Pileus Git - ~andy/linux/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_dev(
 172                                                 netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         dev_put(netdev);
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 344                                       .len = IEEE80211_MAX_DATA_LEN },
 345         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 346         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 347         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 348                 .len = NL80211_HT_CAPABILITY_LEN
 349         },
 350         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 351         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 352         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 353         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 354         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 355         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 356         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 357         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 358         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 359         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 360         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 361         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 362         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 363         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 364         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 365         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 367                 .len = NL80211_VHT_CAPABILITY_LEN,
 368         },
 369         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 370         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 371                                   .len = IEEE80211_MAX_DATA_LEN },
 372         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 373         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 374         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 376         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 377         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 378         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 381         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 382         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 383         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 385         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 386                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 387 };
 388
 389 /* policy for the key attributes */
 390 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 391         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 392         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 393         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 394         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 395         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 396         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 397         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 398         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 399 };
 400
 401 /* policy for the key default flags */
 402 static const struct nla_policy
 403 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 404         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 405         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 406 };
 407
 408 /* policy for WoWLAN attributes */
 409 static const struct nla_policy
 410 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 411         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 413         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 415         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 417         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 418         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 420 };
 421
 422 static const struct nla_policy
 423 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 424         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 425         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 426         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 427         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 428         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 429         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 430         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 431                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 432         },
 433         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 434                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 435         },
 436         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 437         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 438         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 439 };
 440
 441 /* policy for coalesce rule attributes */
 442 static const struct nla_policy
 443 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 444         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 445         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 446         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 447 };
 448
 449 /* policy for GTK rekey offload attributes */
 450 static const struct nla_policy
 451 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 452         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 453         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 454         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 455 };
 456
 457 static const struct nla_policy
 458 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 459         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 460                                                  .len = IEEE80211_MAX_SSID_LEN },
 461         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 462 };
 463
 464 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 465                                      struct netlink_callback *cb,
 466                                      struct cfg80211_registered_device **rdev,
 467                                      struct wireless_dev **wdev)
 468 {
 469         int err;
 470
 471         rtnl_lock();
 472
 473         if (!cb->args[0]) {
 474                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 475                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 476                                   nl80211_policy);
 477                 if (err)
 478                         goto out_unlock;
 479
 480                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 481                                                    nl80211_fam.attrbuf);
 482                 if (IS_ERR(*wdev)) {
 483                         err = PTR_ERR(*wdev);
 484                         goto out_unlock;
 485                 }
 486                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 487                 /* 0 is the first index - add 1 to parse only once */
 488                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 489                 cb->args[1] = (*wdev)->identifier;
 490         } else {
 491                 /* subtract the 1 again here */
 492                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 493                 struct wireless_dev *tmp;
 494
 495                 if (!wiphy) {
 496                         err = -ENODEV;
 497                         goto out_unlock;
 498                 }
 499                 *rdev = wiphy_to_dev(wiphy);
 500                 *wdev = NULL;
 501
 502                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 503                         if (tmp->identifier == cb->args[1]) {
 504                                 *wdev = tmp;
 505                                 break;
 506                         }
 507                 }
 508
 509                 if (!*wdev) {
 510                         err = -ENODEV;
 511                         goto out_unlock;
 512                 }
 513         }
 514
 515         return 0;
 516  out_unlock:
 517         rtnl_unlock();
 518         return err;
 519 }
 520
 521 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 522 {
 523         rtnl_unlock();
 524 }
 525
 526 /* IE validation */
 527 static bool is_valid_ie_attr(const struct nlattr *attr)
 528 {
 529         const u8 *pos;
 530         int len;
 531
 532         if (!attr)
 533                 return true;
 534
 535         pos = nla_data(attr);
 536         len = nla_len(attr);
 537
 538         while (len) {
 539                 u8 elemlen;
 540
 541                 if (len < 2)
 542                         return false;
 543                 len -= 2;
 544
 545                 elemlen = pos[1];
 546                 if (elemlen > len)
 547                         return false;
 548
 549                 len -= elemlen;
 550                 pos += 2 + elemlen;
 551         }
 552
 553         return true;
 554 }
 555
 556 /* message building helper */
 557 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 558                                    int flags, u8 cmd)
 559 {
 560         /* since there is no private header just add the generic one */
 561         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 562 }
 563
 564 static int nl80211_msg_put_channel(struct sk_buff *msg,
 565                                    struct ieee80211_channel *chan,
 566                                    bool large)
 567 {
 568         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 569                         chan->center_freq))
 570                 goto nla_put_failure;
 571
 572         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 573             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 574                 goto nla_put_failure;
 575         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 576                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 577                         goto nla_put_failure;
 578                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 579                         goto nla_put_failure;
 580         }
 581         if (chan->flags & IEEE80211_CHAN_RADAR) {
 582                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 583                         goto nla_put_failure;
 584                 if (large) {
 585                         u32 time;
 586
 587                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 588
 589                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 590                                         chan->dfs_state))
 591                                 goto nla_put_failure;
 592                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 593                                         time))
 594                                 goto nla_put_failure;
 595                 }
 596         }
 597
 598         if (large) {
 599                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 600                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 601                         goto nla_put_failure;
 602                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 603                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 604                         goto nla_put_failure;
 605                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 606                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 607                         goto nla_put_failure;
 608                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 609                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 610                         goto nla_put_failure;
 611         }
 612
 613         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 614                         DBM_TO_MBM(chan->max_power)))
 615                 goto nla_put_failure;
 616
 617         return 0;
 618
 619  nla_put_failure:
 620         return -ENOBUFS;
 621 }
 622
 623 /* netlink command implementations */
 624
 625 struct key_parse {
 626         struct key_params p;
 627         int idx;
 628         int type;
 629         bool def, defmgmt;
 630         bool def_uni, def_multi;
 631 };
 632
 633 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 634 {
 635         struct nlattr *tb[NL80211_KEY_MAX + 1];
 636         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 637                                    nl80211_key_policy);
 638         if (err)
 639                 return err;
 640
 641         k->def = !!tb[NL80211_KEY_DEFAULT];
 642         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 643
 644         if (k->def) {
 645                 k->def_uni = true;
 646                 k->def_multi = true;
 647         }
 648         if (k->defmgmt)
 649                 k->def_multi = true;
 650
 651         if (tb[NL80211_KEY_IDX])
 652                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 653
 654         if (tb[NL80211_KEY_DATA]) {
 655                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 656                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 657         }
 658
 659         if (tb[NL80211_KEY_SEQ]) {
 660                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 661                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 662         }
 663
 664         if (tb[NL80211_KEY_CIPHER])
 665                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 666
 667         if (tb[NL80211_KEY_TYPE]) {
 668                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 669                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 670                         return -EINVAL;
 671         }
 672
 673         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 674                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 675                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 676                                        tb[NL80211_KEY_DEFAULT_TYPES],
 677                                        nl80211_key_default_policy);
 678                 if (err)
 679                         return err;
 680
 681                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 682                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 683         }
 684
 685         return 0;
 686 }
 687
 688 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 689 {
 690         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 691                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 692                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 693         }
 694
 695         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 696                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 697                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 698         }
 699
 700         if (info->attrs[NL80211_ATTR_KEY_IDX])
 701                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 702
 703         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 704                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 705
 706         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 707         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 708
 709         if (k->def) {
 710                 k->def_uni = true;
 711                 k->def_multi = true;
 712         }
 713         if (k->defmgmt)
 714                 k->def_multi = true;
 715
 716         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 717                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 718                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 719                         return -EINVAL;
 720         }
 721
 722         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 723                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 724                 int err = nla_parse_nested(
 725                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 726                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 727                                 nl80211_key_default_policy);
 728                 if (err)
 729                         return err;
 730
 731                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 732                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 733         }
 734
 735         return 0;
 736 }
 737
 738 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 739 {
 740         int err;
 741
 742         memset(k, 0, sizeof(*k));
 743         k->idx = -1;
 744         k->type = -1;
 745
 746         if (info->attrs[NL80211_ATTR_KEY])
 747                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 748         else
 749                 err = nl80211_parse_key_old(info, k);
 750
 751         if (err)
 752                 return err;
 753
 754         if (k->def && k->defmgmt)
 755                 return -EINVAL;
 756
 757         if (k->defmgmt) {
 758                 if (k->def_uni || !k->def_multi)
 759                         return -EINVAL;
 760         }
 761
 762         if (k->idx != -1) {
 763                 if (k->defmgmt) {
 764                         if (k->idx < 4 || k->idx > 5)
 765                                 return -EINVAL;
 766                 } else if (k->def) {
 767                         if (k->idx < 0 || k->idx > 3)
 768                                 return -EINVAL;
 769                 } else {
 770                         if (k->idx < 0 || k->idx > 5)
 771                                 return -EINVAL;
 772                 }
 773         }
 774
 775         return 0;
 776 }
 777
 778 static struct cfg80211_cached_keys *
 779 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 780                        struct nlattr *keys, bool *no_ht)
 781 {
 782         struct key_parse parse;
 783         struct nlattr *key;
 784         struct cfg80211_cached_keys *result;
 785         int rem, err, def = 0;
 786
 787         result = kzalloc(sizeof(*result), GFP_KERNEL);
 788         if (!result)
 789                 return ERR_PTR(-ENOMEM);
 790
 791         result->def = -1;
 792         result->defmgmt = -1;
 793
 794         nla_for_each_nested(key, keys, rem) {
 795                 memset(&parse, 0, sizeof(parse));
 796                 parse.idx = -1;
 797
 798                 err = nl80211_parse_key_new(key, &parse);
 799                 if (err)
 800                         goto error;
 801                 err = -EINVAL;
 802                 if (!parse.p.key)
 803                         goto error;
 804                 if (parse.idx < 0 || parse.idx > 4)
 805                         goto error;
 806                 if (parse.def) {
 807                         if (def)
 808                                 goto error;
 809                         def = 1;
 810                         result->def = parse.idx;
 811                         if (!parse.def_uni || !parse.def_multi)
 812                                 goto error;
 813                 } else if (parse.defmgmt)
 814                         goto error;
 815                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 816                                                      parse.idx, false, NULL);
 817                 if (err)
 818                         goto error;
 819                 result->params[parse.idx].cipher = parse.p.cipher;
 820                 result->params[parse.idx].key_len = parse.p.key_len;
 821                 result->params[parse.idx].key = result->data[parse.idx];
 822                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 823
 824                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 825                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 826                         if (no_ht)
 827                                 *no_ht = true;
 828                 }
 829         }
 830
 831         return result;
 832  error:
 833         kfree(result);
 834         return ERR_PTR(err);
 835 }
 836
 837 static int nl80211_key_allowed(struct wireless_dev *wdev)
 838 {
 839         ASSERT_WDEV_LOCK(wdev);
 840
 841         switch (wdev->iftype) {
 842         case NL80211_IFTYPE_AP:
 843         case NL80211_IFTYPE_AP_VLAN:
 844         case NL80211_IFTYPE_P2P_GO:
 845         case NL80211_IFTYPE_MESH_POINT:
 846                 break;
 847         case NL80211_IFTYPE_ADHOC:
 848         case NL80211_IFTYPE_STATION:
 849         case NL80211_IFTYPE_P2P_CLIENT:
 850                 if (!wdev->current_bss)
 851                         return -ENOLINK;
 852                 break;
 853         default:
 854                 return -EINVAL;
 855         }
 856
 857         return 0;
 858 }
 859
 860 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 861 {
 862         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 863         int i;
 864
 865         if (!nl_modes)
 866                 goto nla_put_failure;
 867
 868         i = 0;
 869         while (ifmodes) {
 870                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 871                         goto nla_put_failure;
 872                 ifmodes >>= 1;
 873                 i++;
 874         }
 875
 876         nla_nest_end(msg, nl_modes);
 877         return 0;
 878
 879 nla_put_failure:
 880         return -ENOBUFS;
 881 }
 882
 883 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 884                                           struct sk_buff *msg,
 885                                           bool large)
 886 {
 887         struct nlattr *nl_combis;
 888         int i, j;
 889
 890         nl_combis = nla_nest_start(msg,
 891                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 892         if (!nl_combis)
 893                 goto nla_put_failure;
 894
 895         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 896                 const struct ieee80211_iface_combination *c;
 897                 struct nlattr *nl_combi, *nl_limits;
 898
 899                 c = &wiphy->iface_combinations[i];
 900
 901                 nl_combi = nla_nest_start(msg, i + 1);
 902                 if (!nl_combi)
 903                         goto nla_put_failure;
 904
 905                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 906                 if (!nl_limits)
 907                         goto nla_put_failure;
 908
 909                 for (j = 0; j < c->n_limits; j++) {
 910                         struct nlattr *nl_limit;
 911
 912                         nl_limit = nla_nest_start(msg, j + 1);
 913                         if (!nl_limit)
 914                                 goto nla_put_failure;
 915                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 916                                         c->limits[j].max))
 917                                 goto nla_put_failure;
 918                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 919                                                 c->limits[j].types))
 920                                 goto nla_put_failure;
 921                         nla_nest_end(msg, nl_limit);
 922                 }
 923
 924                 nla_nest_end(msg, nl_limits);
 925
 926                 if (c->beacon_int_infra_match &&
 927                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 928                         goto nla_put_failure;
 929                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 930                                 c->num_different_channels) ||
 931                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 932                                 c->max_interfaces))
 933                         goto nla_put_failure;
 934                 if (large &&
 935                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 936                                 c->radar_detect_widths))
 937                         goto nla_put_failure;
 938
 939                 nla_nest_end(msg, nl_combi);
 940         }
 941
 942         nla_nest_end(msg, nl_combis);
 943
 944         return 0;
 945 nla_put_failure:
 946         return -ENOBUFS;
 947 }
 948
 949 #ifdef CONFIG_PM
 950 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 951                                         struct sk_buff *msg)
 952 {
 953         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 954         struct nlattr *nl_tcp;
 955
 956         if (!tcp)
 957                 return 0;
 958
 959         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 960         if (!nl_tcp)
 961                 return -ENOBUFS;
 962
 963         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 964                         tcp->data_payload_max))
 965                 return -ENOBUFS;
 966
 967         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 968                         tcp->data_payload_max))
 969                 return -ENOBUFS;
 970
 971         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 972                 return -ENOBUFS;
 973
 974         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 975                                 sizeof(*tcp->tok), tcp->tok))
 976                 return -ENOBUFS;
 977
 978         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 979                         tcp->data_interval_max))
 980                 return -ENOBUFS;
 981
 982         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 983                         tcp->wake_payload_max))
 984                 return -ENOBUFS;
 985
 986         nla_nest_end(msg, nl_tcp);
 987         return 0;
 988 }
 989
 990 static int nl80211_send_wowlan(struct sk_buff *msg,
 991                                struct cfg80211_registered_device *dev,
 992                                bool large)
 993 {
 994         struct nlattr *nl_wowlan;
 995
 996         if (!dev->wiphy.wowlan)
 997                 return 0;
 998
 999         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1000         if (!nl_wowlan)
1001                 return -ENOBUFS;
1002
1003         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1005             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1007             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1008              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1009             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1010              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1011             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1012              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1013             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1014              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1015             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1016              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1017             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1018              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1019                 return -ENOBUFS;
1020
1021         if (dev->wiphy.wowlan->n_patterns) {
1022                 struct nl80211_pattern_support pat = {
1023                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1024                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1025                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1026                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1027                 };
1028
1029                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1030                             sizeof(pat), &pat))
1031                         return -ENOBUFS;
1032         }
1033
1034         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1035                 return -ENOBUFS;
1036
1037         nla_nest_end(msg, nl_wowlan);
1038
1039         return 0;
1040 }
1041 #endif
1042
1043 static int nl80211_send_coalesce(struct sk_buff *msg,
1044                                  struct cfg80211_registered_device *dev)
1045 {
1046         struct nl80211_coalesce_rule_support rule;
1047
1048         if (!dev->wiphy.coalesce)
1049                 return 0;
1050
1051         rule.max_rules = dev->wiphy.coalesce->n_rules;
1052         rule.max_delay = dev->wiphy.coalesce->max_delay;
1053         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1054         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1055         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1056         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1057
1058         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1059                 return -ENOBUFS;
1060
1061         return 0;
1062 }
1063
1064 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1065                                       struct ieee80211_supported_band *sband)
1066 {
1067         struct nlattr *nl_rates, *nl_rate;
1068         struct ieee80211_rate *rate;
1069         int i;
1070
1071         /* add HT info */
1072         if (sband->ht_cap.ht_supported &&
1073             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1074                      sizeof(sband->ht_cap.mcs),
1075                      &sband->ht_cap.mcs) ||
1076              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1077                          sband->ht_cap.cap) ||
1078              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1079                         sband->ht_cap.ampdu_factor) ||
1080              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1081                         sband->ht_cap.ampdu_density)))
1082                 return -ENOBUFS;
1083
1084         /* add VHT info */
1085         if (sband->vht_cap.vht_supported &&
1086             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1087                      sizeof(sband->vht_cap.vht_mcs),
1088                      &sband->vht_cap.vht_mcs) ||
1089              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1090                          sband->vht_cap.cap)))
1091                 return -ENOBUFS;
1092
1093         /* add bitrates */
1094         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1095         if (!nl_rates)
1096                 return -ENOBUFS;
1097
1098         for (i = 0; i < sband->n_bitrates; i++) {
1099                 nl_rate = nla_nest_start(msg, i);
1100                 if (!nl_rate)
1101                         return -ENOBUFS;
1102
1103                 rate = &sband->bitrates[i];
1104                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1105                                 rate->bitrate))
1106                         return -ENOBUFS;
1107                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1108                     nla_put_flag(msg,
1109                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1110                         return -ENOBUFS;
1111
1112                 nla_nest_end(msg, nl_rate);
1113         }
1114
1115         nla_nest_end(msg, nl_rates);
1116
1117         return 0;
1118 }
1119
1120 static int
1121 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1122                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1123 {
1124         u16 stypes;
1125         struct nlattr *nl_ftypes, *nl_ifs;
1126         enum nl80211_iftype ift;
1127         int i;
1128
1129         if (!mgmt_stypes)
1130                 return 0;
1131
1132         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1133         if (!nl_ifs)
1134                 return -ENOBUFS;
1135
1136         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1137                 nl_ftypes = nla_nest_start(msg, ift);
1138                 if (!nl_ftypes)
1139                         return -ENOBUFS;
1140                 i = 0;
1141                 stypes = mgmt_stypes[ift].tx;
1142                 while (stypes) {
1143                         if ((stypes & 1) &&
1144                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1145                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1146                                 return -ENOBUFS;
1147                         stypes >>= 1;
1148                         i++;
1149                 }
1150                 nla_nest_end(msg, nl_ftypes);
1151         }
1152
1153         nla_nest_end(msg, nl_ifs);
1154
1155         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1156         if (!nl_ifs)
1157                 return -ENOBUFS;
1158
1159         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1160                 nl_ftypes = nla_nest_start(msg, ift);
1161                 if (!nl_ftypes)
1162                         return -ENOBUFS;
1163                 i = 0;
1164                 stypes = mgmt_stypes[ift].rx;
1165                 while (stypes) {
1166                         if ((stypes & 1) &&
1167                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1168                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1169                                 return -ENOBUFS;
1170                         stypes >>= 1;
1171                         i++;
1172                 }
1173                 nla_nest_end(msg, nl_ftypes);
1174         }
1175         nla_nest_end(msg, nl_ifs);
1176
1177         return 0;
1178 }
1179
1180 struct nl80211_dump_wiphy_state {
1181         s64 filter_wiphy;
1182         long start;
1183         long split_start, band_start, chan_start;
1184         bool split;
1185 };
1186
1187 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1188                               struct sk_buff *msg, u32 portid, u32 seq,
1189                               int flags, struct nl80211_dump_wiphy_state *state)
1190 {
1191         void *hdr;
1192         struct nlattr *nl_bands, *nl_band;
1193         struct nlattr *nl_freqs, *nl_freq;
1194         struct nlattr *nl_cmds;
1195         enum ieee80211_band band;
1196         struct ieee80211_channel *chan;
1197         int i;
1198         const struct ieee80211_txrx_stypes *mgmt_stypes =
1199                                 dev->wiphy.mgmt_stypes;
1200         u32 features;
1201
1202         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1203         if (!hdr)
1204                 return -ENOBUFS;
1205
1206         if (WARN_ON(!state))
1207                 return -EINVAL;
1208
1209         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1210             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1211                            wiphy_name(&dev->wiphy)) ||
1212             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1213                         cfg80211_rdev_list_generation))
1214                 goto nla_put_failure;
1215
1216         switch (state->split_start) {
1217         case 0:
1218                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1219                                dev->wiphy.retry_short) ||
1220                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1221                                dev->wiphy.retry_long) ||
