPP;
5487
5488         wdev_lock(wdev);
5489         err = rdev_change_bss(rdev, dev, &params);
5490         wdev_unlock(wdev);
5491
5492         return err;
5493 }
5494
5495 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5496 {
5497         char *data = NULL;
5498         bool is_indoor;
5499         enum nl80211_user_reg_hint_type user_reg_hint_type;
5500         u32 owner_nlportid;
5501
5502         /*
5503          * You should only get this when cfg80211 hasn't yet initialized
5504          * completely when built-in to the kernel right between the time
5505          * window between nl80211_init() and regulatory_init(), if that is
5506          * even possible.
5507          */
5508         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5509                 return -EINPROGRESS;
5510
5511         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5512                 user_reg_hint_type =
5513                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5514         else
5515                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5516
5517         switch (user_reg_hint_type) {
5518         case NL80211_USER_REG_HINT_USER:
5519         case NL80211_USER_REG_HINT_CELL_BASE:
5520                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5521                         return -EINVAL;
5522
5523                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5524                 return regulatory_hint_user(data, user_reg_hint_type);
5525         case NL80211_USER_REG_HINT_INDOOR:
5526                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5527                         owner_nlportid = info->snd_portid;
5528                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5529                 } else {
5530                         owner_nlportid = 0;
5531                         is_indoor = true;
5532                 }
5533
5534                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5535         default:
5536                 return -EINVAL;
5537         }
5538 }
5539
5540 static int nl80211_get_mesh_config(struct sk_buff *skb,
5541                                    struct genl_info *info)
5542 {
5543         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5544         struct net_device *dev = info->user_ptr[1];
5545         struct wireless_dev *wdev = dev->ieee80211_ptr;
5546         struct mesh_config cur_params;
5547         int err = 0;
5548         void *hdr;
5549         struct nlattr *pinfoattr;
5550         struct sk_buff *msg;
5551
5552         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5553                 return -EOPNOTSUPP;
5554
5555         if (!rdev->ops->get_mesh_config)
5556                 return -EOPNOTSUPP;
5557
5558         wdev_lock(wdev);
5559         /* If not connected, get default parameters */
5560         if (!wdev->mesh_id_len)
5561                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5562         else
5563                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5564         wdev_unlock(wdev);
5565
5566         if (err)
5567                 return err;
5568
5569         /* Draw up a netlink message to send back */
5570         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5571         if (!msg)
5572                 return -ENOMEM;
5573         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5574                              NL80211_CMD_GET_MESH_CONFIG);
5575         if (!hdr)
5576                 goto out;
5577         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5578         if (!pinfoattr)
5579                 goto nla_put_failure;
5580         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5581             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5582                         cur_params.dot11MeshRetryTimeout) ||
5583             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5584                         cur_params.dot11MeshConfirmTimeout) ||
5585             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5586                         cur_params.dot11MeshHoldingTimeout) ||
5587             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5588                         cur_params.dot11MeshMaxPeerLinks) ||
5589             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5590                        cur_params.dot11MeshMaxRetries) ||
5591             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5592                        cur_params.dot11MeshTTL) ||
5593             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5594                        cur_params.element_ttl) ||
5595             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5596                        cur_params.auto_open_plinks) ||
5597             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5598                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5599             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5600                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5601             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5602                         cur_params.path_refresh_time) ||
5603             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5604                         cur_params.min_discovery_timeout) ||
5605             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5606                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5607             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5608                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5609             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5610                         cur_params.dot11MeshHWMPperrMinInterval) ||
5611             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5612                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5613             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5614                        cur_params.dot11MeshHWMPRootMode) ||
5615             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5616                         cur_params.dot11MeshHWMPRannInterval) ||
5617             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5618                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5619             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5620                        cur_params.dot11MeshForwarding) ||
5621             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5622                         cur_params.rssi_threshold) ||
5623             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5624                         cur_params.ht_opmode) ||
5625             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5626                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5627             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5628                         cur_params.dot11MeshHWMProotInterval) ||
5629             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5630                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5631             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5632                         cur_params.power_mode) ||
5633             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5634                         cur_params.dot11MeshAwakeWindowDuration) ||
5635             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5636                         cur_params.plink_timeout))
5637                 goto nla_put_failure;
5638         nla_nest_end(msg, pinfoattr);
5639         genlmsg_end(msg, hdr);
5640         return genlmsg_reply(msg, info);
5641
5642  nla_put_failure:
5643         genlmsg_cancel(msg, hdr);
5644  out:
5645         nlmsg_free(msg);
5646         return -ENOBUFS;
5647 }
5648
5649 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5650         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5651         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5652         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5653         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5654         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5655         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5656         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5657         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5658         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5659         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5660         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5661         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5662         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5663         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5664         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5665         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5666         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5667         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5668         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5669         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5670         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5671         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5672         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5673         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5674         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5675         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5676         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5677         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5678 };
5679
5680 static const struct nla_policy
5681         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5682         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5683         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5684         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5685         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5686         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5687         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5688         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5689                                     .len = IEEE80211_MAX_DATA_LEN },
5690         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5691 };
5692
5693 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5694 {
5695         u8 val = nla_get_u8(nla);
5696         if (val < min || val > max)
5697                 return -EINVAL;
5698         *out = val;
5699         return 0;
5700 }
5701
5702 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5703 {
5704         u8 val = nla_get_u8(nla);
5705         if (val < min || val > max)
5706                 return -EINVAL;
5707         *out = val;
5708         return 0;
5709 }
5710
5711 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5712 {
5713         u16 val = nla_get_u16(nla);
5714         if (val < min || val > max)
5715                 return -EINVAL;
5716         *out = val;
5717         return 0;
5718 }
5719
5720 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5721 {
5722         u32 val = nla_get_u32(nla);
5723         if (val < min || val > max)
5724                 return -EINVAL;
5725         *out = val;
5726         return 0;
5727 }
5728
5729 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5730 {
5731         s32 val = nla_get_s32(nla);
5732         if (val < min || val > max)
5733                 return -EINVAL;
5734         *out = val;
5735         return 0;
5736 }
5737
5738 static int nl80211_check_power_mode(const struct nlattr *nla,
5739                                     enum nl80211_mesh_power_mode min,
5740                                     enum nl80211_mesh_power_mode max,
5741                                     enum nl80211_mesh_power_mode *out)
5742 {
5743         u32 val = nla_get_u32(nla);
5744         if (val < min || val > max)
5745                 return -EINVAL;
5746         *out = val;
5747         return 0;
5748 }
5749
5750 static int nl80211_parse_mesh_config(struct genl_info *info,
5751                                      struct mesh_config *cfg,
5752                                      u32 *mask_out)
5753 {
5754         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5755         u32 mask = 0;
5756         u16 ht_opmode;
5757
5758 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5759 do {                                                                        \
5760         if (tb[attr]) {                                                     \
5761                 if (fn(tb[attr], min, max, &cfg->param))                    \
5762                         return -EINVAL;                                     \
5763                 mask |= (1 << (attr - 1));                                  \
5764         }                                                                   \
5765 } while (0)
5766
5767         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5768                 return -EINVAL;
5769         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5770                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5771                              nl80211_meshconf_params_policy))
5772                 return -EINVAL;
5773
5774         /* This makes sure that there aren't more than 32 mesh config
5775          * parameters (otherwise our bitfield scheme would not work.) */
5776         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5777
5778         /* Fill in the params struct */
5779         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5780                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5781                                   nl80211_check_u16);
5782         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5783                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5784                                   nl80211_check_u16);
5785         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5786                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5787                                   nl80211_check_u16);
5788         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5789                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5790                                   nl80211_check_u16);
5791         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5792                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5793                                   nl80211_check_u8);
5794         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5795                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5796         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5797                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5798                                   nl80211_check_u8);
5799         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5800                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5801                                   nl80211_check_bool);
5802         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5803                                   1, 255, mask,
5804                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5805                                   nl80211_check_u32);
5806         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5807                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5808                                   nl80211_check_u8);
5809         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5810                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5811                                   nl80211_check_u32);
5812         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5813                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5814                                   nl80211_check_u16);
5815         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5816                                   1, 65535, mask,
5817                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5818                                   nl80211_check_u32);
5819         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5820                                   1, 65535, mask,
5821                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5822                                   nl80211_check_u16);
5823         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5824                                   1, 65535, mask,
5825                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5826                                   nl80211_check_u16);
5827         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5828                                   dot11MeshHWMPnetDiameterTraversalTime,
5829                                   1, 65535, mask,
5830                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5831                                   nl80211_check_u16);
5832         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5833                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5834                                   nl80211_check_u8);
5835         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5836                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5837                                   nl80211_check_u16);
5838         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5839                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5840                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5841                                   nl80211_check_bool);
5842         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5843                                   mask, NL80211_MESHCONF_FORWARDING,
5844                                   nl80211_check_bool);
5845         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5846                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5847                                   nl80211_check_s32);
5848         /*
5849          * Check HT operation mode based on
5850          * IEEE 802.11 2012 8.4.2.59 HT Operation element.
5851          */
5852         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5853                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5854
5855                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5856                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5857                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5858                         return -EINVAL;
5859
5860                 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
5861                     (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5862                         return -EINVAL;
5863
5864                 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
5865                 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
5866                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
5867                         if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
5868                                 return -EINVAL;
5869                         break;
5870                 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
5871                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
5872                         if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5873                                 return -EINVAL;
5874                         break;
5875                 }
5876                 cfg->ht_opmode = ht_opmode;
5877         }
5878         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5879                                   1, 65535, mask,
5880                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5881                                   nl80211_check_u32);
5882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5883                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5884                                   nl80211_check_u16);
5885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5886                                   dot11MeshHWMPconfirmationInterval,
5887                                   1, 65535, mask,
5888                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5889                                   nl80211_check_u16);
5890         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5891                                   NL80211_MESH_POWER_ACTIVE,
5892                                   NL80211_MESH_POWER_MAX,
5893                                   mask, NL80211_MESHCONF_POWER_MODE,
5894                                   nl80211_check_power_mode);
5895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5896                                   0, 65535, mask,
5897                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
5898         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5899                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5900                                   nl80211_check_u32);
5901         if (mask_out)
5902                 *mask_out = mask;
5903
5904         return 0;
5905
5906 #undef FILL_IN_MESH_PARAM_IF_SET
5907 }
5908
5909 static int nl80211_parse_mesh_setup(struct genl_info *info,
5910                                      struct mesh_setup *setup)
5911 {
5912         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5913         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5914
5915         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5916                 return -EINVAL;
5917         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5918                              info->attrs[NL80211_ATTR_MESH_SETUP],
5919                              nl80211_mesh_setup_params_policy))
5920                 return -EINVAL;
5921
5922         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5923                 setup->sync_method =
5924                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5925                  IEEE80211_SYNC_METHOD_VENDOR :
5926                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5927
5928         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5929                 setup->path_sel_proto =
5930                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5931                  IEEE80211_PATH_PROTOCOL_VENDOR :
5932                  IEEE80211_PATH_PROTOCOL_HWMP;
5933
5934         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5935                 setup->path_metric =
5936                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5937                  IEEE80211_PATH_METRIC_VENDOR :
5938                  IEEE80211_PATH_METRIC_AIRTIME;
5939
5940         if (tb[NL80211_MESH_SETUP_IE]) {
5941                 struct nlattr *ieattr =
5942                         tb[NL80211_MESH_SETUP_IE];
5943                 if (!is_valid_ie_attr(ieattr))
5944                         return -EINVAL;
5945                 setup->ie = nla_data(ieattr);
5946                 setup->ie_len = nla_len(ieattr);
5947         }
5948         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5949             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5950                 return -EINVAL;
5951         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5952         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5953         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5954         if (setup->is_secure)
5955                 setup->user_mpm = true;
5956
5957         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5958                 if (!setup->user_mpm)
5959                         return -EINVAL;
5960                 setup->auth_id =
5961                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5962         }
5963
5964         return 0;
5965 }
5966
5967 static int nl80211_update_mesh_config(struct sk_buff *skb,
5968                                       struct genl_info *info)
5969 {
5970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5971         struct net_device *dev = info->user_ptr[1];
5972         struct wireless_dev *wdev = dev->ieee80211_ptr;
5973         struct mesh_config cfg;
5974         u32 mask;
5975         int err;
5976
5977         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5978                 return -EOPNOTSUPP;
5979
5980         if (!rdev->ops->update_mesh_config)
5981                 return -EOPNOTSUPP;
5982
5983         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5984         if (err)
5985                 return err;
5986
5987         wdev_lock(wdev);
5988         if (!wdev->mesh_id_len)
5989                 err = -ENOLINK;
5990
5991         if (!err)
5992                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5993
5994         wdev_unlock(wdev);
5995
5996         return err;
5997 }
5998
5999 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6000                               struct sk_buff *msg)
6001 {
6002         struct nlattr *nl_reg_rules;
6003         unsigned int i;
6004
6005         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6006             (regdom->dfs_region &&
6007              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6008                 goto nla_put_failure;
6009
6010         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6011         if (!nl_reg_rules)
6012                 goto nla_put_failure;
6013
6014         for (i = 0; i < regdom->n_reg_rules; i++) {
6015                 struct nlattr *nl_reg_rule;
6016                 const struct ieee80211_reg_rule *reg_rule;
6017                 const struct ieee80211_freq_range *freq_range;
6018                 const struct ieee80211_power_rule *power_rule;
6019                 unsigned int max_bandwidth_khz;
6020
6021                 reg_rule = &regdom->reg_rules[i];
6022                 freq_range = &reg_rule->freq_range;
6023                 power_rule = &reg_rule->power_rule;
6024
6025                 nl_reg_rule = nla_nest_start(msg, i);
6026                 if (!nl_reg_rule)
6027                         goto nla_put_failure;
6028
6029                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6030                 if (!max_bandwidth_khz)
6031                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6032                                                                   reg_rule);
6033
6034                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6035                                 reg_rule->flags) ||
6036                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6037                                 freq_range->start_freq_khz) ||
6038                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6039                                 freq_range->end_freq_khz) ||
6040                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6041                                 max_bandwidth_khz) ||
6042                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6043                                 power_rule->max_antenna_gain) ||
6044                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6045                                 power_rule->max_eirp) ||
6046                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6047                                 reg_rule->dfs_cac_ms))
6048                         goto nla_put_failure;
6049
6050                 nla_nest_end(msg, nl_reg_rule);
6051         }
6052
6053         nla_nest_end(msg, nl_reg_rules);
6054         return 0;
6055
6056 nla_put_failure:
6057         return -EMSGSIZE;
6058 }
6059
6060 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6061 {
6062         const struct ieee80211_regdomain *regdom = NULL;
6063         struct cfg80211_registered_device *rdev;
6064         struct wiphy *wiphy = NULL;
6065         struct sk_buff *msg;
6066         void *hdr;
6067
6068         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6069         if (!msg)
6070                 return -ENOBUFS;
6071
6072         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6073                              NL80211_CMD_GET_REG);
6074         if (!hdr)
6075                 goto put_failure;
6076
6077         if (info->attrs[NL80211_ATTR_WIPHY]) {
6078                 bool self_managed;
6079
6080                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6081                 if (IS_ERR(rdev)) {
6082                         nlmsg_free(msg);
6083                         return PTR_ERR(rdev);
6084                 }
6085
6086                 wiphy = &rdev->wiphy;
6087                 self_managed = wiphy->regulatory_flags &
6088                                REGULATORY_WIPHY_SELF_MANAGED;
6089                 regdom = get_wiphy_regdom(wiphy);
6090
6091                 /* a self-managed-reg device must have a private regdom */
6092                 if (WARN_ON(!regdom && self_managed)) {
6093                         nlmsg_free(msg);
6094                         return -EINVAL;
6095                 }
6096
6097                 if (regdom &&
6098                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6099                         goto nla_put_failure;
6100         }
6101
6102         if (!wiphy && reg_last_request_cell_base() &&
6103             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6104                         NL80211_USER_REG_HINT_CELL_BASE))
6105                 goto nla_put_failure;
6106
6107         rcu_read_lock();
6108
6109         if (!regdom)
6110                 regdom = rcu_dereference(cfg80211_regdomain);
6111
6112         if (nl80211_put_regdom(regdom, msg))
6113                 goto nla_put_failure_rcu;
6114
6115         rcu_read_unlock();
6116
6117         genlmsg_end(msg, hdr);
6118         return genlmsg_reply(msg, info);
6119
6120 nla_put_failure_rcu:
6121         rcu_read_unlock();
6122 nla_put_failure:
6123         genlmsg_cancel(msg, hdr);
6124 put_failure:
6125         nlmsg_free(msg);
6126         return -EMSGSIZE;
6127 }
6128
6129 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6130                                u32 seq, int flags, struct wiphy *wiphy,
6131                                const struct ieee80211_regdomain *regdom)
6132 {
6133         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6134                                    NL80211_CMD_GET_REG);
6135
6136         if (!hdr)
6137                 return -1;
6138
6139         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6140
6141         if (nl80211_put_regdom(regdom, msg))
6142                 goto nla_put_failure;
6143
6144         if (!wiphy && reg_last_request_cell_base() &&
6145             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6146                         NL80211_USER_REG_HINT_CELL_BASE))
6147                 goto nla_put_failure;
6148
6149         if (wiphy &&
6150             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6151                 goto nla_put_failure;
6152
6153         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6154             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6155                 goto nla_put_failure;
6156
6157         genlmsg_end(msg, hdr);
6158         return 0;
6159
6160 nla_put_failure:
6161         genlmsg_cancel(msg, hdr);
6162         return -EMSGSIZE;
6163 }
6164
6165 static int nl80211_get_reg_dump(struct sk_buff *skb,
6166                                 struct netlink_callback *cb)
6167 {
6168         const struct ieee80211_regdomain *regdom = NULL;
6169         struct cfg80211_registered_device *rdev;
6170         int err, reg_idx, start = cb->args[2];
6171
6172         rtnl_lock();
6173
6174         if (cfg80211_regdomain && start == 0) {
6175                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6176                                           NLM_F_MULTI, NULL,
6177                                           rtnl_dereference(cfg80211_regdomain));
6178                 if (err < 0)
6179                         goto out_err;
6180         }
6181
6182         /* the global regdom is idx 0 */
6183         reg_idx = 1;
6184         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6185                 regdom = get_wiphy_regdom(&rdev->wiphy);
6186                 if (!regdom)
6187                         continue;
6188
6189                 if (++reg_idx <= start)
6190                         continue;
6191
6192                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6193                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6194                 if (err < 0) {
6195                         reg_idx--;
6196                         break;
6197                 }
6198         }
6199
6200         cb->args[2] = reg_idx;
6201         err = skb->len;
6202 out_err:
6203         rtnl_unlock();
6204         return err;
6205 }
6206
6207 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6208 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6209         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6210         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6211         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6212         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6213         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6214         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6215         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6216 };
6217
6218 static int parse_reg_rule(struct nlattr *tb[],
6219         struct ieee80211_reg_rule *reg_rule)
6220 {
6221         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6222         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6223
6224         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6225                 return -EINVAL;
6226         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6227                 return -EINVAL;
6228         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6229                 return -EINVAL;
6230         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6231                 return -EINVAL;
6232         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6233                 return -EINVAL;
6234
6235         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6236
6237         freq_range->start_freq_khz =
6238                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6239         freq_range->end_freq_khz =
6240                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6241         freq_range->max_bandwidth_khz =
6242                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6243
6244         power_rule->max_eirp =
6245                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6246
6247         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6248                 power_rule->max_antenna_gain =
6249                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6250
6251         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6252                 reg_rule->dfs_cac_ms =
6253                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6254
6255         return 0;
6256 }
6257
6258 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6259 {
6260         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6261         struct nlattr *nl_reg_rule;
6262         char *alpha2;
6263         int rem_reg_rules, r;
6264         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6265         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6266         struct ieee80211_regdomain *rd;
6267
6268         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6269                 return -EINVAL;
6270
6271         if (!info->attrs[NL80211_ATTR_REG_RULES])
6272                 return -EINVAL;
6273
6274         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6275
6276         if (info->attrs[NL80211_ATTR_DFS_REGION])
6277                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6278
6279         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6280                             rem_reg_rules) {
6281                 num_rules++;
6282                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6283                         return -EINVAL;
6284         }
6285
6286         if (!reg_is_valid_request(alpha2))
6287                 return -EINVAL;
6288
6289         size_of_regd = sizeof(struct ieee80211_regdomain) +
6290                        num_rules * sizeof(struct ieee80211_reg_rule);
6291
6292         rd = kzalloc(size_of_regd, GFP_KERNEL);
6293         if (!rd)
6294                 return -ENOMEM;
6295
6296         rd->n_reg_rules = num_rules;
6297         rd->alpha2[0] = alpha2[0];
6298         rd->alpha2[1] = alpha2[1];
6299
6300         /*
6301          * Disable DFS master mode if the DFS region was
6302          * not supported or known on this kernel.
6303          */
6304         if (reg_supported_dfs_region(dfs_region))
6305                 rd->dfs_region = dfs_region;
6306
6307         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6308                             rem_reg_rules) {
6309                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
6310                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
6311                               reg_rule_policy);
6312                 if (r)
6313                         goto bad_reg;
6314                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6315                 if (r)
6316                         goto bad_reg;
6317
6318                 rule_idx++;
6319
6320                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6321                         r = -EINVAL;
6322                         goto bad_reg;
6323                 }
6324         }
6325
6326         /* set_regdom takes ownership of rd */
6327         return set_regdom(rd, REGD_SOURCE_CRDA);
6328  bad_reg:
6329         kfree(rd);
6330         return r;
6331 }
6332 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6333
6334 static int validate_scan_freqs(struct nlattr *freqs)
6335 {
6336         struct nlattr *attr1, *attr2;
6337         int n_channels = 0, tmp1, tmp2;
6338
6339         nla_for_each_nested(attr1, freqs, tmp1) {
6340                 n_channels++;
6341                 /*
6342                  * Some hardware has a limited channel list for
6343                  * scanning, and it is pretty much nonsensical
6344                  * to scan for a channel twice, so disallow that
6345                  * and don't require drivers to check that the
6346                  * channel list they get isn't longer than what
6347                  * they can scan, as long as they can scan all
6348                  * the channels they registered at once.
6349                  */
6350                 nla_for_each_nested(attr2, freqs, tmp2)
6351                         if (attr1 != attr2 &&
6352                             nla_get_u32(attr1) == nla_get_u32(attr2))
6353                                 return 0;
6354         }
6355
6356         return n_channels;
6357 }
6358
6359 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6360 {
6361         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6362 }
6363
6364 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6365                             struct cfg80211_bss_selection *bss_select)
6366 {
6367         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6368         struct nlattr *nest;
6369         int err;
6370         bool found = false;
6371         int i;
6372
6373         /* only process one nested attribute */
6374         nest = nla_data(nla);
6375         if (!nla_ok(nest, nla_len(nest)))
6376                 return -EINVAL;
6377
6378         err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
6379                         nla_len(nest), nl80211_bss_select_policy);
6380         if (err)
6381                 return err;
6382
6383         /* only one attribute may be given */
6384         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6385                 if (attr[i]) {
6386                         if (found)
6387                                 return -EINVAL;
6388                         found = true;
6389                 }
6390         }
6391
6392         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6393
6394         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6395                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6396
6397         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6398                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6399                 bss_select->param.band_pref =
6400                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6401                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6402                         return -EINVAL;
6403         }
6404
6405         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6406                 struct nl80211_bss_select_rssi_adjust *adj_param;
6407
6408                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6409                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6410                 bss_select->param.adjust.band = adj_param->band;
6411                 bss_select->param.adjust.delta = adj_param->delta;
6412                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6413                         return -EINVAL;
6414         }
6415
6416         /* user-space did not provide behaviour attribute */
6417         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6418                 return -EINVAL;
6419
6420         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6421                 return -EINVAL;
6422
6423         return 0;
6424 }
6425
6426 static int nl80211_parse_random_mac(struct nlattr **attrs,
6427                                     u8 *mac_addr, u8 *mac_addr_mask)
6428 {
6429         int i;
6430
6431         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6432                 eth_zero_addr(mac_addr);
6433                 eth_zero_addr(mac_addr_mask);
6434                 mac_addr[0] = 0x2;
6435                 mac_addr_mask[0] = 0x3;
6436
6437                 return 0;
6438         }
6439
6440         /* need both or none */
6441         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6442                 return -EINVAL;
6443
6444         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6445         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6446
6447         /* don't allow or configure an mcast address */
6448         if (!is_multicast_ether_addr(mac_addr_mask) ||
6449             is_multicast_ether_addr(mac_addr))
6450                 return -EINVAL;
6451
6452         /*
6453          * allow users to pass a MAC address that has bits set outside
6454          * of the mask, but don't bother drivers with having to deal
6455          * with such bits
6456          */
6457         for (i = 0; i < ETH_ALEN; i++)
6458                 mac_addr[i] &= mac_addr_mask[i];
6459
6460         return 0;
6461 }
6462
6463 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6464 {
6465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6466         struct wireless_dev *wdev = info->user_ptr[1];
6467         struct cfg80211_scan_request *request;
6468         struct nlattr *attr;
6469         struct wiphy *wiphy;
6470         int err, tmp, n_ssids = 0, n_channels, i;
6471         size_t ie_len;
6472
6473         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6474                 return -EINVAL;
6475
6476         wiphy = &rdev->wiphy;
6477
6478         if (wdev->iftype == NL80211_IFTYPE_NAN)
6479                 return -EOPNOTSUPP;
6480
6481         if (!rdev->ops->scan)
6482                 return -EOPNOTSUPP;
6483
6484         if (rdev->scan_req || rdev->scan_msg) {
6485                 err = -EBUSY;
6486                 goto unlock;
6487         }
6488
6489         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6490                 n_channels = validate_scan_freqs(
6491                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6492                 if (!n_channels) {
6493                         err = -EINVAL;
6494                         goto unlock;
6495                 }
6496         } else {
6497                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6498         }
6499
6500         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6501                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6502                         n_ssids++;
6503
6504         if (n_ssids > wiphy->max_scan_ssids) {
6505                 err = -EINVAL;
6506                 goto unlock;
6507         }
6508
6509         if (info->attrs[NL80211_ATTR_IE])
6510                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6511         else
6512                 ie_len = 0;
6513
6514         if (ie_len > wiphy->max_scan_ie_len) {
6515                 err = -EINVAL;
6516                 goto unlock;
6517         }
6518
6519         request = kzalloc(sizeof(*request)
6520                         + sizeof(*request->ssids) * n_ssids
6521                         + sizeof(*request->channels) * n_channels
6522                         + ie_len, GFP_KERNEL);
6523         if (!request) {
6524                 err = -ENOMEM;
6525                 goto unlock;
6526         }
6527
6528         if (n_ssids)
6529                 request->ssids = (void *)&request->channels[n_channels];
6530         request->n_ssids = n_ssids;
6531         if (ie_len) {
6532                 if (n_ssids)
6533                         request->ie = (void *)(request->ssids + n_ssids);
6534                 else
6535                         request->ie = (void *)(request->channels + n_channels);
6536         }
6537
6538         i = 0;
6539         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6540                 /* user specified, bail out if channel not found */
6541                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6542                         struct ieee80211_channel *chan;
6543
6544                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6545
6546                         if (!chan) {
6547                                 err = -EINVAL;
6548                                 goto out_free;
6549                         }
6550
6551                         /* ignore disabled channels */
6552                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6553                                 continue;
6554
6555                         request->channels[i] = chan;
6556                         i++;
6557                 }
6558         } else {
6559                 enum nl80211_band band;
6560
6561                 /* all channels */
6562                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6563                         int j;
6564
6565                         if (!wiphy->bands[band])
6566                                 continue;
6567                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6568                                 struct ieee80211_channel *chan;
6569
6570                                 chan = &wiphy->bands[band]->channels[j];
6571
6572                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6573                                         continue;
6574
6575                                 request->channels[i] = chan;
6576                                 i++;
6577                         }
6578                 }
6579         }
6580
6581         if (!i) {
6582                 err = -EINVAL;
6583                 goto out_free;
6584         }
6585
6586         request->n_channels = i;
6587
6588         i = 0;
6589         if (n_ssids) {
6590                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6591                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6592                                 err = -EINVAL;
6593                                 goto out_free;
6594                         }
6595                         request->ssids[i].ssid_len = nla_len(attr);
6596                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6597                         i++;
6598                 }
6599         }
6600
6601         if (info->attrs[NL80211_ATTR_IE]) {
6602                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6603                 memcpy((void *)request->ie,
6604                        nla_data(info->attrs[NL80211_ATTR_IE]),
6605                        request->ie_len);
6606         }
6607
6608         for (i = 0; i < NUM_NL80211_BANDS; i++)
6609                 if (wiphy->bands[i])
6610                         request->rates[i] =
6611                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6612
6613         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6614                 nla_for_each_nested(attr,
6615                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6616                                     tmp) {
6617                         enum nl80211_band band = nla_type(attr);
6618
6619                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6620                                 err = -EINVAL;
6621                                 goto out_free;
6622                         }
6623
6624                         if (!wiphy->bands[band])
6625                                 continue;
6626
6627                         err = ieee80211_get_ratemask(wiphy->bands[band],
6628                                                      nla_data(attr),
6629                                                      nla_len(attr),
6630                                                      &request->rates[band]);
6631                         if (err)
6632                                 goto out_free;
6633                 }
6634         }
6635
6636         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6637                 if (!wiphy_ext_feature_isset(wiphy,
6638                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6639                         err = -EOPNOTSUPP;
6640                         goto out_free;
6641                 }
6642
6643                 request->duration =
6644                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6645                 request->duration_mandatory =
6646                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6647         }
6648
6649         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6650                 request->flags = nla_get_u32(
6651                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6652                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6653                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6654                         err = -EOPNOTSUPP;
6655                         goto out_free;
6656                 }
6657
6658                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6659                         if (!(wiphy->features &
6660                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6661                                 err = -EOPNOTSUPP;
6662                                 goto out_free;
6663                         }
6664
6665                         if (wdev->current_bss) {
6666                                 err = -EOPNOTSUPP;
6667                                 goto out_free;
6668                         }
6669
6670                         err = nl80211_parse_random_mac(info->attrs,
6671                                                        request->mac_addr,
6672                                                        request->mac_addr_mask);
6673                         if (err)
6674                                 goto out_free;
6675                 }
6676         }
6677
6678         request->no_cck =
6679                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6680
6681         if (info->attrs[NL80211_ATTR_MAC])
6682                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6683                        ETH_ALEN);
6684         else
6685                 eth_broadcast_addr(request->bssid);
6686
6687         request->wdev = wdev;
6688         request->wiphy = &rdev->wiphy;
6689         request->scan_start = jiffies;
6690
6691         rdev->scan_req = request;
6692         err = rdev_scan(rdev, request);
6693
6694         if (!err) {
6695                 nl80211_send_scan_start(rdev, wdev);
6696                 if (wdev->netdev)
6697                         dev_hold(wdev->netdev);
6698         } else {
6699  out_free:
6700                 rdev->scan_req = NULL;
6701                 kfree(request);
6702         }
6703
6704  unlock:
6705         return err;
6706 }
6707
6708 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6709 {
6710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6711         struct wireless_dev *wdev = info->user_ptr[1];
6712
6713         if (!rdev->ops->abort_scan)
6714                 return -EOPNOTSUPP;
6715
6716         if (rdev->scan_msg)
6717                 return 0;
6718
6719         if (!rdev->scan_req)
6720                 return -ENOENT;
6721
6722         rdev_abort_scan(rdev, wdev);
6723         return 0;
6724 }
6725
6726 static int
6727 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6728                                struct cfg80211_sched_scan_request *request,
6729                                struct nlattr **attrs)
6730 {
6731         int tmp, err, i = 0;
6732         struct nlattr *attr;
6733
6734         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6735                 u32 interval;
6736
6737                 /*
6738                  * If scan plans are not specified,
6739                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6740                  * case one scan plan will be set with the specified scan
6741                  * interval and infinite number of iterations.