1222                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1223                                 dev->wiphy.frag_threshold) ||
1224                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1225                                 dev->wiphy.rts_threshold) ||
1226                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1227                                dev->wiphy.coverage_class) ||
1228                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1229                                dev->wiphy.max_scan_ssids) ||
1230                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1231                                dev->wiphy.max_sched_scan_ssids) ||
1232                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1233                                 dev->wiphy.max_scan_ie_len) ||
1234                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1235                                 dev->wiphy.max_sched_scan_ie_len) ||
1236                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1237                                dev->wiphy.max_match_sets))
1238                         goto nla_put_failure;
1239
1240                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1241                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1242                         goto nla_put_failure;
1243                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1244                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1245                         goto nla_put_failure;
1246                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1247                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1248                         goto nla_put_failure;
1249                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1250                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1251                         goto nla_put_failure;
1252                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1253                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1254                         goto nla_put_failure;
1255                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1256                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1257                         goto nla_put_failure;
1258                 state->split_start++;
1259                 if (state->split)
1260                         break;
1261         case 1:
1262                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1263                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1264                             dev->wiphy.cipher_suites))
1265                         goto nla_put_failure;
1266
1267                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1268                                dev->wiphy.max_num_pmkids))
1269                         goto nla_put_failure;
1270
1271                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1272                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1273                         goto nla_put_failure;
1274
1275                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1276                                 dev->wiphy.available_antennas_tx) ||
1277                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1278                                 dev->wiphy.available_antennas_rx))
1279                         goto nla_put_failure;
1280
1281                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1282                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1283                                 dev->wiphy.probe_resp_offload))
1284                         goto nla_put_failure;
1285
1286                 if ((dev->wiphy.available_antennas_tx ||
1287                      dev->wiphy.available_antennas_rx) &&
1288                     dev->ops->get_antenna) {
1289                         u32 tx_ant = 0, rx_ant = 0;
1290                         int res;
1291                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1292                         if (!res) {
1293                                 if (nla_put_u32(msg,
1294                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1295                                                 tx_ant) ||
1296                                     nla_put_u32(msg,
1297                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1298                                                 rx_ant))
1299                                         goto nla_put_failure;
1300                         }
1301                 }
1302
1303                 state->split_start++;
1304                 if (state->split)
1305                         break;
1306         case 2:
1307                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1308                                         dev->wiphy.interface_modes))
1309                                 goto nla_put_failure;
1310                 state->split_start++;
1311                 if (state->split)
1312                         break;
1313         case 3:
1314                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1315                 if (!nl_bands)
1316                         goto nla_put_failure;
1317
1318                 for (band = state->band_start;
1319                      band < IEEE80211_NUM_BANDS; band++) {
1320                         struct ieee80211_supported_band *sband;
1321
1322                         sband = dev->wiphy.bands[band];
1323
1324                         if (!sband)
1325                                 continue;
1326
1327                         nl_band = nla_nest_start(msg, band);
1328                         if (!nl_band)
1329                                 goto nla_put_failure;
1330
1331                         switch (state->chan_start) {
1332                         case 0:
1333                                 if (nl80211_send_band_rateinfo(msg, sband))
1334                                         goto nla_put_failure;
1335                                 state->chan_start++;
1336                                 if (state->split)
1337                                         break;
1338                         default:
1339                                 /* add frequencies */
1340                                 nl_freqs = nla_nest_start(
1341                                         msg, NL80211_BAND_ATTR_FREQS);
1342                                 if (!nl_freqs)
1343                                         goto nla_put_failure;
1344
1345                                 for (i = state->chan_start - 1;
1346                                      i < sband->n_channels;
1347                                      i++) {
1348                                         nl_freq = nla_nest_start(msg, i);
1349                                         if (!nl_freq)
1350                                                 goto nla_put_failure;
1351
1352                                         chan = &sband->channels[i];
1353
1354                                         if (nl80211_msg_put_channel(
1355                                                         msg, chan,
1356                                                         state->split))
1357                                                 goto nla_put_failure;
1358
1359                                         nla_nest_end(msg, nl_freq);
1360                                         if (state->split)
1361                                                 break;
1362                                 }
1363                                 if (i < sband->n_channels)
1364                                         state->chan_start = i + 2;
1365                                 else
1366                                         state->chan_start = 0;
1367                                 nla_nest_end(msg, nl_freqs);
1368                         }
1369
1370                         nla_nest_end(msg, nl_band);
1371
1372                         if (state->split) {
1373                                 /* start again here */
1374                                 if (state->chan_start)
1375                                         band--;
1376                                 break;
1377                         }
1378                 }
1379                 nla_nest_end(msg, nl_bands);
1380
1381                 if (band < IEEE80211_NUM_BANDS)
1382                         state->band_start = band + 1;
1383                 else
1384                         state->band_start = 0;
1385
1386                 /* if bands & channels are done, continue outside */
1387                 if (state->band_start == 0 && state->chan_start == 0)
1388                         state->split_start++;
1389                 if (state->split)
1390                         break;
1391         case 4:
1392                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1393                 if (!nl_cmds)
1394                         goto nla_put_failure;
1395
1396                 i = 0;
1397 #define CMD(op, n)                                                      \
1398                  do {                                                   \
1399                         if (dev->ops->op) {                             \
1400                                 i++;                                    \
1401                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1402                                         goto nla_put_failure;           \
1403                         }                                               \
1404                 } while (0)
1405
1406                 CMD(add_virtual_intf, NEW_INTERFACE);
1407                 CMD(change_virtual_intf, SET_INTERFACE);
1408                 CMD(add_key, NEW_KEY);
1409                 CMD(start_ap, START_AP);
1410                 CMD(add_station, NEW_STATION);
1411                 CMD(add_mpath, NEW_MPATH);
1412                 CMD(update_mesh_config, SET_MESH_CONFIG);
1413                 CMD(change_bss, SET_BSS);
1414                 CMD(auth, AUTHENTICATE);
1415                 CMD(assoc, ASSOCIATE);
1416                 CMD(deauth, DEAUTHENTICATE);
1417                 CMD(disassoc, DISASSOCIATE);
1418                 CMD(join_ibss, JOIN_IBSS);
1419                 CMD(join_mesh, JOIN_MESH);
1420                 CMD(set_pmksa, SET_PMKSA);
1421                 CMD(del_pmksa, DEL_PMKSA);
1422                 CMD(flush_pmksa, FLUSH_PMKSA);
1423                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1424                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1425                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1426                 CMD(mgmt_tx, FRAME);
1427                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1428                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1429                         i++;
1430                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1431                                 goto nla_put_failure;
1432                 }
1433                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1434                     dev->ops->join_mesh) {
1435                         i++;
1436                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1437                                 goto nla_put_failure;
1438                 }
1439                 CMD(set_wds_peer, SET_WDS_PEER);
1440                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1441                         CMD(tdls_mgmt, TDLS_MGMT);
1442                         CMD(tdls_oper, TDLS_OPER);
1443                 }
1444                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1445                         CMD(sched_scan_start, START_SCHED_SCAN);
1446                 CMD(probe_client, PROBE_CLIENT);
1447                 CMD(set_noack_map, SET_NOACK_MAP);
1448                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1449                         i++;
1450                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1451                                 goto nla_put_failure;
1452                 }
1453                 CMD(start_p2p_device, START_P2P_DEVICE);
1454                 CMD(set_mcast_rate, SET_MCAST_RATE);
1455                 if (state->split) {
1456                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1457                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1458                         if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1459                                 CMD(channel_switch, CHANNEL_SWITCH);
1460                 }
1461                 CMD(set_qos_map, SET_QOS_MAP);
1462
1463 #ifdef CONFIG_NL80211_TESTMODE
1464                 CMD(testmode_cmd, TESTMODE);
1465 #endif
1466
1467 #undef CMD
1468
1469                 if (dev->ops->connect || dev->ops->auth) {
1470                         i++;
1471                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1472                                 goto nla_put_failure;
1473                 }
1474
1475                 if (dev->ops->disconnect || dev->ops->deauth) {
1476                         i++;
1477                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1478                                 goto nla_put_failure;
1479                 }
1480
1481                 nla_nest_end(msg, nl_cmds);
1482                 state->split_start++;
1483                 if (state->split)
1484                         break;
1485         case 5:
1486                 if (dev->ops->remain_on_channel &&
1487                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1488                     nla_put_u32(msg,
1489                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1490                                 dev->wiphy.max_remain_on_channel_duration))
1491                         goto nla_put_failure;
1492
1493                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1494                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1495                         goto nla_put_failure;
1496
1497                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1498                         goto nla_put_failure;
1499                 state->split_start++;
1500                 if (state->split)
1501                         break;
1502         case 6:
1503 #ifdef CONFIG_PM
1504                 if (nl80211_send_wowlan(msg, dev, state->split))
1505                         goto nla_put_failure;
1506                 state->split_start++;
1507                 if (state->split)
1508                         break;
1509 #else
1510                 state->split_start++;
1511 #endif
1512         case 7:
1513                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1514                                         dev->wiphy.software_iftypes))
1515                         goto nla_put_failure;
1516
1517                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1518                                                    state->split))
1519                         goto nla_put_failure;
1520
1521                 state->split_start++;
1522                 if (state->split)
1523                         break;
1524         case 8:
1525                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1526                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1527                                 dev->wiphy.ap_sme_capa))
1528                         goto nla_put_failure;
1529
1530                 features = dev->wiphy.features;
1531                 /*
1532                  * We can only add the per-channel limit information if the
1533                  * dump is split, otherwise it makes it too big. Therefore
1534                  * only advertise it in that case.
1535                  */
1536                 if (state->split)
1537                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1538                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1539                         goto nla_put_failure;
1540
1541                 if (dev->wiphy.ht_capa_mod_mask &&
1542                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1543                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1544                             dev->wiphy.ht_capa_mod_mask))
1545                         goto nla_put_failure;
1546
1547                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1548                     dev->wiphy.max_acl_mac_addrs &&
1549                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1550                                 dev->wiphy.max_acl_mac_addrs))
1551                         goto nla_put_failure;
1552
1553                 /*
1554                  * Any information below this point is only available to
1555                  * applications that can deal with it being split. This
1556                  * helps ensure that newly added capabilities don't break
1557                  * older tools by overrunning their buffers.
1558                  *
1559                  * We still increment split_start so that in the split
1560                  * case we'll continue with more data in the next round,
1561                  * but break unconditionally so unsplit data stops here.
1562                  */
1563                 state->split_start++;
1564                 break;
1565         case 9:
1566                 if (dev->wiphy.extended_capabilities &&
1567                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1568                              dev->wiphy.extended_capabilities_len,
1569                              dev->wiphy.extended_capabilities) ||
1570                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1571                              dev->wiphy.extended_capabilities_len,
1572                              dev->wiphy.extended_capabilities_mask)))
1573                         goto nla_put_failure;
1574
1575                 if (dev->wiphy.vht_capa_mod_mask &&
1576                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1577                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1578                             dev->wiphy.vht_capa_mod_mask))
1579                         goto nla_put_failure;
1580
1581                 state->split_start++;
1582                 break;
1583         case 10:
1584                 if (nl80211_send_coalesce(msg, dev))
1585                         goto nla_put_failure;
1586
1587                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1588                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1589                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1590                         goto nla_put_failure;
1591                 state->split_start++;
1592                 break;
1593         case 11:
1594                 if (dev->wiphy.n_vendor_commands) {
1595                         const struct nl80211_vendor_cmd_info *info;
1596                         struct nlattr *nested;
1597
1598                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1599                         if (!nested)
1600                                 goto nla_put_failure;
1601
1602                         for (i = 0; i < dev->wiphy.n_vendor_commands; i++) {
1603                                 info = &dev->wiphy.vendor_commands[i].info;
1604                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1605                                         goto nla_put_failure;
1606                         }
1607                         nla_nest_end(msg, nested);
1608                 }
1609
1610                 if (dev->wiphy.n_vendor_events) {
1611                         const struct nl80211_vendor_cmd_info *info;
1612                         struct nlattr *nested;
1613
1614                         nested = nla_nest_start(msg,
1615                                                 NL80211_ATTR_VENDOR_EVENTS);
1616                         if (!nested)
1617                                 goto nla_put_failure;
1618
1619                         for (i = 0; i < dev->wiphy.n_vendor_events; i++) {
1620                                 info = &dev->wiphy.vendor_events[i];
1621                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1622                                         goto nla_put_failure;
1623                         }
1624                         nla_nest_end(msg, nested);
1625                 }
1626
1627                 /* done */
1628                 state->split_start = 0;
1629                 break;
1630         }
1631         return genlmsg_end(msg, hdr);
1632
1633  nla_put_failure:
1634         genlmsg_cancel(msg, hdr);
1635         return -EMSGSIZE;
1636 }
1637
1638 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1639                                     struct netlink_callback *cb,
1640                                     struct nl80211_dump_wiphy_state *state)
1641 {
1642         struct nlattr **tb = nl80211_fam.attrbuf;
1643         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1644                               tb, nl80211_fam.maxattr, nl80211_policy);
1645         /* ignore parse errors for backward compatibility */
1646         if (ret)
1647                 return 0;
1648
1649         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1650         if (tb[NL80211_ATTR_WIPHY])
1651                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1652         if (tb[NL80211_ATTR_WDEV])
1653                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1654         if (tb[NL80211_ATTR_IFINDEX]) {
1655                 struct net_device *netdev;
1656                 struct cfg80211_registered_device *rdev;
1657                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1658
1659                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1660                 if (!netdev)
1661                         return -ENODEV;
1662                 if (netdev->ieee80211_ptr) {
1663                         rdev = wiphy_to_dev(
1664                                 netdev->ieee80211_ptr->wiphy);
1665                         state->filter_wiphy = rdev->wiphy_idx;
1666                 }
1667                 dev_put(netdev);
1668         }
1669
1670         return 0;
1671 }
1672
1673 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1674 {
1675         int idx = 0, ret;
1676         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1677         struct cfg80211_registered_device *dev;
1678
1679         rtnl_lock();
1680         if (!state) {
1681                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1682                 if (!state) {
1683                         rtnl_unlock();
1684                         return -ENOMEM;
1685                 }
1686                 state->filter_wiphy = -1;
1687                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1688                 if (ret) {
1689                         kfree(state);
1690                         rtnl_unlock();
1691                         return ret;
1692                 }
1693                 cb->args[0] = (long)state;
1694         }
1695
1696         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1697                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1698                         continue;
1699                 if (++idx <= state->start)
1700                         continue;
1701                 if (state->filter_wiphy != -1 &&
1702                     state->filter_wiphy != dev->wiphy_idx)
1703                         continue;
1704                 /* attempt to fit multiple wiphy data chunks into the skb */
1705                 do {
1706                         ret = nl80211_send_wiphy(dev, skb,
1707                                                  NETLINK_CB(cb->skb).portid,
1708                                                  cb->nlh->nlmsg_seq,
1709                                                  NLM_F_MULTI, state);
1710                         if (ret < 0) {
1711                                 /*
1712                                  * If sending the wiphy data didn't fit (ENOBUFS
1713                                  * or EMSGSIZE returned), this SKB is still
1714                                  * empty (so it's not too big because another
1715                                  * wiphy dataset is already in the skb) and
1716                                  * we've not tried to adjust the dump allocation
1717                                  * yet ... then adjust the alloc size to be
1718                                  * bigger, and return 1 but with the empty skb.
1719                                  * This results in an empty message being RX'ed
1720                                  * in userspace, but that is ignored.
1721                                  *
1722                                  * We can then retry with the larger buffer.
1723                                  */
1724                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1725                                     !skb->len &&
1726                                     cb->min_dump_alloc < 4096) {
1727                                         cb->min_dump_alloc = 4096;
1728                                         rtnl_unlock();
1729                                         return 1;
1730                                 }
1731                                 idx--;
1732                                 break;
1733                         }
1734                 } while (state->split_start > 0);
1735                 break;
1736         }
1737         rtnl_unlock();
1738
1739         state->start = idx;
1740
1741         return skb->len;
1742 }
1743
1744 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1745 {
1746         kfree((void *)cb->args[0]);
1747         return 0;
1748 }
1749
1750 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1751 {
1752         struct sk_buff *msg;
1753         struct cfg80211_registered_device *dev = info->user_ptr[0];
1754         struct nl80211_dump_wiphy_state state = {};
1755
1756         msg = nlmsg_new(4096, GFP_KERNEL);
1757         if (!msg)
1758                 return -ENOMEM;
1759
1760         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1761                                &state) < 0) {
1762                 nlmsg_free(msg);
1763                 return -ENOBUFS;
1764         }
1765
1766         return genlmsg_reply(msg, info);
1767 }
1768
1769 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1770         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1771         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1772         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1773         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1774         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1775 };
1776
1777 static int parse_txq_params(struct nlattr *tb[],
1778                             struct ieee80211_txq_params *txq_params)
1779 {
1780         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1781             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1782             !tb[NL80211_TXQ_ATTR_AIFS])
1783                 return -EINVAL;
1784
1785         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1786         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1787         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1788         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1789         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1790
1791         if (txq_params->ac >= NL80211_NUM_ACS)
1792                 return -EINVAL;
1793
1794         return 0;
1795 }
1796
1797 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1798 {
1799         /*
1800          * You can only set the channel explicitly for WDS interfaces,
1801          * all others have their channel managed via their respective
1802          * "establish a connection" command (connect, join, ...)
1803          *
1804          * For AP/GO and mesh mode, the channel can be set with the
1805          * channel userspace API, but is only stored and passed to the
1806          * low-level driver when the AP starts or the mesh is joined.
1807          * This is for backward compatibility, userspace can also give
1808          * the channel in the start-ap or join-mesh commands instead.
1809          *
1810          * Monitors are special as they are normally slaved to
1811          * whatever else is going on, so they have their own special
1812          * operation to set the monitor channel if possible.
1813          */
1814         return !wdev ||
1815                 wdev->iftype == NL80211_IFTYPE_AP ||
1816                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1817                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1818                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1819 }
1820
1821 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1822                                  struct genl_info *info,
1823                                  struct cfg80211_chan_def *chandef)
1824 {
1825         u32 control_freq;
1826
1827         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1828                 return -EINVAL;
1829
1830         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1831
1832         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1833         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1834         chandef->center_freq1 = control_freq;
1835         chandef->center_freq2 = 0;
1836
1837         /* Primary channel not allowed */
1838         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1839                 return -EINVAL;
1840
1841         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1842                 enum nl80211_channel_type chantype;
1843
1844                 chantype = nla_get_u32(
1845                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1846
1847                 switch (chantype) {
1848                 case NL80211_CHAN_NO_HT:
1849                 case NL80211_CHAN_HT20:
1850                 case NL80211_CHAN_HT40PLUS:
1851                 case NL80211_CHAN_HT40MINUS:
1852                         cfg80211_chandef_create(chandef, chandef->chan,
1853                                                 chantype);
1854                         break;
1855                 default:
1856                         return -EINVAL;
1857                 }
1858         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1859                 chandef->width =
1860                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1861                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1862                         chandef->center_freq1 =
1863                                 nla_get_u32(
1864                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1865                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1866                         chandef->center_freq2 =
1867                                 nla_get_u32(
1868                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1869         }
1870
1871         if (!cfg80211_chandef_valid(chandef))
1872                 return -EINVAL;
1873
1874         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1875                                      IEEE80211_CHAN_DISABLED))
1876                 return -EINVAL;
1877
1878         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1879              chandef->width == NL80211_CHAN_WIDTH_10) &&
1880             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1881                 return -EINVAL;
1882
1883         return 0;
1884 }
1885
1886 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1887                                  struct wireless_dev *wdev,
1888                                  struct genl_info *info)
1889 {
1890         struct cfg80211_chan_def chandef;
1891         int result;
1892         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1893
1894         if (wdev)
1895                 iftype = wdev->iftype;
1896
1897         if (!nl80211_can_set_dev_channel(wdev))
1898                 return -EOPNOTSUPP;
1899
1900         result = nl80211_parse_chandef(rdev, info, &chandef);
1901         if (result)
1902                 return result;
1903
1904         switch (iftype) {
1905         case NL80211_IFTYPE_AP:
1906         case NL80211_IFTYPE_P2P_GO:
1907                 if (wdev->beacon_interval) {
1908                         result = -EBUSY;
1909                         break;
1910                 }
1911                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1912                         result = -EINVAL;
1913                         break;
1914                 }
1915                 wdev->preset_chandef = chandef;
1916                 result = 0;
1917                 break;
1918         case NL80211_IFTYPE_MESH_POINT:
1919                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1920                 break;
1921         case NL80211_IFTYPE_MONITOR:
1922                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1923                 break;
1924         default:
1925                 result = -EINVAL;
1926         }
1927
1928         return result;
1929 }
1930
1931 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1932 {
1933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1934         struct net_device *netdev = info->user_ptr[1];
1935
1936         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1937 }
1938
1939 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1940 {
1941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1942         struct net_device *dev = info->user_ptr[1];
1943         struct wireless_dev *wdev = dev->ieee80211_ptr;
1944         const u8 *bssid;
1945
1946         if (!info->attrs[NL80211_ATTR_MAC])
1947                 return -EINVAL;
1948
1949         if (netif_running(dev))
1950                 return -EBUSY;
1951
1952         if (!rdev->ops->set_wds_peer)
1953                 return -EOPNOTSUPP;
1954
1955         if (wdev->iftype != NL80211_IFTYPE_WDS)
1956                 return -EOPNOTSUPP;
1957
1958         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1959         return rdev_set_wds_peer(rdev, dev, bssid);
1960 }
1961
1962
1963 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1964 {
1965         struct cfg80211_registered_device *rdev;
1966         struct net_device *netdev = NULL;
1967         struct wireless_dev *wdev;
1968         int result = 0, rem_txq_params = 0;
1969         struct nlattr *nl_txq_params;
1970         u32 changed;
1971         u8 retry_short = 0, retry_long = 0;
1972         u32 frag_threshold = 0, rts_threshold = 0;
1973         u8 coverage_class = 0;
1974
1975         ASSERT_RTNL();
1976
1977         /*
1978          * Try to find the wiphy and netdev. Normally this
1979          * function shouldn't need the netdev, but this is
1980          * done for backward compatibility -- previously
1981          * setting the channel was done per wiphy, but now
1982          * it is per netdev. Previous userland like hostapd
1983          * also passed a netdev to set_wiphy, so that it is
1984          * possible to let that go to the right netdev!
1985          */
1986
1987         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1988                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1989
1990                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1991                 if (netdev && netdev->ieee80211_ptr)
1992                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1993                 else
1994                         netdev = NULL;
1995         }
1996
1997         if (!netdev) {
1998                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1999                                                   info->attrs);
2000                 if (IS_ERR(rdev))
2001                         return PTR_ERR(rdev);
2002                 wdev = NULL;
2003                 netdev = NULL;
2004                 result = 0;
2005         } else
2006                 wdev = netdev->ieee80211_ptr;
2007
2008         /*
2009          * end workaround code, by now the rdev is available
2010          * and locked, and wdev may or may not be NULL.
2011          */
2012
2013         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2014                 result = cfg80211_dev_rename(
2015                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2016
2017         if (result)
2018                 goto bad_res;
2019
2020         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2021                 struct ieee80211_txq_params txq_params;
2022                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2023
2024                 if (!rdev->ops->set_txq_params) {
2025                         result = -EOPNOTSUPP;
2026                         goto bad_res;
2027                 }
2028
2029                 if (!netdev) {
2030                         result = -EINVAL;
2031                         goto bad_res;
2032                 }
2033
2034                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2035                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
2036                         result = -EINVAL;
2037                         goto bad_res;
2038                 }
2039
2040                 if (!netif_running(netdev)) {
2041                         result = -ENETDOWN;
2042                         goto bad_res;
2043                 }
2044
2045                 nla_for_each_nested(nl_txq_params,
2046                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2047                                     rem_txq_params) {
2048                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2049                                   nla_data(nl_txq_params),
2050                                   nla_len(nl_txq_params),
2051                                   txq_params_policy);
2052                         result = parse_txq_params(tb, &txq_params);
2053                         if (result)
2054                                 goto bad_res;
2055
2056                         result = rdev_set_txq_params(rdev, netdev,
2057                                                      &txq_params);
2058                         if (result)
2059                                 goto bad_res;
2060                 }
2061         }
2062
2063         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2064                 result = __nl80211_set_channel(rdev,
2065                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2066                                 info);
2067                 if (result)
2068                         goto bad_res;
2069         }
2070
2071         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2072                 struct wireless_dev *txp_wdev = wdev;
2073                 enum nl80211_tx_power_setting type;
2074                 int idx, mbm = 0;
2075
2076                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2077                         txp_wdev = NULL;
2078
2079                 if (!rdev->ops->set_tx_power) {
2080                         result = -EOPNOTSUPP;
2081                         goto bad_res;
2082                 }
2083
2084                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2085                 type = nla_get_u32(info->attrs[idx]);
2086
2087                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2088                     (type != NL80211_TX_POWER_AUTOMATIC)) {
2089                         result = -EINVAL;
2090                         goto bad_res;
2091                 }
2092
2093                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2094                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2095                         mbm = nla_get_u32(info->attrs[idx]);
2096                 }
2097
2098                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2099                 if (result)
2100                         goto bad_res;
2101         }
2102
2103         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2104             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2105                 u32 tx_ant, rx_ant;
2106                 if ((!rdev->wiphy.available_antennas_tx &&
2107                      !rdev->wiphy.available_antennas_rx) ||
2108                     !rdev->ops->set_antenna) {
2109                         result = -EOPNOTSUPP;
2110                         goto bad_res;
2111                 }
2112
2113                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2114                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2115
2116                 /* reject antenna configurations which don't match the
2117                  * available antenna masks, except for the "all" mask */
2118                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2119                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2120                         result = -EINVAL;
2121                         goto bad_res;
2122                 }
2123
2124                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2125                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2126
2127                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2128                 if (result)
2129                         goto bad_res;
2130         }
2131
2132         changed = 0;
2133
2134         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2135                 retry_short = nla_get_u8(
2136                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2137                 if (retry_short == 0) {
2138                         result = -EINVAL;
2139                         goto bad_res;
2140                 }
2141                 changed |= WIPHY_PARAM_RETRY_SHORT;
2142         }
2143
2144         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2145                 retry_long = nla_get_u8(
2146                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2147                 if (retry_long == 0) {
2148                         result = -EINVAL;
2149                         goto bad_res;
2150                 }
2151                 changed |= WIPHY_PARAM_RETRY_LONG;
2152         }
2153
2154         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2155                 frag_threshold = nla_get_u32(
2156                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2157                 if (frag_threshold < 256) {
2158                         result = -EINVAL;
2159                         goto bad_res;
2160                 }
2161                 if (frag_threshold != (u32) -1) {
2162                         /*
2163                          * Fragments (apart from the last one) are required to
2164                          * have even length. Make the fragmentation code
2165                          * simpler by stripping LSB should someone try to use
2166                          * odd threshold value.
2167                          */
2168                         frag_threshold &= ~0x1;
2169                 }
2170                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2171         }
2172
2173         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2174                 rts_threshold = nla_get_u32(
2175                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2176                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2177         }
2178
2179         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2180                 coverage_class = nla_get_u8(
2181                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2182                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2183         }
2184
2185         if (changed) {
2186                 u8 old_retry_short, old_retry_long;
2187                 u32 old_frag_threshold, old_rts_threshold;
2188                 u8 old_coverage_class;
2189
2190                 if (!rdev->ops->set_wiphy_params) {
2191                         result = -EOPNOTSUPP;
2192                         goto bad_res;
2193                 }
2194
2195                 old_retry_short = rdev->wiphy.retry_short;
2196                 old_retry_long = rdev->wiphy.retry_long;
2197                 old_frag_threshold = rdev->wiphy.frag_threshold;
2198                 old_rts_threshold = rdev->wiphy.rts_threshold;
2199                 old_coverage_class = rdev->wiphy.coverage_class;
2200
2201                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2202                         rdev->wiphy.retry_short = retry_short;
2203                 if (changed & WIPHY_PARAM_RETRY_LONG)
2204                         rdev->wiphy.retry_long = retry_long;
2205                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2206                         rdev->wiphy.frag_threshold = frag_threshold;
2207                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2208                         rdev->wiphy.rts_threshold = rts_threshold;
2209                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2210                         rdev->wiphy.coverage_class = coverage_class;
2211
2212                 result = rdev_set_wiphy_params(rdev, changed);
2213                 if (result) {
2214                         rdev->wiphy.retry_short = old_retry_short;
2215                         rdev->wiphy.retry_long = old_retry_long;
2216                         rdev->wiphy.frag_threshold = old_frag_threshold;
2217                         rdev->wiphy.rts_threshold = old_rts_threshold;
2218                         rdev->wiphy.coverage_class = old_coverage_class;
2219                 }
2220         }
2221
2222  bad_res:
2223         if (netdev)
2224                 dev_put(netdev);
2225         return result;
2226 }
2227
2228 static inline u64 wdev_id(struct wireless_dev *wdev)
2229 {
2230         return (u64)wdev->identifier |
2231                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2232 }
2233
2234 static int nl80211_send_chandef(struct sk_buff *msg,
2235                                 const struct cfg80211_chan_def *chandef)
2236 {
2237         WARN_ON(!cfg80211_chandef_valid(chandef));
2238
2239         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2240                         chandef->chan->center_freq))
2241                 return -ENOBUFS;
2242         switch (chandef->width) {
2243         case NL80211_CHAN_WIDTH_20_NOHT:
2244         case NL80211_CHAN_WIDTH_20:
2245         case NL80211_CHAN_WIDTH_40:
2246                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2247                                 cfg80211_get_chandef_type(chandef)))
2248                         return -ENOBUFS;
2249                 break;
2250         default:
2251                 break;
2252         }
2253         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2254                 return -ENOBUFS;
2255         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2256                 return -ENOBUFS;
2257         if (chandef->center_freq2 &&
2258             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2259                 return -ENOBUFS;
2260         return 0;
2261 }
2262
2263 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2264                               struct cfg80211_registered_device *rdev,
2265                               struct wireless_dev *wdev)
2266 {
2267         struct net_device *dev = wdev->netdev;
2268         void *hdr;
2269
2270         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2271         if (!hdr)
2272                 return -1;
2273
2274         if (dev &&
2275             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2276              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2277                 goto nla_put_failure;
2278
2279         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2280             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2281             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2282             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2283             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2284                         rdev->devlist_generation ^
2285                         (cfg80211_rdev_list_generation << 2)))
2286                 goto nla_put_failure;
2287
2288         if (rdev->ops->get_channel) {
2289                 int ret;
2290                 struct cfg80211_chan_def chandef;
2291
2292                 ret = rdev_get_channel(rdev, wdev, &chandef);
2293                 if (ret == 0) {
2294                         if (nl80211_send_chandef(msg, &chandef))
2295                                 goto nla_put_failure;
2296                 }
2297         }
2298
2299         if (wdev->ssid_len) {
2300                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2301                         goto nla_put_failure;
2302         }
2303
2304         return genlmsg_end(msg, hdr);
2305
2306  nla_put_failure:
2307         genlmsg_cancel(msg, hdr);
2308         return -EMSGSIZE;
2309 }
2310
2311 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2312 {
2313         int wp_idx = 0;
2314         int if_idx = 0;
2315         int wp_start = cb->args[0];
2316         int if_start = cb->args[1];
2317         struct cfg80211_registered_device *rdev;
2318         struct wireless_dev *wdev;
2319
2320         rtnl_lock();
2321         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2322                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2323                         continue;
2324                 if (wp_idx < wp_start) {
2325                         wp_idx++;
2326                         continue;
2327                 }
2328                 if_idx = 0;
2329
2330                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2331                         if (if_idx < if_start) {
2332                                 if_idx++;
2333                                 continue;
2334                         }
2335                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2336                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2337                                                rdev, wdev) < 0) {
2338                                 goto out;
2339                         }
2340                         if_idx++;
2341                 }
2342
2343                 wp_idx++;
2344         }
2345  out:
2346         rtnl_unlock();
2347
2348         cb->args[0] = wp_idx;
2349         cb->args[1] = if_idx;
2350
2351         return skb->len;
2352 }
2353
2354 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2355 {
2356         struct sk_buff *msg;
2357         struct cfg80211_registered_device *dev = info->user_ptr[0];
2358         struct wireless_dev *wdev = info->user_ptr[1];
2359
2360         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2361         if (!msg)
2362                 return -ENOMEM;
2363
2364         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2365                                dev, wdev) < 0) {
2366                 nlmsg_free(msg);
2367                 return -ENOBUFS;
2368         }
2369
2370         return genlmsg_reply(msg, info);
2371 }
2372
2373 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2374         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2375         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2376         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2377         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2378         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2379         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2380 };
2381
2382 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2383 {
2384         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2385         int flag;
2386
2387         *mntrflags = 0;
2388
2389         if (!nla)
2390                 return -EINVAL;
2391
2392         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2393                              nla, mntr_flags_policy))
2394                 return -EINVAL;
2395
2396         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2397                 if (flags[flag])
2398                         *mntrflags |= (1<<flag);
2399
2400         return 0;
2401 }
2402
2403 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2404                                struct net_device *netdev, u8 use_4addr,
2405                                enum nl80211_iftype iftype)
2406 {
2407         if (!use_4addr) {
2408                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2409                         return -EBUSY;
2410                 return 0;
2411         }
2412
2413         switch (iftype) {
2414         case NL80211_IFTYPE_AP_VLAN:
2415                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2416                         return 0;
2417                 break;
2418         case NL80211_IFTYPE_STATION:
2419                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2420                         return 0;
2421                 break;
2422         default:
2423                 break;
2424         }
2425
2426         return -EOPNOTSUPP;
2427 }
2428
2429 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2430 {
2431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2432         struct vif_params params;
2433         int err;
2434         enum nl80211_iftype otype, ntype;
2435         struct net_device *dev = info->user_ptr[1];
2436         u32 _flags, *flags = NULL;
2437         bool change = false;
2438
2439         memset(&params, 0, sizeof(params));
2440
2441         otype = ntype = dev->ieee80211_ptr->iftype;
2442
2443         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2444                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2445                 if (otype != ntype)
2446                         change = true;
2447                 if (ntype > NL80211_IFTYPE_MAX)
2448                         return -EINVAL;
2449         }
2450
2451         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2452                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2453
2454                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2455                         return -EINVAL;
2456                 if (netif_running(dev))
2457                         return -EBUSY;
2458
2459                 wdev_lock(wdev);
2460                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2461                              IEEE80211_MAX_MESH_ID_LEN);
2462                 wdev->mesh_id_up_len =
2463                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2464                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2465                        wdev->mesh_id_up_len);
2466                 wdev_unlock(wdev);
2467         }
2468
2469         if (info->attrs[NL80211_ATTR_4ADDR]) {
2470                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2471                 change = true;
2472                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2473                 if (err)
2474                         return err;
2475         } else {
2476                 params.use_4addr = -1;
2477         }
2478
2479         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2480                 if (ntype != NL80211_IFTYPE_MONITOR)
2481                         return -EINVAL;
2482                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2483                                           &_flags);
2484                 if (err)
2485                         return err;
2486
2487                 flags = &_flags;
2488                 change = true;
2489         }
2490
2491         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2492             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2493                 return -EOPNOTSUPP;
2494
2495         if (change)
2496                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2497         else
2498                 err = 0;
2499
2500         if (!err && params.use_4addr != -1)
2501                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2502
2503         return err;
2504 }
2505
2506 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2507 {
2508         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2509         struct vif_params params;
2510         struct wireless_dev *wdev;
2511         struct sk_buff *msg;
2512         int err;
2513         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2514         u32 flags;
2515
2516         memset(&params, 0, sizeof(params));
2517
2518         if (!info->attrs[NL80211_ATTR_IFNAME])
2519                 return -EINVAL;
2520
2521         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2522                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2523                 if (type > NL80211_IFTYPE_MAX)
2524                         return -EINVAL;
2525         }
2526
2527         if (!rdev->ops->add_virtual_intf ||
2528             !(rdev->wiphy.interface_modes & (1 << type)))
2529                 return -EOPNOTSUPP;
2530
2531         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2532                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2533                            ETH_ALEN);
2534                 if (!is_valid_ether_addr(params.macaddr))
2535                         return -EADDRNOTAVAIL;
2536         }
2537
2538         if (info->attrs[NL80211_ATTR_4ADDR]) {
2539                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2540                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2541                 if (err)
2542                         return err;
2543         }
2544
2545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2546         if (!msg)
2547                 return -ENOMEM;
2548
2549         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2550                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2551                                   &flags);
2552
2553         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2554             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2555                 return -EOPNOTSUPP;
2556
2557         wdev = rdev_add_virtual_intf(rdev,
2558                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2559                                 type, err ? NULL : &flags, &params);
2560         if (IS_ERR(wdev)) {
2561                 nlmsg_free(msg);
2562                 return PTR_ERR(wdev);
2563         }
2564
2565         switch (type) {
2566         case NL80211_IFTYPE_MESH_POINT:
2567                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2568                         break;
2569                 wdev_lock(wdev);
2570                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2571                              IEEE80211_MAX_MESH_ID_LEN);
2572                 wdev->mesh_id_up_len =
2573                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2574                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2575                        wdev->mesh_id_up_len);
2576                 wdev_unlock(wdev);
2577                 break;
2578         case NL80211_IFTYPE_P2P_DEVICE:
2579                 /*
2580                  * P2P Device doesn't have a netdev, so doesn't go
2581                  * through the netdev notifier and must be added here
2582                  */
2583                 mutex_init(&wdev->mtx);
2584                 INIT_LIST_HEAD(&wdev->event_list);
2585                 spin_lock_init(&wdev->event_lock);
2586                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2587                 spin_lock_init(&wdev->mgmt_registrations_lock);
2588
2589                 wdev->identifier = ++rdev->wdev_id;
2590                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2591                 rdev->devlist_generation++;
2592                 break;
2593         default:
2594                 break;
2595         }
2596
2597         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2598                                rdev, wdev) < 0) {
2599                 nlmsg_free(msg);
2600                 return -ENOBUFS;
2601         }
2602
2603         return genlmsg_reply(msg, info);
2604 }
2605
2606 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2607 {
2608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2609         struct wireless_dev *wdev = info->user_ptr[1];
2610
2611         if (!rdev->ops->del_virtual_intf)
2612                 return -EOPNOTSUPP;
2613
2614         /*
2615          * If we remove a wireless device without a netdev then clear
2616          * user_ptr[1] so that nl80211_post_doit won't dereference it
2617          * to check if it needs to do dev_put(). Otherwise it crashes
2618          * since the wdev has been freed, unlike with a netdev where
2619          * we need the dev_put() for the netdev to really be freed.