6742                  */
6743                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6744                         return -EINVAL;
6745
6746                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6747                 if (!interval)
6748                         return -EINVAL;
6749
6750                 request->scan_plans[0].interval =
6751                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6752                 if (!request->scan_plans[0].interval)
6753                         return -EINVAL;
6754
6755                 if (request->scan_plans[0].interval >
6756                     wiphy->max_sched_scan_plan_interval)
6757                         request->scan_plans[0].interval =
6758                                 wiphy->max_sched_scan_plan_interval;
6759
6760                 return 0;
6761         }
6762
6763         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6764                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6765
6766                 if (WARN_ON(i >= n_plans))
6767                         return -EINVAL;
6768
6769                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6770                                 nla_data(attr), nla_len(attr),
6771                                 nl80211_plan_policy);
6772                 if (err)
6773                         return err;
6774
6775                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6776                         return -EINVAL;
6777
6778                 request->scan_plans[i].interval =
6779                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6780                 if (!request->scan_plans[i].interval ||
6781                     request->scan_plans[i].interval >
6782                     wiphy->max_sched_scan_plan_interval)
6783                         return -EINVAL;
6784
6785                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6786                         request->scan_plans[i].iterations =
6787                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6788                         if (!request->scan_plans[i].iterations ||
6789                             (request->scan_plans[i].iterations >
6790                              wiphy->max_sched_scan_plan_iterations))
6791                                 return -EINVAL;
6792                 } else if (i < n_plans - 1) {
6793                         /*
6794                          * All scan plans but the last one must specify
6795                          * a finite number of iterations
6796                          */
6797                         return -EINVAL;
6798                 }
6799
6800                 i++;
6801         }
6802
6803         /*
6804          * The last scan plan must not specify the number of
6805          * iterations, it is supposed to run infinitely
6806          */
6807         if (request->scan_plans[n_plans - 1].iterations)
6808                 return  -EINVAL;
6809
6810         return 0;
6811 }
6812
6813 static struct cfg80211_sched_scan_request *
6814 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6815                          struct nlattr **attrs)
6816 {
6817         struct cfg80211_sched_scan_request *request;
6818         struct nlattr *attr;
6819         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6820         enum nl80211_band band;
6821         size_t ie_len;
6822         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6823         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6824
6825         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6826                 return ERR_PTR(-EINVAL);
6827
6828         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6829                 n_channels = validate_scan_freqs(
6830                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6831                 if (!n_channels)
6832                         return ERR_PTR(-EINVAL);
6833         } else {
6834                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6835         }
6836
6837         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6838                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6839                                     tmp)
6840                         n_ssids++;
6841
6842         if (n_ssids > wiphy->max_sched_scan_ssids)
6843                 return ERR_PTR(-EINVAL);
6844
6845         /*
6846          * First, count the number of 'real' matchsets. Due to an issue with
6847          * the old implementation, matchsets containing only the RSSI attribute
6848          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6849          * RSSI for all matchsets, rather than their own matchset for reporting
6850          * all APs with a strong RSSI. This is needed to be compatible with
6851          * older userspace that treated a matchset with only the RSSI as the
6852          * global RSSI for all other matchsets - if there are other matchsets.
6853          */
6854         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6855                 nla_for_each_nested(attr,
6856                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6857                                     tmp) {
6858                         struct nlattr *rssi;
6859
6860                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6861                                         nla_data(attr), nla_len(attr),
6862                                         nl80211_match_policy);
6863                         if (err)
6864                                 return ERR_PTR(err);
6865                         /* add other standalone attributes here */
6866                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6867                                 n_match_sets++;
6868                                 continue;
6869                         }
6870                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6871                         if (rssi)
6872                                 default_match_rssi = nla_get_s32(rssi);
6873                 }
6874         }
6875
6876         /* However, if there's no other matchset, add the RSSI one */
6877         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6878                 n_match_sets = 1;
6879
6880         if (n_match_sets > wiphy->max_match_sets)
6881                 return ERR_PTR(-EINVAL);
6882
6883         if (attrs[NL80211_ATTR_IE])
6884                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6885         else
6886                 ie_len = 0;
6887
6888         if (ie_len > wiphy->max_sched_scan_ie_len)
6889                 return ERR_PTR(-EINVAL);
6890
6891         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6892                 /*
6893                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6894                  * each scan plan already specifies its own interval
6895                  */
6896                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6897                         return ERR_PTR(-EINVAL);
6898
6899                 nla_for_each_nested(attr,
6900                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6901                         n_plans++;
6902         } else {
6903                 /*
6904                  * The scan interval attribute is kept for backward
6905                  * compatibility. If no scan plans are specified and sched scan
6906                  * interval is specified, one scan plan will be set with this
6907                  * scan interval and infinite number of iterations.
6908                  */
6909                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6910                         return ERR_PTR(-EINVAL);
6911
6912                 n_plans = 1;
6913         }
6914
6915         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6916                 return ERR_PTR(-EINVAL);
6917
6918         request = kzalloc(sizeof(*request)
6919                         + sizeof(*request->ssids) * n_ssids
6920                         + sizeof(*request->match_sets) * n_match_sets
6921                         + sizeof(*request->scan_plans) * n_plans
6922                         + sizeof(*request->channels) * n_channels
6923                         + ie_len, GFP_KERNEL);
6924         if (!request)
6925                 return ERR_PTR(-ENOMEM);
6926
6927         if (n_ssids)
6928                 request->ssids = (void *)&request->channels[n_channels];
6929         request->n_ssids = n_ssids;
6930         if (ie_len) {
6931                 if (n_ssids)
6932                         request->ie = (void *)(request->ssids + n_ssids);
6933                 else
6934                         request->ie = (void *)(request->channels + n_channels);
6935         }
6936
6937         if (n_match_sets) {
6938                 if (request->ie)
6939                         request->match_sets = (void *)(request->ie + ie_len);
6940                 else if (n_ssids)
6941                         request->match_sets =
6942                                 (void *)(request->ssids + n_ssids);
6943                 else
6944                         request->match_sets =
6945                                 (void *)(request->channels + n_channels);
6946         }
6947         request->n_match_sets = n_match_sets;
6948
6949         if (n_match_sets)
6950                 request->scan_plans = (void *)(request->match_sets +
6951                                                n_match_sets);
6952         else if (request->ie)
6953                 request->scan_plans = (void *)(request->ie + ie_len);
6954         else if (n_ssids)
6955                 request->scan_plans = (void *)(request->ssids + n_ssids);
6956         else
6957                 request->scan_plans = (void *)(request->channels + n_channels);
6958
6959         request->n_scan_plans = n_plans;
6960
6961         i = 0;
6962         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6963                 /* user specified, bail out if channel not found */
6964                 nla_for_each_nested(attr,
6965                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6966                                     tmp) {
6967                         struct ieee80211_channel *chan;
6968
6969                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6970
6971                         if (!chan) {
6972                                 err = -EINVAL;
6973                                 goto out_free;
6974                         }
6975
6976                         /* ignore disabled channels */
6977                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6978                                 continue;
6979
6980                         request->channels[i] = chan;
6981                         i++;
6982                 }
6983         } else {
6984                 /* all channels */
6985                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6986                         int j;
6987
6988                         if (!wiphy->bands[band])
6989                                 continue;
6990                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6991                                 struct ieee80211_channel *chan;
6992
6993                                 chan = &wiphy->bands[band]->channels[j];
6994
6995                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6996                                         continue;
6997
6998                                 request->channels[i] = chan;
6999                                 i++;
7000                         }
7001                 }
7002         }
7003
7004         if (!i) {
7005                 err = -EINVAL;
7006                 goto out_free;
7007         }
7008
7009         request->n_channels = i;
7010
7011         i = 0;
7012         if (n_ssids) {
7013                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7014                                     tmp) {
7015                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7016                                 err = -EINVAL;
7017                                 goto out_free;
7018                         }
7019                         request->ssids[i].ssid_len = nla_len(attr);
7020                         memcpy(request->ssids[i].ssid, nla_data(attr),
7021                                nla_len(attr));
7022                         i++;
7023                 }
7024         }
7025
7026         i = 0;
7027         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7028                 nla_for_each_nested(attr,
7029                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7030                                     tmp) {
7031                         struct nlattr *ssid, *rssi;
7032
7033                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7034                                         nla_data(attr), nla_len(attr),
7035                                         nl80211_match_policy);
7036                         if (err)
7037                                 goto out_free;
7038                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7039                         if (ssid) {
7040                                 if (WARN_ON(i >= n_match_sets)) {
7041                                         /* this indicates a programming error,
7042                                          * the loop above should have verified
7043                                          * things properly
7044                                          */
7045                                         err = -EINVAL;
7046                                         goto out_free;
7047                                 }
7048
7049                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7050                                         err = -EINVAL;
7051                                         goto out_free;
7052                                 }
7053                                 memcpy(request->match_sets[i].ssid.ssid,
7054                                        nla_data(ssid), nla_len(ssid));
7055                                 request->match_sets[i].ssid.ssid_len =
7056                                         nla_len(ssid);
7057                                 /* special attribute - old implementation w/a */
7058                                 request->match_sets[i].rssi_thold =
7059                                         default_match_rssi;
7060                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7061                                 if (rssi)
7062                                         request->match_sets[i].rssi_thold =
7063                                                 nla_get_s32(rssi);
7064                         }
7065                         i++;
7066                 }
7067
7068                 /* there was no other matchset, so the RSSI one is alone */
7069                 if (i == 0 && n_match_sets)
7070                         request->match_sets[0].rssi_thold = default_match_rssi;
7071
7072                 request->min_rssi_thold = INT_MAX;
7073                 for (i = 0; i < n_match_sets; i++)
7074                         request->min_rssi_thold =
7075                                 min(request->match_sets[i].rssi_thold,
7076                                     request->min_rssi_thold);
7077         } else {
7078                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7079         }
7080
7081         if (ie_len) {
7082                 request->ie_len = ie_len;
7083                 memcpy((void *)request->ie,
7084                        nla_data(attrs[NL80211_ATTR_IE]),
7085                        request->ie_len);
7086         }
7087
7088         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
7089                 request->flags = nla_get_u32(
7090                         attrs[NL80211_ATTR_SCAN_FLAGS]);
7091                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7092                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
7093                         err = -EOPNOTSUPP;
7094                         goto out_free;
7095                 }
7096
7097                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7098                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7099
7100                         if (!wdev) /* must be net-detect */
7101                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7102
7103                         if (!(wiphy->features & flg)) {
7104                                 err = -EOPNOTSUPP;
7105                                 goto out_free;
7106                         }
7107
7108                         if (wdev && wdev->current_bss) {
7109                                 err = -EOPNOTSUPP;
7110                                 goto out_free;
7111                         }
7112
7113                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
7114                                                        request->mac_addr_mask);
7115                         if (err)
7116                                 goto out_free;
7117                 }
7118         }
7119
7120         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7121                 request->delay =
7122                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7123
7124         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7125         if (err)
7126                 goto out_free;
7127
7128         request->scan_start = jiffies;
7129
7130         return request;
7131
7132 out_free:
7133         kfree(request);
7134         return ERR_PTR(err);
7135 }
7136
7137 static int nl80211_start_sched_scan(struct sk_buff *skb,
7138                                     struct genl_info *info)
7139 {
7140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7141         struct net_device *dev = info->user_ptr[1];
7142         struct wireless_dev *wdev = dev->ieee80211_ptr;
7143         struct cfg80211_sched_scan_request *sched_scan_req;
7144         int err;
7145
7146         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7147             !rdev->ops->sched_scan_start)
7148                 return -EOPNOTSUPP;
7149
7150         if (rdev->sched_scan_req)
7151                 return -EINPROGRESS;
7152
7153         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7154                                                   info->attrs);
7155
7156         err = PTR_ERR_OR_ZERO(sched_scan_req);
7157         if (err)
7158                 goto out_err;
7159
7160         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7161         if (err)
7162                 goto out_free;
7163
7164         sched_scan_req->dev = dev;
7165         sched_scan_req->wiphy = &rdev->wiphy;
7166
7167         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7168                 sched_scan_req->owner_nlportid = info->snd_portid;
7169
7170         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
7171
7172         nl80211_send_sched_scan(rdev, dev,
7173                                 NL80211_CMD_START_SCHED_SCAN);
7174         return 0;
7175
7176 out_free:
7177         kfree(sched_scan_req);
7178 out_err:
7179         return err;
7180 }
7181
7182 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7183                                    struct genl_info *info)
7184 {
7185         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7186
7187         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7188             !rdev->ops->sched_scan_stop)
7189                 return -EOPNOTSUPP;
7190
7191         return __cfg80211_stop_sched_scan(rdev, false);
7192 }
7193
7194 static int nl80211_start_radar_detection(struct sk_buff *skb,
7195                                          struct genl_info *info)
7196 {
7197         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7198         struct net_device *dev = info->user_ptr[1];
7199         struct wireless_dev *wdev = dev->ieee80211_ptr;
7200         struct cfg80211_chan_def chandef;
7201         enum nl80211_dfs_regions dfs_region;
7202         unsigned int cac_time_ms;
7203         int err;
7204
7205         dfs_region = reg_get_dfs_region(wdev->wiphy);
7206         if (dfs_region == NL80211_DFS_UNSET)
7207                 return -EINVAL;
7208
7209         err = nl80211_parse_chandef(rdev, info, &chandef);
7210         if (err)
7211                 return err;
7212
7213         if (netif_carrier_ok(dev))
7214                 return -EBUSY;
7215
7216         if (wdev->cac_started)
7217                 return -EBUSY;
7218
7219         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7220                                             wdev->iftype);
7221         if (err < 0)
7222                 return err;
7223
7224         if (err == 0)
7225                 return -EINVAL;
7226
7227         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7228                 return -EINVAL;
7229
7230         if (!rdev->ops->start_radar_detection)
7231                 return -EOPNOTSUPP;
7232
7233         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7234         if (WARN_ON(!cac_time_ms))
7235                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7236
7237         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7238         if (!err) {
7239                 wdev->chandef = chandef;
7240                 wdev->cac_started = true;
7241                 wdev->cac_start_time = jiffies;
7242                 wdev->cac_time_ms = cac_time_ms;
7243         }
7244         return err;
7245 }
7246
7247 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7248 {
7249         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7250         struct net_device *dev = info->user_ptr[1];
7251         struct wireless_dev *wdev = dev->ieee80211_ptr;
7252         struct cfg80211_csa_settings params;
7253         /* csa_attrs is defined static to avoid waste of stack size - this
7254          * function is called under RTNL lock, so this should not be a problem.
7255          */
7256         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7257         int err;
7258         bool need_new_beacon = false;
7259         int len, i;
7260         u32 cs_count;
7261
7262         if (!rdev->ops->channel_switch ||
7263             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7264                 return -EOPNOTSUPP;
7265
7266         switch (dev->ieee80211_ptr->iftype) {
7267         case NL80211_IFTYPE_AP:
7268         case NL80211_IFTYPE_P2P_GO:
7269                 need_new_beacon = true;
7270
7271                 /* useless if AP is not running */
7272                 if (!wdev->beacon_interval)
7273                         return -ENOTCONN;
7274                 break;
7275         case NL80211_IFTYPE_ADHOC:
7276                 if (!wdev->ssid_len)
7277                         return -ENOTCONN;
7278                 break;
7279         case NL80211_IFTYPE_MESH_POINT:
7280                 if (!wdev->mesh_id_len)
7281                         return -ENOTCONN;
7282                 break;
7283         default:
7284                 return -EOPNOTSUPP;
7285         }
7286
7287         memset(&params, 0, sizeof(params));
7288
7289         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7290             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7291                 return -EINVAL;
7292
7293         /* only important for AP, IBSS and mesh create IEs internally */
7294         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7295                 return -EINVAL;
7296
7297         /* Even though the attribute is u32, the specification says
7298          * u8, so let's make sure we don't overflow.
7299          */
7300         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7301         if (cs_count > 255)
7302                 return -EINVAL;
7303
7304         params.count = cs_count;
7305
7306         if (!need_new_beacon)
7307                 goto skip_beacons;
7308
7309         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7310         if (err)
7311                 return err;
7312
7313         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7314                                info->attrs[NL80211_ATTR_CSA_IES],
7315                                nl80211_policy);
7316         if (err)
7317                 return err;
7318
7319         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7320         if (err)
7321                 return err;
7322
7323         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7324                 return -EINVAL;
7325
7326         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7327         if (!len || (len % sizeof(u16)))
7328                 return -EINVAL;
7329
7330         params.n_counter_offsets_beacon = len / sizeof(u16);
7331         if (rdev->wiphy.max_num_csa_counters &&
7332             (params.n_counter_offsets_beacon >
7333              rdev->wiphy.max_num_csa_counters))
7334                 return -EINVAL;
7335
7336         params.counter_offsets_beacon =
7337                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7338
7339         /* sanity checks - counters should fit and be the same */
7340         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7341                 u16 offset = params.counter_offsets_beacon[i];
7342
7343                 if (offset >= params.beacon_csa.tail_len)
7344                         return -EINVAL;
7345
7346                 if (params.beacon_csa.tail[offset] != params.count)
7347                         return -EINVAL;
7348         }
7349
7350         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7351                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7352                 if (!len || (len % sizeof(u16)))
7353                         return -EINVAL;
7354
7355                 params.n_counter_offsets_presp = len / sizeof(u16);
7356                 if (rdev->wiphy.max_num_csa_counters &&
7357                     (params.n_counter_offsets_presp >
7358                      rdev->wiphy.max_num_csa_counters))
7359                         return -EINVAL;
7360
7361                 params.counter_offsets_presp =
7362                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7363
7364                 /* sanity checks - counters should fit and be the same */
7365                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7366                         u16 offset = params.counter_offsets_presp[i];
7367
7368                         if (offset >= params.beacon_csa.probe_resp_len)
7369                                 return -EINVAL;
7370
7371                         if (params.beacon_csa.probe_resp[offset] !=
7372                             params.count)
7373                                 return -EINVAL;
7374                 }
7375         }
7376
7377 skip_beacons:
7378         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7379         if (err)
7380                 return err;
7381
7382         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7383                                            wdev->iftype))
7384                 return -EINVAL;
7385
7386         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7387                                             &params.chandef,
7388                                             wdev->iftype);
7389         if (err < 0)
7390                 return err;
7391
7392         if (err > 0)
7393                 params.radar_required = true;
7394
7395         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7396                 params.block_tx = true;
7397
7398         wdev_lock(wdev);
7399         err = rdev_channel_switch(rdev, dev, &params);
7400         wdev_unlock(wdev);
7401
7402         return err;
7403 }
7404
7405 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7406                             u32 seq, int flags,
7407                             struct cfg80211_registered_device *rdev,
7408                             struct wireless_dev *wdev,
7409                             struct cfg80211_internal_bss *intbss)
7410 {
7411         struct cfg80211_bss *res = &intbss->pub;
7412         const struct cfg80211_bss_ies *ies;
7413         void *hdr;
7414         struct nlattr *bss;
7415
7416         ASSERT_WDEV_LOCK(wdev);
7417
7418         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7419                              NL80211_CMD_NEW_SCAN_RESULTS);
7420         if (!hdr)
7421                 return -1;
7422
7423         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7424
7425         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7426                 goto nla_put_failure;
7427         if (wdev->netdev &&
7428             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7429                 goto nla_put_failure;
7430         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7431                               NL80211_ATTR_PAD))
7432                 goto nla_put_failure;
7433
7434         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7435         if (!bss)
7436                 goto nla_put_failure;
7437         if ((!is_zero_ether_addr(res->bssid) &&
7438              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7439                 goto nla_put_failure;
7440
7441         rcu_read_lock();
7442         /* indicate whether we have probe response data or not */
7443         if (rcu_access_pointer(res->proberesp_ies) &&
7444             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7445                 goto fail_unlock_rcu;
7446
7447         /* this pointer prefers to be pointed to probe response data
7448          * but is always valid
7449          */
7450         ies = rcu_dereference(res->ies);
7451         if (ies) {
7452                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7453                                       NL80211_BSS_PAD))
7454                         goto fail_unlock_rcu;
7455                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7456                                         ies->len, ies->data))
7457                         goto fail_unlock_rcu;
7458         }
7459
7460         /* and this pointer is always (unless driver didn't know) beacon data */
7461         ies = rcu_dereference(res->beacon_ies);
7462         if (ies && ies->from_beacon) {
7463                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7464                                       NL80211_BSS_PAD))
7465                         goto fail_unlock_rcu;
7466                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7467                                         ies->len, ies->data))
7468                         goto fail_unlock_rcu;
7469         }
7470         rcu_read_unlock();
7471
7472         if (res->beacon_interval &&
7473             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7474                 goto nla_put_failure;
7475         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7476             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7477             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7478             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7479                         jiffies_to_msecs(jiffies - intbss->ts)))
7480                 goto nla_put_failure;
7481
7482         if (intbss->parent_tsf &&
7483             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7484                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7485              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7486                      intbss->parent_bssid)))
7487                 goto nla_put_failure;
7488
7489         if (intbss->ts_boottime &&
7490             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7491                               intbss->ts_boottime, NL80211_BSS_PAD))
7492                 goto nla_put_failure;
7493
7494         switch (rdev->wiphy.signal_type) {
7495         case CFG80211_SIGNAL_TYPE_MBM:
7496                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7497                         goto nla_put_failure;
7498                 break;
7499         case CFG80211_SIGNAL_TYPE_UNSPEC:
7500                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7501                         goto nla_put_failure;
7502                 break;
7503         default:
7504                 break;
7505         }
7506
7507         switch (wdev->iftype) {
7508         case NL80211_IFTYPE_P2P_CLIENT:
7509         case NL80211_IFTYPE_STATION:
7510                 if (intbss == wdev->current_bss &&
7511                     nla_put_u32(msg, NL80211_BSS_STATUS,
7512                                 NL80211_BSS_STATUS_ASSOCIATED))
7513                         goto nla_put_failure;
7514                 break;
7515         case NL80211_IFTYPE_ADHOC:
7516                 if (intbss == wdev->current_bss &&
7517                     nla_put_u32(msg, NL80211_BSS_STATUS,
7518                                 NL80211_BSS_STATUS_IBSS_JOINED))
7519                         goto nla_put_failure;
7520                 break;
7521         default:
7522                 break;
7523         }
7524
7525         nla_nest_end(msg, bss);
7526
7527         genlmsg_end(msg, hdr);
7528         return 0;
7529
7530  fail_unlock_rcu:
7531         rcu_read_unlock();
7532  nla_put_failure:
7533         genlmsg_cancel(msg, hdr);
7534         return -EMSGSIZE;
7535 }
7536
7537 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7538 {
7539         struct cfg80211_registered_device *rdev;
7540         struct cfg80211_internal_bss *scan;
7541         struct wireless_dev *wdev;
7542         int start = cb->args[2], idx = 0;
7543         int err;
7544
7545         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7546         if (err)
7547                 return err;
7548
7549         wdev_lock(wdev);
7550         spin_lock_bh(&rdev->bss_lock);
7551         cfg80211_bss_expire(rdev);
7552
7553         cb->seq = rdev->bss_generation;
7554
7555         list_for_each_entry(scan, &rdev->bss_list, list) {
7556                 if (++idx <= start)
7557                         continue;
7558                 if (nl80211_send_bss(skb, cb,
7559                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7560                                 rdev, wdev, scan) < 0) {
7561                         idx--;
7562                         break;
7563                 }
7564         }
7565
7566         spin_unlock_bh(&rdev->bss_lock);
7567         wdev_unlock(wdev);
7568
7569         cb->args[2] = idx;
7570         nl80211_finish_wdev_dump(rdev);
7571
7572         return skb->len;
7573 }
7574
7575 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7576                                int flags, struct net_device *dev,
7577                                bool allow_radio_stats,
7578                                struct survey_info *survey)
7579 {
7580         void *hdr;
7581         struct nlattr *infoattr;
7582
7583         /* skip radio stats if userspace didn't request them */
7584         if (!survey->channel && !allow_radio_stats)
7585                 return 0;
7586
7587         hdr = nl80211hdr_put(msg, portid, seq, flags,
7588                              NL80211_CMD_NEW_SURVEY_RESULTS);
7589         if (!hdr)
7590                 return -ENOMEM;
7591
7592         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7593                 goto nla_put_failure;
7594
7595         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7596         if (!infoattr)
7597                 goto nla_put_failure;
7598
7599         if (survey->channel &&
7600             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7601                         survey->channel->center_freq))
7602                 goto nla_put_failure;
7603
7604         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7605             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7606                 goto nla_put_failure;
7607         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7608             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7609                 goto nla_put_failure;
7610         if ((survey->filled & SURVEY_INFO_TIME) &&
7611             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7612                         survey->time, NL80211_SURVEY_INFO_PAD))
7613                 goto nla_put_failure;
7614         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7615             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7616                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7617                 goto nla_put_failure;
7618         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7619             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7620                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7621                 goto nla_put_failure;
7622         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7623             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7624                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7625                 goto nla_put_failure;
7626         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7627             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7628                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7629                 goto nla_put_failure;
7630         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7631             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7632                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7633                 goto nla_put_failure;
7634
7635         nla_nest_end(msg, infoattr);
7636
7637         genlmsg_end(msg, hdr);
7638         return 0;
7639
7640  nla_put_failure:
7641         genlmsg_cancel(msg, hdr);
7642         return -EMSGSIZE;
7643 }
7644
7645 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7646 {
7647         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7648         struct survey_info survey;
7649         struct cfg80211_registered_device *rdev;
7650         struct wireless_dev *wdev;
7651         int survey_idx = cb->args[2];
7652         int res;
7653         bool radio_stats;
7654
7655         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7656         if (res)
7657                 return res;
7658
7659         /* prepare_wdev_dump parsed the attributes */
7660         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7661
7662         if (!wdev->netdev) {
7663                 res = -EINVAL;
7664                 goto out_err;
7665         }
7666
7667         if (!rdev->ops->dump_survey) {
7668                 res = -EOPNOTSUPP;
7669                 goto out_err;
7670         }
7671
7672         while (1) {
7673                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7674                 if (res == -ENOENT)
7675                         break;
7676                 if (res)
7677                         goto out_err;
7678
7679                 /* don't send disabled channels, but do send non-channel data */
7680                 if (survey.channel &&
7681                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7682                         survey_idx++;
7683                         continue;
7684                 }
7685
7686                 if (nl80211_send_survey(skb,
7687                                 NETLINK_CB(cb->skb).portid,
7688                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7689                                 wdev->netdev, radio_stats, &survey) < 0)
7690                         goto out;
7691                 survey_idx++;
7692         }
7693
7694  out:
7695         cb->args[2] = survey_idx;
7696         res = skb->len;
7697  out_err:
7698         nl80211_finish_wdev_dump(rdev);
7699         return res;
7700 }
7701
7702 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7703 {
7704         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7705                                   NL80211_WPA_VERSION_2));
7706 }
7707
7708 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7709 {
7710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7711         struct net_device *dev = info->user_ptr[1];
7712         struct ieee80211_channel *chan;
7713         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7714         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7715         enum nl80211_auth_type auth_type;
7716         struct key_parse key;
7717         bool local_state_change;
7718
7719         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7720                 return -EINVAL;
7721
7722         if (!info->attrs[NL80211_ATTR_MAC])
7723                 return -EINVAL;
7724
7725         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7726                 return -EINVAL;
7727
7728         if (!info->attrs[NL80211_ATTR_SSID])
7729                 return -EINVAL;
7730
7731         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7732                 return -EINVAL;
7733
7734         err = nl80211_parse_key(info, &key);
7735         if (err)
7736                 return err;
7737
7738         if (key.idx >= 0) {
7739                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7740                         return -EINVAL;
7741                 if (!key.p.key || !key.p.key_len)
7742                         return -EINVAL;
7743                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7744                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7745                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7746                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7747                         return -EINVAL;
7748                 if (key.idx > 3)
7749                         return -EINVAL;
7750         } else {
7751                 key.p.key_len = 0;
7752                 key.p.key = NULL;
7753         }
7754
7755         if (key.idx >= 0) {
7756                 int i;
7757                 bool ok = false;
7758
7759                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7760                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7761                                 ok = true;
7762                                 break;
7763                         }
7764                 }
7765                 if (!ok)
7766                         return -EINVAL;
7767         }
7768
7769         if (!rdev->ops->auth)
7770                 return -EOPNOTSUPP;
7771
7772         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7773             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7774                 return -EOPNOTSUPP;
7775
7776         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7777         chan = nl80211_get_valid_chan(&rdev->wiphy,
7778                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7779         if (!chan)
7780                 return -EINVAL;
7781
7782         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7783         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7784
7785         if (info->attrs[NL80211_ATTR_IE]) {
7786                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7787                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7788         }
7789
7790         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7791         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7792                 return -EINVAL;
7793
7794         if (auth_type == NL80211_AUTHTYPE_SAE &&
7795             !info->attrs[NL80211_ATTR_SAE_DATA])
7796                 return -EINVAL;
7797
7798         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7799                 if (auth_type != NL80211_AUTHTYPE_SAE)
7800                         return -EINVAL;
7801                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7802                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7803                 /* need to include at least Auth Transaction and Status Code */
7804                 if (sae_data_len < 4)
7805                         return -EINVAL;
7806         }
7807
7808         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7809
7810         /*
7811          * Since we no longer track auth state, ignore
7812          * requests to only change local state.