2620          */
2621         if (!wdev->netdev)
2622                 info->user_ptr[1] = NULL;
2623
2624         return rdev_del_virtual_intf(rdev, wdev);
2625 }
2626
2627 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2628 {
2629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2630         struct net_device *dev = info->user_ptr[1];
2631         u16 noack_map;
2632
2633         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2634                 return -EINVAL;
2635
2636         if (!rdev->ops->set_noack_map)
2637                 return -EOPNOTSUPP;
2638
2639         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2640
2641         return rdev_set_noack_map(rdev, dev, noack_map);
2642 }
2643
2644 struct get_key_cookie {
2645         struct sk_buff *msg;
2646         int error;
2647         int idx;
2648 };
2649
2650 static void get_key_callback(void *c, struct key_params *params)
2651 {
2652         struct nlattr *key;
2653         struct get_key_cookie *cookie = c;
2654
2655         if ((params->key &&
2656              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2657                      params->key_len, params->key)) ||
2658             (params->seq &&
2659              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2660                      params->seq_len, params->seq)) ||
2661             (params->cipher &&
2662              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2663                          params->cipher)))
2664                 goto nla_put_failure;
2665
2666         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2667         if (!key)
2668                 goto nla_put_failure;
2669
2670         if ((params->key &&
2671              nla_put(cookie->msg, NL80211_KEY_DATA,
2672                      params->key_len, params->key)) ||
2673             (params->seq &&
2674              nla_put(cookie->msg, NL80211_KEY_SEQ,
2675                      params->seq_len, params->seq)) ||
2676             (params->cipher &&
2677              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2678                          params->cipher)))
2679                 goto nla_put_failure;
2680
2681         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2682                 goto nla_put_failure;
2683
2684         nla_nest_end(cookie->msg, key);
2685
2686         return;
2687  nla_put_failure:
2688         cookie->error = 1;
2689 }
2690
2691 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2692 {
2693         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2694         int err;
2695         struct net_device *dev = info->user_ptr[1];
2696         u8 key_idx = 0;
2697         const u8 *mac_addr = NULL;
2698         bool pairwise;
2699         struct get_key_cookie cookie = {
2700                 .error = 0,
2701         };
2702         void *hdr;
2703         struct sk_buff *msg;
2704
2705         if (info->attrs[NL80211_ATTR_KEY_IDX])
2706                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2707
2708         if (key_idx > 5)
2709                 return -EINVAL;
2710
2711         if (info->attrs[NL80211_ATTR_MAC])
2712                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2713
2714         pairwise = !!mac_addr;
2715         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2716                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2717                 if (kt >= NUM_NL80211_KEYTYPES)
2718                         return -EINVAL;
2719                 if (kt != NL80211_KEYTYPE_GROUP &&
2720                     kt != NL80211_KEYTYPE_PAIRWISE)
2721                         return -EINVAL;
2722                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2723         }
2724
2725         if (!rdev->ops->get_key)
2726                 return -EOPNOTSUPP;
2727
2728         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2729         if (!msg)
2730                 return -ENOMEM;
2731
2732         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2733                              NL80211_CMD_NEW_KEY);
2734         if (!hdr)
2735                 goto nla_put_failure;
2736
2737         cookie.msg = msg;
2738         cookie.idx = key_idx;
2739
2740         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2741             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2742                 goto nla_put_failure;
2743         if (mac_addr &&
2744             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2745                 goto nla_put_failure;
2746
2747         if (pairwise && mac_addr &&
2748             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2749                 return -ENOENT;
2750
2751         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2752                            get_key_callback);
2753
2754         if (err)
2755                 goto free_msg;
2756
2757         if (cookie.error)
2758                 goto nla_put_failure;
2759
2760         genlmsg_end(msg, hdr);
2761         return genlmsg_reply(msg, info);
2762
2763  nla_put_failure:
2764         err = -ENOBUFS;
2765  free_msg:
2766         nlmsg_free(msg);
2767         return err;
2768 }
2769
2770 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2771 {
2772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2773         struct key_parse key;
2774         int err;
2775         struct net_device *dev = info->user_ptr[1];
2776
2777         err = nl80211_parse_key(info, &key);
2778         if (err)
2779                 return err;
2780
2781         if (key.idx < 0)
2782                 return -EINVAL;
2783
2784         /* only support setting default key */
2785         if (!key.def && !key.defmgmt)
2786                 return -EINVAL;
2787
2788         wdev_lock(dev->ieee80211_ptr);
2789
2790         if (key.def) {
2791                 if (!rdev->ops->set_default_key) {
2792                         err = -EOPNOTSUPP;
2793                         goto out;
2794                 }
2795
2796                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2797                 if (err)
2798                         goto out;
2799
2800                 err = rdev_set_default_key(rdev, dev, key.idx,
2801                                                  key.def_uni, key.def_multi);
2802
2803                 if (err)
2804                         goto out;
2805
2806 #ifdef CONFIG_CFG80211_WEXT
2807                 dev->ieee80211_ptr->wext.default_key = key.idx;
2808 #endif
2809         } else {
2810                 if (key.def_uni || !key.def_multi) {
2811                         err = -EINVAL;
2812                         goto out;
2813                 }
2814
2815                 if (!rdev->ops->set_default_mgmt_key) {
2816                         err = -EOPNOTSUPP;
2817                         goto out;
2818                 }
2819
2820                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2821                 if (err)
2822                         goto out;
2823
2824                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2825                 if (err)
2826                         goto out;
2827
2828 #ifdef CONFIG_CFG80211_WEXT
2829                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2830 #endif
2831         }
2832
2833  out:
2834         wdev_unlock(dev->ieee80211_ptr);
2835
2836         return err;
2837 }
2838
2839 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2840 {
2841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2842         int err;
2843         struct net_device *dev = info->user_ptr[1];
2844         struct key_parse key;
2845         const u8 *mac_addr = NULL;
2846
2847         err = nl80211_parse_key(info, &key);
2848         if (err)
2849                 return err;
2850
2851         if (!key.p.key)
2852                 return -EINVAL;
2853
2854         if (info->attrs[NL80211_ATTR_MAC])
2855                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2856
2857         if (key.type == -1) {
2858                 if (mac_addr)
2859                         key.type = NL80211_KEYTYPE_PAIRWISE;
2860                 else
2861                         key.type = NL80211_KEYTYPE_GROUP;
2862         }
2863
2864         /* for now */
2865         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2866             key.type != NL80211_KEYTYPE_GROUP)
2867                 return -EINVAL;
2868
2869         if (!rdev->ops->add_key)
2870                 return -EOPNOTSUPP;
2871
2872         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2873                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2874                                            mac_addr))
2875                 return -EINVAL;
2876
2877         wdev_lock(dev->ieee80211_ptr);
2878         err = nl80211_key_allowed(dev->ieee80211_ptr);
2879         if (!err)
2880                 err = rdev_add_key(rdev, dev, key.idx,
2881                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2882                                     mac_addr, &key.p);
2883         wdev_unlock(dev->ieee80211_ptr);
2884
2885         return err;
2886 }
2887
2888 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2889 {
2890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2891         int err;
2892         struct net_device *dev = info->user_ptr[1];
2893         u8 *mac_addr = NULL;
2894         struct key_parse key;
2895
2896         err = nl80211_parse_key(info, &key);
2897         if (err)
2898                 return err;
2899
2900         if (info->attrs[NL80211_ATTR_MAC])
2901                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2902
2903         if (key.type == -1) {
2904                 if (mac_addr)
2905                         key.type = NL80211_KEYTYPE_PAIRWISE;
2906                 else
2907                         key.type = NL80211_KEYTYPE_GROUP;
2908         }
2909
2910         /* for now */
2911         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2912             key.type != NL80211_KEYTYPE_GROUP)
2913                 return -EINVAL;
2914
2915         if (!rdev->ops->del_key)
2916                 return -EOPNOTSUPP;
2917
2918         wdev_lock(dev->ieee80211_ptr);
2919         err = nl80211_key_allowed(dev->ieee80211_ptr);
2920
2921         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2922             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2923                 err = -ENOENT;
2924
2925         if (!err)
2926                 err = rdev_del_key(rdev, dev, key.idx,
2927                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2928                                    mac_addr);
2929
2930 #ifdef CONFIG_CFG80211_WEXT
2931         if (!err) {
2932                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2933                         dev->ieee80211_ptr->wext.default_key = -1;
2934                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2935                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2936         }
2937 #endif
2938         wdev_unlock(dev->ieee80211_ptr);
2939
2940         return err;
2941 }
2942
2943 /* This function returns an error or the number of nested attributes */
2944 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2945 {
2946         struct nlattr *attr;
2947         int n_entries = 0, tmp;
2948
2949         nla_for_each_nested(attr, nl_attr, tmp) {
2950                 if (nla_len(attr) != ETH_ALEN)
2951                         return -EINVAL;
2952
2953                 n_entries++;
2954         }
2955
2956         return n_entries;
2957 }
2958
2959 /*
2960  * This function parses ACL information and allocates memory for ACL data.
2961  * On successful return, the calling function is responsible to free the
2962  * ACL buffer returned by this function.
2963  */
2964 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2965                                                 struct genl_info *info)
2966 {
2967         enum nl80211_acl_policy acl_policy;
2968         struct nlattr *attr;
2969         struct cfg80211_acl_data *acl;
2970         int i = 0, n_entries, tmp;
2971
2972         if (!wiphy->max_acl_mac_addrs)
2973                 return ERR_PTR(-EOPNOTSUPP);
2974
2975         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2976                 return ERR_PTR(-EINVAL);
2977
2978         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2979         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2980             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2981                 return ERR_PTR(-EINVAL);
2982
2983         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2984                 return ERR_PTR(-EINVAL);
2985
2986         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2987         if (n_entries < 0)
2988                 return ERR_PTR(n_entries);
2989
2990         if (n_entries > wiphy->max_acl_mac_addrs)
2991                 return ERR_PTR(-ENOTSUPP);
2992
2993         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2994                       GFP_KERNEL);
2995         if (!acl)
2996                 return ERR_PTR(-ENOMEM);
2997
2998         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2999                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3000                 i++;
3001         }
3002
3003         acl->n_acl_entries = n_entries;
3004         acl->acl_policy = acl_policy;
3005
3006         return acl;
3007 }
3008
3009 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3010 {
3011         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3012         struct net_device *dev = info->user_ptr[1];
3013         struct cfg80211_acl_data *acl;
3014         int err;
3015
3016         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3017             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3018                 return -EOPNOTSUPP;
3019
3020         if (!dev->ieee80211_ptr->beacon_interval)
3021                 return -EINVAL;
3022
3023         acl = parse_acl_data(&rdev->wiphy, info);
3024         if (IS_ERR(acl))
3025                 return PTR_ERR(acl);
3026
3027         err = rdev_set_mac_acl(rdev, dev, acl);
3028
3029         kfree(acl);
3030
3031         return err;
3032 }
3033
3034 static int nl80211_parse_beacon(struct nlattr *attrs[],
3035                                 struct cfg80211_beacon_data *bcn)
3036 {
3037         bool haveinfo = false;
3038
3039         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3040             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3041             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3042             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3043                 return -EINVAL;
3044
3045         memset(bcn, 0, sizeof(*bcn));
3046
3047         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3048                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3049                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3050                 if (!bcn->head_len)
3051                         return -EINVAL;
3052                 haveinfo = true;
3053         }
3054
3055         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3056                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3057                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3058                 haveinfo = true;
3059         }
3060
3061         if (!haveinfo)
3062                 return -EINVAL;
3063
3064         if (attrs[NL80211_ATTR_IE]) {
3065                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3066                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3067         }
3068
3069         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3070                 bcn->proberesp_ies =
3071                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3072                 bcn->proberesp_ies_len =
3073                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3074         }
3075
3076         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3077                 bcn->assocresp_ies =
3078                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3079                 bcn->assocresp_ies_len =
3080                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3081         }
3082
3083         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3084                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3085                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3086         }
3087
3088         return 0;
3089 }
3090
3091 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3092                                    struct cfg80211_ap_settings *params)
3093 {
3094         struct wireless_dev *wdev;
3095         bool ret = false;
3096
3097         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3098                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3099                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3100                         continue;
3101
3102                 if (!wdev->preset_chandef.chan)
3103                         continue;
3104
3105                 params->chandef = wdev->preset_chandef;
3106                 ret = true;
3107                 break;
3108         }
3109
3110         return ret;
3111 }
3112
3113 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3114                                     enum nl80211_auth_type auth_type,
3115                                     enum nl80211_commands cmd)
3116 {
3117         if (auth_type > NL80211_AUTHTYPE_MAX)
3118                 return false;
3119
3120         switch (cmd) {
3121         case NL80211_CMD_AUTHENTICATE:
3122                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3123                     auth_type == NL80211_AUTHTYPE_SAE)
3124                         return false;
3125                 return true;
3126         case NL80211_CMD_CONNECT:
3127         case NL80211_CMD_START_AP:
3128                 /* SAE not supported yet */
3129                 if (auth_type == NL80211_AUTHTYPE_SAE)
3130                         return false;
3131                 return true;
3132         default:
3133                 return false;
3134         }
3135 }
3136
3137 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3138 {
3139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3140         struct net_device *dev = info->user_ptr[1];
3141         struct wireless_dev *wdev = dev->ieee80211_ptr;
3142         struct cfg80211_ap_settings params;
3143         int err;
3144         u8 radar_detect_width = 0;
3145
3146         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3147             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3148                 return -EOPNOTSUPP;
3149
3150         if (!rdev->ops->start_ap)
3151                 return -EOPNOTSUPP;
3152
3153         if (wdev->beacon_interval)
3154                 return -EALREADY;
3155
3156         memset(&params, 0, sizeof(params));
3157
3158         /* these are required for START_AP */
3159         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3160             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3161             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3162                 return -EINVAL;
3163
3164         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3165         if (err)
3166                 return err;
3167
3168         params.beacon_interval =
3169                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3170         params.dtim_period =
3171                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3172
3173         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3174         if (err)
3175                 return err;
3176
3177         /*
3178          * In theory, some of these attributes should be required here
3179          * but since they were not used when the command was originally
3180          * added, keep them optional for old user space programs to let
3181          * them continue to work with drivers that do not need the
3182          * additional information -- drivers must check!
3183          */
3184         if (info->attrs[NL80211_ATTR_SSID]) {
3185                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3186                 params.ssid_len =
3187                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3188                 if (params.ssid_len == 0 ||
3189                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3190                         return -EINVAL;
3191         }
3192
3193         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3194                 params.hidden_ssid = nla_get_u32(
3195                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3196                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3197                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3198                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3199                         return -EINVAL;
3200         }
3201
3202         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3203
3204         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3205                 params.auth_type = nla_get_u32(
3206                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3207                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3208                                              NL80211_CMD_START_AP))
3209                         return -EINVAL;
3210         } else
3211                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3212
3213         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3214                                       NL80211_MAX_NR_CIPHER_SUITES);
3215         if (err)
3216                 return err;
3217
3218         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3219                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3220                         return -EOPNOTSUPP;
3221                 params.inactivity_timeout = nla_get_u16(
3222                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3223         }
3224
3225         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3226                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3227                         return -EINVAL;
3228                 params.p2p_ctwindow =
3229                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3230                 if (params.p2p_ctwindow > 127)
3231                         return -EINVAL;
3232                 if (params.p2p_ctwindow != 0 &&
3233                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3234                         return -EINVAL;
3235         }
3236
3237         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3238                 u8 tmp;
3239
3240                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3241                         return -EINVAL;
3242                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3243                 if (tmp > 1)
3244                         return -EINVAL;
3245                 params.p2p_opp_ps = tmp;
3246                 if (params.p2p_opp_ps != 0 &&
3247                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3248                         return -EINVAL;
3249         }
3250
3251         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3252                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3253                 if (err)
3254                         return err;
3255         } else if (wdev->preset_chandef.chan) {
3256                 params.chandef = wdev->preset_chandef;
3257         } else if (!nl80211_get_ap_channel(rdev, &params))
3258                 return -EINVAL;
3259
3260         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3261                 return -EINVAL;
3262
3263         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3264         if (err < 0)
3265                 return err;
3266         if (err) {
3267                 radar_detect_width = BIT(params.chandef.width);
3268                 params.radar_required = true;
3269         }
3270
3271         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3272                                            params.chandef.chan,
3273                                            CHAN_MODE_SHARED,
3274                                            radar_detect_width);
3275         if (err)
3276                 return err;
3277
3278         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3279                 params.acl = parse_acl_data(&rdev->wiphy, info);
3280                 if (IS_ERR(params.acl))
3281                         return PTR_ERR(params.acl);
3282         }
3283
3284         wdev_lock(wdev);
3285         err = rdev_start_ap(rdev, dev, &params);
3286         if (!err) {
3287                 wdev->preset_chandef = params.chandef;
3288                 wdev->beacon_interval = params.beacon_interval;
3289                 wdev->channel = params.chandef.chan;
3290                 wdev->ssid_len = params.ssid_len;
3291                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3292         }
3293         wdev_unlock(wdev);
3294
3295         kfree(params.acl);
3296
3297         return err;
3298 }
3299
3300 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3301 {
3302         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3303         struct net_device *dev = info->user_ptr[1];
3304         struct wireless_dev *wdev = dev->ieee80211_ptr;
3305         struct cfg80211_beacon_data params;
3306         int err;
3307
3308         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3309             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3310                 return -EOPNOTSUPP;
3311
3312         if (!rdev->ops->change_beacon)
3313                 return -EOPNOTSUPP;
3314
3315         if (!wdev->beacon_interval)
3316                 return -EINVAL;
3317
3318         err = nl80211_parse_beacon(info->attrs, &params);
3319         if (err)
3320                 return err;
3321
3322         wdev_lock(wdev);
3323         err = rdev_change_beacon(rdev, dev, &params);
3324         wdev_unlock(wdev);
3325
3326         return err;
3327 }
3328
3329 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3330 {
3331         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3332         struct net_device *dev = info->user_ptr[1];
3333
3334         return cfg80211_stop_ap(rdev, dev);
3335 }
3336
3337 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3338         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3339         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3340         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3341         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3342         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3343         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3344 };
3345
3346 static int parse_station_flags(struct genl_info *info,
3347                                enum nl80211_iftype iftype,
3348                                struct station_parameters *params)
3349 {
3350         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3351         struct nlattr *nla;
3352         int flag;
3353
3354         /*
3355          * Try parsing the new attribute first so userspace
3356          * can specify both for older kernels.
3357          */
3358         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3359         if (nla) {
3360                 struct nl80211_sta_flag_update *sta_flags;
3361
3362                 sta_flags = nla_data(nla);
3363                 params->sta_flags_mask = sta_flags->mask;
3364                 params->sta_flags_set = sta_flags->set;
3365                 params->sta_flags_set &= params->sta_flags_mask;
3366                 if ((params->sta_flags_mask |
3367                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3368                         return -EINVAL;
3369                 return 0;
3370         }
3371
3372         /* if present, parse the old attribute */
3373
3374         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3375         if (!nla)
3376                 return 0;
3377
3378         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3379                              nla, sta_flags_policy))
3380                 return -EINVAL;
3381
3382         /*
3383          * Only allow certain flags for interface types so that
3384          * other attributes are silently ignored. Remember that
3385          * this is backward compatibility code with old userspace
3386          * and shouldn't be hit in other cases anyway.
3387          */
3388         switch (iftype) {
3389         case NL80211_IFTYPE_AP:
3390         case NL80211_IFTYPE_AP_VLAN:
3391         case NL80211_IFTYPE_P2P_GO:
3392                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3393                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3394                                          BIT(NL80211_STA_FLAG_WME) |
3395                                          BIT(NL80211_STA_FLAG_MFP);
3396                 break;
3397         case NL80211_IFTYPE_P2P_CLIENT:
3398         case NL80211_IFTYPE_STATION:
3399                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3400                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3401                 break;
3402         case NL80211_IFTYPE_MESH_POINT:
3403                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3404                                          BIT(NL80211_STA_FLAG_MFP) |
3405                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3406         default:
3407                 return -EINVAL;
3408         }
3409
3410         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3411                 if (flags[flag]) {
3412                         params->sta_flags_set |= (1<<flag);
3413
3414                         /* no longer support new API additions in old API */
3415                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3416                                 return -EINVAL;
3417                 }
3418         }
3419
3420         return 0;
3421 }
3422
3423 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3424                                  int attr)
3425 {
3426         struct nlattr *rate;
3427         u32 bitrate;
3428         u16 bitrate_compat;
3429
3430         rate = nla_nest_start(msg, attr);
3431         if (!rate)
3432                 return false;
3433
3434         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3435         bitrate = cfg80211_calculate_bitrate(info);
3436         /* report 16-bit bitrate only if we can */
3437         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3438         if (bitrate > 0 &&
3439             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3440                 return false;
3441         if (bitrate_compat > 0 &&
3442             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3443                 return false;
3444
3445         if (info->flags & RATE_INFO_FLAGS_MCS) {
3446                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3447                         return false;
3448                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3449                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3450                         return false;
3451                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3452                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3453                         return false;
3454         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3455                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3456                         return false;
3457                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3458                         return false;
3459                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3460                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3461                         return false;
3462                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3463                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3464                         return false;
3465                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3466                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3467                         return false;
3468                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3469                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3470                         return false;
3471                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3472                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3473                         return false;
3474         }
3475
3476         nla_nest_end(msg, rate);
3477         return true;
3478 }
3479
3480 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3481                                int id)
3482 {
3483         void *attr;
3484         int i = 0;
3485
3486         if (!mask)
3487                 return true;
3488
3489         attr = nla_nest_start(msg, id);
3490         if (!attr)
3491                 return false;
3492
3493         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3494                 if (!(mask & BIT(i)))
3495                         continue;
3496
3497                 if (nla_put_u8(msg, i, signal[i]))
3498                         return false;
3499         }
3500
3501         nla_nest_end(msg, attr);
3502
3503         return true;
3504 }
3505
3506 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3507                                 int flags,
3508                                 struct cfg80211_registered_device *rdev,
3509                                 struct net_device *dev,
3510                                 const u8 *mac_addr, struct station_info *sinfo)
3511 {
3512         void *hdr;
3513         struct nlattr *sinfoattr, *bss_param;
3514
3515         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3516         if (!hdr)
3517                 return -1;
3518
3519         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3520             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3521             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3522                 goto nla_put_failure;
3523
3524         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3525         if (!sinfoattr)
3526                 goto nla_put_failure;
3527         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3528             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3529                         sinfo->connected_time))
3530                 goto nla_put_failure;
3531         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3532             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3533                         sinfo->inactive_time))
3534                 goto nla_put_failure;
3535         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3536                               STATION_INFO_RX_BYTES64)) &&
3537             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3538                         (u32)sinfo->rx_bytes))
3539                 goto nla_put_failure;
3540         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3541                               STATION_INFO_TX_BYTES64)) &&
3542             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3543                         (u32)sinfo->tx_bytes))
3544                 goto nla_put_failure;
3545         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3546             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3547                         sinfo->rx_bytes))
3548                 goto nla_put_failure;
3549         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3550             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3551                         sinfo->tx_bytes))
3552                 goto nla_put_failure;
3553         if ((sinfo->filled & STATION_INFO_LLID) &&
3554             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3555                 goto nla_put_failure;
3556         if ((sinfo->filled & STATION_INFO_PLID) &&
3557             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3558                 goto nla_put_failure;
3559         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3560             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3561                        sinfo->plink_state))
3562                 goto nla_put_failure;
3563         switch (rdev->wiphy.signal_type) {
3564         case CFG80211_SIGNAL_TYPE_MBM:
3565                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3566                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3567                                sinfo->signal))
3568                         goto nla_put_failure;
3569                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3570                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3571                                sinfo->signal_avg))
3572                         goto nla_put_failure;
3573                 break;
3574         default:
3575                 break;
3576         }
3577         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3578                 if (!nl80211_put_signal(msg, sinfo->chains,
3579                                         sinfo->chain_signal,
3580                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3581                         goto nla_put_failure;
3582         }
3583         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3584                 if (!nl80211_put_signal(msg, sinfo->chains,
3585                                         sinfo->chain_signal_avg,
3586                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3587                         goto nla_put_failure;
3588         }
3589         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3590                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3591                                           NL80211_STA_INFO_TX_BITRATE))
3592                         goto nla_put_failure;
3593         }
3594         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3595                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3596                                           NL80211_STA_INFO_RX_BITRATE))
3597                         goto nla_put_failure;
3598         }
3599         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3600             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3601                         sinfo->rx_packets))
3602                 goto nla_put_failure;
3603         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3604             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3605                         sinfo->tx_packets))
3606                 goto nla_put_failure;
3607         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3608             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3609                         sinfo->tx_retries))
3610                 goto nla_put_failure;
3611         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3612             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3613                         sinfo->tx_failed))
3614                 goto nla_put_failure;
3615         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3616             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3617                         sinfo->beacon_loss_count))
3618                 goto nla_put_failure;
3619         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3620             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3621                         sinfo->local_pm))
3622                 goto nla_put_failure;
3623         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3624             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3625                         sinfo->peer_pm))
3626                 goto nla_put_failure;
3627         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3628             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3629                         sinfo->nonpeer_pm))
3630                 goto nla_put_failure;
3631         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3632                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3633                 if (!bss_param)
3634                         goto nla_put_failure;
3635
3636                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3637                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3638                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3639                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3640                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3641                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3642                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3643                                sinfo->bss_param.dtim_period) ||
3644                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3645                                 sinfo->bss_param.beacon_interval))
3646                         goto nla_put_failure;
3647
3648                 nla_nest_end(msg, bss_param);
3649         }
3650         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3651             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3652                     sizeof(struct nl80211_sta_flag_update),
3653                     &sinfo->sta_flags))
3654                 goto nla_put_failure;
3655         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3656                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3657                             sinfo->t_offset))
3658                 goto nla_put_failure;
3659         nla_nest_end(msg, sinfoattr);
3660
3661         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3662             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3663                     sinfo->assoc_req_ies))
3664                 goto nla_put_failure;
3665
3666         return genlmsg_end(msg, hdr);
3667
3668  nla_put_failure:
3669         genlmsg_cancel(msg, hdr);
3670         return -EMSGSIZE;
3671 }
3672
3673 static int nl80211_dump_station(struct sk_buff *skb,
3674                                 struct netlink_callback *cb)
3675 {
3676         struct station_info sinfo;
3677         struct cfg80211_registered_device *dev;
3678         struct wireless_dev *wdev;
3679         u8 mac_addr[ETH_ALEN];
3680         int sta_idx = cb->args[2];
3681         int err;
3682
3683         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3684         if (err)
3685                 return err;
3686
3687         if (!wdev->netdev) {
3688                 err = -EINVAL;
3689                 goto out_err;
3690         }
3691
3692         if (!dev->ops->dump_station) {
3693                 err = -EOPNOTSUPP;
3694                 goto out_err;
3695         }
3696
3697         while (1) {
3698                 memset(&sinfo, 0, sizeof(sinfo));
3699                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3700                                         mac_addr, &sinfo);
3701                 if (err == -ENOENT)
3702                         break;
3703                 if (err)
3704                         goto out_err;
3705
3706                 if (nl80211_send_station(skb,
3707                                 NETLINK_CB(cb->skb).portid,
3708                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3709                                 dev, wdev->netdev, mac_addr,
3710                                 &sinfo) < 0)
3711                         goto out;
3712
3713                 sta_idx++;
3714         }
3715
3716
3717  out:
3718         cb->args[2] = sta_idx;
3719         err = skb->len;
3720  out_err:
3721         nl80211_finish_wdev_dump(dev);
3722
3723         return err;
3724 }
3725
3726 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3727 {
3728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3729         struct net_device *dev = info->user_ptr[1];
3730         struct station_info sinfo;
3731         struct sk_buff *msg;
3732         u8 *mac_addr = NULL;
3733         int err;
3734
3735         memset(&sinfo, 0, sizeof(sinfo));
3736
3737         if (!info->attrs[NL80211_ATTR_MAC])
3738                 return -EINVAL;
3739
3740         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3741
3742         if (!rdev->ops->get_station)
3743                 return -EOPNOTSUPP;
3744
3745         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3746         if (err)
3747                 return err;
3748
3749         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3750         if (!msg)
3751                 return -ENOMEM;
3752
3753         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3754                                  rdev, dev, mac_addr, &sinfo) < 0) {
3755                 nlmsg_free(msg);
3756                 return -ENOBUFS;
3757         }
3758
3759         return genlmsg_reply(msg, info);
3760 }
3761
3762 int cfg80211_check_station_change(struct wiphy *wiphy,
3763                                   struct station_parameters *params,
3764                                   enum cfg80211_station_type statype)
3765 {
3766         if (params->listen_interval != -1)
3767                 return -EINVAL;
3768         if (params->aid)
3769                 return -EINVAL;
3770
3771         /* When you run into this, adjust the code below for the new flag */
3772         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3773
3774         switch (statype) {
3775         case CFG80211_STA_MESH_PEER_KERNEL:
3776         case CFG80211_STA_MESH_PEER_USER:
3777                 /*
3778                  * No ignoring the TDLS flag here -- the userspace mesh
3779                  * code doesn't have the bug of including TDLS in the
3780                  * mask everywhere.
3781                  */
3782                 if (params->sta_flags_mask &
3783                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3784                                   BIT(NL80211_STA_FLAG_MFP) |
3785                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3786                         return -EINVAL;
3787                 break;
3788         case CFG80211_STA_TDLS_PEER_SETUP:
3789         case CFG80211_STA_TDLS_PEER_ACTIVE:
3790                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3791                         return -EINVAL;
3792                 /* ignore since it can't change */
3793                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3794                 break;
3795         default:
3796                 /* disallow mesh-specific things */
3797                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3798                         return -EINVAL;
3799                 if (params->local_pm)
3800                         return -EINVAL;
3801                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3802                         return -EINVAL;
3803         }
3804
3805         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3806             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3807                 /* TDLS can't be set, ... */
3808                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3809                         return -EINVAL;
3810                 /*
3811                  * ... but don't bother the driver with it. This works around
3812                  * a hostapd/wpa_supplicant issue -- it always includes the
3813                  * TLDS_PEER flag in the mask even for AP mode.
3814                  */
3815                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3816         }
3817
3818         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3819                 /* reject other things that can't change */
3820                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3821                         return -EINVAL;
3822                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3823                         return -EINVAL;
3824                 if (params->supported_rates)
3825                         return -EINVAL;
3826                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3827                         return -EINVAL;
3828         }
3829
3830         if (statype != CFG80211_STA_AP_CLIENT) {
3831                 if (params->vlan)
3832                         return -EINVAL;
3833         }
3834
3835         switch (statype) {
3836         case CFG80211_STA_AP_MLME_CLIENT:
3837                 /* Use this only for authorizing/unauthorizing a station */
3838                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3839                         return -EOPNOTSUPP;
3840                 break;
3841         case CFG80211_STA_AP_CLIENT:
3842                 /* accept only the listed bits */
3843                 if (params->sta_flags_mask &
3844                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3845                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3846                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3847                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3848                                   BIT(NL80211_STA_FLAG_WME) |
3849                                   BIT(NL80211_STA_FLAG_MFP)))
3850                         return -EINVAL;
3851
3852                 /* but authenticated/associated only if driver handles it */
3853                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3854                     params->sta_flags_mask &
3855                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3856                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3857                         return -EINVAL;
3858                 break;
3859         case CFG80211_STA_IBSS:
3860         case CFG80211_STA_AP_STA:
3861                 /* reject any changes other than AUTHORIZED */
3862                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3863                         return -EINVAL;
3864                 break;
3865         case CFG80211_STA_TDLS_PEER_SETUP:
3866                 /* reject any changes other than AUTHORIZED or WME */
3867                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3868                                                BIT(NL80211_STA_FLAG_WME)))
3869                         return -EINVAL;
3870                 /* force (at least) rates when authorizing */
3871                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3872                     !params->supported_rates)
3873                         return -EINVAL;
3874                 break;
3875         case CFG80211_STA_TDLS_PEER_ACTIVE:
3876                 /* reject any changes */
3877                 return -EINVAL;
3878         case CFG80211_STA_MESH_PEER_KERNEL:
3879                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3880                         return -EINVAL;
3881                 break;
3882         case CFG80211_STA_MESH_PEER_USER:
3883                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3884                         return -EINVAL;
3885                 break;
3886         }
3887
3888         return 0;
3889 }
3890 EXPORT_SYMBOL(cfg80211_check_station_change);
3891
3892 /*
3893  * Get vlan interface making sure it is running and on the right wiphy.
3894  */
3895 static struct net_device *get_vlan(struct genl_info *info,
3896                                    struct cfg80211_registered_device *rdev)
3897 {
3898         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3899         struct net_device *v;
3900         int ret;
3901
3902         if (!vlanattr)
3903                 return NULL;
3904
3905         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3906         if (!v)
3907                 return ERR_PTR(-ENODEV);
3908
3909         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3910                 ret = -EINVAL;
3911                 goto error;
3912         }
3913
3914         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3915             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3916             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3917                 ret = -EINVAL;
3918                 goto error;
3919         }
3920
3921         if (!netif_running(v)) {
3922                 ret = -ENETDOWN;
3923                 goto error;
3924         }
3925
3926         return v;
3927  error:
3928         dev_put(v);
3929         return ERR_PTR(ret);
3930 }
3931
3932 static struct nla_policy
3933 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3934         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3935         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3936 };
3937
3938 static int nl80211_parse_sta_wme(struct genl_info *info,
3939                                  struct station_parameters *params)
3940 {
3941         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3942         struct nlattr *nla;
3943         int err;
3944
3945         /* parse WME attributes if present */
3946         if (!info->attrs[NL80211_ATTR_STA_WME])
3947                 return 0;
3948
3949         nla = info->attrs[NL80211_ATTR_STA_WME];
3950         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3951                                nl80211_sta_wme_policy);
3952         if (err)
3953                 return err;
3954
3955         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3956                 params->uapsd_queues = nla_get_u8(
3957                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3958         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3959                 return -EINVAL;
3960
3961         if (tb[NL80211_STA_WME_MAX_SP])
3962                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3963
3964         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3965                 return -EINVAL;
3966
3967         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3968
3969         return 0;
3970 }
3971
3972 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3973                                       struct station_parameters *params)
3974 {
3975         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3976                 params->supported_channels =
3977                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3978                 params->supported_channels_len =
3979                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3980                 /*
3981                  * Need to include at least one (first channel, number of
3982                  * channels) tuple for each subband, and must have proper
3983                  * tuples for the rest of the data as well.
3984                  */
3985                 if (params->supported_channels_len < 2)
3986                         return -EINVAL;
3987                 if (params->supported_channels_len % 2)
3988                         return -EINVAL;
3989         }
3990
3991         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3992                 params->supported_oper_classes =
3993                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3994                 params->supported_oper_classes_len =
3995                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3996                 /*
3997                  * The value of the Length field of the Supported Operating
3998                  * Classes element is between 2 and 253.
3999                  */
4000                 if (params->supported_oper_classes_len < 2 ||
4001                     params->supported_oper_classes_len > 253)
4002                         return -EINVAL;
4003         }
4004         return 0;
4005 }
4006
4007 static int nl80211_set_station_tdls(struct genl_info *info,
4008                                     struct station_parameters *params)
4009 {
4010         int err;
4011         /* Dummy STA entry gets updated once the peer capabilities are known */
4012         if (info->attrs[NL80211_ATTR_PEER_AID])
4013                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4014         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4015                 params->ht_capa =
4016                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4017         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4018                 params->vht_capa =
4019                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4020
4021         err = nl80211_parse_sta_channel_info(info, params);
4022         if (err)
4023                 return err;
4024
4025         return nl80211_parse_sta_wme(info, params);
4026 }
4027
4028 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4029 {
4030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4031         struct net_device *dev = info->user_ptr[1];
4032         struct station_parameters params;
4033         u8 *mac_addr;
4034         int err;
4035
4036         memset(&params, 0, sizeof(params));
4037
4038         params.listen_interval = -1;
4039
4040         if (!rdev->ops->change_station)
4041                 return -EOPNOTSUPP;
4042
4043         if (info->attrs[NL80211_ATTR_STA_AID])
4044                 return -EINVAL;
4045
4046         if (!info->attrs[NL80211_ATTR_MAC])
4047                 return -EINVAL;
4048
4049         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4050
4051         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4052                 params.supported_rates =
4053                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4054                 params.supported_rates_len =
4055                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4056         }
4057
4058         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4059                 params.capability =
4060                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4061                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4062         }
4063
4064         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4065                 params.ext_capab =
4066                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4067                 params.ext_capab_len =
4068                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4069         }
4070
4071         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4072                 return -EINVAL;
4073
4074         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4075                 return -EINVAL;
4076
4077         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4078                 params.plink_action =
4079                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4080                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4081                         return -EINVAL;
4082         }
4083
4084         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4085                 params.plink_state =
4086                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4087                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4088                         return -EINVAL;
4089                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4090         }
4091
4092         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4093                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4094                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4095
4096                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4097                     pm > NL80211_MESH_POWER_MAX)
4098                         return -EINVAL;
4099
4100                 params.local_pm = pm;
4101         }
4102
4103         /* Include parameters for TDLS peer (will check later) */
4104         err = nl80211_set_station_tdls(info, &params);
4105         if (err)
4106                 return err;
4107
4108         params.vlan = get_vlan(info, rdev);
4109         if (IS_ERR(params.vlan))
4110                 return PTR_ERR(params.vlan);
4111
4112         switch (dev->ieee80211_ptr->iftype) {
4113         case NL80211_IFTYPE_AP:
4114         case NL80211_IFTYPE_AP_VLAN:
4115         case NL80211_IFTYPE_P2P_GO:
4116         case NL80211_IFTYPE_P2P_CLIENT:
4117         case NL80211_IFTYPE_STATION:
4118         case NL80211_IFTYPE_ADHOC:
4119         case NL80211_IFTYPE_MESH_POINT:
4120                 break;
4121         default:
4122                 err = -EOPNOTSUPP;
4123                 goto out_put_vlan;
4124         }
4125
4126         /* driver will call cfg80211_check_station_change() */
4127         err = rdev_change_station(rdev, dev, mac_addr, &params);
4128
4129  out_put_vlan:
4130         if (params.vlan)
4131                 dev_put(params.vlan);
4132
4133         return err;
4134 }
4135
4136 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4137 {
4138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4139         int err;
4140         struct net_device *dev = info->user_ptr[1];
4141         struct station_parameters params;
4142         u8 *mac_addr = NULL;
4143
4144         memset(&params, 0, sizeof(params));
4145
4146         if (!rdev->ops->add_station)
4147                 return -EOPNOTSUPP;
4148
4149         if (!info->attrs[NL80211_ATTR_MAC])
4150                 return -EINVAL;
4151
4152         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4153                 return -EINVAL;
4154
4155         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4156                 return -EINVAL;
4157
4158         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4159             !info->attrs[NL80211_ATTR_PEER_AID])
4160                 return -EINVAL;
4161
4162         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4163         params.supported_rates =
4164                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4165         params.supported_rates_len =
4166                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4167         params.listen_interval =
4168                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4169
4170         if (info->attrs[NL80211_ATTR_PEER_AID])
4171                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4172         else
4173                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4174         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4175                 return -EINVAL;
4176
4177         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4178                 params.capability =
4179                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4180                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4181         }
4182
4183         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4184                 params.ext_capab =
4185                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4186                 params.ext_capab_len =
4187                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4188         }
4189
4190         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4191                 params.ht_capa =
4192                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4193
4194         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4195                 params.vht_capa =
4196                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4197
4198         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4199                 params.opmode_notif_used = true;
4200                 params.opmode_notif =
4201                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4202         }
4203
4204         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4205                 params.plink_action =
4206                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4207                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4208                         return -EINVAL;
4209         }
4210
4211         err = nl80211_parse_sta_channel_info(info, &params);
4212         if (err)
4213                 return err;
4214
4215         err = nl80211_parse_sta_wme(info, &params);
4216         if (err)
4217                 return err;
4218
4219         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4220                 return -EINVAL;
4221
4222         /* When you run into this, adjust the code below for the new flag */
4223         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4224
4225         switch (dev->ieee80211_ptr->iftype) {
4226         case NL80211_IFTYPE_AP:
4227         case NL80211_IFTYPE_AP_VLAN:
4228         case NL80211_IFTYPE_P2P_GO:
4229                 /* ignore WME attributes if iface/sta is not capable */
4230                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4231                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4232                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4233
4234                 /* TDLS peers cannot be added */
4235                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4236                     info->attrs[NL80211_ATTR_PEER_AID])
4237                         return -EINVAL;
4238                 /* but don't bother the driver with it */
4239                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4240
4241                 /* allow authenticated/associated only if driver handles it */
4242                 if (!(rdev->wiphy.features &
4243                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4244                     params.sta_flags_mask &
4245                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4246                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4247                         return -EINVAL;
4248
4249                 /* must be last in here for error handling */
4250                 params.vlan = get_vlan(info, rdev);
4251                 if (IS_ERR(params.vlan))
4252                         return PTR_ERR(params.vlan);
4253                 break;
4254         case NL80211_IFTYPE_MESH_POINT:
4255                 /* ignore uAPSD data */
4256                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4257
4258                 /* associated is disallowed */
4259                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4260                         return -EINVAL;
4261                 /* TDLS peers cannot be added */
4262                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4263                     info->attrs[NL80211_ATTR_PEER_AID])
4264                         return -EINVAL;
4265                 break;
4266         case NL80211_IFTYPE_STATION:
4267         case NL80211_IFTYPE_P2P_CLIENT:
4268                 /* ignore uAPSD data */
4269                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4270
4271                 /* these are disallowed */
4272                 if (params.sta_flags_mask &
4273                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4274                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4275                         return -EINVAL;
4276                 /* Only TDLS peers can be added */
4277                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4278                         return -EINVAL;
4279                 /* Can only add if TDLS ... */
4280                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4281                         return -EOPNOTSUPP;
4282                 /* ... with external setup is supported */
4283                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4284                         return -EOPNOTSUPP;
4285                 /*
4286                  * Older wpa_supplicant versions always mark the TDLS peer
4287                  * as authorized, but it shouldn't yet be.