7813          */
7814         if (local_state_change)
7815                 return 0;
7816
7817         wdev_lock(dev->ieee80211_ptr);
7818         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7819                                  ssid, ssid_len, ie, ie_len,
7820                                  key.p.key, key.p.key_len, key.idx,
7821                                  sae_data, sae_data_len);
7822         wdev_unlock(dev->ieee80211_ptr);
7823         return err;
7824 }
7825
7826 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7827                                    struct genl_info *info,
7828                                    struct cfg80211_crypto_settings *settings,
7829                                    int cipher_limit)
7830 {
7831         memset(settings, 0, sizeof(*settings));
7832
7833         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7834
7835         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7836                 u16 proto;
7837
7838                 proto = nla_get_u16(
7839                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7840                 settings->control_port_ethertype = cpu_to_be16(proto);
7841                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7842                     proto != ETH_P_PAE)
7843                         return -EINVAL;
7844                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7845                         settings->control_port_no_encrypt = true;
7846         } else
7847                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7848
7849         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7850                 void *data;
7851                 int len, i;
7852
7853                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7854                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7855                 settings->n_ciphers_pairwise = len / sizeof(u32);
7856
7857                 if (len % sizeof(u32))
7858                         return -EINVAL;
7859
7860                 if (settings->n_ciphers_pairwise > cipher_limit)
7861                         return -EINVAL;
7862
7863                 memcpy(settings->ciphers_pairwise, data, len);
7864
7865                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7866                         if (!cfg80211_supported_cipher_suite(
7867                                         &rdev->wiphy,
7868                                         settings->ciphers_pairwise[i]))
7869                                 return -EINVAL;
7870         }
7871
7872         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7873                 settings->cipher_group =
7874                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7875                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7876                                                      settings->cipher_group))
7877                         return -EINVAL;
7878         }
7879
7880         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7881                 settings->wpa_versions =
7882                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7883                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7884                         return -EINVAL;
7885         }
7886
7887         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7888                 void *data;
7889                 int len;
7890
7891                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7892                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7893                 settings->n_akm_suites = len / sizeof(u32);
7894
7895                 if (len % sizeof(u32))
7896                         return -EINVAL;
7897
7898                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7899                         return -EINVAL;
7900
7901                 memcpy(settings->akm_suites, data, len);
7902         }
7903
7904         return 0;
7905 }
7906
7907 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7908 {
7909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7910         struct net_device *dev = info->user_ptr[1];
7911         struct ieee80211_channel *chan;
7912         struct cfg80211_assoc_request req = {};
7913         const u8 *bssid, *ssid;
7914         int err, ssid_len = 0;
7915
7916         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7917                 return -EINVAL;
7918
7919         if (!info->attrs[NL80211_ATTR_MAC] ||
7920             !info->attrs[NL80211_ATTR_SSID] ||
7921             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7922                 return -EINVAL;
7923
7924         if (!rdev->ops->assoc)
7925                 return -EOPNOTSUPP;
7926
7927         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7928             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7929                 return -EOPNOTSUPP;
7930
7931         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7932
7933         chan = nl80211_get_valid_chan(&rdev->wiphy,
7934                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7935         if (!chan)
7936                 return -EINVAL;
7937
7938         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7939         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7940
7941         if (info->attrs[NL80211_ATTR_IE]) {
7942                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7943                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7944         }
7945
7946         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7947                 enum nl80211_mfp mfp =
7948                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7949                 if (mfp == NL80211_MFP_REQUIRED)
7950                         req.use_mfp = true;
7951                 else if (mfp != NL80211_MFP_NO)
7952                         return -EINVAL;
7953         }
7954
7955         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7956                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7957
7958         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7959                 req.flags |= ASSOC_REQ_DISABLE_HT;
7960
7961         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7962                 memcpy(&req.ht_capa_mask,
7963                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7964                        sizeof(req.ht_capa_mask));
7965
7966         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7967                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7968                         return -EINVAL;
7969                 memcpy(&req.ht_capa,
7970                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7971                        sizeof(req.ht_capa));
7972         }
7973
7974         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7975                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7976
7977         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7978                 memcpy(&req.vht_capa_mask,
7979                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7980                        sizeof(req.vht_capa_mask));
7981
7982         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7983                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7984                         return -EINVAL;
7985                 memcpy(&req.vht_capa,
7986                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7987                        sizeof(req.vht_capa));
7988         }
7989
7990         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7991                 if (!((rdev->wiphy.features &
7992                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
7993                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
7994                     !wiphy_ext_feature_isset(&rdev->wiphy,
7995                                              NL80211_EXT_FEATURE_RRM))
7996                         return -EINVAL;
7997                 req.flags |= ASSOC_REQ_USE_RRM;
7998         }
7999
8000         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8001         if (!err) {
8002                 wdev_lock(dev->ieee80211_ptr);
8003                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8004                                           ssid, ssid_len, &req);
8005                 wdev_unlock(dev->ieee80211_ptr);
8006         }
8007
8008         return err;
8009 }
8010
8011 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8012 {
8013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8014         struct net_device *dev = info->user_ptr[1];
8015         const u8 *ie = NULL, *bssid;
8016         int ie_len = 0, err;
8017         u16 reason_code;
8018         bool local_state_change;
8019
8020         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8021                 return -EINVAL;
8022
8023         if (!info->attrs[NL80211_ATTR_MAC])
8024                 return -EINVAL;
8025
8026         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8027                 return -EINVAL;
8028
8029         if (!rdev->ops->deauth)
8030                 return -EOPNOTSUPP;
8031
8032         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8033             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8034                 return -EOPNOTSUPP;
8035
8036         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8037
8038         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8039         if (reason_code == 0) {
8040                 /* Reason Code 0 is reserved */
8041                 return -EINVAL;
8042         }
8043
8044         if (info->attrs[NL80211_ATTR_IE]) {
8045                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8046                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8047         }
8048
8049         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8050
8051         wdev_lock(dev->ieee80211_ptr);
8052         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8053                                    local_state_change);
8054         wdev_unlock(dev->ieee80211_ptr);
8055         return err;
8056 }
8057
8058 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8059 {
8060         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8061         struct net_device *dev = info->user_ptr[1];
8062         const u8 *ie = NULL, *bssid;
8063         int ie_len = 0, err;
8064         u16 reason_code;
8065         bool local_state_change;
8066
8067         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8068                 return -EINVAL;
8069
8070         if (!info->attrs[NL80211_ATTR_MAC])
8071                 return -EINVAL;
8072
8073         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8074                 return -EINVAL;
8075
8076         if (!rdev->ops->disassoc)
8077                 return -EOPNOTSUPP;
8078
8079         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8080             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8081                 return -EOPNOTSUPP;
8082
8083         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8084
8085         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8086         if (reason_code == 0) {
8087                 /* Reason Code 0 is reserved */
8088                 return -EINVAL;
8089         }
8090
8091         if (info->attrs[NL80211_ATTR_IE]) {
8092                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8093                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8094         }
8095
8096         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8097
8098         wdev_lock(dev->ieee80211_ptr);
8099         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8100                                      local_state_change);
8101         wdev_unlock(dev->ieee80211_ptr);
8102         return err;
8103 }
8104
8105 static bool
8106 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8107                          int mcast_rate[NUM_NL80211_BANDS],
8108                          int rateval)
8109 {
8110         struct wiphy *wiphy = &rdev->wiphy;
8111         bool found = false;
8112         int band, i;
8113
8114         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8115                 struct ieee80211_supported_band *sband;
8116
8117                 sband = wiphy->bands[band];
8118                 if (!sband)
8119                         continue;
8120
8121                 for (i = 0; i < sband->n_bitrates; i++) {
8122                         if (sband->bitrates[i].bitrate == rateval) {
8123                                 mcast_rate[band] = i + 1;
8124                                 found = true;
8125                                 break;
8126                         }
8127                 }
8128         }
8129
8130         return found;
8131 }
8132
8133 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8134 {
8135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8136         struct net_device *dev = info->user_ptr[1];
8137         struct cfg80211_ibss_params ibss;
8138         struct wiphy *wiphy;
8139         struct cfg80211_cached_keys *connkeys = NULL;
8140         int err;
8141
8142         memset(&ibss, 0, sizeof(ibss));
8143
8144         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8145                 return -EINVAL;
8146
8147         if (!info->attrs[NL80211_ATTR_SSID] ||
8148             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8149                 return -EINVAL;
8150
8151         ibss.beacon_interval = 100;
8152
8153         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8154                 ibss.beacon_interval =
8155                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8156
8157         err = cfg80211_validate_beacon_int(rdev, ibss.beacon_interval);
8158         if (err)
8159                 return err;
8160
8161         if (!rdev->ops->join_ibss)
8162                 return -EOPNOTSUPP;
8163
8164         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8165                 return -EOPNOTSUPP;
8166
8167         wiphy = &rdev->wiphy;
8168
8169         if (info->attrs[NL80211_ATTR_MAC]) {
8170                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8171
8172                 if (!is_valid_ether_addr(ibss.bssid))
8173                         return -EINVAL;
8174         }
8175         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8176         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8177
8178         if (info->attrs[NL80211_ATTR_IE]) {
8179                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8180                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8181         }
8182
8183         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8184         if (err)
8185                 return err;
8186
8187         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8188                                      NL80211_IFTYPE_ADHOC))
8189                 return -EINVAL;
8190
8191         switch (ibss.chandef.width) {
8192         case NL80211_CHAN_WIDTH_5:
8193         case NL80211_CHAN_WIDTH_10:
8194         case NL80211_CHAN_WIDTH_20_NOHT:
8195                 break;
8196         case NL80211_CHAN_WIDTH_20:
8197         case NL80211_CHAN_WIDTH_40:
8198                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8199                         return -EINVAL;
8200                 break;
8201         case NL80211_CHAN_WIDTH_80:
8202         case NL80211_CHAN_WIDTH_80P80:
8203         case NL80211_CHAN_WIDTH_160:
8204                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8205                         return -EINVAL;
8206                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8207                                              NL80211_EXT_FEATURE_VHT_IBSS))
8208                         return -EINVAL;
8209                 break;
8210         default:
8211                 return -EINVAL;
8212         }
8213
8214         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8215         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8216
8217         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8218                 u8 *rates =
8219                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8220                 int n_rates =
8221                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8222                 struct ieee80211_supported_band *sband =
8223                         wiphy->bands[ibss.chandef.chan->band];
8224
8225                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8226                                              &ibss.basic_rates);
8227                 if (err)
8228                         return err;
8229         }
8230
8231         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8232                 memcpy(&ibss.ht_capa_mask,
8233                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8234                        sizeof(ibss.ht_capa_mask));
8235
8236         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8237                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8238                         return -EINVAL;
8239                 memcpy(&ibss.ht_capa,
8240                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8241                        sizeof(ibss.ht_capa));
8242         }
8243
8244         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8245             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8246                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8247                 return -EINVAL;
8248
8249         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8250                 bool no_ht = false;
8251
8252                 connkeys = nl80211_parse_connkeys(rdev,
8253                                           info->attrs[NL80211_ATTR_KEYS],
8254                                           &no_ht);
8255                 if (IS_ERR(connkeys))
8256                         return PTR_ERR(connkeys);
8257
8258                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8259                     no_ht) {
8260                         kzfree(connkeys);
8261                         return -EINVAL;
8262                 }
8263         }
8264
8265         ibss.control_port =
8266                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8267
8268         ibss.userspace_handles_dfs =
8269                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8270
8271         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8272         if (err)
8273                 kzfree(connkeys);
8274         return err;
8275 }
8276
8277 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8278 {
8279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8280         struct net_device *dev = info->user_ptr[1];
8281
8282         if (!rdev->ops->leave_ibss)
8283                 return -EOPNOTSUPP;
8284
8285         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8286                 return -EOPNOTSUPP;
8287
8288         return cfg80211_leave_ibss(rdev, dev, false);
8289 }
8290
8291 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8292 {
8293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8294         struct net_device *dev = info->user_ptr[1];
8295         int mcast_rate[NUM_NL80211_BANDS];
8296         u32 nla_rate;
8297         int err;
8298
8299         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8300             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8301             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8302                 return -EOPNOTSUPP;
8303
8304         if (!rdev->ops->set_mcast_rate)
8305                 return -EOPNOTSUPP;
8306
8307         memset(mcast_rate, 0, sizeof(mcast_rate));
8308
8309         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8310                 return -EINVAL;
8311
8312         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8313         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8314                 return -EINVAL;
8315
8316         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8317
8318         return err;
8319 }
8320
8321 static struct sk_buff *
8322 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8323                             struct wireless_dev *wdev, int approxlen,
8324                             u32 portid, u32 seq, enum nl80211_commands cmd,
8325                             enum nl80211_attrs attr,
8326                             const struct nl80211_vendor_cmd_info *info,
8327                             gfp_t gfp)
8328 {
8329         struct sk_buff *skb;
8330         void *hdr;
8331         struct nlattr *data;
8332
8333         skb = nlmsg_new(approxlen + 100, gfp);
8334         if (!skb)
8335                 return NULL;
8336
8337         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8338         if (!hdr) {
8339                 kfree_skb(skb);
8340                 return NULL;
8341         }
8342
8343         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8344                 goto nla_put_failure;
8345
8346         if (info) {
8347                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8348                                 info->vendor_id))
8349                         goto nla_put_failure;
8350                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8351                                 info->subcmd))
8352                         goto nla_put_failure;
8353         }
8354
8355         if (wdev) {
8356                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8357                                       wdev_id(wdev), NL80211_ATTR_PAD))
8358                         goto nla_put_failure;
8359                 if (wdev->netdev &&
8360                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8361                                 wdev->netdev->ifindex))
8362                         goto nla_put_failure;
8363         }
8364
8365         data = nla_nest_start(skb, attr);
8366         if (!data)
8367                 goto nla_put_failure;
8368
8369         ((void **)skb->cb)[0] = rdev;
8370         ((void **)skb->cb)[1] = hdr;
8371         ((void **)skb->cb)[2] = data;
8372
8373         return skb;
8374
8375  nla_put_failure:
8376         kfree_skb(skb);
8377         return NULL;
8378 }
8379
8380 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8381                                            struct wireless_dev *wdev,
8382                                            enum nl80211_commands cmd,
8383                                            enum nl80211_attrs attr,
8384                                            int vendor_event_idx,
8385                                            int approxlen, gfp_t gfp)
8386 {
8387         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8388         const struct nl80211_vendor_cmd_info *info;
8389
8390         switch (cmd) {
8391         case NL80211_CMD_TESTMODE:
8392                 if (WARN_ON(vendor_event_idx != -1))
8393                         return NULL;
8394                 info = NULL;
8395                 break;
8396         case NL80211_CMD_VENDOR:
8397                 if (WARN_ON(vendor_event_idx < 0 ||
8398                             vendor_event_idx >= wiphy->n_vendor_events))
8399                         return NULL;
8400                 info = &wiphy->vendor_events[vendor_event_idx];
8401                 break;
8402         default:
8403                 WARN_ON(1);
8404                 return NULL;
8405         }
8406
8407         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8408                                            cmd, attr, info, gfp);
8409 }
8410 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8411
8412 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8413 {
8414         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8415         void *hdr = ((void **)skb->cb)[1];
8416         struct nlattr *data = ((void **)skb->cb)[2];
8417         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8418
8419         /* clear CB data for netlink core to own from now on */
8420         memset(skb->cb, 0, sizeof(skb->cb));
8421
8422         nla_nest_end(skb, data);
8423         genlmsg_end(skb, hdr);
8424
8425         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8426                 mcgrp = NL80211_MCGRP_VENDOR;
8427
8428         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8429                                 mcgrp, gfp);
8430 }
8431 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8432
8433 #ifdef CONFIG_NL80211_TESTMODE
8434 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8435 {
8436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8437         struct wireless_dev *wdev =
8438                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8439         int err;
8440
8441         if (!rdev->ops->testmode_cmd)
8442                 return -EOPNOTSUPP;
8443
8444         if (IS_ERR(wdev)) {
8445                 err = PTR_ERR(wdev);
8446                 if (err != -EINVAL)
8447                         return err;
8448                 wdev = NULL;
8449         } else if (wdev->wiphy != &rdev->wiphy) {
8450                 return -EINVAL;
8451         }
8452
8453         if (!info->attrs[NL80211_ATTR_TESTDATA])
8454                 return -EINVAL;
8455
8456         rdev->cur_cmd_info = info;
8457         err = rdev_testmode_cmd(rdev, wdev,
8458                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8459                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8460         rdev->cur_cmd_info = NULL;
8461
8462         return err;
8463 }
8464
8465 static int nl80211_testmode_dump(struct sk_buff *skb,
8466                                  struct netlink_callback *cb)
8467 {
8468         struct cfg80211_registered_device *rdev;
8469         int err;
8470         long phy_idx;
8471         void *data = NULL;
8472         int data_len = 0;
8473
8474         rtnl_lock();
8475
8476         if (cb->args[0]) {
8477                 /*
8478                  * 0 is a valid index, but not valid for args[0],
8479                  * so we need to offset by 1.
8480                  */
8481                 phy_idx = cb->args[0] - 1;
8482         } else {
8483                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8484
8485                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8486                                   attrbuf, nl80211_fam.maxattr, nl80211_policy);
8487                 if (err)
8488                         goto out_err;
8489
8490                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8491                 if (IS_ERR(rdev)) {
8492                         err = PTR_ERR(rdev);
8493                         goto out_err;
8494                 }
8495                 phy_idx = rdev->wiphy_idx;
8496                 rdev = NULL;
8497
8498                 if (attrbuf[NL80211_ATTR_TESTDATA])
8499                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8500         }
8501
8502         if (cb->args[1]) {
8503                 data = nla_data((void *)cb->args[1]);
8504                 data_len = nla_len((void *)cb->args[1]);
8505         }
8506
8507         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8508         if (!rdev) {
8509                 err = -ENOENT;
8510                 goto out_err;
8511         }
8512
8513         if (!rdev->ops->testmode_dump) {
8514                 err = -EOPNOTSUPP;
8515                 goto out_err;
8516         }
8517
8518         while (1) {
8519                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8520                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8521                                            NL80211_CMD_TESTMODE);
8522                 struct nlattr *tmdata;
8523
8524                 if (!hdr)
8525                         break;
8526
8527                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8528                         genlmsg_cancel(skb, hdr);
8529                         break;
8530                 }
8531
8532                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8533                 if (!tmdata) {
8534                         genlmsg_cancel(skb, hdr);
8535                         break;
8536                 }
8537                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8538                 nla_nest_end(skb, tmdata);
8539
8540                 if (err == -ENOBUFS || err == -ENOENT) {
8541                         genlmsg_cancel(skb, hdr);
8542                         break;
8543                 } else if (err) {
8544                         genlmsg_cancel(skb, hdr);
8545                         goto out_err;
8546                 }
8547
8548                 genlmsg_end(skb, hdr);
8549         }
8550
8551         err = skb->len;
8552         /* see above */
8553         cb->args[0] = phy_idx + 1;
8554  out_err:
8555         rtnl_unlock();
8556         return err;
8557 }
8558 #endif
8559
8560 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8561 {
8562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8563         struct net_device *dev = info->user_ptr[1];
8564         struct cfg80211_connect_params connect;
8565         struct wiphy *wiphy;
8566         struct cfg80211_cached_keys *connkeys = NULL;
8567         int err;
8568
8569         memset(&connect, 0, sizeof(connect));
8570
8571         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8572                 return -EINVAL;
8573
8574         if (!info->attrs[NL80211_ATTR_SSID] ||
8575             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8576                 return -EINVAL;
8577
8578         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8579                 connect.auth_type =
8580                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8581                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8582                                              NL80211_CMD_CONNECT))
8583                         return -EINVAL;
8584         } else
8585                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8586
8587         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8588
8589         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8590                                       NL80211_MAX_NR_CIPHER_SUITES);
8591         if (err)
8592                 return err;
8593
8594         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8595             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8596                 return -EOPNOTSUPP;
8597
8598         wiphy = &rdev->wiphy;
8599
8600         connect.bg_scan_period = -1;
8601         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8602                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8603                 connect.bg_scan_period =
8604                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8605         }
8606
8607         if (info->attrs[NL80211_ATTR_MAC])
8608                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8609         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8610                 connect.bssid_hint =
8611                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8612         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8613         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8614
8615         if (info->attrs[NL80211_ATTR_IE]) {
8616                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8617                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8618         }
8619
8620         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8621                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8622                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8623                     connect.mfp != NL80211_MFP_NO)
8624                         return -EINVAL;
8625         } else {
8626                 connect.mfp = NL80211_MFP_NO;
8627         }
8628
8629         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8630                 connect.prev_bssid =
8631                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8632
8633         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8634                 connect.channel = nl80211_get_valid_chan(
8635                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8636                 if (!connect.channel)
8637                         return -EINVAL;
8638         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8639                 connect.channel_hint = nl80211_get_valid_chan(
8640                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8641                 if (!connect.channel_hint)
8642                         return -EINVAL;
8643         }
8644
8645         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8646                 connkeys = nl80211_parse_connkeys(rdev,
8647                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8648                 if (IS_ERR(connkeys))
8649                         return PTR_ERR(connkeys);
8650         }
8651
8652         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8653                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8654
8655         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8656                 memcpy(&connect.ht_capa_mask,
8657                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8658                        sizeof(connect.ht_capa_mask));
8659
8660         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8661                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8662                         kzfree(connkeys);
8663                         return -EINVAL;
8664                 }
8665                 memcpy(&connect.ht_capa,
8666                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8667                        sizeof(connect.ht_capa));
8668         }
8669
8670         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8671                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8672
8673         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8674                 memcpy(&connect.vht_capa_mask,
8675                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8676                        sizeof(connect.vht_capa_mask));
8677
8678         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8679                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8680                         kzfree(connkeys);
8681                         return -EINVAL;
8682                 }
8683                 memcpy(&connect.vht_capa,
8684                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8685                        sizeof(connect.vht_capa));
8686         }
8687
8688         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8689                 if (!((rdev->wiphy.features &
8690                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8691                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8692                     !wiphy_ext_feature_isset(&rdev->wiphy,
8693                                              NL80211_EXT_FEATURE_RRM)) {
8694                         kzfree(connkeys);
8695                         return -EINVAL;
8696                 }
8697                 connect.flags |= ASSOC_REQ_USE_RRM;
8698         }
8699
8700         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8701         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8702                 kzfree(connkeys);
8703                 return -EOPNOTSUPP;
8704         }
8705
8706         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8707                 /* bss selection makes no sense if bssid is set */
8708                 if (connect.bssid) {
8709                         kzfree(connkeys);
8710                         return -EINVAL;
8711                 }
8712
8713                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8714                                        wiphy, &connect.bss_select);
8715                 if (err) {
8716                         kzfree(connkeys);
8717                         return err;
8718                 }
8719         }
8720
8721         wdev_lock(dev->ieee80211_ptr);
8722         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8723                                connect.prev_bssid);
8724         wdev_unlock(dev->ieee80211_ptr);
8725         if (err)
8726                 kzfree(connkeys);
8727         return err;
8728 }
8729
8730 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8731 {
8732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8733         struct net_device *dev = info->user_ptr[1];
8734         u16 reason;
8735         int ret;
8736
8737         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8738                 reason = WLAN_REASON_DEAUTH_LEAVING;
8739         else
8740                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8741
8742         if (reason == 0)
8743                 return -EINVAL;
8744
8745         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8746             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8747                 return -EOPNOTSUPP;
8748
8749         wdev_lock(dev->ieee80211_ptr);
8750         ret = cfg80211_disconnect(rdev, dev, reason, true);
8751         wdev_unlock(dev->ieee80211_ptr);
8752         return ret;
8753 }
8754
8755 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8756 {
8757         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8758         struct net *net;
8759         int err;
8760
8761         if (info->attrs[NL80211_ATTR_PID]) {
8762                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8763
8764                 net = get_net_ns_by_pid(pid);
8765         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8766                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8767
8768                 net = get_net_ns_by_fd(fd);
8769         } else {
8770                 return -EINVAL;
8771         }
8772
8773         if (IS_ERR(net))
8774                 return PTR_ERR(net);
8775
8776         err = 0;
8777
8778         /* check if anything to do */
8779         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8780                 err = cfg80211_switch_netns(rdev, net);
8781
8782         put_net(net);
8783         return err;
8784 }
8785
8786 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8787 {
8788         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8789         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8790                         struct cfg80211_pmksa *pmksa) = NULL;
8791         struct net_device *dev = info->user_ptr[1];
8792         struct cfg80211_pmksa pmksa;
8793
8794         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8795
8796         if (!info->attrs[NL80211_ATTR_MAC])
8797                 return -EINVAL;
8798
8799         if (!info->attrs[NL80211_ATTR_PMKID])
8800                 return -EINVAL;
8801
8802         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8803         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8804
8805         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8806             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8807                 return -EOPNOTSUPP;
8808
8809         switch (info->genlhdr->cmd) {
8810         case NL80211_CMD_SET_PMKSA:
8811                 rdev_ops = rdev->ops->set_pmksa;
8812                 break;
8813         case NL80211_CMD_DEL_PMKSA:
8814                 rdev_ops = rdev->ops->del_pmksa;
8815                 break;
8816         default:
8817                 WARN_ON(1);
8818                 break;
8819         }
8820
8821         if (!rdev_ops)
8822                 return -EOPNOTSUPP;
8823
8824         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8825 }
8826
8827 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8828 {
8829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8830         struct net_device *dev = info->user_ptr[1];
8831
8832         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8833             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8834                 return -EOPNOTSUPP;
8835
8836         if (!rdev->ops->flush_pmksa)
8837                 return -EOPNOTSUPP;
8838
8839         return rdev_flush_pmksa(rdev, dev);
8840 }
8841
8842 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8843 {
8844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8845         struct net_device *dev = info->user_ptr[1];
8846         u8 action_code, dialog_token;
8847         u32 peer_capability = 0;
8848         u16 status_code;
8849         u8 *peer;
8850         bool initiator;
8851
8852         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8853             !rdev->ops->tdls_mgmt)
8854                 return -EOPNOTSUPP;
8855
8856         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8857             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8858             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8859             !info->attrs[NL80211_ATTR_IE] ||
8860             !info->attrs[NL80211_ATTR_MAC])
8861                 return -EINVAL;
8862
8863         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8864         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8865         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8866         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8867         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8868         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8869                 peer_capability =
8870                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8871
8872         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8873                               dialog_token, status_code, peer_capability,
8874                               initiator,
8875                               nla_data(info->attrs[NL80211_ATTR_IE]),
8876                               nla_len(info->attrs[NL80211_ATTR_IE]));
8877 }
8878
8879 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8880 {
8881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8882         struct net_device *dev = info->user_ptr[1];
8883         enum nl80211_tdls_operation operation;
8884         u8 *peer;
8885
8886         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8887             !rdev->ops->tdls_oper)
8888                 return -EOPNOTSUPP;
8889
8890         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8891             !info->attrs[NL80211_ATTR_MAC])
8892                 return -EINVAL;
8893
8894         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8895         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8896
8897         return rdev_tdls_oper(rdev, dev, peer, operation);
8898 }
8899
8900 static int nl80211_remain_on_channel(struct sk_buff *skb,
8901                                      struct genl_info *info)
8902 {
8903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8904         struct wireless_dev *wdev = info->user_ptr[1];
8905         struct cfg80211_chan_def chandef;
8906         struct sk_buff *msg;
8907         void *hdr;
8908         u64 cookie;
8909         u32 duration;
8910         int err;
8911
8912         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8913             !info->attrs[NL80211_ATTR_DURATION])
8914                 return -EINVAL;
8915
8916         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8917
8918         if (!rdev->ops->remain_on_channel ||
8919             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8920                 return -EOPNOTSUPP;
8921
8922         /*
8923          * We should be on that channel for at least a minimum amount of
8924          * time (10ms) but no longer than the driver supports.
8925          */
8926         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8927             duration > rdev->wiphy.max_remain_on_channel_duration)
8928                 return -EINVAL;
8929
8930         err = nl80211_parse_chandef(rdev, info, &chandef);
8931         if (err)
8932                 return err;
8933
8934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8935         if (!msg)
8936                 return -ENOMEM;
8937
8938         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8939                              NL80211_CMD_REMAIN_ON_CHANNEL);
8940         if (!hdr) {
8941                 err = -ENOBUFS;
8942                 goto free_msg;
8943         }
8944
8945         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8946                                      duration, &cookie);
8947
8948         if (err)
8949                 goto free_msg;
8950
8951         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
8952                               NL80211_ATTR_PAD))
8953                 goto nla_put_failure;
8954
8955         genlmsg_end(msg, hdr);
8956
8957         return genlmsg_reply(msg, info);
8958
8959  nla_put_failure:
8960         err = -ENOBUFS;
8961  free_msg:
8962         nlmsg_free(msg);
8963         return err;
8964 }
8965
8966 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8967                                             struct genl_info *info)
8968 {
8969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8970         struct wireless_dev *wdev = info->user_ptr[1];
8971         u64 cookie;
8972
8973         if (!info->attrs[NL80211_ATTR_COOKIE])
8974                 return -EINVAL;
8975
8976         if (!rdev->ops->cancel_remain_on_channel)
8977                 return -EOPNOTSUPP;
8978
8979         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8980
8981         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8982 }
8983
8984 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8985                                        struct genl_info *info)
8986 {
8987         struct cfg80211_bitrate_mask mask;
8988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8989         struct net_device *dev = info->user_ptr[1];
8990         int err;
8991
8992         if (!rdev->ops->set_bitrate_mask)
8993                 return -EOPNOTSUPP;
8994
8995         err = nl80211_parse_tx_bitrate_mask(info, &mask);
8996         if (err)
8997                 return err;
8998
8999         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9000 }
9001
9002 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9003 {
9004         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9005         struct wireless_dev *wdev = info->user_ptr[1];
9006         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9007
9008         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9009                 return -EINVAL;
9010
9011         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9012                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9013
9014         switch (wdev->iftype) {
9015         case NL80211_IFTYPE_STATION:
9016         case NL80211_IFTYPE_ADHOC:
9017         case NL80211_IFTYPE_P2P_CLIENT:
9018         case NL80211_IFTYPE_AP:
9019         case NL80211_IFTYPE_AP_VLAN:
9020         case NL80211_IFTYPE_MESH_POINT:
9021         case NL80211_IFTYPE_P2P_GO:
9022         case NL80211_IFTYPE_P2P_DEVICE:
9023                 break;
9024         case NL80211_IFTYPE_NAN:
9025         default:
9026                 return -EOPNOTSUPP;
9027         }
9028
9029         /* not much point in registering if we can't reply */
9030         if (!rdev->ops->mgmt_tx)
9031                 return -EOPNOTSUPP;
9032
9033         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9034                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9035                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9036 }
9037
9038 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9039 {
9040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9041         struct wireless_dev *wdev = info->user_ptr[1];
9042         struct cfg80211_chan_def chandef;
9043         int err;
9044         void *hdr = NULL;
9045         u64 cookie;
9046         struct sk_buff *msg = NULL;
9047         struct cfg80211_mgmt_tx_params params = {
9048                 .dont_wait_for_ack =
9049                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9050         };
9051
9052         if (!info->attrs[NL80211_ATTR_FRAME])
9053                 return -EINVAL;
9054
9055         if (!rdev->ops->mgmt_tx)
9056                 return -EOPNOTSUPP;
9057
9058         switch (wdev->iftype) {
9059         case NL80211_IFTYPE_P2P_DEVICE:
9060                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9061                         return -EINVAL;
9062         case NL80211_IFTYPE_STATION:
9063         case NL80211_IFTYPE_ADHOC:
9064         case NL80211_IFTYPE_P2P_CLIENT:
9065         case NL80211_IFTYPE_AP:
9066         case NL80211_IFTYPE_AP_VLAN:
9067         case NL80211_IFTYPE_MESH_POINT:
9068         case NL80211_IFTYPE_P2P_GO:
9069                 break;
9070         case NL80211_IFTYPE_NAN:
9071         default:
9072                 return -EOPNOTSUPP;
9073         }
9074
9075         if (info->attrs[NL80211_ATTR_DURATION]) {
9076                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9077                         return -EINVAL;
9078                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9079
9080                 /*
9081                  * We should wait on the channel for at least a minimum amount
9082                  * of time (10ms) but no longer than the driver supports.
9083                  */
9084                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9085                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9086                         return -EINVAL;
9087         }
9088
9089         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9090
9091         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9092                 return -EINVAL;
9093
9094         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9095
9096         /* get the channel if any has been specified, otherwise pass NULL to
9097          * the driver. The latter will use the current one
9098          */
9099         chandef.chan = NULL;
9100         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9101                 err = nl80211_parse_chandef(rdev, info, &chandef);
9102                 if (err)
9103                         return err;
9104         }
9105
9106         if (!chandef.chan && params.offchan)
9107                 return -EINVAL;
9108
9109         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9110         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9111
9112         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9113                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9114                 int i;
9115
9116                 if (len % sizeof(u16))
9117                         return -EINVAL;
9118
9119                 params.n_csa_offsets = len / sizeof(u16);
9120                 params.csa_offsets =
9121                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9122
9123                 /* check that all the offsets fit the frame */
9124                 for (i = 0; i < params.n_csa_offsets; i++) {
9125                         if (params.csa_offsets[i] >= params.len)
9126                                 return -EINVAL;
9127                 }
9128         }
9129
9130         if (!params.dont_wait_for_ack) {
9131                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9132                 if (!msg)
9133                         return -ENOMEM;
9134
9135                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9136                                      NL80211_CMD_FRAME);
9137                 if (!hdr) {
9138                         err = -ENOBUFS;
9139                         goto free_msg;
9140                 }
9141         }
9142
9143         params.chan = chandef.chan;
9144         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9145         if (err)
9146                 goto free_msg;
9147
9148         if (msg) {
9149                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9150                                       NL80211_ATTR_PAD))
9151                         goto nla_put_failure;
9152
9153                 genlmsg_end(msg, hdr);
9154                 return genlmsg_reply(msg, info);
9155         }
9156
9157         return 0;
9158
9159  nla_put_failure:
9160         err = -ENOBUFS;
9161  free_msg:
9162         nlmsg_free(msg);
9163         return err;
9164 }
9165
9166 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9167 {
9168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9169         struct wireless_dev *wdev = info->user_ptr[1];
9170         u64 cookie;
9171
9172         if (!info->attrs[NL80211_ATTR_COOKIE])
9173                 return -EINVAL;
9174
9175         if (!rdev->ops->mgmt_tx_cancel_wait)
9176                 return -EOPNOTSUPP;
9177
9178         switch (wdev->iftype) {
9179         case NL80211_IFTYPE_STATION:
9180         case NL80211_IFTYPE_ADHOC:
9181         case NL80211_IFTYPE_P2P_CLIENT:
9182         case NL80211_IFTYPE_AP:
9183         case NL80211_IFTYPE_AP_VLAN:
9184         case NL80211_IFTYPE_P2P_GO:
9185         case NL80211_IFTYPE_P2P_DEVICE:
9186                 break;
9187         case NL80211_IFTYPE_NAN:
9188         default:
9189                 return -EOPNOTSUPP;
9190         }
9191
9192         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9193
9194         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9195 }
9196
9197 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9198 {
9199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9200         struct wireless_dev *wdev;
9201         struct net_device *dev = info->user_ptr[1];
9202         u8 ps_state;
9203         bool state;
9204         int err;
9205
9206         if (!info->attrs[NL80211_ATTR_PS_STATE])
9207                 return -EINVAL;
9208
9209         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9210
9211         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9212                 return -EINVAL;
9213
9214         wdev = dev->ieee80211_ptr;
9215
9216         if (!rdev->ops->set_power_mgmt)
9217                 return -EOPNOTSUPP;
9218
9219         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9220
9221         if (state == wdev->ps)
9222                 return 0;
9223
9224         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9225         if (!err)
9226                 wdev->ps = state;
9227         return err;
9228 }
9229
9230 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9231 {
9232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9233         enum nl80211_ps_state ps_state;
9234         struct wireless_dev *wdev;
9235         struct net_device *dev = info->user_ptr[1];
9236         struct sk_buff *msg;
9237         void *hdr;
9238         int err;
9239
9240         wdev = dev->ieee80211_ptr;
9241
9242         if (!rdev->ops->set_power_mgmt)
9243                 return -EOPNOTSUPP;
9244
9245         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9246         if (!msg)
9247                 return -ENOMEM;
9248
9249         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9250                              NL80211_CMD_GET_POWER_SAVE);
9251         if (!hdr) {
9252                 err = -ENOBUFS;
9253                 goto free_msg;
9254         }
9255
9256         if (wdev->ps)
9257                 ps_state = NL80211_PS_ENABLED;
9258         else
9259                 ps_state = NL80211_PS_DISABLED;
9260
9261         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9262                 goto nla_put_failure;
9263
9264         genlmsg_end(msg, hdr);
9265         return genlmsg_reply(msg, info);
9266
9267  nla_put_failure:
9268         err = -ENOBUFS;
9269  free_msg:
9270         nlmsg_free(msg);
9271         return err;
9272 }
9273
9274 static const struct nla_policy
9275 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9276         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9277         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9278         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9279         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9280         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9281         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9282 };
9283
9284 static int nl80211_set_cqm_txe(struct genl_info *info,
9285                                u32 rate, u32 pkts, u32 intvl)
9286 {
9287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9288         struct net_device *dev = info->user_ptr[1];
9289         struct wireless_dev *wdev = dev->ieee80211_ptr;
9290
9291         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9292                 return -EINVAL;
9293
9294         if (!rdev->ops->set_cqm_txe_config)
9295                 return -EOPNOTSUPP;
9296
9297         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9298             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9299                 return -EOPNOTSUPP;
9300
9301         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9302 }
9303
9304 static int nl80211_set_cqm_rssi(struct genl_info *info,
9305                                 s32 threshold, u32 hysteresis)
9306 {
9307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9308         struct net_device *dev = info->user_ptr[1];
9309         struct wireless_dev *wdev = dev->ieee80211_ptr;
9310
9311         if (threshold > 0)
9312                 return -EINVAL;
9313
9314         /* disabling - hysteresis should also be zero then */
9315         if (threshold == 0)
9316                 hysteresis = 0;
9317
9318         if (!rdev->ops->set_cqm_rssi_config)
9319                 return -EOPNOTSUPP;
9320
9321         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9322             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9323                 return -EOPNOTSUPP;
9324
9325         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9326 }
9327
9328 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9329 {
9330         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9331         struct nlattr *cqm;
9332         int err;
9333
9334         cqm = info->attrs[NL80211_ATTR_CQM];
9335         if (!cqm)
9336                 return -EINVAL;
9337
9338         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9339                                nl80211_attr_cqm_policy);
9340         if (err)
9341                 return err;
9342
9343         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9344             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9345                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9346                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9347
9348                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9349         }
9350
9351         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9352             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9353             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9354                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9355                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9356                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9357
9358                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9359         }
9360
9361         return -EINVAL;
9362 }
9363
9364 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9365 {
9366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9367         struct net_device *dev = info->user_ptr[1];
9368         struct ocb_setup setup = {};
9369         int err;
9370
9371         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9372         if (err)
9373                 return err;
9374
9375         return cfg80211_join_ocb(rdev, dev, &setup);
9376 }
9377
9378 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9379 {
9380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9381         struct net_device *dev = info->user_ptr[1];
9382
9383         return cfg80211_leave_ocb(rdev, dev);
9384 }
9385
9386 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9387 {
9388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9389         struct net_device *dev = info->user_ptr[1];
9390         struct mesh_config cfg;
9391         struct mesh_setup setup;
9392         int err;
9393
9394         /* start with default */
9395         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9396         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9397
9398         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9399                 /* and parse parameters if given */
9400                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9401                 if (err)
9402                         return err;
9403         }
9404
9405         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9406             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9407                 return -EINVAL;
9408
9409         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9410         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9411
9412         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9413             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9414                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9415                         return -EINVAL;
9416
9417         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9418                 setup.beacon_interval =
9419                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9420
9421                 err = cfg80211_validate_beacon_int(rdev, setup.beacon_interval);
9422                 if (err)
9423                         return err;
9424         }
9425
9426         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9427                 setup.dtim_period =
9428                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9429                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9430                         return -EINVAL;
9431         }
9432
9433         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9434                 /* parse additional setup parameters if given */
9435                 err = nl80211_parse_mesh_setup(info, &setup);
9436                 if (err)
9437                         return err;
9438         }
9439
9440         if (setup.user_mpm)
9441                 cfg.auto_open_plinks = false;
9442
9443         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9444                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9445                 if (err)
9446                         return err;
9447         } else {
9448                 /* cfg80211_join_mesh() will sort it out */
9449                 setup.chandef.chan = NULL;
9450         }
9451
9452         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9453                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9454                 int n_rates =
9455                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9456                 struct ieee80211_supported_band *sband;
9457
9458                 if (!setup.chandef.chan)
9459                         return -EINVAL;
9460
9461                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9462
9463                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9464                                              &setup.basic_rates);
9465                 if (err)
9466                         return err;
9467         }
9468
9469         if (info->attrs[NL80211_ATTR_TX_RATES]) {
9470                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9471                 if (err)
9472                         return err;
9473
9474                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
9475                                               &setup.beacon_rate);
9476                 if (err)
9477                         return err;
9478         }
9479
9480         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9481 }
9482
9483 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9484 {
9485         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9486         struct net_device *dev = info->user_ptr[1];
9487
9488         return cfg80211_leave_mesh(rdev, dev);
9489 }
9490
9491 #ifdef CONFIG_PM
9492 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9493                                         struct cfg80211_registered_device *rdev)
9494 {
9495         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9496         struct nlattr *nl_pats, *nl_pat;
9497         int i, pat_len;
9498
9499         if (!wowlan->n_patterns)
9500                 return 0;
9501
9502         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9503         if (!nl_pats)
9504                 return -ENOBUFS;
9505
9506         for (i = 0; i < wowlan->n_patterns; i++) {
9507                 nl_pat = nla_nest_start(msg, i + 1);
9508                 if (!nl_pat)
9509                         return -ENOBUFS;
9510                 pat_len = wowlan->patterns[i].pattern_len;
9511                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9512                             wowlan->patterns[i].mask) ||
9513                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9514                             wowlan->patterns[i].pattern) ||
9515                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9516                                 wowlan->patterns[i].pkt_offset))
9517                         return -ENOBUFS;
9518                 nla_nest_end(msg, nl_pat);
9519         }
9520         nla_nest_end(msg, nl_pats);
9521
9522         return 0;
9523 }
9524
9525 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9526                                    struct cfg80211_wowlan_tcp *tcp)
9527 {
9528         struct nlattr *nl_tcp;
9529
9530         if (!tcp)
9531                 return 0;
9532
9533         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9534         if (!nl_tcp)
9535                 return -ENOBUFS;
9536
9537         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9538             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9539             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9540             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9541             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9542             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9543                     tcp->payload_len, tcp->payload) ||
9544             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9545                         tcp->data_interval) ||
9546             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9547                     tcp->wake_len, tcp->wake_data) ||
9548             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9549                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9550                 return -ENOBUFS;
9551
9552         if (tcp->payload_seq.len &&
9553             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9554                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9555                 return -ENOBUFS;
9556
9557         if (tcp->payload_tok.len &&
9558             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9559                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9560                     &tcp->payload_tok))
9561                 return -ENOBUFS;
9562
9563         nla_nest_end(msg, nl_tcp);
9564
9565         return 0;
9566 }
9567
9568 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9569                                   struct cfg80211_sched_scan_request *req)
9570 {
9571         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9572         int i;
9573
9574         if (!req)
9575                 return 0;
9576
9577         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9578         if (!nd)
9579                 return -ENOBUFS;
9580
9581         if (req->n_scan_plans == 1 &&
9582             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9583                         req->scan_plans[0].interval * 1000))
9584                 return -ENOBUFS;
9585
9586         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9587                 return -ENOBUFS;
9588
9589         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9590         if (!freqs)
9591                 return -ENOBUFS;
9592
9593         for (i = 0; i < req->n_channels; i++) {
9594                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9595                         return -ENOBUFS;
9596         }
9597
9598         nla_nest_end(msg, freqs);
9599
9600         if (req->n_match_sets) {
9601                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9602                 if (!matches)
9603                         return -ENOBUFS;
9604
9605                 for (i = 0; i < req->n_match_sets; i++) {
9606                         match = nla_nest_start(msg, i);
9607                         if (!match)
9608                                 return -ENOBUFS;
9609
9610                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9611                                     req->match_sets[i].ssid.ssid_len,
9612                                     req->match_sets[i].ssid.ssid))
9613                                 return -ENOBUFS;
9614                         nla_nest_end(msg, match);
9615                 }
9616                 nla_nest_end(msg, matches);
9617         }
9618
9619         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9620         if (!scan_plans)
9621                 return -ENOBUFS;
9622
9623         for (i = 0; i < req->n_scan_plans; i++) {
9624                 scan_plan = nla_nest_start(msg, i + 1);
9625                 if (!scan_plan)
9626                         return -ENOBUFS;
9627
9628                 if (!scan_plan ||
9629                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9630                                 req->scan_plans[i].interval) ||
9631                     (req->scan_plans[i].iterations &&
9632                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9633                                  req->scan_plans[i].iterations)))
9634                         return -ENOBUFS;
9635                 nla_nest_end(msg, scan_plan);
9636         }
9637         nla_nest_end(msg, scan_plans);
9638
9639         nla_nest_end(msg, nd);
9640
9641         return 0;
9642 }
9643
9644 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9645 {
9646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9647         struct sk_buff *msg;
9648         void *hdr;
9649         u32 size = NLMSG_DEFAULT_SIZE;
9650
9651         if (!rdev->wiphy.wowlan)
9652                 return -EOPNOTSUPP;
9653
9654         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9655                 /* adjust size to have room for all the data */
9656                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9657                         rdev->wiphy.wowlan_config->tcp->payload_len +
9658                         rdev->wiphy.wowlan_config->tcp->wake_len +
9659                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9660         }
9661
9662         msg = nlmsg_new(size, GFP_KERNEL);
9663         if (!msg)
9664                 return -ENOMEM;
9665
9666         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9667                              NL80211_CMD_GET_WOWLAN);
9668         if (!hdr)
9669                 goto nla_put_failure;
9670
9671         if (rdev->wiphy.wowlan_config) {
9672                 struct nlattr *nl_wowlan;
9673
9674                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9675                 if (!nl_wowlan)
9676                         goto nla_put_failure;
9677
9678                 if ((rdev->wiphy.wowlan_config->any &&
9679                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9680                     (rdev->wiphy.wowlan_config->disconnect &&
9681                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9682                     (rdev->wiphy.wowlan_config->magic_pkt &&
9683                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9684                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9685                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9686                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9687                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9688                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9689                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9690                     (rdev->wiphy.wowlan_config->rfkill_release &&
9691                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9692                         goto nla_put_failure;
9693
9694                 if (nl80211_send_wowlan_patterns(msg, rdev))
9695                         goto nla_put_failure;
9696
9697                 if (nl80211_send_wowlan_tcp(msg,
9698                                             rdev->wiphy.wowlan_config->tcp))
9699                         goto nla_put_failure;
9700
9701                 if (nl80211_send_wowlan_nd(
9702                             msg,
9703                             rdev->wiphy.wowlan_config->nd_config))
9704                         goto nla_put_failure;
9705
9706                 nla_nest_end(msg, nl_wowlan);
9707         }
9708
9709         genlmsg_end(msg, hdr);
9710         return genlmsg_reply(msg, info);
9711
9712 nla_put_failure:
9713         nlmsg_free(msg);
9714         return -ENOBUFS;
9715 }
9716
9717 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9718                                     struct nlattr *attr,
9719                                     struct cfg80211_wowlan *trig)
9720 {
9721         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9722         struct cfg80211_wowlan_tcp *cfg;
9723         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9724         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9725         u32 size;
9726         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9727         int err, port;
9728
9729         if (!rdev->wiphy.wowlan->tcp)
9730                 return -EINVAL;
9731
9732         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9733                         nla_data(attr), nla_len(attr),
9734                         nl80211_wowlan_tcp_policy);
9735         if (err)
9736                 return err;
9737
9738         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9739             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9740             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9741             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9742             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9743             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9744             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9745             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9746                 return -EINVAL;
9747
9748         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9749         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9750                 return -EINVAL;
9751
9752         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9753                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9754             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9755                 return -EINVAL;
9756
9757         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9758         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9759                 return -EINVAL;
9760
9761         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9762         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9763                 return -EINVAL;
9764
9765         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9766                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9767
9768                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9769                 tokens_size = tokln - sizeof(*tok);
9770
9771                 if (!tok->len || tokens_size % tok->len)
9772                         return -EINVAL;
9773                 if (!rdev->wiphy.wowlan->tcp->tok)
9774                         return -EINVAL;
9775                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9776                         return -EINVAL;
9777                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9778                         return -EINVAL;
9779                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9780                         return -EINVAL;
9781                 if (tok->offset + tok->len > data_size)
9782                         return -EINVAL;
9783         }
9784
9785         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9786                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9787                 if (!rdev->wiphy.wowlan->tcp->seq)
9788                         return -EINVAL;
9789                 if (seq->len == 0 || seq->len > 4)
9790                         return -EINVAL;
9791                 if (seq->len + seq->offset > data_size)
9792                         return -EINVAL;
9793         }
9794
9795         size = sizeof(*cfg);
9796         size += data_size;
9797         size += wake_size + wake_mask_size;
9798         size += tokens_size;
9799
9800         cfg = kzalloc(size, GFP_KERNEL);
9801         if (!cfg)
9802                 return -ENOMEM;
9803         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9804         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9805         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9806                ETH_ALEN);
9807         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9808                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9809         else
9810                 port = 0;
9811 #ifdef CONFIG_INET
9812         /* allocate a socket and port for it and use it */
9813         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9814                             IPPROTO_TCP, &cfg->sock, 1);
9815         if (err) {
9816                 kfree(cfg);
9817                 return err;
9818         }
9819         if (inet_csk_get_port(cfg->sock->sk, port)) {
9820                 sock_release(cfg->sock);
9821                 kfree(cfg);
9822                 return -EADDRINUSE;
9823         }
9824         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9825 #else
9826         if (!port) {
9827                 kfree(cfg);
9828                 return -EINVAL;
9829         }
9830         cfg->src_port = port;
9831 #endif
9832
9833         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9834         cfg->payload_len = data_size;
9835         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9836         memcpy((void *)cfg->payload,
9837                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9838                data_size);
9839         if (seq)
9840                 cfg->payload_seq = *seq;
9841         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9842         cfg->wake_len = wake_size;
9843         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9844         memcpy((void *)cfg->wake_data,
9845                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9846                wake_size);
9847         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9848                          data_size + wake_size;
9849         memcpy((void *)cfg->wake_mask,
9850                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9851                wake_mask_size);
9852         if (tok) {
9853                 cfg->tokens_size = tokens_size;
9854                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9855         }
9856
9857         trig->tcp = cfg;
9858
9859         return 0;
9860 }
9861
9862 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9863                                    const struct wiphy_wowlan_support *wowlan,
9864                                    struct nlattr *attr,
9865                                    struct cfg80211_wowlan *trig)
9866 {
9867         struct nlattr **tb;
9868         int err;
9869
9870         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9871         if (!tb)
9872                 return -ENOMEM;
9873
9874         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9875                 err = -EOPNOTSUPP;
9876                 goto out;
9877         }
9878
9879         err = nla_parse(tb, NL80211_ATTR_MAX,
9880                         nla_data(attr), nla_len(attr),
9881                         nl80211_policy);
9882         if (err)
9883                 goto out;
9884
9885         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9886         err = PTR_ERR_OR_ZERO(trig->nd_config);
9887         if (err)
9888                 trig->nd_config = NULL;
9889
9890 out:
9891         kfree(tb);
9892         return err;
9893 }
9894
9895 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9896 {
9897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9898         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9899         struct cfg80211_wowlan new_triggers = {};
9900         struct cfg80211_wowlan *ntrig;
9901         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9902         int err, i;
9903         bool prev_enabled = rdev->wiphy.wowlan_config;
9904         bool regular = false;
9905
9906         if (!wowlan)
9907                 return -EOPNOTSUPP;
9908
9909         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9910                 cfg80211_rdev_free_wowlan(rdev);
9911                 rdev->wiphy.wowlan_config = NULL;
9912                 goto set_wakeup;
9913         }
9914
9915         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9916                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9917                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9918                         nl80211_wowlan_policy);
9919         if (err)
9920                 return err;
9921
9922         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9923                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9924                         return -EINVAL;
9925                 new_triggers.any = true;
9926         }
9927
9928         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9929                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9930                         return -EINVAL;
9931                 new_triggers.disconnect = true;
9932                 regular = true;
9933         }
9934
9935         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9936                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9937                         return -EINVAL;
9938                 new_triggers.magic_pkt = true;
9939                 regular = true;
9940         }
9941
9942         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9943                 return -EINVAL;
9944
9945         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9946                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9947                         return -EINVAL;
9948                 new_triggers.gtk_rekey_failure = true;
9949                 regular = true;
9950         }
9951
9952         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9953                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9954                         return -EINVAL;
9955                 new_triggers.eap_identity_req = true;
9956                 regular = true;
9957         }
9958
9959         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9960                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9961                         return -EINVAL;
9962                 new_triggers.four_way_handshake = true;
9963                 regular = true;
9964         }
9965
9966         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9967                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9968                         return -EINVAL;
9969                 new_triggers.rfkill_release = true;
9970                 regular = true;
9971         }
9972
9973         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9974                 struct nlattr *pat;
9975                 int n_patterns = 0;
9976                 int rem, pat_len, mask_len, pkt_offset;
9977                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9978
9979                 regular = true;
9980
9981                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9982                                     rem)
9983                         n_patterns++;
9984                 if (n_patterns > wowlan->n_patterns)
9985                         return -EINVAL;
9986
9987                 new_triggers.patterns = kcalloc(n_patterns,
9988                                                 sizeof(new_triggers.patterns[0]),
9989                                                 GFP_KERNEL);
9990                 if (!new_triggers.patterns)
9991                         return -ENOMEM;
9992
9993                 new_triggers.n_patterns = n_patterns;
9994                 i = 0;
9995
9996                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9997                                     rem) {
9998                         u8 *mask_pat;
9999
10000                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10001                                   nla_len(pat), NULL);
10002                         err = -EINVAL;
10003                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10004                             !pat_tb[NL80211_PKTPAT_PATTERN])
10005                                 goto error;
10006                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10007                         mask_len = DIV_ROUND_UP(pat_len, 8);
10008                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10009                                 goto error;
10010                         if (pat_len > wowlan->pattern_max_len ||
10011                             pat_len < wowlan->pattern_min_len)
10012                                 goto error;
10013
10014                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
10015                                 pkt_offset = 0;
10016                         else
10017                                 pkt_offset = nla_get_u32(
10018                                         pat_tb[NL80211_PKTPAT_OFFSET]);
10019                         if (pkt_offset > wowlan->max_pkt_offset)
10020                                 goto error;
10021                         new_triggers.patterns[i].pkt_offset = pkt_offset;
10022
10023                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10024                         if (!mask_pat) {
10025                                 err = -ENOMEM;
10026                                 goto error;
10027                         }
10028                         new_triggers.patterns[i].mask = mask_pat;
10029                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10030                                mask_len);
10031                         mask_pat += mask_len;
10032                         new_triggers.patterns[i].pattern = mask_pat;
10033                         new_triggers.patterns[i].pattern_len = pat_len;
10034                         memcpy(mask_pat,
10035                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10036                                pat_len);
10037                         i++;
10038                 }
10039         }
10040
10041         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10042                 regular = true;
10043                 err = nl80211_parse_wowlan_tcp(
10044                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10045                         &new_triggers);
10046                 if (err)
10047                         goto error;
10048         }
10049
10050         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10051                 regular = true;
10052                 err = nl80211_parse_wowlan_nd(
10053                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10054                         &new_triggers);
10055                 if (err)
10056                         goto error;
10057         }
10058
10059         /* The 'any' trigger means the device continues operating more or less
10060          * as in its normal operation mode and wakes up the host on most of the
10061          * normal interrupts (like packet RX, ...)
10062          * It therefore makes little sense to combine with the more constrained
10063          * wakeup trigger modes.