4288                  */
4289                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4290                 break;
4291         default:
4292                 return -EOPNOTSUPP;
4293         }
4294
4295         /* be aware of params.vlan when changing code here */
4296
4297         err = rdev_add_station(rdev, dev, mac_addr, &params);
4298
4299         if (params.vlan)
4300                 dev_put(params.vlan);
4301         return err;
4302 }
4303
4304 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4305 {
4306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4307         struct net_device *dev = info->user_ptr[1];
4308         u8 *mac_addr = NULL;
4309
4310         if (info->attrs[NL80211_ATTR_MAC])
4311                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4312
4313         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4314             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4315             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4316             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4317                 return -EINVAL;
4318
4319         if (!rdev->ops->del_station)
4320                 return -EOPNOTSUPP;
4321
4322         return rdev_del_station(rdev, dev, mac_addr);
4323 }
4324
4325 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4326                                 int flags, struct net_device *dev,
4327                                 u8 *dst, u8 *next_hop,
4328                                 struct mpath_info *pinfo)
4329 {
4330         void *hdr;
4331         struct nlattr *pinfoattr;
4332
4333         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4334         if (!hdr)
4335                 return -1;
4336
4337         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4338             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4339             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4340             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4341                 goto nla_put_failure;
4342
4343         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4344         if (!pinfoattr)
4345                 goto nla_put_failure;
4346         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4347             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4348                         pinfo->frame_qlen))
4349                 goto nla_put_failure;
4350         if (((pinfo->filled & MPATH_INFO_SN) &&
4351              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4352             ((pinfo->filled & MPATH_INFO_METRIC) &&
4353              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4354                          pinfo->metric)) ||
4355             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4356              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4357                          pinfo->exptime)) ||
4358             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4359              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4360                         pinfo->flags)) ||
4361             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4362              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4363                          pinfo->discovery_timeout)) ||
4364             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4365              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4366                         pinfo->discovery_retries)))
4367                 goto nla_put_failure;
4368
4369         nla_nest_end(msg, pinfoattr);
4370
4371         return genlmsg_end(msg, hdr);
4372
4373  nla_put_failure:
4374         genlmsg_cancel(msg, hdr);
4375         return -EMSGSIZE;
4376 }
4377
4378 static int nl80211_dump_mpath(struct sk_buff *skb,
4379                               struct netlink_callback *cb)
4380 {
4381         struct mpath_info pinfo;
4382         struct cfg80211_registered_device *dev;
4383         struct wireless_dev *wdev;
4384         u8 dst[ETH_ALEN];
4385         u8 next_hop[ETH_ALEN];
4386         int path_idx = cb->args[2];
4387         int err;
4388
4389         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4390         if (err)
4391                 return err;
4392
4393         if (!dev->ops->dump_mpath) {
4394                 err = -EOPNOTSUPP;
4395                 goto out_err;
4396         }
4397
4398         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4399                 err = -EOPNOTSUPP;
4400                 goto out_err;
4401         }
4402
4403         while (1) {
4404                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4405                                       next_hop, &pinfo);
4406                 if (err == -ENOENT)
4407                         break;
4408                 if (err)
4409                         goto out_err;
4410
4411                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4412                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4413                                        wdev->netdev, dst, next_hop,
4414                                        &pinfo) < 0)
4415                         goto out;
4416
4417                 path_idx++;
4418         }
4419
4420
4421  out:
4422         cb->args[2] = path_idx;
4423         err = skb->len;
4424  out_err:
4425         nl80211_finish_wdev_dump(dev);
4426         return err;
4427 }
4428
4429 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4430 {
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         int err;
4433         struct net_device *dev = info->user_ptr[1];
4434         struct mpath_info pinfo;
4435         struct sk_buff *msg;
4436         u8 *dst = NULL;
4437         u8 next_hop[ETH_ALEN];
4438
4439         memset(&pinfo, 0, sizeof(pinfo));
4440
4441         if (!info->attrs[NL80211_ATTR_MAC])
4442                 return -EINVAL;
4443
4444         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4445
4446         if (!rdev->ops->get_mpath)
4447                 return -EOPNOTSUPP;
4448
4449         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4450                 return -EOPNOTSUPP;
4451
4452         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4453         if (err)
4454                 return err;
4455
4456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4457         if (!msg)
4458                 return -ENOMEM;
4459
4460         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4461                                  dev, dst, next_hop, &pinfo) < 0) {
4462                 nlmsg_free(msg);
4463                 return -ENOBUFS;
4464         }
4465
4466         return genlmsg_reply(msg, info);
4467 }
4468
4469 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4470 {
4471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4472         struct net_device *dev = info->user_ptr[1];
4473         u8 *dst = NULL;
4474         u8 *next_hop = NULL;
4475
4476         if (!info->attrs[NL80211_ATTR_MAC])
4477                 return -EINVAL;
4478
4479         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4480                 return -EINVAL;
4481
4482         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4483         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4484
4485         if (!rdev->ops->change_mpath)
4486                 return -EOPNOTSUPP;
4487
4488         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4489                 return -EOPNOTSUPP;
4490
4491         return rdev_change_mpath(rdev, dev, dst, next_hop);
4492 }
4493
4494 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4495 {
4496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4497         struct net_device *dev = info->user_ptr[1];
4498         u8 *dst = NULL;
4499         u8 *next_hop = NULL;
4500
4501         if (!info->attrs[NL80211_ATTR_MAC])
4502                 return -EINVAL;
4503
4504         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4505                 return -EINVAL;
4506
4507         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4508         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4509
4510         if (!rdev->ops->add_mpath)
4511                 return -EOPNOTSUPP;
4512
4513         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4514                 return -EOPNOTSUPP;
4515
4516         return rdev_add_mpath(rdev, dev, dst, next_hop);
4517 }
4518
4519 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4520 {
4521         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4522         struct net_device *dev = info->user_ptr[1];
4523         u8 *dst = NULL;
4524
4525         if (info->attrs[NL80211_ATTR_MAC])
4526                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4527
4528         if (!rdev->ops->del_mpath)
4529                 return -EOPNOTSUPP;
4530
4531         return rdev_del_mpath(rdev, dev, dst);
4532 }
4533
4534 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4535 {
4536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4537         struct net_device *dev = info->user_ptr[1];
4538         struct wireless_dev *wdev = dev->ieee80211_ptr;
4539         struct bss_parameters params;
4540         int err;
4541
4542         memset(&params, 0, sizeof(params));
4543         /* default to not changing parameters */
4544         params.use_cts_prot = -1;
4545         params.use_short_preamble = -1;
4546         params.use_short_slot_time = -1;
4547         params.ap_isolate = -1;
4548         params.ht_opmode = -1;
4549         params.p2p_ctwindow = -1;
4550         params.p2p_opp_ps = -1;
4551
4552         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4553                 params.use_cts_prot =
4554                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4555         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4556                 params.use_short_preamble =
4557                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4558         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4559                 params.use_short_slot_time =
4560                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4561         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4562                 params.basic_rates =
4563                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4564                 params.basic_rates_len =
4565                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4566         }
4567         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4568                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4569         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4570                 params.ht_opmode =
4571                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4572
4573         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4574                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4575                         return -EINVAL;
4576                 params.p2p_ctwindow =
4577                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4578                 if (params.p2p_ctwindow < 0)
4579                         return -EINVAL;
4580                 if (params.p2p_ctwindow != 0 &&
4581                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4582                         return -EINVAL;
4583         }
4584
4585         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4586                 u8 tmp;
4587
4588                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4589                         return -EINVAL;
4590                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4591                 if (tmp > 1)
4592                         return -EINVAL;
4593                 params.p2p_opp_ps = tmp;
4594                 if (params.p2p_opp_ps &&
4595                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4596                         return -EINVAL;
4597         }
4598
4599         if (!rdev->ops->change_bss)
4600                 return -EOPNOTSUPP;
4601
4602         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4603             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4604                 return -EOPNOTSUPP;
4605
4606         wdev_lock(wdev);
4607         err = rdev_change_bss(rdev, dev, &params);
4608         wdev_unlock(wdev);
4609
4610         return err;
4611 }
4612
4613 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4614         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4615         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4616         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4617         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4618         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4619         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4620 };
4621
4622 static int parse_reg_rule(struct nlattr *tb[],
4623         struct ieee80211_reg_rule *reg_rule)
4624 {
4625         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4626         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4627
4628         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4629                 return -EINVAL;
4630         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4631                 return -EINVAL;
4632         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4633                 return -EINVAL;
4634         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4635                 return -EINVAL;
4636         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4637                 return -EINVAL;
4638
4639         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4640
4641         freq_range->start_freq_khz =
4642                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4643         freq_range->end_freq_khz =
4644                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4645         freq_range->max_bandwidth_khz =
4646                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4647
4648         power_rule->max_eirp =
4649                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4650
4651         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4652                 power_rule->max_antenna_gain =
4653                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4654
4655         return 0;
4656 }
4657
4658 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4659 {
4660         int r;
4661         char *data = NULL;
4662         enum nl80211_user_reg_hint_type user_reg_hint_type;
4663
4664         /*
4665          * You should only get this when cfg80211 hasn't yet initialized
4666          * completely when built-in to the kernel right between the time
4667          * window between nl80211_init() and regulatory_init(), if that is
4668          * even possible.
4669          */
4670         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4671                 return -EINPROGRESS;
4672
4673         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4674                 return -EINVAL;
4675
4676         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4677
4678         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4679                 user_reg_hint_type =
4680                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4681         else
4682                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4683
4684         switch (user_reg_hint_type) {
4685         case NL80211_USER_REG_HINT_USER:
4686         case NL80211_USER_REG_HINT_CELL_BASE:
4687                 break;
4688         default:
4689                 return -EINVAL;
4690         }
4691
4692         r = regulatory_hint_user(data, user_reg_hint_type);
4693
4694         return r;
4695 }
4696
4697 static int nl80211_get_mesh_config(struct sk_buff *skb,
4698                                    struct genl_info *info)
4699 {
4700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4701         struct net_device *dev = info->user_ptr[1];
4702         struct wireless_dev *wdev = dev->ieee80211_ptr;
4703         struct mesh_config cur_params;
4704         int err = 0;
4705         void *hdr;
4706         struct nlattr *pinfoattr;
4707         struct sk_buff *msg;
4708
4709         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4710                 return -EOPNOTSUPP;
4711
4712         if (!rdev->ops->get_mesh_config)
4713                 return -EOPNOTSUPP;
4714
4715         wdev_lock(wdev);
4716         /* If not connected, get default parameters */
4717         if (!wdev->mesh_id_len)
4718                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4719         else
4720                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4721         wdev_unlock(wdev);
4722
4723         if (err)
4724                 return err;
4725
4726         /* Draw up a netlink message to send back */
4727         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4728         if (!msg)
4729                 return -ENOMEM;
4730         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4731                              NL80211_CMD_GET_MESH_CONFIG);
4732         if (!hdr)
4733                 goto out;
4734         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4735         if (!pinfoattr)
4736                 goto nla_put_failure;
4737         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4738             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4739                         cur_params.dot11MeshRetryTimeout) ||
4740             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4741                         cur_params.dot11MeshConfirmTimeout) ||
4742             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4743                         cur_params.dot11MeshHoldingTimeout) ||
4744             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4745                         cur_params.dot11MeshMaxPeerLinks) ||
4746             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4747                        cur_params.dot11MeshMaxRetries) ||
4748             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4749                        cur_params.dot11MeshTTL) ||
4750             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4751                        cur_params.element_ttl) ||
4752             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4753                        cur_params.auto_open_plinks) ||
4754             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4755                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4756             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4757                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4758             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4759                         cur_params.path_refresh_time) ||
4760             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4761                         cur_params.min_discovery_timeout) ||
4762             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4763                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4764             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4765                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4766             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4767                         cur_params.dot11MeshHWMPperrMinInterval) ||
4768             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4769                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4770             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4771                        cur_params.dot11MeshHWMPRootMode) ||
4772             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4773                         cur_params.dot11MeshHWMPRannInterval) ||
4774             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4775                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4776             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4777                        cur_params.dot11MeshForwarding) ||
4778             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4779                         cur_params.rssi_threshold) ||
4780             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4781                         cur_params.ht_opmode) ||
4782             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4783                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4784             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4785                         cur_params.dot11MeshHWMProotInterval) ||
4786             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4787                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4788             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4789                         cur_params.power_mode) ||
4790             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4791                         cur_params.dot11MeshAwakeWindowDuration) ||
4792             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4793                         cur_params.plink_timeout))
4794                 goto nla_put_failure;
4795         nla_nest_end(msg, pinfoattr);
4796         genlmsg_end(msg, hdr);
4797         return genlmsg_reply(msg, info);
4798
4799  nla_put_failure:
4800         genlmsg_cancel(msg, hdr);
4801  out:
4802         nlmsg_free(msg);
4803         return -ENOBUFS;
4804 }
4805
4806 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4807         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4808         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4809         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4810         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4811         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4812         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4813         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4814         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4815         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4816         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4817         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4818         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4819         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4820         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4821         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4822         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4823         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4824         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4825         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4826         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4827         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4828         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4829         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4830         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4831         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4832         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4833         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4834         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4835 };
4836
4837 static const struct nla_policy
4838         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4839         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4840         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4841         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4842         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4843         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4844         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4845         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4846                                     .len = IEEE80211_MAX_DATA_LEN },
4847         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4848 };
4849
4850 static int nl80211_parse_mesh_config(struct genl_info *info,
4851                                      struct mesh_config *cfg,
4852                                      u32 *mask_out)
4853 {
4854         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4855         u32 mask = 0;
4856
4857 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4858 do {                                                                        \
4859         if (tb[attr]) {                                                     \
4860                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4861                         return -EINVAL;                                     \
4862                 cfg->param = fn(tb[attr]);                                  \
4863                 mask |= (1 << (attr - 1));                                  \
4864         }                                                                   \
4865 } while (0)
4866
4867
4868         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4869                 return -EINVAL;
4870         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4871                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4872                              nl80211_meshconf_params_policy))
4873                 return -EINVAL;
4874
4875         /* This makes sure that there aren't more than 32 mesh config
4876          * parameters (otherwise our bitfield scheme would not work.) */
4877         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4878
4879         /* Fill in the params struct */
4880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4881                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4882                                   nla_get_u16);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4884                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4885                                   nla_get_u16);
4886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4887                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4888                                   nla_get_u16);
4889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4890                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4891                                   nla_get_u16);
4892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4893                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4894                                   nla_get_u8);
4895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4896                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4898                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4899                                   nla_get_u8);
4900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4901                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4902                                   nla_get_u8);
4903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4904                                   1, 255, mask,
4905                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4906                                   nla_get_u32);
4907         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4908                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4909                                   nla_get_u8);
4910         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4911                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4912                                   nla_get_u32);
4913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4914                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4915                                   nla_get_u16);
4916         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4917                                   1, 65535, mask,
4918                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4919                                   nla_get_u32);
4920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4921                                   1, 65535, mask,
4922                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4923                                   nla_get_u16);
4924         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4925                                   1, 65535, mask,
4926                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4927                                   nla_get_u16);
4928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4929                                   dot11MeshHWMPnetDiameterTraversalTime,
4930                                   1, 65535, mask,
4931                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4932                                   nla_get_u16);
4933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4934                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4935                                   nla_get_u8);
4936         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4937                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4938                                   nla_get_u16);
4939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4940                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4941                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4942                                   nla_get_u8);
4943         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4944                                   mask, NL80211_MESHCONF_FORWARDING,
4945                                   nla_get_u8);
4946         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4947                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4948                                   nla_get_s32);
4949         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4950                                   mask, NL80211_MESHCONF_HT_OPMODE,
4951                                   nla_get_u16);
4952         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4953                                   1, 65535, mask,
4954                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4955                                   nla_get_u32);
4956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4957                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4958                                   nla_get_u16);
4959         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4960                                   dot11MeshHWMPconfirmationInterval,
4961                                   1, 65535, mask,
4962                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4963                                   nla_get_u16);
4964         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4965                                   NL80211_MESH_POWER_ACTIVE,
4966                                   NL80211_MESH_POWER_MAX,
4967                                   mask, NL80211_MESHCONF_POWER_MODE,
4968                                   nla_get_u32);
4969         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4970                                   0, 65535, mask,
4971                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4972         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4973                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4974                                   nla_get_u32);
4975         if (mask_out)
4976                 *mask_out = mask;
4977
4978         return 0;
4979
4980 #undef FILL_IN_MESH_PARAM_IF_SET
4981 }
4982
4983 static int nl80211_parse_mesh_setup(struct genl_info *info,
4984                                      struct mesh_setup *setup)
4985 {
4986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4987         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4988
4989         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4990                 return -EINVAL;
4991         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4992                              info->attrs[NL80211_ATTR_MESH_SETUP],
4993                              nl80211_mesh_setup_params_policy))
4994                 return -EINVAL;
4995
4996         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4997                 setup->sync_method =
4998                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4999                  IEEE80211_SYNC_METHOD_VENDOR :
5000                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5001
5002         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5003                 setup->path_sel_proto =
5004                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5005                  IEEE80211_PATH_PROTOCOL_VENDOR :
5006                  IEEE80211_PATH_PROTOCOL_HWMP;
5007
5008         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5009                 setup->path_metric =
5010                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5011                  IEEE80211_PATH_METRIC_VENDOR :
5012                  IEEE80211_PATH_METRIC_AIRTIME;
5013
5014
5015         if (tb[NL80211_MESH_SETUP_IE]) {
5016                 struct nlattr *ieattr =
5017                         tb[NL80211_MESH_SETUP_IE];
5018                 if (!is_valid_ie_attr(ieattr))
5019                         return -EINVAL;
5020                 setup->ie = nla_data(ieattr);
5021                 setup->ie_len = nla_len(ieattr);
5022         }
5023         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5024             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5025                 return -EINVAL;
5026         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5027         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5028         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5029         if (setup->is_secure)
5030                 setup->user_mpm = true;
5031
5032         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5033                 if (!setup->user_mpm)
5034                         return -EINVAL;
5035                 setup->auth_id =
5036                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5037         }
5038
5039         return 0;
5040 }
5041
5042 static int nl80211_update_mesh_config(struct sk_buff *skb,
5043                                       struct genl_info *info)
5044 {
5045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5046         struct net_device *dev = info->user_ptr[1];
5047         struct wireless_dev *wdev = dev->ieee80211_ptr;
5048         struct mesh_config cfg;
5049         u32 mask;
5050         int err;
5051
5052         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5053                 return -EOPNOTSUPP;
5054
5055         if (!rdev->ops->update_mesh_config)
5056                 return -EOPNOTSUPP;
5057
5058         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5059         if (err)
5060                 return err;
5061
5062         wdev_lock(wdev);
5063         if (!wdev->mesh_id_len)
5064                 err = -ENOLINK;
5065
5066         if (!err)
5067                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5068
5069         wdev_unlock(wdev);
5070
5071         return err;
5072 }
5073
5074 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5075 {
5076         const struct ieee80211_regdomain *regdom;
5077         struct sk_buff *msg;
5078         void *hdr = NULL;
5079         struct nlattr *nl_reg_rules;
5080         unsigned int i;
5081
5082         if (!cfg80211_regdomain)
5083                 return -EINVAL;
5084
5085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5086         if (!msg)
5087                 return -ENOBUFS;
5088
5089         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5090                              NL80211_CMD_GET_REG);
5091         if (!hdr)
5092                 goto put_failure;
5093
5094         if (reg_last_request_cell_base() &&
5095             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5096                         NL80211_USER_REG_HINT_CELL_BASE))
5097                 goto nla_put_failure;
5098
5099         rcu_read_lock();
5100         regdom = rcu_dereference(cfg80211_regdomain);
5101
5102         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5103             (regdom->dfs_region &&
5104              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5105                 goto nla_put_failure_rcu;
5106
5107         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5108         if (!nl_reg_rules)
5109                 goto nla_put_failure_rcu;
5110
5111         for (i = 0; i < regdom->n_reg_rules; i++) {
5112                 struct nlattr *nl_reg_rule;
5113                 const struct ieee80211_reg_rule *reg_rule;
5114                 const struct ieee80211_freq_range *freq_range;
5115                 const struct ieee80211_power_rule *power_rule;
5116
5117                 reg_rule = &regdom->reg_rules[i];
5118                 freq_range = &reg_rule->freq_range;
5119                 power_rule = &reg_rule->power_rule;
5120
5121                 nl_reg_rule = nla_nest_start(msg, i);
5122                 if (!nl_reg_rule)
5123                         goto nla_put_failure_rcu;
5124
5125                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5126                                 reg_rule->flags) ||
5127                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5128                                 freq_range->start_freq_khz) ||
5129                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5130                                 freq_range->end_freq_khz) ||
5131                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5132                                 freq_range->max_bandwidth_khz) ||
5133                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5134                                 power_rule->max_antenna_gain) ||
5135                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5136                                 power_rule->max_eirp))
5137                         goto nla_put_failure_rcu;
5138
5139                 nla_nest_end(msg, nl_reg_rule);
5140         }
5141         rcu_read_unlock();
5142
5143         nla_nest_end(msg, nl_reg_rules);
5144
5145         genlmsg_end(msg, hdr);
5146         return genlmsg_reply(msg, info);
5147
5148 nla_put_failure_rcu:
5149         rcu_read_unlock();
5150 nla_put_failure:
5151         genlmsg_cancel(msg, hdr);
5152 put_failure:
5153         nlmsg_free(msg);
5154         return -EMSGSIZE;
5155 }
5156
5157 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5158 {
5159         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5160         struct nlattr *nl_reg_rule;
5161         char *alpha2 = NULL;
5162         int rem_reg_rules = 0, r = 0;
5163         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5164         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5165         struct ieee80211_regdomain *rd = NULL;
5166
5167         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5168                 return -EINVAL;
5169
5170         if (!info->attrs[NL80211_ATTR_REG_RULES])
5171                 return -EINVAL;
5172
5173         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5174
5175         if (info->attrs[NL80211_ATTR_DFS_REGION])
5176                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5177
5178         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5179                             rem_reg_rules) {
5180                 num_rules++;
5181                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5182                         return -EINVAL;
5183         }
5184
5185         if (!reg_is_valid_request(alpha2))
5186                 return -EINVAL;
5187
5188         size_of_regd = sizeof(struct ieee80211_regdomain) +
5189                        num_rules * sizeof(struct ieee80211_reg_rule);
5190
5191         rd = kzalloc(size_of_regd, GFP_KERNEL);
5192         if (!rd)
5193                 return -ENOMEM;
5194
5195         rd->n_reg_rules = num_rules;
5196         rd->alpha2[0] = alpha2[0];
5197         rd->alpha2[1] = alpha2[1];
5198
5199         /*
5200          * Disable DFS master mode if the DFS region was
5201          * not supported or known on this kernel.
5202          */
5203         if (reg_supported_dfs_region(dfs_region))
5204                 rd->dfs_region = dfs_region;
5205
5206         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5207                             rem_reg_rules) {
5208                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5209                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5210                           reg_rule_policy);
5211                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5212                 if (r)
5213                         goto bad_reg;
5214
5215                 rule_idx++;
5216
5217                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5218                         r = -EINVAL;
5219                         goto bad_reg;
5220                 }
5221         }
5222
5223         r = set_regdom(rd);
5224         /* set_regdom took ownership */
5225         rd = NULL;
5226
5227  bad_reg:
5228         kfree(rd);
5229         return r;
5230 }
5231
5232 static int validate_scan_freqs(struct nlattr *freqs)
5233 {
5234         struct nlattr *attr1, *attr2;
5235         int n_channels = 0, tmp1, tmp2;
5236
5237         nla_for_each_nested(attr1, freqs, tmp1) {
5238                 n_channels++;
5239                 /*
5240                  * Some hardware has a limited channel list for
5241                  * scanning, and it is pretty much nonsensical
5242                  * to scan for a channel twice, so disallow that
5243                  * and don't require drivers to check that the
5244                  * channel list they get isn't longer than what
5245                  * they can scan, as long as they can scan all
5246                  * the channels they registered at once.