10064          */
10065         if (new_triggers.any && regular) {
10066                 err = -EINVAL;
10067                 goto error;
10068         }
10069
10070         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10071         if (!ntrig) {
10072                 err = -ENOMEM;
10073                 goto error;
10074         }
10075         cfg80211_rdev_free_wowlan(rdev);
10076         rdev->wiphy.wowlan_config = ntrig;
10077
10078  set_wakeup:
10079         if (rdev->ops->set_wakeup &&
10080             prev_enabled != !!rdev->wiphy.wowlan_config)
10081                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10082
10083         return 0;
10084  error:
10085         for (i = 0; i < new_triggers.n_patterns; i++)
10086                 kfree(new_triggers.patterns[i].mask);
10087         kfree(new_triggers.patterns);
10088         if (new_triggers.tcp && new_triggers.tcp->sock)
10089                 sock_release(new_triggers.tcp->sock);
10090         kfree(new_triggers.tcp);
10091         kfree(new_triggers.nd_config);
10092         return err;
10093 }
10094 #endif
10095
10096 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10097                                        struct cfg80211_registered_device *rdev)
10098 {
10099         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10100         int i, j, pat_len;
10101         struct cfg80211_coalesce_rules *rule;
10102
10103         if (!rdev->coalesce->n_rules)
10104                 return 0;
10105
10106         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10107         if (!nl_rules)
10108                 return -ENOBUFS;
10109
10110         for (i = 0; i < rdev->coalesce->n_rules; i++) {
10111                 nl_rule = nla_nest_start(msg, i + 1);
10112                 if (!nl_rule)
10113                         return -ENOBUFS;
10114
10115                 rule = &rdev->coalesce->rules[i];
10116                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10117                                 rule->delay))
10118                         return -ENOBUFS;
10119
10120                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10121                                 rule->condition))
10122                         return -ENOBUFS;
10123
10124                 nl_pats = nla_nest_start(msg,
10125                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10126                 if (!nl_pats)
10127                         return -ENOBUFS;
10128
10129                 for (j = 0; j < rule->n_patterns; j++) {
10130                         nl_pat = nla_nest_start(msg, j + 1);
10131                         if (!nl_pat)
10132                                 return -ENOBUFS;
10133                         pat_len = rule->patterns[j].pattern_len;
10134                         if (nla_put(msg, NL80211_PKTPAT_MASK,
10135                                     DIV_ROUND_UP(pat_len, 8),
10136                                     rule->patterns[j].mask) ||
10137                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10138                                     rule->patterns[j].pattern) ||
10139                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10140                                         rule->patterns[j].pkt_offset))
10141                                 return -ENOBUFS;
10142                         nla_nest_end(msg, nl_pat);
10143                 }
10144                 nla_nest_end(msg, nl_pats);
10145                 nla_nest_end(msg, nl_rule);
10146         }
10147         nla_nest_end(msg, nl_rules);
10148
10149         return 0;
10150 }
10151
10152 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10153 {
10154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10155         struct sk_buff *msg;
10156         void *hdr;
10157
10158         if (!rdev->wiphy.coalesce)
10159                 return -EOPNOTSUPP;
10160
10161         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10162         if (!msg)
10163                 return -ENOMEM;
10164
10165         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10166                              NL80211_CMD_GET_COALESCE);
10167         if (!hdr)
10168                 goto nla_put_failure;
10169
10170         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10171                 goto nla_put_failure;
10172
10173         genlmsg_end(msg, hdr);
10174         return genlmsg_reply(msg, info);
10175
10176 nla_put_failure:
10177         nlmsg_free(msg);
10178         return -ENOBUFS;
10179 }
10180
10181 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10182 {
10183         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10184         int i, j;
10185         struct cfg80211_coalesce_rules *rule;
10186
10187         if (!coalesce)
10188                 return;
10189
10190         for (i = 0; i < coalesce->n_rules; i++) {
10191                 rule = &coalesce->rules[i];
10192                 for (j = 0; j < rule->n_patterns; j++)
10193                         kfree(rule->patterns[j].mask);
10194                 kfree(rule->patterns);
10195         }
10196         kfree(coalesce->rules);
10197         kfree(coalesce);
10198         rdev->coalesce = NULL;
10199 }
10200
10201 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10202                                        struct nlattr *rule,
10203                                        struct cfg80211_coalesce_rules *new_rule)
10204 {
10205         int err, i;
10206         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10207         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10208         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10209         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10210
10211         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
10212                         nla_len(rule), nl80211_coalesce_policy);
10213         if (err)
10214                 return err;
10215
10216         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10217                 new_rule->delay =
10218                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10219         if (new_rule->delay > coalesce->max_delay)
10220                 return -EINVAL;
10221
10222         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10223                 new_rule->condition =
10224                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10225         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10226             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10227                 return -EINVAL;
10228
10229         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10230                 return -EINVAL;
10231
10232         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10233                             rem)
10234                 n_patterns++;
10235         if (n_patterns > coalesce->n_patterns)
10236                 return -EINVAL;
10237
10238         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10239                                      GFP_KERNEL);
10240         if (!new_rule->patterns)
10241                 return -ENOMEM;
10242
10243         new_rule->n_patterns = n_patterns;
10244         i = 0;
10245
10246         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10247                             rem) {
10248                 u8 *mask_pat;
10249
10250                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10251                           nla_len(pat), NULL);
10252                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10253                     !pat_tb[NL80211_PKTPAT_PATTERN])
10254                         return -EINVAL;
10255                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10256                 mask_len = DIV_ROUND_UP(pat_len, 8);
10257                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10258                         return -EINVAL;
10259                 if (pat_len > coalesce->pattern_max_len ||
10260                     pat_len < coalesce->pattern_min_len)
10261                         return -EINVAL;
10262
10263                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10264                         pkt_offset = 0;
10265                 else
10266                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10267                 if (pkt_offset > coalesce->max_pkt_offset)
10268                         return -EINVAL;
10269                 new_rule->patterns[i].pkt_offset = pkt_offset;
10270
10271                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10272                 if (!mask_pat)
10273                         return -ENOMEM;
10274
10275                 new_rule->patterns[i].mask = mask_pat;
10276                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10277                        mask_len);
10278
10279                 mask_pat += mask_len;
10280                 new_rule->patterns[i].pattern = mask_pat;
10281                 new_rule->patterns[i].pattern_len = pat_len;
10282                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10283                        pat_len);
10284                 i++;
10285         }
10286
10287         return 0;
10288 }
10289
10290 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10291 {
10292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10293         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10294         struct cfg80211_coalesce new_coalesce = {};
10295         struct cfg80211_coalesce *n_coalesce;
10296         int err, rem_rule, n_rules = 0, i, j;
10297         struct nlattr *rule;
10298         struct cfg80211_coalesce_rules *tmp_rule;
10299
10300         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10301                 return -EOPNOTSUPP;
10302
10303         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10304                 cfg80211_rdev_free_coalesce(rdev);
10305                 rdev_set_coalesce(rdev, NULL);
10306                 return 0;
10307         }
10308
10309         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10310                             rem_rule)
10311                 n_rules++;
10312         if (n_rules > coalesce->n_rules)
10313                 return -EINVAL;
10314
10315         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10316                                      GFP_KERNEL);
10317         if (!new_coalesce.rules)
10318                 return -ENOMEM;
10319
10320         new_coalesce.n_rules = n_rules;
10321         i = 0;
10322
10323         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10324                             rem_rule) {
10325                 err = nl80211_parse_coalesce_rule(rdev, rule,
10326                                                   &new_coalesce.rules[i]);
10327                 if (err)
10328                         goto error;
10329
10330                 i++;
10331         }
10332
10333         err = rdev_set_coalesce(rdev, &new_coalesce);
10334         if (err)
10335                 goto error;
10336
10337         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10338         if (!n_coalesce) {
10339                 err = -ENOMEM;
10340                 goto error;
10341         }
10342         cfg80211_rdev_free_coalesce(rdev);
10343         rdev->coalesce = n_coalesce;
10344
10345         return 0;
10346 error:
10347         for (i = 0; i < new_coalesce.n_rules; i++) {
10348                 tmp_rule = &new_coalesce.rules[i];
10349                 for (j = 0; j < tmp_rule->n_patterns; j++)
10350                         kfree(tmp_rule->patterns[j].mask);
10351                 kfree(tmp_rule->patterns);
10352         }
10353         kfree(new_coalesce.rules);
10354
10355         return err;
10356 }
10357
10358 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10359 {
10360         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10361         struct net_device *dev = info->user_ptr[1];
10362         struct wireless_dev *wdev = dev->ieee80211_ptr;
10363         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10364         struct cfg80211_gtk_rekey_data rekey_data;
10365         int err;
10366
10367         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10368                 return -EINVAL;
10369
10370         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10371                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10372                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10373                         nl80211_rekey_policy);
10374         if (err)
10375                 return err;
10376
10377         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10378                 return -ERANGE;
10379         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10380                 return -ERANGE;
10381         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10382                 return -ERANGE;
10383
10384         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10385         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10386         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10387
10388         wdev_lock(wdev);
10389         if (!wdev->current_bss) {
10390                 err = -ENOTCONN;
10391                 goto out;
10392         }
10393
10394         if (!rdev->ops->set_rekey_data) {
10395                 err = -EOPNOTSUPP;
10396                 goto out;
10397         }
10398
10399         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10400  out:
10401         wdev_unlock(wdev);
10402         return err;
10403 }
10404
10405 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10406                                              struct genl_info *info)
10407 {
10408         struct net_device *dev = info->user_ptr[1];
10409         struct wireless_dev *wdev = dev->ieee80211_ptr;
10410
10411         if (wdev->iftype != NL80211_IFTYPE_AP &&
10412             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10413                 return -EINVAL;
10414
10415         if (wdev->ap_unexpected_nlportid)
10416                 return -EBUSY;
10417
10418         wdev->ap_unexpected_nlportid = info->snd_portid;
10419         return 0;
10420 }
10421
10422 static int nl80211_probe_client(struct sk_buff *skb,
10423                                 struct genl_info *info)
10424 {
10425         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10426         struct net_device *dev = info->user_ptr[1];
10427         struct wireless_dev *wdev = dev->ieee80211_ptr;
10428         struct sk_buff *msg;
10429         void *hdr;
10430         const u8 *addr;
10431         u64 cookie;
10432         int err;
10433
10434         if (wdev->iftype != NL80211_IFTYPE_AP &&
10435             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10436                 return -EOPNOTSUPP;
10437
10438         if (!info->attrs[NL80211_ATTR_MAC])
10439                 return -EINVAL;
10440
10441         if (!rdev->ops->probe_client)
10442                 return -EOPNOTSUPP;
10443
10444         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10445         if (!msg)
10446                 return -ENOMEM;
10447
10448         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10449                              NL80211_CMD_PROBE_CLIENT);
10450         if (!hdr) {
10451                 err = -ENOBUFS;
10452                 goto free_msg;
10453         }
10454
10455         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10456
10457         err = rdev_probe_client(rdev, dev, addr, &cookie);
10458         if (err)
10459                 goto free_msg;
10460
10461         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10462                               NL80211_ATTR_PAD))
10463                 goto nla_put_failure;
10464
10465         genlmsg_end(msg, hdr);
10466
10467         return genlmsg_reply(msg, info);
10468
10469  nla_put_failure:
10470         err = -ENOBUFS;
10471  free_msg:
10472         nlmsg_free(msg);
10473         return err;
10474 }
10475
10476 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10477 {
10478         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10479         struct cfg80211_beacon_registration *reg, *nreg;
10480         int rv;
10481
10482         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10483                 return -EOPNOTSUPP;
10484
10485         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10486         if (!nreg)
10487                 return -ENOMEM;
10488
10489         /* First, check if already registered. */
10490         spin_lock_bh(&rdev->beacon_registrations_lock);
10491         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10492                 if (reg->nlportid == info->snd_portid) {
10493                         rv = -EALREADY;
10494                         goto out_err;
10495                 }
10496         }
10497         /* Add it to the list */
10498         nreg->nlportid = info->snd_portid;
10499         list_add(&nreg->list, &rdev->beacon_registrations);
10500
10501         spin_unlock_bh(&rdev->beacon_registrations_lock);
10502
10503         return 0;
10504 out_err:
10505         spin_unlock_bh(&rdev->beacon_registrations_lock);
10506         kfree(nreg);
10507         return rv;
10508 }
10509
10510 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10511 {
10512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10513         struct wireless_dev *wdev = info->user_ptr[1];
10514         int err;
10515
10516         if (!rdev->ops->start_p2p_device)
10517                 return -EOPNOTSUPP;
10518
10519         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10520                 return -EOPNOTSUPP;
10521
10522         if (wdev->p2p_started)
10523                 return 0;
10524
10525         if (rfkill_blocked(rdev->rfkill))
10526                 return -ERFKILL;
10527
10528         err = rdev_start_p2p_device(rdev, wdev);
10529         if (err)
10530                 return err;
10531
10532         wdev->p2p_started = true;
10533         rdev->opencount++;
10534
10535         return 0;
10536 }
10537
10538 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10539 {
10540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10541         struct wireless_dev *wdev = info->user_ptr[1];
10542
10543         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10544                 return -EOPNOTSUPP;
10545
10546         if (!rdev->ops->stop_p2p_device)
10547                 return -EOPNOTSUPP;
10548
10549         cfg80211_stop_p2p_device(rdev, wdev);
10550
10551         return 0;
10552 }
10553
10554 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
10555 {
10556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10557         struct wireless_dev *wdev = info->user_ptr[1];
10558         struct cfg80211_nan_conf conf = {};
10559         int err;
10560
10561         if (wdev->iftype != NL80211_IFTYPE_NAN)
10562                 return -EOPNOTSUPP;
10563
10564         if (wdev->nan_started)
10565                 return -EEXIST;
10566
10567         if (rfkill_blocked(rdev->rfkill))
10568                 return -ERFKILL;
10569
10570         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
10571                 return -EINVAL;
10572
10573         if (!info->attrs[NL80211_ATTR_NAN_DUAL])
10574                 return -EINVAL;
10575
10576         conf.master_pref =
10577                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10578         if (!conf.master_pref)
10579                 return -EINVAL;
10580
10581         conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
10582
10583         err = rdev_start_nan(rdev, wdev, &conf);
10584         if (err)
10585                 return err;
10586
10587         wdev->nan_started = true;
10588         rdev->opencount++;
10589
10590         return 0;
10591 }
10592
10593 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
10594 {
10595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10596         struct wireless_dev *wdev = info->user_ptr[1];
10597
10598         if (wdev->iftype != NL80211_IFTYPE_NAN)
10599                 return -EOPNOTSUPP;
10600
10601         cfg80211_stop_nan(rdev, wdev);
10602
10603         return 0;
10604 }
10605
10606 static int validate_nan_filter(struct nlattr *filter_attr)
10607 {
10608         struct nlattr *attr;
10609         int len = 0, n_entries = 0, rem;
10610
10611         nla_for_each_nested(attr, filter_attr, rem) {
10612                 len += nla_len(attr);
10613                 n_entries++;
10614         }
10615
10616         if (len >= U8_MAX)
10617                 return -EINVAL;
10618
10619         return n_entries;
10620 }
10621
10622 static int handle_nan_filter(struct nlattr *attr_filter,
10623                              struct cfg80211_nan_func *func,
10624                              bool tx)
10625 {
10626         struct nlattr *attr;
10627         int n_entries, rem, i;
10628         struct cfg80211_nan_func_filter *filter;
10629
10630         n_entries = validate_nan_filter(attr_filter);
10631         if (n_entries < 0)
10632                 return n_entries;
10633
10634         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
10635
10636         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
10637         if (!filter)
10638                 return -ENOMEM;
10639
10640         i = 0;
10641         nla_for_each_nested(attr, attr_filter, rem) {
10642                 filter[i].filter = kmemdup(nla_data(attr), nla_len(attr),
10643                                            GFP_KERNEL);
10644                 filter[i].len = nla_len(attr);
10645                 i++;
10646         }
10647         if (tx) {
10648                 func->num_tx_filters = n_entries;
10649                 func->tx_filters = filter;
10650         } else {
10651                 func->num_rx_filters = n_entries;
10652                 func->rx_filters = filter;
10653         }
10654
10655         return 0;
10656 }
10657
10658 static int nl80211_nan_add_func(struct sk_buff *skb,
10659                                 struct genl_info *info)
10660 {
10661         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10662         struct wireless_dev *wdev = info->user_ptr[1];
10663         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
10664         struct cfg80211_nan_func *func;
10665         struct sk_buff *msg = NULL;
10666         void *hdr = NULL;
10667         int err = 0;
10668
10669         if (wdev->iftype != NL80211_IFTYPE_NAN)
10670                 return -EOPNOTSUPP;
10671
10672         if (!wdev->nan_started)
10673                 return -ENOTCONN;
10674
10675         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
10676                 return -EINVAL;
10677
10678         if (wdev->owner_nlportid &&
10679             wdev->owner_nlportid != info->snd_portid)
10680                 return -ENOTCONN;
10681
10682         err = nla_parse(tb, NL80211_NAN_FUNC_ATTR_MAX,
10683                         nla_data(info->attrs[NL80211_ATTR_NAN_FUNC]),
10684                         nla_len(info->attrs[NL80211_ATTR_NAN_FUNC]),
10685                         nl80211_nan_func_policy);
10686         if (err)
10687                 return err;
10688
10689         func = kzalloc(sizeof(*func), GFP_KERNEL);
10690         if (!func)
10691                 return -ENOMEM;
10692
10693         func->cookie = wdev->wiphy->cookie_counter++;
10694
10695         if (!tb[NL80211_NAN_FUNC_TYPE] ||
10696             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
10697                 err = -EINVAL;
10698                 goto out;
10699         }
10700
10701
10702         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
10703
10704         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
10705                 err = -EINVAL;
10706                 goto out;
10707         }
10708
10709         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
10710                sizeof(func->service_id));
10711
10712         func->close_range =
10713                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
10714
10715         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
10716                 func->serv_spec_info_len =
10717                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
10718                 func->serv_spec_info =
10719                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
10720                                 func->serv_spec_info_len,
10721                                 GFP_KERNEL);
10722                 if (!func->serv_spec_info) {
10723                         err = -ENOMEM;
10724                         goto out;
10725                 }
10726         }
10727
10728         if (tb[NL80211_NAN_FUNC_TTL])
10729                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
10730
10731         switch (func->type) {
10732         case NL80211_NAN_FUNC_PUBLISH:
10733                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
10734                         err = -EINVAL;
10735                         goto out;
10736                 }
10737
10738                 func->publish_type =
10739                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
10740                 func->publish_bcast =
10741                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
10742
10743                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
10744                         func->publish_bcast) {
10745                         err = -EINVAL;
10746                         goto out;
10747                 }
10748                 break;
10749         case NL80211_NAN_FUNC_SUBSCRIBE:
10750                 func->subscribe_active =
10751                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
10752                 break;
10753         case NL80211_NAN_FUNC_FOLLOW_UP:
10754                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
10755                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
10756                         err = -EINVAL;
10757                         goto out;
10758                 }
10759
10760                 func->followup_id =
10761                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
10762                 func->followup_reqid =
10763                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
10764                 memcpy(func->followup_dest.addr,
10765                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
10766                        sizeof(func->followup_dest.addr));
10767                 if (func->ttl) {
10768                         err = -EINVAL;
10769                         goto out;
10770                 }
10771                 break;
10772         default:
10773                 err = -EINVAL;
10774                 goto out;
10775         }
10776
10777         if (tb[NL80211_NAN_FUNC_SRF]) {
10778                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
10779
10780                 err = nla_parse(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
10781                                 nla_data(tb[NL80211_NAN_FUNC_SRF]),
10782                                 nla_len(tb[NL80211_NAN_FUNC_SRF]), NULL);
10783                 if (err)
10784                         goto out;
10785
10786                 func->srf_include =
10787                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
10788
10789                 if (srf_tb[NL80211_NAN_SRF_BF]) {
10790                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
10791                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
10792                                 err = -EINVAL;
10793                                 goto out;
10794                         }
10795
10796                         func->srf_bf_len =
10797                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
10798                         func->srf_bf =
10799                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
10800                                         func->srf_bf_len, GFP_KERNEL);
10801                         if (!func->srf_bf) {
10802                                 err = -ENOMEM;
10803                                 goto out;
10804                         }
10805
10806                         func->srf_bf_idx =
10807                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
10808                 } else {
10809                         struct nlattr *attr, *mac_attr =
10810                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
10811                         int n_entries, rem, i = 0;
10812
10813                         if (!mac_attr) {
10814                                 err = -EINVAL;
10815                                 goto out;
10816                         }
10817
10818                         n_entries = validate_acl_mac_addrs(mac_attr);
10819                         if (n_entries <= 0) {
10820                                 err = -EINVAL;
10821                                 goto out;
10822                         }
10823
10824                         func->srf_num_macs = n_entries;
10825                         func->srf_macs =
10826                                 kzalloc(sizeof(*func->srf_macs) * n_entries,
10827                                         GFP_KERNEL);
10828                         if (!func->srf_macs) {
10829                                 err = -ENOMEM;
10830                                 goto out;
10831                         }
10832
10833                         nla_for_each_nested(attr, mac_attr, rem)
10834                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
10835                                        sizeof(*func->srf_macs));
10836                 }
10837         }
10838
10839         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
10840                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
10841                                         func, true);
10842                 if (err)
10843                         goto out;
10844         }
10845
10846         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
10847                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
10848                                         func, false);
10849                 if (err)
10850                         goto out;
10851         }
10852
10853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10854         if (!msg) {
10855                 err = -ENOMEM;
10856                 goto out;
10857         }
10858
10859         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10860                              NL80211_CMD_ADD_NAN_FUNCTION);
10861         /* This can't really happen - we just allocated 4KB */
10862         if (WARN_ON(!hdr)) {
10863                 err = -ENOMEM;
10864                 goto out;
10865         }
10866
10867         err = rdev_add_nan_func(rdev, wdev, func);
10868 out:
10869         if (err < 0) {
10870                 cfg80211_free_nan_func(func);
10871                 nlmsg_free(msg);
10872                 return err;
10873         }
10874
10875         /* propagate the instance id and cookie to userspace  */
10876         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
10877                               NL80211_ATTR_PAD))
10878                 goto nla_put_failure;
10879
10880         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
10881         if (!func_attr)
10882                 goto nla_put_failure;
10883
10884         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
10885                        func->instance_id))
10886                 goto nla_put_failure;
10887
10888         nla_nest_end(msg, func_attr);
10889
10890         genlmsg_end(msg, hdr);
10891         return genlmsg_reply(msg, info);
10892
10893 nla_put_failure:
10894         nlmsg_free(msg);
10895         return -ENOBUFS;
10896 }
10897
10898 static int nl80211_nan_del_func(struct sk_buff *skb,
10899                                struct genl_info *info)
10900 {
10901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10902         struct wireless_dev *wdev = info->user_ptr[1];
10903         u64 cookie;
10904
10905         if (wdev->iftype != NL80211_IFTYPE_NAN)
10906                 return -EOPNOTSUPP;
10907
10908         if (!wdev->nan_started)
10909                 return -ENOTCONN;
10910
10911         if (!info->attrs[NL80211_ATTR_COOKIE])
10912                 return -EINVAL;
10913
10914         if (wdev->owner_nlportid &&
10915             wdev->owner_nlportid != info->snd_portid)
10916                 return -ENOTCONN;
10917
10918         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10919
10920         rdev_del_nan_func(rdev, wdev, cookie);
10921
10922         return 0;
10923 }
10924
10925 static int nl80211_nan_change_config(struct sk_buff *skb,
10926                                      struct genl_info *info)
10927 {
10928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10929         struct wireless_dev *wdev = info->user_ptr[1];
10930         struct cfg80211_nan_conf conf = {};
10931         u32 changed = 0;
10932
10933         if (wdev->iftype != NL80211_IFTYPE_NAN)
10934                 return -EOPNOTSUPP;
10935
10936         if (!wdev->nan_started)
10937                 return -ENOTCONN;
10938
10939         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
10940                 conf.master_pref =
10941                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10942                 if (conf.master_pref <= 1 || conf.master_pref == 255)
10943                         return -EINVAL;
10944
10945                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
10946         }
10947
10948         if (info->attrs[NL80211_ATTR_NAN_DUAL]) {
10949                 conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
10950                 changed |= CFG80211_NAN_CONF_CHANGED_DUAL;
10951         }
10952
10953         if (!changed)
10954                 return -EINVAL;
10955
10956         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
10957 }
10958
10959 void cfg80211_nan_match(struct wireless_dev *wdev,
10960                         struct cfg80211_nan_match_params *match, gfp_t gfp)
10961 {
10962         struct wiphy *wiphy = wdev->wiphy;
10963         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10964         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
10965         struct sk_buff *msg;
10966         void *hdr;
10967
10968         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
10969                 return;
10970
10971         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10972         if (!msg)
10973                 return;
10974
10975         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
10976         if (!hdr) {
10977                 nlmsg_free(msg);
10978                 return;
10979         }
10980
10981         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10982             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10983                                          wdev->netdev->ifindex)) ||
10984             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10985                               NL80211_ATTR_PAD))
10986                 goto nla_put_failure;
10987
10988         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
10989                               NL80211_ATTR_PAD) ||
10990             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
10991                 goto nla_put_failure;
10992
10993         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
10994         if (!match_attr)
10995                 goto nla_put_failure;
10996
10997         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
10998         if (!local_func_attr)
10999                 goto nla_put_failure;
11000
11001         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11002                 goto nla_put_failure;
11003
11004         nla_nest_end(msg, local_func_attr);
11005
11006         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11007         if (!peer_func_attr)
11008                 goto nla_put_failure;
11009
11010         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11011             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11012                 goto nla_put_failure;
11013
11014         if (match->info && match->info_len &&
11015             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11016                     match->info))
11017                 goto nla_put_failure;
11018
11019         nla_nest_end(msg, peer_func_attr);
11020         nla_nest_end(msg, match_attr);
11021         genlmsg_end(msg, hdr);
11022
11023         if (!wdev->owner_nlportid)
11024                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11025                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11026         else
11027                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11028                                 wdev->owner_nlportid);
11029
11030         return;
11031
11032 nla_put_failure:
11033         nlmsg_free(msg);
11034 }
11035 EXPORT_SYMBOL(cfg80211_nan_match);
11036
11037 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11038                                   u8 inst_id,
11039                                   enum nl80211_nan_func_term_reason reason,
11040                                   u64 cookie, gfp_t gfp)
11041 {
11042         struct wiphy *wiphy = wdev->wiphy;
11043         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11044         struct sk_buff *msg;
11045         struct nlattr *func_attr;
11046         void *hdr;
11047
11048         if (WARN_ON(!inst_id))
11049                 return;
11050
11051         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11052         if (!msg)
11053                 return;
11054
11055         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11056         if (!hdr) {
11057                 nlmsg_free(msg);
11058                 return;
11059         }
11060
11061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11062             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11063                                          wdev->netdev->ifindex)) ||
11064             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11065                               NL80211_ATTR_PAD))
11066                 goto nla_put_failure;
11067
11068         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11069                               NL80211_ATTR_PAD))
11070                 goto nla_put_failure;
11071
11072         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11073         if (!func_attr)
11074                 goto nla_put_failure;
11075
11076         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11077             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11078                 goto nla_put_failure;
11079
11080         nla_nest_end(msg, func_attr);
11081         genlmsg_end(msg, hdr);
11082
11083         if (!wdev->owner_nlportid)
11084                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11085                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11086         else
11087                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11088                                 wdev->owner_nlportid);
11089
11090         return;
11091
11092 nla_put_failure:
11093         nlmsg_free(msg);
11094 }
11095 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11096
11097 static int nl80211_get_protocol_features(struct sk_buff *skb,
11098                                          struct genl_info *info)
11099 {
11100         void *hdr;
11101         struct sk_buff *msg;
11102
11103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11104         if (!msg)
11105                 return -ENOMEM;
11106
11107         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11108                              NL80211_CMD_GET_PROTOCOL_FEATURES);
11109         if (!hdr)
11110                 goto nla_put_failure;
11111
11112         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11113                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11114                 goto nla_put_failure;
11115
11116         genlmsg_end(msg, hdr);
11117         return genlmsg_reply(msg, info);
11118
11119  nla_put_failure:
11120         kfree_skb(msg);
11121         return -ENOBUFS;
11122 }
11123
11124 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11125 {
11126         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11127         struct cfg80211_update_ft_ies_params ft_params;
11128         struct net_device *dev = info->user_ptr[1];
11129
11130         if (!rdev->ops->update_ft_ies)
11131                 return -EOPNOTSUPP;
11132
11133         if (!info->attrs[NL80211_ATTR_MDID] ||
11134             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11135                 return -EINVAL;
11136
11137         memset(&ft_params, 0, sizeof(ft_params));
11138         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11139         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11140         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11141
11142         return rdev_update_ft_ies(rdev, dev, &ft_params);
11143 }
11144
11145 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11146                                        struct genl_info *info)
11147 {
11148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11149         struct wireless_dev *wdev = info->user_ptr[1];
11150         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11151         u16 duration;
11152         int ret;
11153
11154         if (!rdev->ops->crit_proto_start)
11155                 return -EOPNOTSUPP;
11156
11157         if (WARN_ON(!rdev->ops->crit_proto_stop))
11158                 return -EINVAL;
11159
11160         if (rdev->crit_proto_nlportid)
11161                 return -EBUSY;
11162
11163         /* determine protocol if provided */
11164         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11165                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11166
11167         if (proto >= NUM_NL80211_CRIT_PROTO)
11168                 return -EINVAL;
11169
11170         /* timeout must be provided */
11171         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11172                 return -EINVAL;
11173
11174         duration =
11175                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11176
11177         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11178                 return -ERANGE;
11179
11180         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11181         if (!ret)
11182                 rdev->crit_proto_nlportid = info->snd_portid;
11183
11184         return ret;
11185 }
11186
11187 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11188                                       struct genl_info *info)
11189 {
11190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11191         struct wireless_dev *wdev = info->user_ptr[1];
11192
11193         if (!rdev->ops->crit_proto_stop)
11194                 return -EOPNOTSUPP;
11195
11196         if (rdev->crit_proto_nlportid) {
11197                 rdev->crit_proto_nlportid = 0;
11198                 rdev_crit_proto_stop(rdev, wdev);
11199         }
11200         return 0;
11201 }
11202
11203 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11204 {
11205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11206         struct wireless_dev *wdev =
11207                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11208         int i, err;
11209         u32 vid, subcmd;
11210
11211         if (!rdev->wiphy.vendor_commands)
11212                 return -EOPNOTSUPP;
11213
11214         if (IS_ERR(wdev)) {
11215                 err = PTR_ERR(wdev);
11216                 if (err != -EINVAL)
11217                         return err;
11218                 wdev = NULL;
11219         } else if (wdev->wiphy != &rdev->wiphy) {
11220                 return -EINVAL;
11221         }
11222
11223         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11224             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11225                 return -EINVAL;
11226
11227         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11228         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11229         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11230                 const struct wiphy_vendor_command *vcmd;
11231                 void *data = NULL;
11232                 int len = 0;
11233
11234                 vcmd = &rdev->wiphy.vendor_commands[i];
11235
11236                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11237                         continue;
11238
11239                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11240                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11241                         if (!wdev)
11242                                 return -EINVAL;
11243                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11244                             !wdev->netdev)
11245                                 return -EINVAL;
11246
11247                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11248                                 if (wdev->netdev &&
11249                                     !netif_running(wdev->netdev))
11250                                         return -ENETDOWN;
11251                                 if (!wdev->netdev && !wdev->p2p_started)
11252                                         return -ENETDOWN;
11253                         }
11254
11255                         if (!vcmd->doit)
11256                                 return -EOPNOTSUPP;
11257                 } else {
11258                         wdev = NULL;
11259                 }
11260
11261                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11262                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11263                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11264                 }
11265
11266                 rdev->cur_cmd_info = info;
11267                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11268                                                           data, len);
11269                 rdev->cur_cmd_info = NULL;
11270                 return err;
11271         }
11272
11273         return -EOPNOTSUPP;
11274 }
11275
11276 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11277                                        struct netlink_callback *cb,
11278                                        struct cfg80211_registered_device **rdev,
11279                                        struct wireless_dev **wdev)
11280 {
11281         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11282         u32 vid, subcmd;
11283         unsigned int i;
11284         int vcmd_idx = -1;
11285         int err;
11286         void *data = NULL;
11287         unsigned int data_len = 0;
11288
11289         rtnl_lock();
11290
11291         if (cb->args[0]) {
11292                 /* subtract the 1 again here */
11293                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11294                 struct wireless_dev *tmp;
11295
11296                 if (!wiphy) {
11297                         err = -ENODEV;
11298                         goto out_unlock;
11299                 }
11300                 *rdev = wiphy_to_rdev(wiphy);
11301                 *wdev = NULL;
11302
11303                 if (cb->args[1]) {
11304                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11305                                 if (tmp->identifier == cb->args[1] - 1) {
11306                                         *wdev = tmp;
11307                                         break;
11308                                 }
11309                         }
11310                 }
11311
11312                 /* keep rtnl locked in successful case */
11313                 return 0;
11314         }
11315
11316         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
11317                           attrbuf, nl80211_fam.maxattr, nl80211_policy);
11318         if (err)
11319                 goto out_unlock;
11320
11321         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11322             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
11323                 err = -EINVAL;
11324                 goto out_unlock;
11325         }
11326
11327         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11328         if (IS_ERR(*wdev))
11329                 *wdev = NULL;
11330
11331         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11332         if (IS_ERR(*rdev)) {
11333                 err = PTR_ERR(*rdev);
11334                 goto out_unlock;
11335         }
11336
11337         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11338         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11339
11340         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11341                 const struct wiphy_vendor_command *vcmd;
11342
11343                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11344
11345                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11346                         continue;
11347
11348                 if (!vcmd->dumpit) {
11349                         err = -EOPNOTSUPP;
11350                         goto out_unlock;
11351                 }
11352
11353                 vcmd_idx = i;
11354                 break;
11355         }
11356
11357         if (vcmd_idx < 0) {
11358                 err = -EOPNOTSUPP;
11359                 goto out_unlock;
11360         }
11361
11362         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11363                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11364                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11365         }
11366
11367         /* 0 is the first index - add 1 to parse only once */
11368         cb->args[0] = (*rdev)->wiphy_idx + 1;
11369         /* add 1 to know if it was NULL */
11370         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11371         cb->args[2] = vcmd_idx;
11372         cb->args[3] = (unsigned long)data;
11373         cb->args[4] = data_len;
11374
11375         /* keep rtnl locked in successful case */
11376         return 0;
11377  out_unlock:
11378         rtnl_unlock();
11379         return err;
11380 }
11381
11382 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11383                                    struct netlink_callback *cb)
11384 {
11385         struct cfg80211_registered_device *rdev;
11386         struct wireless_dev *wdev;
11387         unsigned int vcmd_idx;
11388         const struct wiphy_vendor_command *vcmd;
11389         void *data;
11390         int data_len;
11391         int err;
11392         struct nlattr *vendor_data;
11393
11394         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11395         if (err)
11396                 return err;
11397
11398         vcmd_idx = cb->args[2];
11399         data = (void *)cb->args[3];
11400         data_len = cb->args[4];
11401         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11402
11403         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11404                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11405                 if (!wdev)
11406                         return -EINVAL;
11407                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11408                     !wdev->netdev)
11409                         return -EINVAL;
11410
11411                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11412                         if (wdev->netdev &&
11413                             !netif_running(wdev->netdev))
11414                                 return -ENETDOWN;
11415                         if (!wdev->netdev && !wdev->p2p_started)
11416                                 return -ENETDOWN;
11417                 }
11418         }
11419
11420         while (1) {
11421                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11422                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11423                                            NL80211_CMD_VENDOR);
11424                 if (!hdr)
11425                         break;
11426
11427                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11428                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11429                                                wdev_id(wdev),
11430                                                NL80211_ATTR_PAD))) {
11431                         genlmsg_cancel(skb, hdr);
11432                         break;
11433                 }
11434
11435                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11436                 if (!vendor_data) {
11437                         genlmsg_cancel(skb, hdr);
11438                         break;
11439                 }
11440
11441                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
11442                                    (unsigned long *)&cb->args[5]);
11443                 nla_nest_end(skb, vendor_data);
11444
11445                 if (err == -ENOBUFS || err == -ENOENT) {
11446                         genlmsg_cancel(skb, hdr);
11447                         break;
11448                 } else if (err) {
11449                         genlmsg_cancel(skb, hdr);
11450                         goto out;
11451                 }
11452
11453                 genlmsg_end(skb, hdr);
11454         }
11455
11456         err = skb->len;
11457  out:
11458         rtnl_unlock();
11459         return err;
11460 }
11461
11462 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
11463                                            enum nl80211_commands cmd,
11464                                            enum nl80211_attrs attr,
11465                                            int approxlen)
11466 {
11467         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11468
11469         if (WARN_ON(!rdev->cur_cmd_info))
11470                 return NULL;
11471
11472         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
11473                                            rdev->cur_cmd_info->snd_portid,
11474                                            rdev->cur_cmd_info->snd_seq,
11475                                            cmd, attr, NULL, GFP_KERNEL);
11476 }
11477 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
11478
11479 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
11480 {
11481         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11482         void *hdr = ((void **)skb->cb)[1];
11483         struct nlattr *data = ((void **)skb->cb)[2];
11484
11485         /* clear CB data for netlink core to own from now on */
11486         memset(skb->cb, 0, sizeof(skb->cb));
11487
11488         if (WARN_ON(!rdev->cur_cmd_info)) {
11489                 kfree_skb(skb);
11490                 return -EINVAL;
11491         }
11492
11493         nla_nest_end(skb, data);
11494         genlmsg_end(skb, hdr);
11495         return genlmsg_reply(skb, rdev->cur_cmd_info);
11496 }
11497 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
11498
11499 static int nl80211_set_qos_map(struct sk_buff *skb,
11500                                struct genl_info *info)
11501 {
11502         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11503         struct cfg80211_qos_map *qos_map = NULL;
11504         struct net_device *dev = info->user_ptr[1];
11505         u8 *pos, len, num_des, des_len, des;
11506         int ret;
11507
11508         if (!rdev->ops->set_qos_map)
11509                 return -EOPNOTSUPP;
11510
11511         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
11512                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
11513                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
11514
11515                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
11516                     len > IEEE80211_QOS_MAP_LEN_MAX)
11517                         return -EINVAL;
11518
11519                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
11520                 if (!qos_map)
11521                         return -ENOMEM;
11522
11523                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
11524                 if (num_des) {
11525                         des_len = num_des *
11526                                 sizeof(struct cfg80211_dscp_exception);
11527                         memcpy(qos_map->dscp_exception, pos, des_len);
11528                         qos_map->num_des = num_des;
11529                         for (des = 0; des < num_des; des++) {
11530                                 if (qos_map->dscp_exception[des].up > 7) {
11531                                         kfree(qos_map);
11532                                         return -EINVAL;
11533                                 }
11534                         }
11535                         pos += des_len;
11536                 }
11537                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
11538         }
11539
11540         wdev_lock(dev->ieee80211_ptr);
11541         ret = nl80211_key_allowed(dev->ieee80211_ptr);
11542         if (!ret)
11543                 ret = rdev_set_qos_map(rdev, dev, qos_map);
11544         wdev_unlock(dev->ieee80211_ptr);
11545
11546         kfree(qos_map);
11547         return ret;
11548 }
11549
11550 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
11551 {
11552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11553         struct net_device *dev = info->user_ptr[1];
11554         struct wireless_dev *wdev = dev->ieee80211_ptr;
11555         const u8 *peer;
11556         u8 tsid, up;
11557         u16 admitted_time = 0;
11558         int err;
11559
11560         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
11561                 return -EOPNOTSUPP;
11562
11563         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
11564             !info->attrs[NL80211_ATTR_USER_PRIO])
11565                 return -EINVAL;
11566
11567         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11568         if (tsid >= IEEE80211_NUM_TIDS)
11569                 return -EINVAL;
11570
11571         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
11572         if (up >= IEEE80211_NUM_UPS)
11573                 return -EINVAL;
11574
11575         /* WMM uses TIDs 0-7 even for TSPEC */
11576         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
11577                 /* TODO: handle 802.11 TSPEC/admission control
11578                  * need more attributes for that (e.g. BA session requirement);
11579                  * change the WMM adminssion test above to allow both then
11580                  */
11581                 return -EINVAL;
11582         }
11583
11584         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11585
11586         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
11587                 admitted_time =
11588                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
11589                 if (!admitted_time)
11590                         return -EINVAL;
11591         }
11592
11593         wdev_lock(wdev);
11594         switch (wdev->iftype) {
11595         case NL80211_IFTYPE_STATION:
11596         case NL80211_IFTYPE_P2P_CLIENT:
11597                 if (wdev->current_bss)
11598                         break;
11599                 err = -ENOTCONN;
11600                 goto out;
11601         default:
11602                 err = -EOPNOTSUPP;
11603                 goto out;
11604         }
11605
11606         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
11607
11608  out:
11609         wdev_unlock(wdev);
11610         return err;
11611 }
11612
11613 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
11614 {
11615         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11616         struct net_device *dev = info->user_ptr[1];
11617         struct wireless_dev *wdev = dev->ieee80211_ptr;
11618         const u8 *peer;
11619         u8 tsid;
11620         int err;
11621
11622         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
11623                 return -EINVAL;
11624
11625         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11626         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11627
11628         wdev_lock(wdev);
11629         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
11630         wdev_unlock(wdev);
11631
11632         return err;
11633 }
11634
11635 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
11636                                        struct genl_info *info)
11637 {
11638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11639         struct net_device *dev = info->user_ptr[1];
11640         struct wireless_dev *wdev = dev->ieee80211_ptr;
11641         struct cfg80211_chan_def chandef = {};
11642         const u8 *addr;
11643         u8 oper_class;
11644         int err;
11645
11646         if (!rdev->ops->tdls_channel_switch ||
11647             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11648                 return -EOPNOTSUPP;
11649
11650         switch (dev->ieee80211_ptr->iftype) {
11651         case NL80211_IFTYPE_STATION:
11652         case NL80211_IFTYPE_P2P_CLIENT:
11653                 break;
11654         default:
11655                 return -EOPNOTSUPP;
11656         }
11657
11658         if (!info->attrs[NL80211_ATTR_MAC] ||
11659             !info->attrs[NL80211_ATTR_OPER_CLASS])
11660                 return -EINVAL;
11661
11662         err = nl80211_parse_chandef(rdev, info, &chandef);
11663         if (err)
11664                 return err;
11665
11666         /*
11667          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
11668          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
11669          * specification is not defined for them.
11670          */
11671         if (chandef.chan->band == NL80211_BAND_2GHZ &&
11672             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
11673             chandef.width != NL80211_CHAN_WIDTH_20)
11674                 return -EINVAL;
11675
11676         /* we will be active on the TDLS link */
11677         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
11678                                            wdev->iftype))
11679                 return -EINVAL;
11680
11681         /* don't allow switching to DFS channels */
11682         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
11683                 return -EINVAL;
11684
11685         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11686         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
11687
11688         wdev_lock(wdev);
11689         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
11690         wdev_unlock(wdev);
11691
11692         return err;
11693 }
11694
11695 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
11696                                               struct genl_info *info)
11697 {
11698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11699         struct net_device *dev = info->user_ptr[1];
11700         struct wireless_dev *wdev = dev->ieee80211_ptr;
11701         const u8 *addr;
11702
11703         if (!rdev->ops->tdls_channel_switch ||
11704             !rdev->ops->tdls_cancel_channel_switch ||
11705             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11706                 return -EOPNOTSUPP;
11707
11708         switch (dev->ieee80211_ptr->iftype) {
11709         case NL80211_IFTYPE_STATION:
11710         case NL80211_IFTYPE_P2P_CLIENT:
11711                 break;
11712         default:
11713                 return -EOPNOTSUPP;
11714         }
11715
11716         if (!info->attrs[NL80211_ATTR_MAC])
11717                 return -EINVAL;
11718
11719         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11720
11721         wdev_lock(wdev);
11722         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11723         wdev_unlock(wdev);
11724
11725         return 0;
11726 }
11727
11728 #define NL80211_FLAG_NEED_WIPHY         0x01
11729 #define NL80211_FLAG_NEED_NETDEV        0x02
11730 #define NL80211_FLAG_NEED_RTNL          0x04
11731 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
11732 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
11733                                          NL80211_FLAG_CHECK_NETDEV_UP)
11734 #define NL80211_FLAG_NEED_WDEV          0x10
11735 /* If a netdev is associated, it must be UP, P2P must be started */
11736 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
11737                                          NL80211_FLAG_CHECK_NETDEV_UP)
11738 #define NL80211_FLAG_CLEAR_SKB          0x20
11739
11740 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11741                             struct genl_info *info)
11742 {
11743         struct cfg80211_registered_device *rdev;
11744         struct wireless_dev *wdev;
11745         struct net_device *dev;
11746         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11747
11748         if (rtnl)
11749                 rtnl_lock();
11750
11751         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11752                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11753                 if (IS_ERR(rdev)) {
11754                         if (rtnl)
11755                                 rtnl_unlock();
11756                         return PTR_ERR(rdev);
11757                 }
11758                 info->user_ptr[0] = rdev;
11759         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
11760                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11761                 ASSERT_RTNL();
11762
11763                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
11764                                                   info->attrs);
11765                 if (IS_ERR(wdev)) {
11766                         if (rtnl)
11767                                 rtnl_unlock();
11768                         return PTR_ERR(wdev);
11769                 }
11770
11771                 dev = wdev->netdev;
11772                 rdev = wiphy_to_rdev(wdev->wiphy);
11773
11774                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
11775                         if (!dev) {
11776                                 if (rtnl)
11777                                         rtnl_unlock();
11778                                 return -EINVAL;
11779                         }
11780
11781                         info->user_ptr[1] = dev;
11782                 } else {
11783                         info->user_ptr[1] = wdev;
11784                 }
11785
11786                 if (dev) {
11787                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
11788                             !netif_running(dev)) {
11789                                 if (rtnl)
11790                                         rtnl_unlock();
11791                                 return -ENETDOWN;
11792                         }
11793
11794                         dev_hold(dev);
11795                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
11796                         if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE &&
11797                             !wdev->p2p_started) {
11798                                 if (rtnl)
11799                                         rtnl_unlock();
11800                                 return -ENETDOWN;
11801                         }
11802                         if (wdev->iftype == NL80211_IFTYPE_NAN &&
11803                             !wdev->nan_started) {
11804                                 if (rtnl)
11805                                         rtnl_unlock();
11806                                 return -ENETDOWN;
11807                         }
11808                 }
11809
11810                 info->user_ptr[0] = rdev;
11811         }
11812
11813         return 0;
11814 }
11815
11816 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
11817                               struct genl_info *info)
11818 {
11819         if (info->user_ptr[1]) {
11820                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11821                         struct wireless_dev *wdev = info->user_ptr[1];
11822
11823                         if (wdev->netdev)
11824                                 dev_put(wdev->netdev);
11825                 } else {
11826                         dev_put(info->user_ptr[1]);
11827                 }
11828         }
11829
11830         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
11831                 rtnl_unlock();
11832
11833         /* If needed, clear the netlink message payload from the SKB
11834          * as it might contain key data that shouldn't stick around on
11835          * the heap after the SKB is freed. The netlink message header
11836          * is still needed for further processing, so leave it intact.
11837          */
11838         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
11839                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
11840
11841                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
11842         }
11843 }
11844
11845 static const struct genl_ops nl80211_ops[] = {
11846         {
11847                 .cmd = NL80211_CMD_GET_WIPHY,
11848                 .doit = nl80211_get_wiphy,
11849                 .dumpit = nl80211_dump_wiphy,
11850                 .done = nl80211_dump_wiphy_done,
11851                 .policy = nl80211_policy,
11852                 /* can be retrieved by unprivileged users */
11853                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11854                                   NL80211_FLAG_NEED_RTNL,
11855         },
11856         {
11857                 .cmd = NL80211_CMD_SET_WIPHY,
11858                 .doit = nl80211_set_wiphy,
11859                 .policy = nl80211_policy,
11860                 .flags = GENL_UNS_ADMIN_PERM,
11861                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11862         },
11863         {
11864                 .cmd = NL80211_CMD_GET_INTERFACE,
11865                 .doit = nl80211_get_interface,
11866                 .dumpit = nl80211_dump_interface,
11867                 .policy = nl80211_policy,
11868                 /* can be retrieved by unprivileged users */
11869                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11870                                   NL80211_FLAG_NEED_RTNL,
11871         },
11872         {
11873                 .cmd = NL80211_CMD_SET_INTERFACE,
11874                 .doit = nl80211_set_interface,
11875                 .policy = nl80211_policy,
11876                 .flags = GENL_UNS_ADMIN_PERM,
11877                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11878                                   NL80211_FLAG_NEED_RTNL,
11879         },
11880         {
11881                 .cmd = NL80211_CMD_NEW_INTERFACE,
11882                 .doit = nl80211_new_interface,
11883                 .policy = nl80211_policy,
11884                 .flags = GENL_UNS_ADMIN_PERM,
11885                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11886                                   NL80211_FLAG_NEED_RTNL,
11887         },
11888         {
11889                 .cmd = NL80211_CMD_DEL_INTERFACE,
11890                 .doit = nl80211_del_interface,
11891                 .policy = nl80211_policy,
11892                 .flags = GENL_UNS_ADMIN_PERM,
11893                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11894                                   NL80211_FLAG_NEED_RTNL,
11895         },
11896         {
11897                 .cmd = NL80211_CMD_GET_KEY,
11898                 .doit = nl80211_get_key,
11899                 .policy = nl80211_policy,
11900                 .flags = GENL_UNS_ADMIN_PERM,
11901                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11902                                   NL80211_FLAG_NEED_RTNL,
11903         },
11904         {
11905                 .cmd = NL80211_CMD_SET_KEY,
11906                 .doit = nl80211_set_key,
11907                 .policy = nl80211_policy,
11908                 .flags = GENL_UNS_ADMIN_PERM,
11909                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11910                                   NL80211_FLAG_NEED_RTNL |
11911                                   NL80211_FLAG_CLEAR_SKB,
11912         },
11913         {
11914                 .cmd = NL80211_CMD_NEW_KEY,
11915                 .doit = nl80211_new_key,
11916                 .policy = nl80211_policy,
11917                 .flags = GENL_UNS_ADMIN_PERM,
11918                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11919                                   NL80211_FLAG_NEED_RTNL |
11920                                   NL80211_FLAG_CLEAR_SKB,
11921         },
11922         {
11923                 .cmd = NL80211_CMD_DEL_KEY,
11924                 .doit = nl80211_del_key,
11925                 .policy = nl80211_policy,
11926                 .flags = GENL_UNS_ADMIN_PERM,
11927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11928                                   NL80211_FLAG_NEED_RTNL,
11929         },
11930         {
11931                 .cmd = NL80211_CMD_SET_BEACON,
11932                 .policy = nl80211_policy,
11933                 .flags = GENL_UNS_ADMIN_PERM,
11934                 .doit = nl80211_set_beacon,
11935                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11936                                   NL80211_FLAG_NEED_RTNL,
11937         },
11938         {
11939                 .cmd = NL80211_CMD_START_AP,
11940                 .policy = nl80211_policy,
11941                 .flags = GENL_UNS_ADMIN_PERM,
11942                 .doit = nl80211_start_ap,
11943                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11944                                   NL80211_FLAG_NEED_RTNL,
11945         },
11946         {
11947                 .cmd = NL80211_CMD_STOP_AP,
11948                 .policy = nl80211_policy,
11949                 .flags = GENL_UNS_ADMIN_PERM,
11950                 .doit = nl80211_stop_ap,
11951                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11952                                   NL80211_FLAG_NEED_RTNL,
11953         },
11954         {
11955                 .cmd = NL80211_CMD_GET_STATION,
11956                 .doit = nl80211_get_station,
11957                 .dumpit = nl80211_dump_station,
11958                 .policy = nl80211_policy,
11959                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11960                                   NL80211_FLAG_NEED_RTNL,
11961         },
11962         {
11963                 .cmd = NL80211_CMD_SET_STATION,
11964                 .doit = nl80211_set_station,
11965                 .policy = nl80211_policy,
11966                 .flags = GENL_UNS_ADMIN_PERM,
11967                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11968                                   NL80211_FLAG_NEED_RTNL,
11969         },
11970         {
11971                 .cmd = NL80211_CMD_NEW_STATION,
11972                 .doit = nl80211_new_station,
11973                 .policy = nl80211_policy,
11974                 .flags = GENL_UNS_ADMIN_PERM,
11975                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11976                                   NL80211_FLAG_NEED_RTNL,
11977         },
11978         {
11979                 .cmd = NL80211_CMD_DEL_STATION,
11980                 .doit = nl80211_del_station,
11981                 .policy = nl80211_policy,
11982                 .flags = GENL_UNS_ADMIN_PERM,
11983                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11984                                   NL80211_FLAG_NEED_RTNL,
11985         },
11986         {
11987                 .cmd = NL80211_CMD_GET_MPATH,
11988                 .doit = nl80211_get_mpath,
11989                 .dumpit = nl80211_dump_mpath,
11990                 .policy = nl80211_policy,
11991                 .flags = GENL_UNS_ADMIN_PERM,
11992                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11993                                   NL80211_FLAG_NEED_RTNL,
11994         },
11995         {
11996                 .cmd = NL80211_CMD_GET_MPP,
11997                 .doit = nl80211_get_mpp,
11998                 .dumpit = nl80211_dump_mpp,
11999                 .policy = nl80211_policy,
12000                 .flags = GENL_UNS_ADMIN_PERM,
12001                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12002                                   NL80211_FLAG_NEED_RTNL,
12003         },
12004         {
12005                 .cmd = NL80211_CMD_SET_MPATH,
12006                 .doit = nl80211_set_mpath,
12007                 .policy = nl80211_policy,
12008                 .flags = GENL_UNS_ADMIN_PERM,
12009                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12010                                   NL80211_FLAG_NEED_RTNL,
12011         },
12012         {
12013                 .cmd = NL80211_CMD_NEW_MPATH,
12014                 .doit = nl80211_new_mpath,
12015                 .policy = nl80211_policy,
12016                 .flags = GENL_UNS_ADMIN_PERM,
12017                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12018                                   NL80211_FLAG_NEED_RTNL,
12019         },
12020         {
12021                 .cmd = NL80211_CMD_DEL_MPATH,
12022                 .doit = nl80211_del_mpath,
12023                 .policy = nl80211_policy,
12024                 .flags = GENL_UNS_ADMIN_PERM,
12025                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12026                                   NL80211_FLAG_NEED_RTNL,
12027         },
12028         {
12029                 .cmd = NL80211_CMD_SET_BSS,
12030                 .doit = nl80211_set_bss,
12031                 .policy = nl80211_policy,
12032                 .flags = GENL_UNS_ADMIN_PERM,
12033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12034                                   NL80211_FLAG_NEED_RTNL,
12035         },
12036         {
12037                 .cmd = NL80211_CMD_GET_REG,
12038                 .doit = nl80211_get_reg_do,
12039                 .dumpit = nl80211_get_reg_dump,
12040                 .policy = nl80211_policy,
12041                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12042                 /* can be retrieved by unprivileged users */
12043         },
12044 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12045         {
12046                 .cmd = NL80211_CMD_SET_REG,
12047                 .doit = nl80211_set_reg,
12048                 .policy = nl80211_policy,
12049                 .flags = GENL_ADMIN_PERM,
12050                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12051         },
12052 #endif
12053         {
12054                 .cmd = NL80211_CMD_REQ_SET_REG,
12055                 .doit = nl80211_req_set_reg,
12056                 .policy = nl80211_policy,
12057                 .flags = GENL_ADMIN_PERM,
12058         },
12059         {
12060                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12061                 .doit = nl80211_get_mesh_config,
12062                 .policy = nl80211_policy,
12063                 /* can be retrieved by unprivileged users */
12064                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12065                                   NL80211_FLAG_NEED_RTNL,
12066         },
12067         {
12068                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12069                 .doit = nl80211_update_mesh_config,
12070                 .policy = nl80211_policy,
12071                 .flags = GENL_UNS_ADMIN_PERM,
12072                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12073                                   NL80211_FLAG_NEED_RTNL,
12074         },
12075         {
12076                 .cmd = NL80211_CMD_TRIGGER_SCAN,
12077                 .doit = nl80211_trigger_scan,
12078                 .policy = nl80211_policy,
12079                 .flags = GENL_UNS_ADMIN_PERM,
12080                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12081                                   NL80211_FLAG_NEED_RTNL,
12082         },
12083         {
12084                 .cmd = NL80211_CMD_ABORT_SCAN,
12085                 .doit = nl80211_abort_scan,
12086                 .policy = nl80211_policy,
12087                 .flags = GENL_UNS_ADMIN_PERM,
12088                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12089                                   NL80211_FLAG_NEED_RTNL,
12090         },
12091         {
12092                 .cmd = NL80211_CMD_GET_SCAN,
12093                 .policy = nl80211_policy,
12094                 .dumpit = nl80211_dump_scan,
12095         },
12096         {
12097                 .cmd = NL80211_CMD_START_SCHED_SCAN,
12098                 .doit = nl80211_start_sched_scan,
12099                 .policy = nl80211_policy,
12100                 .flags = GENL_UNS_ADMIN_PERM,
12101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12102                                   NL80211_FLAG_NEED_RTNL,
12103         },
12104         {
12105                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12106                 .doit = nl80211_stop_sched_scan,
12107                 .policy = nl80211_policy,
12108                 .flags = GENL_UNS_ADMIN_PERM,
12109                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12110                                   NL80211_FLAG_NEED_RTNL,
12111         },
12112         {
12113                 .cmd = NL80211_CMD_AUTHENTICATE,
12114                 .doit = nl80211_authenticate,
12115                 .policy = nl80211_policy,
12116                 .flags = GENL_UNS_ADMIN_PERM,
12117                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12118                                   NL80211_FLAG_NEED_RTNL |
12119                                   NL80211_FLAG_CLEAR_SKB,
12120         },
12121         {
12122                 .cmd = NL80211_CMD_ASSOCIATE,
12123                 .doit = nl80211_associate,
12124                 .policy = nl80211_policy,
12125                 .flags = GENL_UNS_ADMIN_PERM,
12126                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12127                                   NL80211_FLAG_NEED_RTNL,
12128         },
12129         {
12130                 .cmd = NL80211_CMD_DEAUTHENTICATE,
12131                 .doit = nl80211_deauthenticate,
12132                 .policy = nl80211_policy,
12133                 .flags = GENL_UNS_ADMIN_PERM,
12134                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12135                                   NL80211_FLAG_NEED_RTNL,
12136         },
12137         {
12138                 .cmd = NL80211_CMD_DISASSOCIATE,
12139                 .doit = nl80211_disassociate,
12140                 .policy = nl80211_policy,
12141                 .flags = GENL_UNS_ADMIN_PERM,
12142                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12143                                   NL80211_FLAG_NEED_RTNL,
12144         },
12145         {
12146                 .cmd = NL80211_CMD_JOIN_IBSS,
12147                 .doit = nl80211_join_ibss,
12148                 .policy = nl80211_policy,
12149                 .flags = GENL_UNS_ADMIN_PERM,
12150                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12151                                   NL80211_FLAG_NEED_RTNL,
12152         },
12153         {
12154                 .cmd = NL80211_CMD_LEAVE_IBSS,
12155                 .doit = nl80211_leave_ibss,
12156                 .policy = nl80211_policy,
12157                 .flags = GENL_UNS_ADMIN_PERM,
12158                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12159                                   NL80211_FLAG_NEED_RTNL,
12160         },
12161 #ifdef CONFIG_NL80211_TESTMODE
12162         {
12163                 .cmd = NL80211_CMD_TESTMODE,
12164                 .doit = nl80211_testmode_do,
12165                 .dumpit = nl80211_testmode_dump,
12166                 .policy = nl80211_policy,
12167                 .flags = GENL_UNS_ADMIN_PERM,
12168                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12169                                   NL80211_FLAG_NEED_RTNL,
12170         },
12171 #endif
12172         {
12173                 .cmd = NL80211_CMD_CONNECT,
12174                 .doit = nl80211_connect,
12175                 .policy = nl80211_policy,
12176                 .flags = GENL_UNS_ADMIN_PERM,
12177                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12178                                   NL80211_FLAG_NEED_RTNL,
12179         },
12180         {
12181                 .cmd = NL80211_CMD_DISCONNECT,
12182                 .doit = nl80211_disconnect,
12183                 .policy = nl80211_policy,
12184                 .flags = GENL_UNS_ADMIN_PERM,
12185                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12186                                   NL80211_FLAG_NEED_RTNL,
12187         },
12188         {
12189                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12190                 .doit = nl80211_wiphy_netns,
12191                 .policy = nl80211_policy,
12192                 .flags = GENL_UNS_ADMIN_PERM,
12193                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12194                                   NL80211_FLAG_NEED_RTNL,
12195         },
12196         {
12197                 .cmd = NL80211_CMD_GET_SURVEY,
12198                 .policy = nl80211_policy,
12199                 .dumpit = nl80211_dump_survey,
12200         },
12201         {
12202                 .cmd = NL80211_CMD_SET_PMKSA,
12203                 .doit = nl80211_setdel_pmksa,
12204                 .policy = nl80211_policy,
12205                 .flags = GENL_UNS_ADMIN_PERM,
12206                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12207                                   NL80211_FLAG_NEED_RTNL,
12208         },
12209         {
12210                 .cmd = NL80211_CMD_DEL_PMKSA,
12211                 .doit = nl80211_setdel_pmksa,
12212                 .policy = nl80211_policy,
12213                 .flags = GENL_UNS_ADMIN_PERM,
12214                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12215                                   NL80211_FLAG_NEED_RTNL,
12216         },
12217         {
12218                 .cmd = NL80211_CMD_FLUSH_PMKSA,
12219                 .doit = nl80211_flush_pmksa,
12220                 .policy = nl80211_policy,
12221                 .flags = GENL_UNS_ADMIN_PERM,
12222                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12223                                   NL80211_FLAG_NEED_RTNL,
12224         },
12225         {
12226                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12227                 .doit = nl80211_remain_on_channel,
12228                 .policy = nl80211_policy,
12229                 .flags = GENL_UNS_ADMIN_PERM,
12230                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12231                                   NL80211_FLAG_NEED_RTNL,
12232         },
12233         {
12234                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12235                 .doit = nl80211_cancel_remain_on_channel,
12236                 .policy = nl80211_policy,
12237                 .flags = GENL_UNS_ADMIN_PERM,
12238                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12239                                   NL80211_FLAG_NEED_RTNL,
12240         },
12241         {
12242                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12243                 .doit = nl80211_set_tx_bitrate_mask,
12244                 .policy = nl80211_policy,
12245                 .flags = GENL_UNS_ADMIN_PERM,
12246                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12247                                   NL80211_FLAG_NEED_RTNL,
12248         },
12249         {
12250                 .cmd = NL80211_CMD_REGISTER_FRAME,
12251                 .doit = nl80211_register_mgmt,
12252                 .policy = nl80211_policy,
12253                 .flags = GENL_UNS_ADMIN_PERM,
12254                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12255                                   NL80211_FLAG_NEED_RTNL,
12256         },
12257         {
12258                 .cmd = NL80211_CMD_FRAME,
12259                 .doit = nl80211_tx_mgmt,
12260                 .policy = nl80211_policy,
12261                 .flags = GENL_UNS_ADMIN_PERM,
12262                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12263                                   NL80211_FLAG_NEED_RTNL,
12264         },
12265         {
12266                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12267                 .doit = nl80211_tx_mgmt_cancel_wait,
12268                 .policy = nl80211_policy,
12269                 .flags = GENL_UNS_ADMIN_PERM,
12270                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12271                                   NL80211_FLAG_NEED_RTNL,
12272         },
12273         {
12274                 .cmd = NL80211_CMD_SET_POWER_SAVE,
12275                 .doit = nl80211_set_power_save,
12276                 .policy = nl80211_policy,
12277                 .flags = GENL_UNS_ADMIN_PERM,
12278                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12279                                   NL80211_FLAG_NEED_RTNL,
12280         },
12281         {
12282                 .cmd = NL80211_CMD_GET_POWER_SAVE,
12283                 .doit = nl80211_get_power_save,
12284                 .policy = nl80211_policy,
12285                 /* can be retrieved by unprivileged users */
12286                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12287                                   NL80211_FLAG_NEED_RTNL,
12288         },
12289         {
12290                 .cmd = NL80211_CMD_SET_CQM,
12291                 .doit = nl80211_set_cqm,
12292                 .policy = nl80211_policy,
12293                 .flags = GENL_UNS_ADMIN_PERM,
12294                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12295                                   NL80211_FLAG_NEED_RTNL,
12296         },
12297         {
12298                 .cmd = NL80211_CMD_SET_CHANNEL,