5247                  */
5248                 nla_for_each_nested(attr2, freqs, tmp2)
5249                         if (attr1 != attr2 &&
5250                             nla_get_u32(attr1) == nla_get_u32(attr2))
5251                                 return 0;
5252         }
5253
5254         return n_channels;
5255 }
5256
5257 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5258 {
5259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5260         struct wireless_dev *wdev = info->user_ptr[1];
5261         struct cfg80211_scan_request *request;
5262         struct nlattr *attr;
5263         struct wiphy *wiphy;
5264         int err, tmp, n_ssids = 0, n_channels, i;
5265         size_t ie_len;
5266
5267         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5268                 return -EINVAL;
5269
5270         wiphy = &rdev->wiphy;
5271
5272         if (!rdev->ops->scan)
5273                 return -EOPNOTSUPP;
5274
5275         if (rdev->scan_req) {
5276                 err = -EBUSY;
5277                 goto unlock;
5278         }
5279
5280         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5281                 n_channels = validate_scan_freqs(
5282                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5283                 if (!n_channels) {
5284                         err = -EINVAL;
5285                         goto unlock;
5286                 }
5287         } else {
5288                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5289         }
5290
5291         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5292                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5293                         n_ssids++;
5294
5295         if (n_ssids > wiphy->max_scan_ssids) {
5296                 err = -EINVAL;
5297                 goto unlock;
5298         }
5299
5300         if (info->attrs[NL80211_ATTR_IE])
5301                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5302         else
5303                 ie_len = 0;
5304
5305         if (ie_len > wiphy->max_scan_ie_len) {
5306                 err = -EINVAL;
5307                 goto unlock;
5308         }
5309
5310         request = kzalloc(sizeof(*request)
5311                         + sizeof(*request->ssids) * n_ssids
5312                         + sizeof(*request->channels) * n_channels
5313                         + ie_len, GFP_KERNEL);
5314         if (!request) {
5315                 err = -ENOMEM;
5316                 goto unlock;
5317         }
5318
5319         if (n_ssids)
5320                 request->ssids = (void *)&request->channels[n_channels];
5321         request->n_ssids = n_ssids;
5322         if (ie_len) {
5323                 if (request->ssids)
5324                         request->ie = (void *)(request->ssids + n_ssids);
5325                 else
5326                         request->ie = (void *)(request->channels + n_channels);
5327         }
5328
5329         i = 0;
5330         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5331                 /* user specified, bail out if channel not found */
5332                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5333                         struct ieee80211_channel *chan;
5334
5335                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5336
5337                         if (!chan) {
5338                                 err = -EINVAL;
5339                                 goto out_free;
5340                         }
5341
5342                         /* ignore disabled channels */
5343                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5344                                 continue;
5345
5346                         request->channels[i] = chan;
5347                         i++;
5348                 }
5349         } else {
5350                 enum ieee80211_band band;
5351
5352                 /* all channels */
5353                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5354                         int j;
5355                         if (!wiphy->bands[band])
5356                                 continue;
5357                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5358                                 struct ieee80211_channel *chan;
5359
5360                                 chan = &wiphy->bands[band]->channels[j];
5361
5362                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5363                                         continue;
5364
5365                                 request->channels[i] = chan;
5366                                 i++;
5367                         }
5368                 }
5369         }
5370
5371         if (!i) {
5372                 err = -EINVAL;
5373                 goto out_free;
5374         }
5375
5376         request->n_channels = i;
5377
5378         i = 0;
5379         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5380                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5381                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5382                                 err = -EINVAL;
5383                                 goto out_free;
5384                         }
5385                         request->ssids[i].ssid_len = nla_len(attr);
5386                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5387                         i++;
5388                 }
5389         }
5390
5391         if (info->attrs[NL80211_ATTR_IE]) {
5392                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5393                 memcpy((void *)request->ie,
5394                        nla_data(info->attrs[NL80211_ATTR_IE]),
5395                        request->ie_len);
5396         }
5397
5398         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5399                 if (wiphy->bands[i])
5400                         request->rates[i] =
5401                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5402
5403         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5404                 nla_for_each_nested(attr,
5405                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5406                                     tmp) {
5407                         enum ieee80211_band band = nla_type(attr);
5408
5409                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5410                                 err = -EINVAL;
5411                                 goto out_free;
5412                         }
5413
5414                         if (!wiphy->bands[band])
5415                                 continue;
5416
5417                         err = ieee80211_get_ratemask(wiphy->bands[band],
5418                                                      nla_data(attr),
5419                                                      nla_len(attr),
5420                                                      &request->rates[band]);
5421                         if (err)
5422                                 goto out_free;
5423                 }
5424         }
5425
5426         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5427                 request->flags = nla_get_u32(
5428                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5429                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5430                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5431                         err = -EOPNOTSUPP;
5432                         goto out_free;
5433                 }
5434         }
5435
5436         request->no_cck =
5437                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5438
5439         request->wdev = wdev;
5440         request->wiphy = &rdev->wiphy;
5441         request->scan_start = jiffies;
5442
5443         rdev->scan_req = request;
5444         err = rdev_scan(rdev, request);
5445
5446         if (!err) {
5447                 nl80211_send_scan_start(rdev, wdev);
5448                 if (wdev->netdev)
5449                         dev_hold(wdev->netdev);
5450         } else {
5451  out_free:
5452                 rdev->scan_req = NULL;
5453                 kfree(request);
5454         }
5455
5456  unlock:
5457         return err;
5458 }
5459
5460 static int nl80211_start_sched_scan(struct sk_buff *skb,
5461                                     struct genl_info *info)
5462 {
5463         struct cfg80211_sched_scan_request *request;
5464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5465         struct net_device *dev = info->user_ptr[1];
5466         struct nlattr *attr;
5467         struct wiphy *wiphy;
5468         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5469         u32 interval;
5470         enum ieee80211_band band;
5471         size_t ie_len;
5472         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5473
5474         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5475             !rdev->ops->sched_scan_start)
5476                 return -EOPNOTSUPP;
5477
5478         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5479                 return -EINVAL;
5480
5481         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5482                 return -EINVAL;
5483
5484         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5485         if (interval == 0)
5486                 return -EINVAL;
5487
5488         wiphy = &rdev->wiphy;
5489
5490         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5491                 n_channels = validate_scan_freqs(
5492                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5493                 if (!n_channels)
5494                         return -EINVAL;
5495         } else {
5496                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5497         }
5498
5499         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5500                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5501                                     tmp)
5502                         n_ssids++;
5503
5504         if (n_ssids > wiphy->max_sched_scan_ssids)
5505                 return -EINVAL;
5506
5507         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5508                 nla_for_each_nested(attr,
5509                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5510                                     tmp)
5511                         n_match_sets++;
5512
5513         if (n_match_sets > wiphy->max_match_sets)
5514                 return -EINVAL;
5515
5516         if (info->attrs[NL80211_ATTR_IE])
5517                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5518         else
5519                 ie_len = 0;
5520
5521         if (ie_len > wiphy->max_sched_scan_ie_len)
5522                 return -EINVAL;
5523
5524         if (rdev->sched_scan_req) {
5525                 err = -EINPROGRESS;
5526                 goto out;
5527         }
5528
5529         request = kzalloc(sizeof(*request)
5530                         + sizeof(*request->ssids) * n_ssids
5531                         + sizeof(*request->match_sets) * n_match_sets
5532                         + sizeof(*request->channels) * n_channels
5533                         + ie_len, GFP_KERNEL);
5534         if (!request) {
5535                 err = -ENOMEM;
5536                 goto out;
5537         }
5538
5539         if (n_ssids)
5540                 request->ssids = (void *)&request->channels[n_channels];
5541         request->n_ssids = n_ssids;
5542         if (ie_len) {
5543                 if (request->ssids)
5544                         request->ie = (void *)(request->ssids + n_ssids);
5545                 else
5546                         request->ie = (void *)(request->channels + n_channels);
5547         }
5548
5549         if (n_match_sets) {
5550                 if (request->ie)
5551                         request->match_sets = (void *)(request->ie + ie_len);
5552                 else if (request->ssids)
5553                         request->match_sets =
5554                                 (void *)(request->ssids + n_ssids);
5555                 else
5556                         request->match_sets =
5557                                 (void *)(request->channels + n_channels);
5558         }
5559         request->n_match_sets = n_match_sets;
5560
5561         i = 0;
5562         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5563                 /* user specified, bail out if channel not found */
5564                 nla_for_each_nested(attr,
5565                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5566                                     tmp) {
5567                         struct ieee80211_channel *chan;
5568
5569                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5570
5571                         if (!chan) {
5572                                 err = -EINVAL;
5573                                 goto out_free;
5574                         }
5575
5576                         /* ignore disabled channels */
5577                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5578                                 continue;
5579
5580                         request->channels[i] = chan;
5581                         i++;
5582                 }
5583         } else {
5584                 /* all channels */
5585                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5586                         int j;
5587                         if (!wiphy->bands[band])
5588                                 continue;
5589                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5590                                 struct ieee80211_channel *chan;
5591
5592                                 chan = &wiphy->bands[band]->channels[j];
5593
5594                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5595                                         continue;
5596
5597                                 request->channels[i] = chan;
5598                                 i++;
5599                         }
5600                 }
5601         }
5602
5603         if (!i) {
5604                 err = -EINVAL;
5605                 goto out_free;
5606         }
5607
5608         request->n_channels = i;
5609
5610         i = 0;
5611         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5612                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5613                                     tmp) {
5614                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5615                                 err = -EINVAL;
5616                                 goto out_free;
5617                         }
5618                         request->ssids[i].ssid_len = nla_len(attr);
5619                         memcpy(request->ssids[i].ssid, nla_data(attr),
5620                                nla_len(attr));
5621                         i++;
5622                 }
5623         }
5624
5625         i = 0;
5626         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5627                 nla_for_each_nested(attr,
5628                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5629                                     tmp) {
5630                         struct nlattr *ssid, *rssi;
5631
5632                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5633                                   nla_data(attr), nla_len(attr),
5634                                   nl80211_match_policy);
5635                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5636                         if (ssid) {
5637                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5638                                         err = -EINVAL;
5639                                         goto out_free;
5640                                 }
5641                                 memcpy(request->match_sets[i].ssid.ssid,
5642                                        nla_data(ssid), nla_len(ssid));
5643                                 request->match_sets[i].ssid.ssid_len =
5644                                         nla_len(ssid);
5645                         }
5646                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5647                         if (rssi)
5648                                 request->rssi_thold = nla_get_u32(rssi);
5649                         else
5650                                 request->rssi_thold =
5651                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5652                         i++;
5653                 }
5654         }
5655
5656         if (info->attrs[NL80211_ATTR_IE]) {
5657                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5658                 memcpy((void *)request->ie,
5659                        nla_data(info->attrs[NL80211_ATTR_IE]),
5660                        request->ie_len);
5661         }
5662
5663         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5664                 request->flags = nla_get_u32(
5665                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5666                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5667                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5668                         err = -EOPNOTSUPP;
5669                         goto out_free;
5670                 }
5671         }
5672
5673         request->dev = dev;
5674         request->wiphy = &rdev->wiphy;
5675         request->interval = interval;
5676         request->scan_start = jiffies;
5677
5678         err = rdev_sched_scan_start(rdev, dev, request);
5679         if (!err) {
5680                 rdev->sched_scan_req = request;
5681                 nl80211_send_sched_scan(rdev, dev,
5682                                         NL80211_CMD_START_SCHED_SCAN);
5683                 goto out;
5684         }
5685
5686 out_free:
5687         kfree(request);
5688 out:
5689         return err;
5690 }
5691
5692 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5693                                    struct genl_info *info)
5694 {
5695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5696
5697         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5698             !rdev->ops->sched_scan_stop)
5699                 return -EOPNOTSUPP;
5700
5701         return __cfg80211_stop_sched_scan(rdev, false);
5702 }
5703
5704 static int nl80211_start_radar_detection(struct sk_buff *skb,
5705                                          struct genl_info *info)
5706 {
5707         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5708         struct net_device *dev = info->user_ptr[1];
5709         struct wireless_dev *wdev = dev->ieee80211_ptr;
5710         struct cfg80211_chan_def chandef;
5711         enum nl80211_dfs_regions dfs_region;
5712         int err;
5713
5714         dfs_region = reg_get_dfs_region(wdev->wiphy);
5715         if (dfs_region == NL80211_DFS_UNSET)
5716                 return -EINVAL;
5717
5718         err = nl80211_parse_chandef(rdev, info, &chandef);
5719         if (err)
5720                 return err;
5721
5722         if (netif_carrier_ok(dev))
5723                 return -EBUSY;
5724
5725         if (wdev->cac_started)
5726                 return -EBUSY;
5727
5728         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5729         if (err < 0)
5730                 return err;
5731
5732         if (err == 0)
5733                 return -EINVAL;
5734
5735         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5736                 return -EINVAL;
5737
5738         if (!rdev->ops->start_radar_detection)
5739                 return -EOPNOTSUPP;
5740
5741         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5742                                            chandef.chan, CHAN_MODE_SHARED,
5743                                            BIT(chandef.width));
5744         if (err)
5745                 return err;
5746
5747         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5748         if (!err) {
5749                 wdev->channel = chandef.chan;
5750                 wdev->cac_started = true;
5751                 wdev->cac_start_time = jiffies;
5752         }
5753         return err;
5754 }
5755
5756 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5757 {
5758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5759         struct net_device *dev = info->user_ptr[1];
5760         struct wireless_dev *wdev = dev->ieee80211_ptr;
5761         struct cfg80211_csa_settings params;
5762         /* csa_attrs is defined static to avoid waste of stack size - this
5763          * function is called under RTNL lock, so this should not be a problem.
5764          */
5765         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5766         u8 radar_detect_width = 0;
5767         int err;
5768         bool need_new_beacon = false;
5769
5770         if (!rdev->ops->channel_switch ||
5771             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5772                 return -EOPNOTSUPP;
5773
5774         switch (dev->ieee80211_ptr->iftype) {
5775         case NL80211_IFTYPE_AP:
5776         case NL80211_IFTYPE_P2P_GO:
5777                 need_new_beacon = true;
5778
5779                 /* useless if AP is not running */
5780                 if (!wdev->beacon_interval)
5781                         return -EINVAL;
5782                 break;
5783         case NL80211_IFTYPE_ADHOC:
5784         case NL80211_IFTYPE_MESH_POINT:
5785                 break;
5786         default:
5787                 return -EOPNOTSUPP;
5788         }
5789
5790         memset(&params, 0, sizeof(params));
5791
5792         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5793             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5794                 return -EINVAL;
5795
5796         /* only important for AP, IBSS and mesh create IEs internally */
5797         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5798                 return -EINVAL;
5799
5800         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5801
5802         if (!need_new_beacon)
5803                 goto skip_beacons;
5804
5805         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5806         if (err)
5807                 return err;
5808
5809         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5810                                info->attrs[NL80211_ATTR_CSA_IES],
5811                                nl80211_policy);
5812         if (err)
5813                 return err;
5814
5815         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5816         if (err)
5817                 return err;
5818
5819         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5820                 return -EINVAL;
5821
5822         params.counter_offset_beacon =
5823                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5824         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5825                 return -EINVAL;
5826
5827         /* sanity check - counters should be the same */
5828         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5829             params.count)
5830                 return -EINVAL;
5831
5832         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5833                 params.counter_offset_presp =
5834                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5835                 if (params.counter_offset_presp >=
5836                     params.beacon_csa.probe_resp_len)
5837                         return -EINVAL;
5838
5839                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5840                     params.count)
5841                         return -EINVAL;
5842         }
5843
5844 skip_beacons:
5845         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5846         if (err)
5847                 return err;
5848
5849         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
5850                 return -EINVAL;
5851
5852         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5853             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
5854             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5855                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
5856                                                     &params.chandef);
5857                 if (err < 0) {
5858                         return err;
5859                 } else if (err) {
5860                         radar_detect_width = BIT(params.chandef.width);
5861                         params.radar_required = true;
5862                 }
5863         }
5864
5865         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5866                                            params.chandef.chan,
5867                                            CHAN_MODE_SHARED,
5868                                            radar_detect_width);
5869         if (err)
5870                 return err;
5871
5872         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5873                 params.block_tx = true;
5874
5875         wdev_lock(wdev);
5876         err = rdev_channel_switch(rdev, dev, &params);
5877         wdev_unlock(wdev);
5878
5879         return err;
5880 }
5881
5882 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5883                             u32 seq, int flags,
5884                             struct cfg80211_registered_device *rdev,
5885                             struct wireless_dev *wdev,
5886                             struct cfg80211_internal_bss *intbss)
5887 {
5888         struct cfg80211_bss *res = &intbss->pub;
5889         const struct cfg80211_bss_ies *ies;
5890         void *hdr;
5891         struct nlattr *bss;
5892         bool tsf = false;
5893
5894         ASSERT_WDEV_LOCK(wdev);
5895
5896         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5897                              NL80211_CMD_NEW_SCAN_RESULTS);
5898         if (!hdr)
5899                 return -1;
5900
5901         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5902
5903         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5904                 goto nla_put_failure;
5905         if (wdev->netdev &&
5906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5907                 goto nla_put_failure;
5908         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5909                 goto nla_put_failure;
5910
5911         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5912         if (!bss)
5913                 goto nla_put_failure;
5914         if ((!is_zero_ether_addr(res->bssid) &&
5915              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5916                 goto nla_put_failure;
5917
5918         rcu_read_lock();
5919         ies = rcu_dereference(res->ies);
5920         if (ies) {
5921                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5922                         goto fail_unlock_rcu;
5923                 tsf = true;
5924                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5925                                         ies->len, ies->data))
5926                         goto fail_unlock_rcu;
5927         }
5928         ies = rcu_dereference(res->beacon_ies);
5929         if (ies) {
5930                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5931                         goto fail_unlock_rcu;
5932                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5933                                         ies->len, ies->data))
5934                         goto fail_unlock_rcu;
5935         }
5936         rcu_read_unlock();
5937
5938         if (res->beacon_interval &&
5939             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5940                 goto nla_put_failure;
5941         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5942             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5943             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5944             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5945                         jiffies_to_msecs(jiffies - intbss->ts)))
5946                 goto nla_put_failure;
5947
5948         switch (rdev->wiphy.signal_type) {
5949         case CFG80211_SIGNAL_TYPE_MBM:
5950                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5951                         goto nla_put_failure;
5952                 break;
5953         case CFG80211_SIGNAL_TYPE_UNSPEC:
5954                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5955                         goto nla_put_failure;
5956                 break;
5957         default:
5958                 break;
5959         }
5960
5961         switch (wdev->iftype) {
5962         case NL80211_IFTYPE_P2P_CLIENT:
5963         case NL80211_IFTYPE_STATION:
5964                 if (intbss == wdev->current_bss &&
5965                     nla_put_u32(msg, NL80211_BSS_STATUS,
5966                                 NL80211_BSS_STATUS_ASSOCIATED))
5967                         goto nla_put_failure;
5968                 break;
5969         case NL80211_IFTYPE_ADHOC:
5970                 if (intbss == wdev->current_bss &&
5971                     nla_put_u32(msg, NL80211_BSS_STATUS,
5972                                 NL80211_BSS_STATUS_IBSS_JOINED))
5973                         goto nla_put_failure;
5974                 break;
5975         default:
5976                 break;
5977         }
5978
5979         nla_nest_end(msg, bss);
5980
5981         return genlmsg_end(msg, hdr);
5982
5983  fail_unlock_rcu:
5984         rcu_read_unlock();
5985  nla_put_failure:
5986         genlmsg_cancel(msg, hdr);
5987         return -EMSGSIZE;
5988 }
5989
5990 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5991 {
5992         struct cfg80211_registered_device *rdev;
5993         struct cfg80211_internal_bss *scan;
5994         struct wireless_dev *wdev;
5995         int start = cb->args[2], idx = 0;
5996         int err;
5997
5998         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5999         if (err)
6000                 return err;
6001
6002         wdev_lock(wdev);
6003         spin_lock_bh(&rdev->bss_lock);
6004         cfg80211_bss_expire(rdev);
6005
6006         cb->seq = rdev->bss_generation;
6007
6008         list_for_each_entry(scan, &rdev->bss_list, list) {
6009                 if (++idx <= start)
6010                         continue;
6011                 if (nl80211_send_bss(skb, cb,
6012                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6013                                 rdev, wdev, scan) < 0) {
6014                         idx--;
6015                         break;
6016                 }
6017         }
6018
6019         spin_unlock_bh(&rdev->bss_lock);
6020         wdev_unlock(wdev);
6021
6022         cb->args[2] = idx;
6023         nl80211_finish_wdev_dump(rdev);
6024
6025         return skb->len;
6026 }
6027
6028 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6029                                 int flags, struct net_device *dev,
6030                                 struct survey_info *survey)
6031 {
6032         void *hdr;
6033         struct nlattr *infoattr;
6034
6035         hdr = nl80211hdr_put(msg, portid, seq, flags,
6036                              NL80211_CMD_NEW_SURVEY_RESULTS);
6037         if (!hdr)
6038                 return -ENOMEM;
6039
6040         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6041                 goto nla_put_failure;
6042
6043         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6044         if (!infoattr)
6045                 goto nla_put_failure;
6046
6047         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6048                         survey->channel->center_freq))
6049                 goto nla_put_failure;
6050
6051         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6052             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6053                 goto nla_put_failure;
6054         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6055             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6056                 goto nla_put_failure;
6057         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6058             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6059                         survey->channel_time))
6060                 goto nla_put_failure;
6061         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6062             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6063                         survey->channel_time_busy))
6064                 goto nla_put_failure;
6065         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6066             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6067                         survey->channel_time_ext_busy))
6068                 goto nla_put_failure;
6069         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6070             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6071                         survey->channel_time_rx))
6072                 goto nla_put_failure;
6073         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6074             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6075                         survey->channel_time_tx))
6076                 goto nla_put_failure;
6077
6078         nla_nest_end(msg, infoattr);
6079
6080         return genlmsg_end(msg, hdr);
6081
6082  nla_put_failure:
6083         genlmsg_cancel(msg, hdr);
6084         return -EMSGSIZE;
6085 }
6086
6087 static int nl80211_dump_survey(struct sk_buff *skb,
6088                         struct netlink_callback *cb)
6089 {
6090         struct survey_info survey;
6091         struct cfg80211_registered_device *dev;
6092         struct wireless_dev *wdev;
6093         int survey_idx = cb->args[2];
6094         int res;
6095
6096         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6097         if (res)
6098                 return res;
6099
6100         if (!wdev->netdev) {
6101                 res = -EINVAL;
6102                 goto out_err;
6103         }
6104
6105         if (!dev->ops->dump_survey) {
6106                 res = -EOPNOTSUPP;
6107                 goto out_err;
6108         }
6109
6110         while (1) {
6111                 struct ieee80211_channel *chan;
6112
6113                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6114                 if (res == -ENOENT)
6115                         break;
6116                 if (res)
6117                         goto out_err;
6118
6119                 /* Survey without a channel doesn't make sense */
6120                 if (!survey.channel) {
6121                         res = -EINVAL;
6122                         goto out;
6123                 }
6124
6125                 chan = ieee80211_get_channel(&dev->wiphy,
6126                                              survey.channel->center_freq);
6127                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6128                         survey_idx++;
6129                         continue;
6130                 }
6131
6132                 if (nl80211_send_survey(skb,
6133                                 NETLINK_CB(cb->skb).portid,
6134                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6135                                 wdev->netdev, &survey) < 0)
6136                         goto out;
6137                 survey_idx++;
6138         }
6139
6140  out:
6141         cb->args[2] = survey_idx;
6142         res = skb->len;
6143  out_err:
6144         nl80211_finish_wdev_dump(dev);
6145         return res;
6146 }
6147
6148 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6149 {
6150         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6151                                   NL80211_WPA_VERSION_2));
6152 }
6153
6154 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6155 {
6156         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6157         struct net_device *dev = info->user_ptr[1];
6158         struct ieee80211_channel *chan;
6159         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6160         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6161         enum nl80211_auth_type auth_type;
6162         struct key_parse key;
6163         bool local_state_change;
6164
6165         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6166                 return -EINVAL;
6167
6168         if (!info->attrs[NL80211_ATTR_MAC])
6169                 return -EINVAL;
6170
6171         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6172                 return -EINVAL;
6173
6174         if (!info->attrs[NL80211_ATTR_SSID])
6175                 return -EINVAL;
6176
6177         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6178                 return -EINVAL;
6179
6180         err = nl80211_parse_key(info, &key);
6181         if (err)
6182                 return err;
6183
6184         if (key.idx >= 0) {
6185                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6186                         return -EINVAL;
6187                 if (!key.p.key || !key.p.key_len)
6188                         return -EINVAL;
6189                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6190                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6191                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6192                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6193                         return -EINVAL;
6194                 if (key.idx > 4)
6195                         return -EINVAL;
6196         } else {
6197                 key.p.key_len = 0;
6198                 key.p.key = NULL;
6199         }
6200
6201         if (key.idx >= 0) {
6202                 int i;
6203                 bool ok = false;
6204                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6205                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6206                                 ok = true;
6207                                 break;
6208                         }
6209                 }
6210                 if (!ok)
6211                         return -EINVAL;
6212         }
6213
6214         if (!rdev->ops->auth)
6215                 return -EOPNOTSUPP;
6216
6217         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6218             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6219                 return -EOPNOTSUPP;
6220
6221         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6222         chan = ieee80211_get_channel(&rdev->wiphy,
6223                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6224         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6225                 return -EINVAL;
6226
6227         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6228         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6229
6230         if (info->attrs[NL80211_ATTR_IE]) {
6231                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6232                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6233         }
6234
6235         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6236         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6237                 return -EINVAL;
6238
6239         if (auth_type == NL80211_AUTHTYPE_SAE &&
6240             !info->attrs[NL80211_ATTR_SAE_DATA])
6241                 return -EINVAL;
6242
6243         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6244                 if (auth_type != NL80211_AUTHTYPE_SAE)
6245                         return -EINVAL;
6246                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6247                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6248                 /* need to include at least Auth Transaction and Status Code */
6249                 if (sae_data_len < 4)
6250                         return -EINVAL;
6251         }
6252
6253         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6254
6255         /*
6256          * Since we no longer track auth state, ignore
6257          * requests to only change local state.