12299                 .doit = nl80211_set_channel,
12300                 .policy = nl80211_policy,
12301                 .flags = GENL_UNS_ADMIN_PERM,
12302                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12303                                   NL80211_FLAG_NEED_RTNL,
12304         },
12305         {
12306                 .cmd = NL80211_CMD_SET_WDS_PEER,
12307                 .doit = nl80211_set_wds_peer,
12308                 .policy = nl80211_policy,
12309                 .flags = GENL_UNS_ADMIN_PERM,
12310                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12311                                   NL80211_FLAG_NEED_RTNL,
12312         },
12313         {
12314                 .cmd = NL80211_CMD_JOIN_MESH,
12315                 .doit = nl80211_join_mesh,
12316                 .policy = nl80211_policy,
12317                 .flags = GENL_UNS_ADMIN_PERM,
12318                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12319                                   NL80211_FLAG_NEED_RTNL,
12320         },
12321         {
12322                 .cmd = NL80211_CMD_LEAVE_MESH,
12323                 .doit = nl80211_leave_mesh,
12324                 .policy = nl80211_policy,
12325                 .flags = GENL_UNS_ADMIN_PERM,
12326                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12327                                   NL80211_FLAG_NEED_RTNL,
12328         },
12329         {
12330                 .cmd = NL80211_CMD_JOIN_OCB,
12331                 .doit = nl80211_join_ocb,
12332                 .policy = nl80211_policy,
12333                 .flags = GENL_UNS_ADMIN_PERM,
12334                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12335                                   NL80211_FLAG_NEED_RTNL,
12336         },
12337         {
12338                 .cmd = NL80211_CMD_LEAVE_OCB,
12339                 .doit = nl80211_leave_ocb,
12340                 .policy = nl80211_policy,
12341                 .flags = GENL_UNS_ADMIN_PERM,
12342                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12343                                   NL80211_FLAG_NEED_RTNL,
12344         },
12345 #ifdef CONFIG_PM
12346         {
12347                 .cmd = NL80211_CMD_GET_WOWLAN,
12348                 .doit = nl80211_get_wowlan,
12349                 .policy = nl80211_policy,
12350                 /* can be retrieved by unprivileged users */
12351                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12352                                   NL80211_FLAG_NEED_RTNL,
12353         },
12354         {
12355                 .cmd = NL80211_CMD_SET_WOWLAN,
12356                 .doit = nl80211_set_wowlan,
12357                 .policy = nl80211_policy,
12358                 .flags = GENL_UNS_ADMIN_PERM,
12359                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12360                                   NL80211_FLAG_NEED_RTNL,
12361         },
12362 #endif
12363         {
12364                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
12365                 .doit = nl80211_set_rekey_data,
12366                 .policy = nl80211_policy,
12367                 .flags = GENL_UNS_ADMIN_PERM,
12368                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12369                                   NL80211_FLAG_NEED_RTNL |
12370                                   NL80211_FLAG_CLEAR_SKB,
12371         },
12372         {
12373                 .cmd = NL80211_CMD_TDLS_MGMT,
12374                 .doit = nl80211_tdls_mgmt,
12375                 .policy = nl80211_policy,
12376                 .flags = GENL_UNS_ADMIN_PERM,
12377                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12378                                   NL80211_FLAG_NEED_RTNL,
12379         },
12380         {
12381                 .cmd = NL80211_CMD_TDLS_OPER,
12382                 .doit = nl80211_tdls_oper,
12383                 .policy = nl80211_policy,
12384                 .flags = GENL_UNS_ADMIN_PERM,
12385                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12386                                   NL80211_FLAG_NEED_RTNL,
12387         },
12388         {
12389                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
12390                 .doit = nl80211_register_unexpected_frame,
12391                 .policy = nl80211_policy,
12392                 .flags = GENL_UNS_ADMIN_PERM,
12393                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12394                                   NL80211_FLAG_NEED_RTNL,
12395         },
12396         {
12397                 .cmd = NL80211_CMD_PROBE_CLIENT,
12398                 .doit = nl80211_probe_client,
12399                 .policy = nl80211_policy,
12400                 .flags = GENL_UNS_ADMIN_PERM,
12401                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12402                                   NL80211_FLAG_NEED_RTNL,
12403         },
12404         {
12405                 .cmd = NL80211_CMD_REGISTER_BEACONS,
12406                 .doit = nl80211_register_beacons,
12407                 .policy = nl80211_policy,
12408                 .flags = GENL_UNS_ADMIN_PERM,
12409                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12410                                   NL80211_FLAG_NEED_RTNL,
12411         },
12412         {
12413                 .cmd = NL80211_CMD_SET_NOACK_MAP,
12414                 .doit = nl80211_set_noack_map,
12415                 .policy = nl80211_policy,
12416                 .flags = GENL_UNS_ADMIN_PERM,
12417                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12418                                   NL80211_FLAG_NEED_RTNL,
12419         },
12420         {
12421                 .cmd = NL80211_CMD_START_P2P_DEVICE,
12422                 .doit = nl80211_start_p2p_device,
12423                 .policy = nl80211_policy,
12424                 .flags = GENL_UNS_ADMIN_PERM,
12425                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12426                                   NL80211_FLAG_NEED_RTNL,
12427         },
12428         {
12429                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
12430                 .doit = nl80211_stop_p2p_device,
12431                 .policy = nl80211_policy,
12432                 .flags = GENL_UNS_ADMIN_PERM,
12433                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12434                                   NL80211_FLAG_NEED_RTNL,
12435         },
12436         {
12437                 .cmd = NL80211_CMD_START_NAN,
12438                 .doit = nl80211_start_nan,
12439                 .policy = nl80211_policy,
12440                 .flags = GENL_ADMIN_PERM,
12441                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12442                                   NL80211_FLAG_NEED_RTNL,
12443         },
12444         {
12445                 .cmd = NL80211_CMD_STOP_NAN,
12446                 .doit = nl80211_stop_nan,
12447                 .policy = nl80211_policy,
12448                 .flags = GENL_ADMIN_PERM,
12449                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12450                                   NL80211_FLAG_NEED_RTNL,
12451         },
12452         {
12453                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
12454                 .doit = nl80211_nan_add_func,
12455                 .policy = nl80211_policy,
12456                 .flags = GENL_ADMIN_PERM,
12457                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12458                                   NL80211_FLAG_NEED_RTNL,
12459         },
12460         {
12461                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
12462                 .doit = nl80211_nan_del_func,
12463                 .policy = nl80211_policy,
12464                 .flags = GENL_ADMIN_PERM,
12465                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12466                                   NL80211_FLAG_NEED_RTNL,
12467         },
12468         {
12469                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
12470                 .doit = nl80211_nan_change_config,
12471                 .policy = nl80211_policy,
12472                 .flags = GENL_ADMIN_PERM,
12473                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12474                                   NL80211_FLAG_NEED_RTNL,
12475         },
12476         {
12477                 .cmd = NL80211_CMD_SET_MCAST_RATE,
12478                 .doit = nl80211_set_mcast_rate,
12479                 .policy = nl80211_policy,
12480                 .flags = GENL_UNS_ADMIN_PERM,
12481                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12482                                   NL80211_FLAG_NEED_RTNL,
12483         },
12484         {
12485                 .cmd = NL80211_CMD_SET_MAC_ACL,
12486                 .doit = nl80211_set_mac_acl,
12487                 .policy = nl80211_policy,
12488                 .flags = GENL_UNS_ADMIN_PERM,
12489                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12490                                   NL80211_FLAG_NEED_RTNL,
12491         },
12492         {
12493                 .cmd = NL80211_CMD_RADAR_DETECT,
12494                 .doit = nl80211_start_radar_detection,
12495                 .policy = nl80211_policy,
12496                 .flags = GENL_UNS_ADMIN_PERM,
12497                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12498                                   NL80211_FLAG_NEED_RTNL,
12499         },
12500         {
12501                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
12502                 .doit = nl80211_get_protocol_features,
12503                 .policy = nl80211_policy,
12504         },
12505         {
12506                 .cmd = NL80211_CMD_UPDATE_FT_IES,
12507                 .doit = nl80211_update_ft_ies,
12508                 .policy = nl80211_policy,
12509                 .flags = GENL_UNS_ADMIN_PERM,
12510                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12511                                   NL80211_FLAG_NEED_RTNL,
12512         },
12513         {
12514                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
12515                 .doit = nl80211_crit_protocol_start,
12516                 .policy = nl80211_policy,
12517                 .flags = GENL_UNS_ADMIN_PERM,
12518                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12519                                   NL80211_FLAG_NEED_RTNL,
12520         },
12521         {
12522                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
12523                 .doit = nl80211_crit_protocol_stop,
12524                 .policy = nl80211_policy,
12525                 .flags = GENL_UNS_ADMIN_PERM,
12526                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12527                                   NL80211_FLAG_NEED_RTNL,
12528         },
12529         {
12530                 .cmd = NL80211_CMD_GET_COALESCE,
12531                 .doit = nl80211_get_coalesce,
12532                 .policy = nl80211_policy,
12533                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12534                                   NL80211_FLAG_NEED_RTNL,
12535         },
12536         {
12537                 .cmd = NL80211_CMD_SET_COALESCE,
12538                 .doit = nl80211_set_coalesce,
12539                 .policy = nl80211_policy,
12540                 .flags = GENL_UNS_ADMIN_PERM,
12541                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12542                                   NL80211_FLAG_NEED_RTNL,
12543         },
12544         {
12545                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
12546                 .doit = nl80211_channel_switch,
12547                 .policy = nl80211_policy,
12548                 .flags = GENL_UNS_ADMIN_PERM,
12549                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12550                                   NL80211_FLAG_NEED_RTNL,
12551         },
12552         {
12553                 .cmd = NL80211_CMD_VENDOR,
12554                 .doit = nl80211_vendor_cmd,
12555                 .dumpit = nl80211_vendor_cmd_dump,
12556                 .policy = nl80211_policy,
12557                 .flags = GENL_UNS_ADMIN_PERM,
12558                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12559                                   NL80211_FLAG_NEED_RTNL,
12560         },
12561         {
12562                 .cmd = NL80211_CMD_SET_QOS_MAP,
12563                 .doit = nl80211_set_qos_map,
12564                 .policy = nl80211_policy,
12565                 .flags = GENL_UNS_ADMIN_PERM,
12566                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12567                                   NL80211_FLAG_NEED_RTNL,
12568         },
12569         {
12570                 .cmd = NL80211_CMD_ADD_TX_TS,
12571                 .doit = nl80211_add_tx_ts,
12572                 .policy = nl80211_policy,
12573                 .flags = GENL_UNS_ADMIN_PERM,
12574                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12575                                   NL80211_FLAG_NEED_RTNL,
12576         },
12577         {
12578                 .cmd = NL80211_CMD_DEL_TX_TS,
12579                 .doit = nl80211_del_tx_ts,
12580                 .policy = nl80211_policy,
12581                 .flags = GENL_UNS_ADMIN_PERM,
12582                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12583                                   NL80211_FLAG_NEED_RTNL,
12584         },
12585         {
12586                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
12587                 .doit = nl80211_tdls_channel_switch,
12588                 .policy = nl80211_policy,
12589                 .flags = GENL_UNS_ADMIN_PERM,
12590                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12591                                   NL80211_FLAG_NEED_RTNL,
12592         },
12593         {
12594                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
12595                 .doit = nl80211_tdls_cancel_channel_switch,
12596                 .policy = nl80211_policy,
12597                 .flags = GENL_UNS_ADMIN_PERM,
12598                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12599                                   NL80211_FLAG_NEED_RTNL,
12600         },
12601 };
12602
12603 /* notification functions */
12604
12605 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
12606                           enum nl80211_commands cmd)
12607 {
12608         struct sk_buff *msg;
12609         struct nl80211_dump_wiphy_state state = {};
12610
12611         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
12612                 cmd != NL80211_CMD_DEL_WIPHY);
12613
12614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12615         if (!msg)
12616                 return;
12617
12618         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
12619                 nlmsg_free(msg);
12620                 return;
12621         }
12622
12623         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12624                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12625 }
12626
12627 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
12628                                 struct wireless_dev *wdev,
12629                                 enum nl80211_commands cmd)
12630 {
12631         struct sk_buff *msg;
12632
12633         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
12634                 cmd != NL80211_CMD_DEL_INTERFACE);
12635
12636         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12637         if (!msg)
12638                 return;
12639
12640         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
12641                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
12642                 nlmsg_free(msg);
12643                 return;
12644         }
12645
12646         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12647                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12648 }
12649
12650 static int nl80211_add_scan_req(struct sk_buff *msg,
12651                                 struct cfg80211_registered_device *rdev)
12652 {
12653         struct cfg80211_scan_request *req = rdev->scan_req;
12654         struct nlattr *nest;
12655         int i;
12656
12657         if (WARN_ON(!req))
12658                 return 0;
12659
12660         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
12661         if (!nest)
12662                 goto nla_put_failure;
12663         for (i = 0; i < req->n_ssids; i++) {
12664                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
12665                         goto nla_put_failure;
12666         }
12667         nla_nest_end(msg, nest);
12668
12669         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12670         if (!nest)
12671                 goto nla_put_failure;
12672         for (i = 0; i < req->n_channels; i++) {
12673                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12674                         goto nla_put_failure;
12675         }
12676         nla_nest_end(msg, nest);
12677
12678         if (req->ie &&
12679             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
12680                 goto nla_put_failure;
12681
12682         if (req->flags &&
12683             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
12684                 goto nla_put_failure;
12685
12686         if (req->info.scan_start_tsf &&
12687             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
12688                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
12689              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
12690                      req->info.tsf_bssid)))
12691                 goto nla_put_failure;
12692
12693         return 0;
12694  nla_put_failure:
12695         return -ENOBUFS;
12696 }
12697
12698 static int nl80211_send_scan_msg(struct sk_buff *msg,
12699                                  struct cfg80211_registered_device *rdev,
12700                                  struct wireless_dev *wdev,
12701                                  u32 portid, u32 seq, int flags,
12702                                  u32 cmd)
12703 {
12704         void *hdr;
12705
12706         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12707         if (!hdr)
12708                 return -1;
12709
12710         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12711             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12712                                          wdev->netdev->ifindex)) ||
12713             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12714                               NL80211_ATTR_PAD))
12715                 goto nla_put_failure;
12716
12717         /* ignore errors and send incomplete event anyway */
12718         nl80211_add_scan_req(msg, rdev);
12719
12720         genlmsg_end(msg, hdr);
12721         return 0;
12722
12723  nla_put_failure:
12724         genlmsg_cancel(msg, hdr);
12725         return -EMSGSIZE;
12726 }
12727
12728 static int
12729 nl80211_send_sched_scan_msg(struct sk_buff *msg,
12730                             struct cfg80211_registered_device *rdev,
12731                             struct net_device *netdev,
12732                             u32 portid, u32 seq, int flags, u32 cmd)
12733 {
12734         void *hdr;
12735
12736         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12737         if (!hdr)
12738                 return -1;
12739
12740         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12741             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12742                 goto nla_put_failure;
12743
12744         genlmsg_end(msg, hdr);
12745         return 0;
12746
12747  nla_put_failure:
12748         genlmsg_cancel(msg, hdr);
12749         return -EMSGSIZE;
12750 }
12751
12752 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
12753                              struct wireless_dev *wdev)
12754 {
12755         struct sk_buff *msg;
12756
12757         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12758         if (!msg)
12759                 return;
12760
12761         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12762                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
12763                 nlmsg_free(msg);
12764                 return;
12765         }
12766
12767         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12768                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12769 }
12770
12771 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
12772                                        struct wireless_dev *wdev, bool aborted)
12773 {
12774         struct sk_buff *msg;
12775
12776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12777         if (!msg)
12778                 return NULL;
12779
12780         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12781                                   aborted ? NL80211_CMD_SCAN_ABORTED :
12782                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
12783                 nlmsg_free(msg);
12784                 return NULL;
12785         }
12786
12787         return msg;
12788 }
12789
12790 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
12791                               struct sk_buff *msg)
12792 {
12793         if (!msg)
12794                 return;
12795
12796         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12797                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12798 }
12799
12800 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
12801                                      struct net_device *netdev)
12802 {
12803         struct sk_buff *msg;
12804
12805         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12806         if (!msg)
12807                 return;
12808
12809         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
12810                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
12811                 nlmsg_free(msg);
12812                 return;
12813         }
12814
12815         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12816                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12817 }
12818
12819 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
12820                              struct net_device *netdev, u32 cmd)
12821 {
12822         struct sk_buff *msg;
12823
12824         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12825         if (!msg)
12826                 return;
12827
12828         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
12829                 nlmsg_free(msg);
12830                 return;
12831         }
12832
12833         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12834                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12835 }
12836
12837 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
12838                                           struct regulatory_request *request)
12839 {
12840         /* Userspace can always count this one always being set */
12841         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
12842                 goto nla_put_failure;
12843
12844         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
12845                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12846                                NL80211_REGDOM_TYPE_WORLD))
12847                         goto nla_put_failure;
12848         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
12849                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12850                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
12851                         goto nla_put_failure;
12852         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
12853                    request->intersect) {
12854                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12855                                NL80211_REGDOM_TYPE_INTERSECTION))
12856                         goto nla_put_failure;
12857         } else {
12858                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12859                                NL80211_REGDOM_TYPE_COUNTRY) ||
12860                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
12861                                    request->alpha2))
12862                         goto nla_put_failure;
12863         }
12864
12865         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
12866                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
12867
12868                 if (wiphy &&
12869                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
12870                         goto nla_put_failure;
12871
12872                 if (wiphy &&
12873                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
12874                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
12875                         goto nla_put_failure;
12876         }
12877
12878         return true;
12879
12880 nla_put_failure:
12881         return false;
12882 }
12883
12884 /*
12885  * This can happen on global regulatory changes or device specific settings
12886  * based on custom regulatory domains.
12887  */
12888 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
12889                                      struct regulatory_request *request)
12890 {
12891         struct sk_buff *msg;
12892         void *hdr;
12893
12894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12895         if (!msg)
12896                 return;
12897
12898         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
12899         if (!hdr) {
12900                 nlmsg_free(msg);
12901                 return;
12902         }
12903
12904         if (nl80211_reg_change_event_fill(msg, request) == false)
12905                 goto nla_put_failure;
12906
12907         genlmsg_end(msg, hdr);
12908
12909         rcu_read_lock();
12910         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12911                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12912         rcu_read_unlock();
12913
12914         return;
12915
12916 nla_put_failure:
12917         genlmsg_cancel(msg, hdr);
12918         nlmsg_free(msg);
12919 }
12920
12921 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
12922                                     struct net_device *netdev,
12923                                     const u8 *buf, size_t len,
12924                                     enum nl80211_commands cmd, gfp_t gfp,
12925                                     int uapsd_queues)
12926 {
12927         struct sk_buff *msg;
12928         void *hdr;
12929
12930         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12931         if (!msg)
12932                 return;
12933
12934         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12935         if (!hdr) {
12936                 nlmsg_free(msg);
12937                 return;
12938         }
12939
12940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12941             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12942             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
12943                 goto nla_put_failure;
12944
12945         if (uapsd_queues >= 0) {
12946                 struct nlattr *nla_wmm =
12947                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
12948                 if (!nla_wmm)
12949                         goto nla_put_failure;
12950
12951                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
12952                                uapsd_queues))
12953                         goto nla_put_failure;
12954
12955                 nla_nest_end(msg, nla_wmm);
12956         }
12957
12958         genlmsg_end(msg, hdr);
12959
12960         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12961                                 NL80211_MCGRP_MLME, gfp);
12962         return;
12963
12964  nla_put_failure:
12965         genlmsg_cancel(msg, hdr);
12966         nlmsg_free(msg);
12967 }
12968
12969 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
12970                           struct net_device *netdev, const u8 *buf,
12971                           size_t len, gfp_t gfp)
12972 {
12973         nl80211_send_mlme_event(rdev, netdev, buf, len,
12974                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
12975 }
12976
12977 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
12978                            struct net_device *netdev, const u8 *buf,
12979                            size_t len, gfp_t gfp, int uapsd_queues)
12980 {
12981         nl80211_send_mlme_event(rdev, netdev, buf, len,
12982                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
12983 }
12984
12985 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
12986                          struct net_device *netdev, const u8 *buf,
12987                          size_t len, gfp_t gfp)
12988 {
12989         nl80211_send_mlme_event(rdev, netdev, buf, len,
12990                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
12991 }
12992
12993 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
12994                            struct net_device *netdev, const u8 *buf,
12995                            size_t len, gfp_t gfp)
12996 {
12997         nl80211_send_mlme_event(rdev, netdev, buf, len,
12998                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
12999 }
13000
13001 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13002                                   size_t len)
13003 {
13004         struct wireless_dev *wdev = dev->ieee80211_ptr;
13005         struct wiphy *wiphy = wdev->wiphy;
13006         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13007         const struct ieee80211_mgmt *mgmt = (void *)buf;
13008         u32 cmd;
13009
13010         if (WARN_ON(len < 2))
13011                 return;
13012
13013         if (ieee80211_is_deauth(mgmt->frame_control))
13014                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13015         else
13016                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13017
13018         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13019         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13020 }
13021 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13022
13023 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13024                                       struct net_device *netdev, int cmd,
13025                                       const u8 *addr, gfp_t gfp)
13026 {
13027         struct sk_buff *msg;
13028         void *hdr;
13029
13030         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13031         if (!msg)
13032                 return;
13033
13034         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13035         if (!hdr) {
13036                 nlmsg_free(msg);
13037                 return;
13038         }
13039
13040         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13041             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13042             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13043             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13044                 goto nla_put_failure;
13045
13046         genlmsg_end(msg, hdr);
13047
13048         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13049                                 NL80211_MCGRP_MLME, gfp);
13050         return;
13051
13052  nla_put_failure:
13053         genlmsg_cancel(msg, hdr);
13054         nlmsg_free(msg);
13055 }
13056
13057 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13058                                struct net_device *netdev, const u8 *addr,
13059                                gfp_t gfp)
13060 {
13061         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13062                                   addr, gfp);
13063 }
13064
13065 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13066                                 struct net_device *netdev, const u8 *addr,
13067                                 gfp_t gfp)
13068 {
13069         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13070                                   addr, gfp);
13071 }
13072
13073 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13074                                  struct net_device *netdev, const u8 *bssid,
13075                                  const u8 *req_ie, size_t req_ie_len,
13076                                  const u8 *resp_ie, size_t resp_ie_len,
13077                                  int status, gfp_t gfp)
13078 {
13079         struct sk_buff *msg;
13080         void *hdr;
13081
13082         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13083         if (!msg)
13084                 return;
13085
13086         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13087         if (!hdr) {
13088                 nlmsg_free(msg);
13089                 return;
13090         }
13091
13092         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13093             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13094             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
13095             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13096                         status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13097                         status) ||
13098             (status < 0 && nla_put_flag(msg, NL80211_ATTR_TIMED_OUT)) ||
13099             (req_ie &&
13100              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13101             (resp_ie &&
13102              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13103                 goto nla_put_failure;
13104
13105         genlmsg_end(msg, hdr);
13106
13107         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13108                                 NL80211_MCGRP_MLME, gfp);
13109         return;
13110
13111  nla_put_failure:
13112         genlmsg_cancel(msg, hdr);
13113         nlmsg_free(msg);
13114 }
13115
13116 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13117                          struct net_device *netdev, const u8 *bssid,
13118                          const u8 *req_ie, size_t req_ie_len,
13119                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
13120 {
13121         struct sk_buff *msg;
13122         void *hdr;
13123
13124         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13125         if (!msg)
13126                 return;
13127
13128         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13129         if (!hdr) {
13130                 nlmsg_free(msg);
13131                 return;
13132         }
13133
13134         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13135             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13136             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13137             (req_ie &&
13138              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13139             (resp_ie &&
13140              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13141                 goto nla_put_failure;
13142
13143         genlmsg_end(msg, hdr);
13144
13145         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13146                                 NL80211_MCGRP_MLME, gfp);
13147         return;
13148
13149  nla_put_failure:
13150         genlmsg_cancel(msg, hdr);
13151         nlmsg_free(msg);
13152 }
13153
13154 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13155                                struct net_device *netdev, u16 reason,
13156                                const u8 *ie, size_t ie_len, bool from_ap)
13157 {
13158         struct sk_buff *msg;
13159         void *hdr;
13160
13161         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13162         if (!msg)
13163                 return;
13164
13165         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13166         if (!hdr) {
13167                 nlmsg_free(msg);
13168                 return;
13169         }
13170
13171         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13172             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13173             (from_ap && reason &&
13174              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13175             (from_ap &&
13176              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13177             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13178                 goto nla_put_failure;
13179
13180         genlmsg_end(msg, hdr);
13181
13182         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13183                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13184         return;
13185
13186  nla_put_failure:
13187         genlmsg_cancel(msg, hdr);
13188         nlmsg_free(msg);
13189 }
13190
13191 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13192                              struct net_device *netdev, const u8 *bssid,
13193                              gfp_t gfp)
13194 {
13195         struct sk_buff *msg;
13196         void *hdr;
13197
13198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13199         if (!msg)
13200                 return;
13201
13202         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13203         if (!hdr) {
13204                 nlmsg_free(msg);
13205                 return;
13206         }
13207
13208         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13209             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13210             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13211                 goto nla_put_failure;
13212
13213         genlmsg_end(msg, hdr);
13214
13215         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13216                                 NL80211_MCGRP_MLME, gfp);
13217         return;
13218
13219  nla_put_failure:
13220         genlmsg_cancel(msg, hdr);
13221         nlmsg_free(msg);
13222 }
13223
13224 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13225                                         const u8* ie, u8 ie_len, gfp_t gfp)
13226 {
13227         struct wireless_dev *wdev = dev->ieee80211_ptr;
13228         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13229         struct sk_buff *msg;
13230         void *hdr;
13231
13232         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13233                 return;
13234
13235         trace_cfg80211_notify_new_peer_candidate(dev, addr);
13236
13237         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13238         if (!msg)
13239                 return;
13240
13241         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13242         if (!hdr) {
13243                 nlmsg_free(msg);
13244                 return;
13245         }
13246
13247         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13248             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13249             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13250             (ie_len && ie &&
13251              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13252                 goto nla_put_failure;
13253
13254         genlmsg_end(msg, hdr);
13255
13256         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13257                                 NL80211_MCGRP_MLME, gfp);
13258         return;
13259
13260  nla_put_failure:
13261         genlmsg_cancel(msg, hdr);
13262         nlmsg_free(msg);
13263 }
13264 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13265
13266 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13267                                  struct net_device *netdev, const u8 *addr,
13268                                  enum nl80211_key_type key_type, int key_id,
13269                                  const u8 *tsc, gfp_t gfp)
13270 {
13271         struct sk_buff *msg;
13272         void *hdr;
13273
13274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13275         if (!msg)
13276                 return;
13277
13278         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
13279         if (!hdr) {
13280                 nlmsg_free(msg);
13281                 return;
13282         }
13283
13284         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13285             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13286             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
13287             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
13288             (key_id != -1 &&
13289              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
13290             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
13291                 goto nla_put_failure;
13292
13293         genlmsg_end(msg, hdr);
13294
13295         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13296                                 NL80211_MCGRP_MLME, gfp);
13297         return;
13298
13299  nla_put_failure:
13300         genlmsg_cancel(msg, hdr);
13301         nlmsg_free(msg);
13302 }
13303
13304 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
13305                                     struct ieee80211_channel *channel_before,
13306                                     struct ieee80211_channel *channel_after)
13307 {
13308         struct sk_buff *msg;
13309         void *hdr;
13310         struct nlattr *nl_freq;
13311
13312         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
13313         if (!msg)
13314                 return;
13315
13316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
13317         if (!hdr) {
13318                 nlmsg_free(msg);
13319                 return;
13320         }
13321
13322         /*
13323          * Since we are applying the beacon hint to a wiphy we know its
13324          * wiphy_idx is valid
13325          */
13326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
13327                 goto nla_put_failure;
13328
13329         /* Before */
13330         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
13331         if (!nl_freq)
13332                 goto nla_put_failure;
13333         if (nl80211_msg_put_channel(msg, channel_before, false))
13334                 goto nla_put_failure;
13335         nla_nest_end(msg, nl_freq);
13336
13337         /* After */
13338         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
13339         if (!nl_freq)
13340                 goto nla_put_failure;
13341         if (nl80211_msg_put_channel(msg, channel_after, false))
13342                 goto nla_put_failure;
13343         nla_nest_end(msg, nl_freq);
13344
13345         genlmsg_end(msg, hdr);
13346
13347         rcu_read_lock();
13348         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13349                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13350         rcu_read_unlock();
13351
13352         return;
13353
13354 nla_put_failure:
13355         genlmsg_cancel(msg, hdr);
13356         nlmsg_free(msg);
13357 }
13358
13359 static void nl80211_send_remain_on_chan_event(
13360         int cmd, struct cfg80211_registered_device *rdev,
13361         struct wireless_dev *wdev, u64 cookie,
13362         struct ieee80211_channel *chan,
13363         unsigned int duration, gfp_t gfp)
13364 {
13365         struct sk_buff *msg;
13366         void *hdr;
13367
13368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13369         if (!msg)
13370                 return;
13371
13372         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13373         if (!hdr) {
13374                 nlmsg_free(msg);
13375                 return;
13376         }
13377
13378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13379             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13380                                          wdev->netdev->ifindex)) ||
13381             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13382                               NL80211_ATTR_PAD) ||
13383             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
13384             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
13385                         NL80211_CHAN_NO_HT) ||
13386             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13387                               NL80211_ATTR_PAD))
13388                 goto nla_put_failure;
13389
13390         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
13391             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
13392                 goto nla_put_failure;
13393
13394         genlmsg_end(msg, hdr);
13395
13396         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13397                                 NL80211_MCGRP_MLME, gfp);
13398         return;
13399
13400  nla_put_failure:
13401         genlmsg_cancel(msg, hdr);
13402         nlmsg_free(msg);
13403 }
13404
13405 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
13406                                struct ieee80211_channel *chan,
13407                                unsigned int duration, gfp_t gfp)
13408 {
13409         struct wiphy *wiphy = wdev->wiphy;
13410         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13411
13412         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
13413         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
13414                                           rdev, wdev, cookie, chan,
13415                                           duration, gfp);
13416 }
13417 EXPORT_SYMBOL(cfg80211_ready_on_channel);
13418
13419 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
13420                                         struct ieee80211_channel *chan,
13421                                         gfp_t gfp)
13422 {
13423         struct wiphy *wiphy = wdev->wiphy;
13424         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13425
13426         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
13427         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13428                                           rdev, wdev, cookie, chan, 0, gfp);
13429 }
13430 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
13431
13432 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
13433                       struct station_info *sinfo, gfp_t gfp)
13434 {
13435         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13436         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13437         struct sk_buff *msg;
13438
13439         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
13440
13441         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13442         if (!msg)
13443                 return;
13444
13445         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
13446                                  rdev, dev, mac_addr, sinfo) < 0) {
13447                 nlmsg_free(msg);
13448                 return;
13449         }
13450
13451         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13452                                 NL80211_MCGRP_MLME, gfp);
13453 }
13454 EXPORT_SYMBOL(cfg80211_new_sta);
13455
13456 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
13457                             struct station_info *sinfo, gfp_t gfp)
13458 {
13459         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13460         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13461         struct sk_buff *msg;
13462         struct station_info empty_sinfo = {};
13463
13464         if (!sinfo)
13465                 sinfo = &empty_sinfo;
13466
13467         trace_cfg80211_del_sta(dev, mac_addr);
13468
13469         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13470         if (!msg)
13471                 return;
13472
13473         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
13474                                  rdev, dev, mac_addr, sinfo) < 0) {
13475                 nlmsg_free(msg);
13476                 return;
13477         }
13478
13479         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13480                                 NL80211_MCGRP_MLME, gfp);
13481 }
13482 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
13483
13484 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
13485                           enum nl80211_connect_failed_reason reason,
13486                           gfp_t gfp)
13487 {
13488         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13489         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13490         struct sk_buff *msg;
13491         void *hdr;
13492
13493         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
13494         if (!msg)
13495                 return;
13496
13497         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
13498         if (!hdr) {
13499                 nlmsg_free(msg);
13500                 return;
13501         }
13502
13503         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13504             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
13505             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
13506                 goto nla_put_failure;
13507
13508         genlmsg_end(msg, hdr);
13509
13510         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13511                                 NL80211_MCGRP_MLME, gfp);
13512         return;
13513
13514  nla_put_failure:
13515         genlmsg_cancel(msg, hdr);
13516         nlmsg_free(msg);
13517 }
13518 EXPORT_SYMBOL(cfg80211_conn_failed);
13519
13520 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
13521                                        const u8 *addr, gfp_t gfp)
13522 {
13523         struct wireless_dev *wdev = dev->ieee80211_ptr;
13524         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13525         struct sk_buff *msg;
13526         void *hdr;
13527         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
13528
13529         if (!nlportid)
13530                 return false;
13531
13532         msg = nlmsg_new(100, gfp);
13533         if (!msg)
13534                 return true;
13535
13536         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13537         if (!hdr) {
13538                 nlmsg_free(msg);
13539                 return true;
13540         }
13541
13542         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13543             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13544             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13545                 goto nla_put_failure;
13546
13547         genlmsg_end(msg, hdr);
13548         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13549         return true;
13550
13551  nla_put_failure:
13552         genlmsg_cancel(msg, hdr);
13553         nlmsg_free(msg);
13554         return true;
13555 }
13556
13557 bool cfg80211_rx_spurious_frame(struct net_device *dev,
13558                                 const u8 *addr, gfp_t gfp)
13559 {
13560         struct wireless_dev *wdev = dev->ieee80211_ptr;
13561         bool ret;
13562
13563         trace_cfg80211_rx_spurious_frame(dev, addr);
13564
13565         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13566                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
13567                 trace_cfg80211_return_bool(false);
13568                 return false;
13569         }
13570         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
13571                                          addr, gfp);
13572         trace_cfg80211_return_bool(ret);
13573         return ret;
13574 }
13575 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
13576
13577 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
13578                                         const u8 *addr, gfp_t gfp)
13579 {
13580         struct wireless_dev *wdev = dev->ieee80211_ptr;
13581         bool ret;
13582
13583         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
13584
13585         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13586                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
13587                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
13588                 trace_cfg80211_return_bool(false);
13589                 return false;
13590         }
13591         ret = __nl80211_unexpected_frame(dev,
13592                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
13593                                          addr, gfp);
13594         trace_cfg80211_return_bool(ret);
13595         return ret;
13596 }
13597 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
13598
13599 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
13600                       struct wireless_dev *wdev, u32 nlportid,
13601                       int freq, int sig_dbm,
13602                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
13603 {
13604         struct net_device *netdev = wdev->netdev;
13605         struct sk_buff *msg;
13606         void *hdr;
13607
13608         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13609         if (!msg)
13610                 return -ENOMEM;
13611
13612         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13613         if (!hdr) {
13614                 nlmsg_free(msg);
13615                 return -ENOMEM;
13616         }
13617
13618         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13619             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13620                                         netdev->ifindex)) ||
13621             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13622                               NL80211_ATTR_PAD) ||
13623             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
13624             (sig_dbm &&
13625              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13626             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13627             (flags &&
13628              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
13629                 goto nla_put_failure;
13630
13631         genlmsg_end(msg, hdr);
13632
13633         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13634
13635  nla_put_failure:
13636         genlmsg_cancel(msg, hdr);
13637         nlmsg_free(msg);
13638         return -ENOBUFS;
13639 }
13640
13641 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
13642                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
13643 {
13644         struct wiphy *wiphy = wdev->wiphy;
13645         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13646         struct net_device *netdev = wdev->netdev;
13647         struct sk_buff *msg;
13648         void *hdr;
13649
13650         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
13651
13652         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13653         if (!msg)
13654                 return;
13655
13656         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
13657         if (!hdr) {
13658                 nlmsg_free(msg);
13659                 return;
13660         }
13661
13662         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13663             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13664                                    netdev->ifindex)) ||
13665             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13666                               NL80211_ATTR_PAD) ||
13667             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13668             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13669                               NL80211_ATTR_PAD) ||
13670             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
13671                 goto nla_put_failure;
13672
13673         genlmsg_end(msg, hdr);
13674
13675         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13676                                 NL80211_MCGRP_MLME, gfp);
13677         return;
13678
13679  nla_put_failure:
13680         genlmsg_cancel(msg, hdr);
13681         nlmsg_free(msg);
13682 }
13683 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
13684
13685 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
13686                                             const char *mac, gfp_t gfp)
13687 {
13688         struct wireless_dev *wdev = dev->ieee80211_ptr;
13689         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13690         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13691         void **cb;
13692
13693         if (!msg)
13694                 return NULL;
13695
13696         cb = (void **)msg->cb;
13697
13698         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
13699         if (!cb[0]) {
13700                 nlmsg_free(msg);
13701                 return NULL;
13702         }
13703
13704         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13705             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13706                 goto nla_put_failure;
13707
13708         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
13709                 goto nla_put_failure;
13710
13711         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
13712         if (!cb[1])
13713                 goto nla_put_failure;
13714
13715         cb[2] = rdev;
13716
13717         return msg;
13718  nla_put_failure:
13719         nlmsg_free(msg);
13720         return NULL;
13721 }
13722
13723 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
13724 {
13725         void **cb = (void **)msg->cb;
13726         struct cfg80211_registered_device *rdev = cb[2];
13727
13728         nla_nest_end(msg, cb[1]);
13729         genlmsg_end(msg, cb[0]);
13730
13731         memset(msg->cb, 0, sizeof(msg->cb));
13732
13733         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13734                                 NL80211_MCGRP_MLME, gfp);
13735 }
13736
13737 void cfg80211_cqm_rssi_notify(struct net_device *dev,
13738                               enum nl80211_cqm_rssi_threshold_event rssi_event,
13739                               gfp_t gfp)
13740 {
13741         struct sk_buff *msg;
13742
13743         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
13744
13745         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
13746                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
13747                 return;
13748
13749         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13750         if (!msg)
13751                 return;
13752
13753         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
13754                         rssi_event))
13755                 goto nla_put_failure;
13756
13757         cfg80211_send_cqm(msg, gfp);
13758
13759         return;
13760
13761  nla_put_failure:
13762         nlmsg_free(msg);
13763 }
13764 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
13765
13766 void cfg80211_cqm_txe_notify(struct net_device *dev,
13767                              const u8 *peer, u32 num_packets,
13768                              u32 rate, u32 intvl, gfp_t gfp)
13769 {
13770         struct sk_buff *msg;
13771
13772         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13773         if (!msg)
13774                 return;
13775
13776         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
13777                 goto nla_put_failure;
13778
13779         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
13780                 goto nla_put_failure;
13781
13782         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
13783                 goto nla_put_failure;
13784
13785         cfg80211_send_cqm(msg, gfp);
13786         return;
13787
13788  nla_put_failure:
13789         nlmsg_free(msg);
13790 }
13791 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
13792
13793 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
13794                                  const u8 *peer, u32 num_packets, gfp_t gfp)
13795 {
13796         struct sk_buff *msg;
13797
13798         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
13799
13800         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13801         if (!msg)
13802                 return;
13803
13804         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
13805                 goto nla_put_failure;
13806
13807         cfg80211_send_cqm(msg, gfp);
13808         return;
13809
13810  nla_put_failure:
13811         nlmsg_free(msg);
13812 }
13813 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
13814
13815 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
13816 {
13817         struct sk_buff *msg;
13818
13819         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13820         if (!msg)
13821                 return;
13822
13823         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
13824                 goto nla_put_failure;
13825
13826         cfg80211_send_cqm(msg, gfp);
13827         return;
13828
13829  nla_put_failure:
13830         nlmsg_free(msg);
13831 }
13832 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
13833
13834 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
13835                                      struct net_device *netdev, const u8 *bssid,
13836                                      const u8 *replay_ctr, gfp_t gfp)
13837 {
13838         struct sk_buff *msg;
13839         struct nlattr *rekey_attr;
13840         void *hdr;
13841
13842         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13843         if (!msg)
13844                 return;
13845
13846         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
13847         if (!hdr) {
13848                 nlmsg_free(msg);
13849                 return;
13850         }
13851
13852         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13853             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13854             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13855                 goto nla_put_failure;
13856
13857         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
13858         if (!rekey_attr)
13859                 goto nla_put_failure;
13860
13861         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
13862                     NL80211_REPLAY_CTR_LEN, replay_ctr))
13863                 goto nla_put_failure;
13864
13865         nla_nest_end(msg, rekey_attr);
13866
13867         genlmsg_end(msg, hdr);
13868
13869         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13870                                 NL80211_MCGRP_MLME, gfp);
13871         return;
13872
13873  nla_put_failure:
13874         genlmsg_cancel(msg, hdr);
13875         nlmsg_free(msg);
13876 }
13877
13878 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
13879                                const u8 *replay_ctr, gfp_t gfp)
13880 {
13881         struct wireless_dev *wdev = dev->ieee80211_ptr;
13882         struct wiphy *wiphy = wdev->wiphy;
13883         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13884
13885         trace_cfg80211_gtk_rekey_notify(dev, bssid);
13886         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
13887 }
13888 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
13889
13890 static void
13891 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
13892                                struct net_device *netdev, int index,
13893                                const u8 *bssid, bool preauth, gfp_t gfp)
13894 {
13895         struct sk_buff *msg;
13896         struct nlattr *attr;
13897         void *hdr;
13898
13899         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13900         if (!msg)
13901                 return;
13902
13903         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
13904         if (!hdr) {
13905                 nlmsg_free(msg);
13906                 return;
13907         }
13908
13909         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13910             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13911                 goto nla_put_failure;
13912
13913         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
13914         if (!attr)
13915                 goto nla_put_failure;
13916
13917         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
13918             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
13919             (preauth &&
13920              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
13921                 goto nla_put_failure;
13922
13923         nla_nest_end(msg, attr);
13924
13925         genlmsg_end(msg, hdr);
13926
13927         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13928                                 NL80211_MCGRP_MLME, gfp);
13929         return;
13930
13931  nla_put_failure:
13932         genlmsg_cancel(msg, hdr);
13933         nlmsg_free(msg);
13934 }
13935
13936 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
13937                                      const u8 *bssid, bool preauth, gfp_t gfp)
13938 {
13939         struct wireless_dev *wdev = dev->ieee80211_ptr;
13940         struct wiphy *wiphy = wdev->wiphy;
13941         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13942
13943         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
13944         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
13945 }
13946 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
13947
13948 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
13949                                      struct net_device *netdev,
13950                                      struct cfg80211_chan_def *chandef,
13951                                      gfp_t gfp,
13952                                      enum nl80211_commands notif,
13953                                      u8 count)
13954 {
13955         struct sk_buff *msg;
13956         void *hdr;
13957
13958         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13959         if (!msg)
13960                 return;
13961
13962         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
13963         if (!hdr) {
13964                 nlmsg_free(msg);
13965                 return;
13966         }
13967
13968         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13969                 goto nla_put_failure;
13970
13971         if (nl80211_send_chandef(msg, chandef))
13972                 goto nla_put_failure;
13973
13974         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
13975             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
13976                         goto nla_put_failure;
13977
13978         genlmsg_end(msg, hdr);
13979
13980         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13981                                 NL80211_MCGRP_MLME, gfp);
13982         return;
13983
13984  nla_put_failure:
13985         genlmsg_cancel(msg, hdr);
13986         nlmsg_free(msg);
13987 }
13988
13989 void cfg80211_ch_switch_notify(struct net_device *dev,
13990                                struct cfg80211_chan_def *chandef)
13991 {
13992         struct wireless_dev *wdev = dev->ieee80211_ptr;
13993         struct wiphy *wiphy = wdev->wiphy;
13994         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13995
13996         ASSERT_WDEV_LOCK(wdev);
13997
13998         trace_cfg80211_ch_switch_notify(dev, chandef);
13999
14000         wdev->chandef = *chandef;
14001         wdev->preset_chandef = *chandef;
14002         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14003                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14004 }
14005 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14006
14007 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14008                                        struct cfg80211_chan_def *chandef,
14009                                        u8 count)
14010 {
14011         struct wireless_dev *wdev = dev->ieee80211_ptr;
14012         struct wiphy *wiphy = wdev->wiphy;
14013         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14014
14015         trace_cfg80211_ch_switch_started_notify(dev, chandef);
14016
14017         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14018                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14019 }
14020 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14021
14022 void
14023 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14024                      const struct cfg80211_chan_def *chandef,
14025                      enum nl80211_radar_event event,
14026                      struct net_device *netdev, gfp_t gfp)
14027 {
14028         struct sk_buff *msg;
14029         void *hdr;
14030
14031         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14032         if (!msg)
14033                 return;
14034
14035         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14036         if (!hdr) {
14037                 nlmsg_free(msg);
14038                 return;
14039         }
14040
14041         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14042                 goto nla_put_failure;
14043
14044         /* NOP and radar events don't need a netdev parameter */
14045         if (netdev) {
14046                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14047
14048                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14049                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14050                                       NL80211_ATTR_PAD))
14051                         goto nla_put_failure;
14052         }
14053
14054         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14055                 goto nla_put_failure;
14056
14057         if (nl80211_send_chandef(msg, chandef))
14058                 goto nla_put_failure;
14059
14060         genlmsg_end(msg, hdr);
14061
14062         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14063                                 NL80211_MCGRP_MLME, gfp);
14064         return;
14065
14066  nla_put_failure:
14067         genlmsg_cancel(msg, hdr);
14068         nlmsg_free(msg);
14069 }
14070
14071 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14072                            u64 cookie, bool acked, gfp_t gfp)
14073 {
14074         struct wireless_dev *wdev = dev->ieee80211_ptr;
14075         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14076         struct sk_buff *msg;
14077         void *hdr;
14078
14079         trace_cfg80211_probe_status(dev, addr, cookie, acked);
14080
14081         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14082
14083         if (!msg)
14084                 return;
14085
14086         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14087         if (!hdr) {
14088                 nlmsg_free(msg);
14089                 return;
14090         }
14091
14092         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14093             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14094             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14095             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14096                               NL80211_ATTR_PAD) ||
14097             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14098                 goto nla_put_failure;
14099
14100         genlmsg_end(msg, hdr);
14101
14102         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14103                                 NL80211_MCGRP_MLME, gfp);
14104         return;
14105
14106  nla_put_failure:
14107         genlmsg_cancel(msg, hdr);
14108         nlmsg_free(msg);
14109 }
14110 EXPORT_SYMBOL(cfg80211_probe_status);
14111
14112 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14113                                  const u8 *frame, size_t len,
14114                                  int freq, int sig_dbm)
14115 {
14116         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14117         struct sk_buff *msg;
14118         void *hdr;
14119         struct cfg80211_beacon_registration *reg;
14120
14121         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14122
14123         spin_lock_bh(&rdev->beacon_registrations_lock);
14124         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14125                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14126                 if (!msg) {
14127                         spin_unlock_bh(&rdev->beacon_registrations_lock);
14128                         return;
14129                 }
14130
14131                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14132                 if (!hdr)
14133                         goto nla_put_failure;
14134
14135                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14136                     (freq &&
14137                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14138                     (sig_dbm &&
14139                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14140                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14141                         goto nla_put_failure;
14142
14143                 genlmsg_end(msg, hdr);
14144
14145                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14146         }
14147         spin_unlock_bh(&rdev->beacon_registrations_lock);
14148         return;
14149
14150  nla_put_failure:
14151         spin_unlock_bh(&rdev->beacon_registrations_lock);
14152         if (hdr)
14153                 genlmsg_cancel(msg, hdr);
14154         nlmsg_free(msg);
14155 }
14156 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14157
14158 #ifdef CONFIG_PM
14159 static int cfg80211_net_detect_results(struct sk_buff *msg,
14160                                        struct cfg80211_wowlan_wakeup *wakeup)
14161 {
14162         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14163         struct nlattr *nl_results, *nl_match, *nl_freqs;
14164         int i, j;
14165
14166         nl_results = nla_nest_start(
14167                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14168         if (!nl_results)
14169                 return -EMSGSIZE;
14170
14171         for (i = 0; i < nd->n_matches; i++) {
14172                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14173
14174                 nl_match = nla_nest_start(msg, i);
14175                 if (!nl_match)
14176                         break;
14177
14178                 /* The SSID attribute is optional in nl80211, but for
14179                  * simplicity reasons it's always present in the
14180                  * cfg80211 structure.  If a driver can't pass the
14181                  * SSID, that needs to be changed.  A zero length SSID
14182                  * is still a valid SSID (wildcard), so it cannot be
14183                  * used for this purpose.
14184                  */
14185                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14186                             match->ssid.ssid)) {
14187                         nla_nest_cancel(msg, nl_match);
14188                         goto out;
14189                 }
14190
14191                 if (match->n_channels) {
14192                         nl_freqs = nla_nest_start(
14193                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14194                         if (!nl_freqs) {
14195                                 nla_nest_cancel(msg, nl_match);
14196                                 goto out;
14197                         }
14198
14199                         for (j = 0; j < match->n_channels; j++) {
14200                                 if (nla_put_u32(msg, j, match->channels[j])) {
14201                                         nla_nest_cancel(msg, nl_freqs);
14202                                         nla_nest_cancel(msg, nl_match);
14203                                         goto out;
14204                                 }
14205                         }
14206
14207                         nla_nest_end(msg, nl_freqs);
14208                 }
14209
14210                 nla_nest_end(msg, nl_match);
14211         }
14212
14213 out:
14214         nla_nest_end(msg, nl_results);
14215         return 0;
14216 }
14217
14218 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14219                                    struct cfg80211_wowlan_wakeup *wakeup,
14220                                    gfp_t gfp)
14221 {
14222         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14223         struct sk_buff *msg;
14224         void *hdr;
14225         int size = 200;
14226
14227         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14228
14229         if (wakeup)
14230                 size += wakeup->packet_present_len;
14231
14232         msg = nlmsg_new(size, gfp);
14233         if (!msg)
14234                 return;
14235
14236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14237         if (!hdr)
14238                 goto free_msg;
14239
14240         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14241             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14242                               NL80211_ATTR_PAD))
14243                 goto free_msg;
14244
14245         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14246                                         wdev->netdev->ifindex))
14247                 goto free_msg;
14248
14249         if (wakeup) {
14250                 struct nlattr *reasons;
14251
14252                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14253                 if (!reasons)
14254                         goto free_msg;
14255
14256                 if (wakeup->disconnect &&
14257                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
14258                         goto free_msg;
14259                 if (wakeup->magic_pkt &&
14260                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
14261                         goto free_msg;
14262                 if (wakeup->gtk_rekey_failure &&
14263                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
14264                         goto free_msg;
14265                 if (wakeup->eap_identity_req &&
14266                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
14267                         goto free_msg;
14268                 if (wakeup->four_way_handshake &&
14269                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
14270                         goto free_msg;
14271                 if (wakeup->rfkill_release &&
14272                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
14273                         goto free_msg;
14274
14275                 if (wakeup->pattern_idx >= 0 &&
14276                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
14277                                 wakeup->pattern_idx))
14278                         goto free_msg;
14279
14280                 if (wakeup->tcp_match &&
14281                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
14282                         goto free_msg;
14283
14284                 if (wakeup->tcp_connlost &&
14285                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
14286                         goto free_msg;
14287
14288                 if (wakeup->tcp_nomoretokens &&
14289                     nla_put_flag(msg,
14290                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
14291                         goto free_msg;
14292
14293                 if (wakeup->packet) {
14294                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
14295                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
14296
14297                         if (!wakeup->packet_80211) {
14298                                 pkt_attr =
14299                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
14300                                 len_attr =
14301                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
14302                         }
14303
14304                         if (wakeup->packet_len &&
14305                             nla_put_u32(msg, len_attr, wakeup->packet_len))
14306                                 goto free_msg;
14307
14308                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
14309                                     wakeup->packet))
14310                                 goto free_msg;
14311                 }
14312
14313                 if (wakeup->net_detect &&
14314                     cfg80211_net_detect_results(msg, wakeup))
14315                                 goto free_msg;
14316
14317                 nla_nest_end(msg, reasons);
14318         }
14319
14320         genlmsg_end(msg, hdr);
14321
14322         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14323                                 NL80211_MCGRP_MLME, gfp);
14324         return;
14325
14326  free_msg:
14327         nlmsg_free(msg);
14328 }
14329 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
14330 #endif
14331
14332 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
14333                                 enum nl80211_tdls_operation oper,
14334                                 u16 reason_code, gfp_t gfp)
14335 {
14336         struct wireless_dev *wdev = dev->ieee80211_ptr;
14337         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14338         struct sk_buff *msg;
14339         void *hdr;
14340
14341         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
14342                                          reason_code);
14343
14344         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14345         if (!msg)
14346                 return;
14347
14348         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
14349         if (!hdr) {
14350                 nlmsg_free(msg);
14351                 return;
14352         }
14353
14354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14355             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14356             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
14357             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
14358             (reason_code > 0 &&
14359              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
14360                 goto nla_put_failure;
14361
14362         genlmsg_end(msg, hdr);
14363
14364         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14365                                 NL80211_MCGRP_MLME, gfp);
14366         return;
14367
14368  nla_put_failure:
14369         genlmsg_cancel(msg, hdr);
14370         nlmsg_free(msg);
14371 }
14372 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
14373
14374 static int nl80211_netlink_notify(struct notifier_block * nb,
14375                                   unsigned long state,
14376                                   void *_notify)
14377 {
14378         struct netlink_notify *notify = _notify;
14379         struct cfg80211_registered_device *rdev;
14380         struct wireless_dev *wdev;
14381         struct cfg80211_beacon_registration *reg, *tmp;
14382
14383         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
14384                 return NOTIFY_DONE;
14385
14386         rcu_read_lock();
14387
14388         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
14389                 bool schedule_destroy_work = false;
14390                 bool schedule_scan_stop = false;
14391                 struct cfg80211_sched_scan_request *sched_scan_req =
14392                         rcu_dereference(rdev->sched_scan_req);
14393
14394                 if (sched_scan_req && notify->portid &&
14395                     sched_scan_req->owner_nlportid == notify->portid)
14396                         schedule_scan_stop = true;
14397
14398                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
14399                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
14400
14401                         if (wdev->owner_nlportid == notify->portid)
14402                                 schedule_destroy_work = true;
14403                 }
14404
14405                 spin_lock_bh(&rdev->beacon_registrations_lock);
14406                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
14407                                          list) {
14408                         if (reg->nlportid == notify->portid) {
14409                                 list_del(&reg->list);
14410                                 kfree(reg);
14411                                 break;
14412                         }
14413                 }
14414                 spin_unlock_bh(&rdev->beacon_registrations_lock);
14415
14416                 if (schedule_destroy_work) {
14417                         struct cfg80211_iface_destroy *destroy;
14418
14419                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
14420                         if (destroy) {
14421                                 destroy->nlportid = notify->portid;
14422                                 spin_lock(&rdev->destroy_list_lock);
14423                                 list_add(&destroy->list, &rdev->destroy_list);
14424                                 spin_unlock(&rdev->destroy_list_lock);
14425                                 schedule_work(&rdev->destroy_work);
14426                         }
14427                 } else if (schedule_scan_stop) {
14428                         sched_scan_req->owner_nlportid = 0;
14429
14430                         if (rdev->ops->sched_scan_stop &&
14431                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
14432                                 schedule_work(&rdev->sched_scan_stop_wk);
14433                 }
14434         }
14435
14436         rcu_read_unlock();
14437
14438         /*
14439          * It is possible that the user space process that is controlling the
14440          * indoor setting disappeared, so notify the regulatory core.
14441          */
14442         regulatory_netlink_notify(notify->portid);
14443         return NOTIFY_OK;
14444 }
14445
14446 static struct notifier_block nl80211_netlink_notifier = {
14447         .notifier_call = nl80211_netlink_notify,
14448 };
14449
14450 void cfg80211_ft_event(struct net_device *netdev,
14451                        struct cfg80211_ft_event_params *ft_event)
14452 {
14453         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
14454         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14455         struct sk_buff *msg;
14456         void *hdr;
14457
14458         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
14459
14460         if (!ft_event->target_ap)
14461                 return;
14462
14463         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14464         if (!msg)
14465                 return;
14466
14467         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
14468         if (!hdr)
14469                 goto out;
14470
14471         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14472             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14473             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
14474                 goto out;
14475
14476         if (ft_event->ies &&
14477             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
14478                 goto out;
14479         if (ft_event->ric_ies &&
14480             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
14481                     ft_event->ric_ies))
14482                 goto out;
14483
14484         genlmsg_end(msg, hdr);
14485
14486         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14487                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14488         return;
14489  out:
14490         nlmsg_free(msg);
14491 }
14492 EXPORT_SYMBOL(cfg80211_ft_event);
14493
14494 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
14495 {
14496         struct cfg80211_registered_device *rdev;
14497         struct sk_buff *msg;
14498         void *hdr;
14499         u32 nlportid;
14500
14501         rdev = wiphy_to_rdev(wdev->wiphy);
14502         if (!rdev->crit_proto_nlportid)
14503                 return;
14504
14505         nlportid = rdev->crit_proto_nlportid;
14506         rdev->crit_proto_nlportid = 0;
14507
14508         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14509         if (!msg)
14510                 return;
14511
14512         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
14513         if (!hdr)
14514                 goto nla_put_failure;
14515
14516         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14517             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14518                               NL80211_ATTR_PAD))
14519                 goto nla_put_failure;
14520
14521         genlmsg_end(msg, hdr);
14522
14523         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14524         return;
14525
14526  nla_put_failure:
14527         if (hdr)
14528                 genlmsg_cancel(msg, hdr);
14529         nlmsg_free(msg);
14530 }
14531 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
14532
14533 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
14534 {
14535         struct wiphy *wiphy = wdev->wiphy;
14536         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14537         struct sk_buff *msg;
14538         void *hdr;
14539
14540         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14541         if (!msg)
14542                 return;
14543
14544         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
14545         if (!hdr)
14546                 goto out;
14547
14548         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14549             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
14550             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14551                               NL80211_ATTR_PAD))
14552                 goto out;
14553
14554         genlmsg_end(msg, hdr);
14555
14556         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
14557                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14558         return;
14559  out:
14560         nlmsg_free(msg);
14561 }
14562
14563 /* initialisation/exit functions */
14564
14565 int nl80211_init(void)
14566 {
14567         int err;
14568
14569         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
14570                                                    nl80211_mcgrps);
14571         if (err)
14572                 return err;
14573
14574         err = netlink_register_notifier(&nl80211_netlink_notifier);
14575         if (err)
14576                 goto err_out;
14577
14578         return 0;
14579  err_out:
14580         genl_unregister_family(&nl80211_fam);
14581         return err;
14582 }
14583
14584 void nl80211_exit(void)
14585 {
14586         netlink_unregister_notifier(&nl80211_netlink_notifier);
14587         genl_unregister_family(&nl80211_fam);
14588 }