6258          */
6259         if (local_state_change)
6260                 return 0;
6261
6262         wdev_lock(dev->ieee80211_ptr);
6263         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6264                                  ssid, ssid_len, ie, ie_len,
6265                                  key.p.key, key.p.key_len, key.idx,
6266                                  sae_data, sae_data_len);
6267         wdev_unlock(dev->ieee80211_ptr);
6268         return err;
6269 }
6270
6271 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6272                                    struct genl_info *info,
6273                                    struct cfg80211_crypto_settings *settings,
6274                                    int cipher_limit)
6275 {
6276         memset(settings, 0, sizeof(*settings));
6277
6278         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6279
6280         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6281                 u16 proto;
6282                 proto = nla_get_u16(
6283                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6284                 settings->control_port_ethertype = cpu_to_be16(proto);
6285                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6286                     proto != ETH_P_PAE)
6287                         return -EINVAL;
6288                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6289                         settings->control_port_no_encrypt = true;
6290         } else
6291                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6292
6293         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6294                 void *data;
6295                 int len, i;
6296
6297                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6298                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6299                 settings->n_ciphers_pairwise = len / sizeof(u32);
6300
6301                 if (len % sizeof(u32))
6302                         return -EINVAL;
6303
6304                 if (settings->n_ciphers_pairwise > cipher_limit)
6305                         return -EINVAL;
6306
6307                 memcpy(settings->ciphers_pairwise, data, len);
6308
6309                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6310                         if (!cfg80211_supported_cipher_suite(
6311                                         &rdev->wiphy,
6312                                         settings->ciphers_pairwise[i]))
6313                                 return -EINVAL;
6314         }
6315
6316         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6317                 settings->cipher_group =
6318                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6319                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6320                                                      settings->cipher_group))
6321                         return -EINVAL;
6322         }
6323
6324         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6325                 settings->wpa_versions =
6326                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6327                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6328                         return -EINVAL;
6329         }
6330
6331         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6332                 void *data;
6333                 int len;
6334
6335                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6336                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6337                 settings->n_akm_suites = len / sizeof(u32);
6338
6339                 if (len % sizeof(u32))
6340                         return -EINVAL;
6341
6342                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6343                         return -EINVAL;
6344
6345                 memcpy(settings->akm_suites, data, len);
6346         }
6347
6348         return 0;
6349 }
6350
6351 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6352 {
6353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6354         struct net_device *dev = info->user_ptr[1];
6355         struct ieee80211_channel *chan;
6356         struct cfg80211_assoc_request req = {};
6357         const u8 *bssid, *ssid;
6358         int err, ssid_len = 0;
6359
6360         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6361                 return -EINVAL;
6362
6363         if (!info->attrs[NL80211_ATTR_MAC] ||
6364             !info->attrs[NL80211_ATTR_SSID] ||
6365             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6366                 return -EINVAL;
6367
6368         if (!rdev->ops->assoc)
6369                 return -EOPNOTSUPP;
6370
6371         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6372             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6373                 return -EOPNOTSUPP;
6374
6375         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6376
6377         chan = ieee80211_get_channel(&rdev->wiphy,
6378                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6379         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6380                 return -EINVAL;
6381
6382         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6383         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6384
6385         if (info->attrs[NL80211_ATTR_IE]) {
6386                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6387                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6388         }
6389
6390         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6391                 enum nl80211_mfp mfp =
6392                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6393                 if (mfp == NL80211_MFP_REQUIRED)
6394                         req.use_mfp = true;
6395                 else if (mfp != NL80211_MFP_NO)
6396                         return -EINVAL;
6397         }
6398
6399         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6400                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6401
6402         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6403                 req.flags |= ASSOC_REQ_DISABLE_HT;
6404
6405         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6406                 memcpy(&req.ht_capa_mask,
6407                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6408                        sizeof(req.ht_capa_mask));
6409
6410         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6411                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6412                         return -EINVAL;
6413                 memcpy(&req.ht_capa,
6414                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6415                        sizeof(req.ht_capa));
6416         }
6417
6418         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6419                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6420
6421         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6422                 memcpy(&req.vht_capa_mask,
6423                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6424                        sizeof(req.vht_capa_mask));
6425
6426         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6427                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6428                         return -EINVAL;
6429                 memcpy(&req.vht_capa,
6430                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6431                        sizeof(req.vht_capa));
6432         }
6433
6434         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6435         if (!err) {
6436                 wdev_lock(dev->ieee80211_ptr);
6437                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6438                                           ssid, ssid_len, &req);
6439                 wdev_unlock(dev->ieee80211_ptr);
6440         }
6441
6442         return err;
6443 }
6444
6445 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6446 {
6447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6448         struct net_device *dev = info->user_ptr[1];
6449         const u8 *ie = NULL, *bssid;
6450         int ie_len = 0, err;
6451         u16 reason_code;
6452         bool local_state_change;
6453
6454         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6455                 return -EINVAL;
6456
6457         if (!info->attrs[NL80211_ATTR_MAC])
6458                 return -EINVAL;
6459
6460         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6461                 return -EINVAL;
6462
6463         if (!rdev->ops->deauth)
6464                 return -EOPNOTSUPP;
6465
6466         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6467             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6468                 return -EOPNOTSUPP;
6469
6470         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6471
6472         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6473         if (reason_code == 0) {
6474                 /* Reason Code 0 is reserved */
6475                 return -EINVAL;
6476         }
6477
6478         if (info->attrs[NL80211_ATTR_IE]) {
6479                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6480                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6481         }
6482
6483         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6484
6485         wdev_lock(dev->ieee80211_ptr);
6486         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6487                                    local_state_change);
6488         wdev_unlock(dev->ieee80211_ptr);
6489         return err;
6490 }
6491
6492 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6493 {
6494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6495         struct net_device *dev = info->user_ptr[1];
6496         const u8 *ie = NULL, *bssid;
6497         int ie_len = 0, err;
6498         u16 reason_code;
6499         bool local_state_change;
6500
6501         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6502                 return -EINVAL;
6503
6504         if (!info->attrs[NL80211_ATTR_MAC])
6505                 return -EINVAL;
6506
6507         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6508                 return -EINVAL;
6509
6510         if (!rdev->ops->disassoc)
6511                 return -EOPNOTSUPP;
6512
6513         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6514             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6515                 return -EOPNOTSUPP;
6516
6517         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6518
6519         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6520         if (reason_code == 0) {
6521                 /* Reason Code 0 is reserved */
6522                 return -EINVAL;
6523         }
6524
6525         if (info->attrs[NL80211_ATTR_IE]) {
6526                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6527                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6528         }
6529
6530         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6531
6532         wdev_lock(dev->ieee80211_ptr);
6533         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6534                                      local_state_change);
6535         wdev_unlock(dev->ieee80211_ptr);
6536         return err;
6537 }
6538
6539 static bool
6540 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6541                          int mcast_rate[IEEE80211_NUM_BANDS],
6542                          int rateval)
6543 {
6544         struct wiphy *wiphy = &rdev->wiphy;
6545         bool found = false;
6546         int band, i;
6547
6548         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6549                 struct ieee80211_supported_band *sband;
6550
6551                 sband = wiphy->bands[band];
6552                 if (!sband)
6553                         continue;
6554
6555                 for (i = 0; i < sband->n_bitrates; i++) {
6556                         if (sband->bitrates[i].bitrate == rateval) {
6557                                 mcast_rate[band] = i + 1;
6558                                 found = true;
6559                                 break;
6560                         }
6561                 }
6562         }
6563
6564         return found;
6565 }
6566
6567 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6568 {
6569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6570         struct net_device *dev = info->user_ptr[1];
6571         struct cfg80211_ibss_params ibss;
6572         struct wiphy *wiphy;
6573         struct cfg80211_cached_keys *connkeys = NULL;
6574         int err;
6575
6576         memset(&ibss, 0, sizeof(ibss));
6577
6578         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6579                 return -EINVAL;
6580
6581         if (!info->attrs[NL80211_ATTR_SSID] ||
6582             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6583                 return -EINVAL;
6584
6585         ibss.beacon_interval = 100;
6586
6587         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6588                 ibss.beacon_interval =
6589                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6590                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6591                         return -EINVAL;
6592         }
6593
6594         if (!rdev->ops->join_ibss)
6595                 return -EOPNOTSUPP;
6596
6597         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6598                 return -EOPNOTSUPP;
6599
6600         wiphy = &rdev->wiphy;
6601
6602         if (info->attrs[NL80211_ATTR_MAC]) {
6603                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6604
6605                 if (!is_valid_ether_addr(ibss.bssid))
6606                         return -EINVAL;
6607         }
6608         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6609         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6610
6611         if (info->attrs[NL80211_ATTR_IE]) {
6612                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6613                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6614         }
6615
6616         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6617         if (err)
6618                 return err;
6619
6620         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6621                 return -EINVAL;
6622
6623         switch (ibss.chandef.width) {
6624         case NL80211_CHAN_WIDTH_5:
6625         case NL80211_CHAN_WIDTH_10:
6626         case NL80211_CHAN_WIDTH_20_NOHT:
6627                 break;
6628         case NL80211_CHAN_WIDTH_20:
6629         case NL80211_CHAN_WIDTH_40:
6630                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6631                         break;
6632         default:
6633                 return -EINVAL;
6634         }
6635
6636         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6637         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6638
6639         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6640                 u8 *rates =
6641                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6642                 int n_rates =
6643                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6644                 struct ieee80211_supported_band *sband =
6645                         wiphy->bands[ibss.chandef.chan->band];
6646
6647                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6648                                              &ibss.basic_rates);
6649                 if (err)
6650                         return err;
6651         }
6652
6653         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6654                 memcpy(&ibss.ht_capa_mask,
6655                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6656                        sizeof(ibss.ht_capa_mask));
6657
6658         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6659                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6660                         return -EINVAL;
6661                 memcpy(&ibss.ht_capa,
6662                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6663                        sizeof(ibss.ht_capa));
6664         }
6665
6666         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6667             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6668                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6669                 return -EINVAL;
6670
6671         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6672                 bool no_ht = false;
6673
6674                 connkeys = nl80211_parse_connkeys(rdev,
6675                                           info->attrs[NL80211_ATTR_KEYS],
6676                                           &no_ht);
6677                 if (IS_ERR(connkeys))
6678                         return PTR_ERR(connkeys);
6679
6680                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6681                     no_ht) {
6682                         kfree(connkeys);
6683                         return -EINVAL;
6684                 }
6685         }
6686
6687         ibss.control_port =
6688                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6689
6690         ibss.userspace_handles_dfs =
6691                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6692
6693         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6694         if (err)
6695                 kfree(connkeys);
6696         return err;
6697 }
6698
6699 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6700 {
6701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6702         struct net_device *dev = info->user_ptr[1];
6703
6704         if (!rdev->ops->leave_ibss)
6705                 return -EOPNOTSUPP;
6706
6707         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6708                 return -EOPNOTSUPP;
6709
6710         return cfg80211_leave_ibss(rdev, dev, false);
6711 }
6712
6713 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6714 {
6715         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6716         struct net_device *dev = info->user_ptr[1];
6717         int mcast_rate[IEEE80211_NUM_BANDS];
6718         u32 nla_rate;
6719         int err;
6720
6721         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6722             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6723                 return -EOPNOTSUPP;
6724
6725         if (!rdev->ops->set_mcast_rate)
6726                 return -EOPNOTSUPP;
6727
6728         memset(mcast_rate, 0, sizeof(mcast_rate));
6729
6730         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6731                 return -EINVAL;
6732
6733         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6734         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6735                 return -EINVAL;
6736
6737         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6738
6739         return err;
6740 }
6741
6742 static struct sk_buff *
6743 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6744                             int approxlen, u32 portid, u32 seq,
6745                             enum nl80211_commands cmd,
6746                             enum nl80211_attrs attr,
6747                             const struct nl80211_vendor_cmd_info *info,
6748                             gfp_t gfp)
6749 {
6750         struct sk_buff *skb;
6751         void *hdr;
6752         struct nlattr *data;
6753
6754         skb = nlmsg_new(approxlen + 100, gfp);
6755         if (!skb)
6756                 return NULL;
6757
6758         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6759         if (!hdr) {
6760                 kfree_skb(skb);
6761                 return NULL;
6762         }
6763
6764         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6765                 goto nla_put_failure;
6766
6767         if (info) {
6768                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6769                                 info->vendor_id))
6770                         goto nla_put_failure;
6771                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6772                                 info->subcmd))
6773                         goto nla_put_failure;
6774         }
6775
6776         data = nla_nest_start(skb, attr);
6777
6778         ((void **)skb->cb)[0] = rdev;
6779         ((void **)skb->cb)[1] = hdr;
6780         ((void **)skb->cb)[2] = data;
6781
6782         return skb;
6783
6784  nla_put_failure:
6785         kfree_skb(skb);
6786         return NULL;
6787 }
6788
6789 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6790                                            enum nl80211_commands cmd,
6791                                            enum nl80211_attrs attr,
6792                                            int vendor_event_idx,
6793                                            int approxlen, gfp_t gfp)
6794 {
6795         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6796         const struct nl80211_vendor_cmd_info *info;
6797
6798         switch (cmd) {
6799         case NL80211_CMD_TESTMODE:
6800                 if (WARN_ON(vendor_event_idx != -1))
6801                         return NULL;
6802                 info = NULL;
6803                 break;
6804         case NL80211_CMD_VENDOR:
6805                 if (WARN_ON(vendor_event_idx < 0 ||
6806                             vendor_event_idx >= wiphy->n_vendor_events))
6807                         return NULL;
6808                 info = &wiphy->vendor_events[vendor_event_idx];
6809                 break;
6810         default:
6811                 WARN_ON(1);
6812                 return NULL;
6813         }
6814
6815         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6816                                            cmd, attr, info, gfp);
6817 }
6818 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6819
6820 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6821 {
6822         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6823         void *hdr = ((void **)skb->cb)[1];
6824         struct nlattr *data = ((void **)skb->cb)[2];
6825         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6826
6827         nla_nest_end(skb, data);
6828         genlmsg_end(skb, hdr);
6829
6830         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6831                 mcgrp = NL80211_MCGRP_VENDOR;
6832
6833         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6834                                 mcgrp, gfp);
6835 }
6836 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6837
6838 #ifdef CONFIG_NL80211_TESTMODE
6839 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6840 {
6841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6842         struct wireless_dev *wdev =
6843                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6844         int err;
6845
6846         if (!rdev->ops->testmode_cmd)
6847                 return -EOPNOTSUPP;
6848
6849         if (IS_ERR(wdev)) {
6850                 err = PTR_ERR(wdev);
6851                 if (err != -EINVAL)
6852                         return err;
6853                 wdev = NULL;
6854         } else if (wdev->wiphy != &rdev->wiphy) {
6855                 return -EINVAL;
6856         }
6857
6858         if (!info->attrs[NL80211_ATTR_TESTDATA])
6859                 return -EINVAL;
6860
6861         rdev->cur_cmd_info = info;
6862         err = rdev_testmode_cmd(rdev, wdev,
6863                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6864                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6865         rdev->cur_cmd_info = NULL;
6866
6867         return err;
6868 }
6869
6870 static int nl80211_testmode_dump(struct sk_buff *skb,
6871                                  struct netlink_callback *cb)
6872 {
6873         struct cfg80211_registered_device *rdev;
6874         int err;
6875         long phy_idx;
6876         void *data = NULL;
6877         int data_len = 0;
6878
6879         rtnl_lock();
6880
6881         if (cb->args[0]) {
6882                 /*
6883                  * 0 is a valid index, but not valid for args[0],
6884                  * so we need to offset by 1.
6885                  */
6886                 phy_idx = cb->args[0] - 1;
6887         } else {
6888                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6889                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6890                                   nl80211_policy);
6891                 if (err)
6892                         goto out_err;
6893
6894                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6895                                                   nl80211_fam.attrbuf);
6896                 if (IS_ERR(rdev)) {
6897                         err = PTR_ERR(rdev);
6898                         goto out_err;
6899                 }
6900                 phy_idx = rdev->wiphy_idx;
6901                 rdev = NULL;
6902
6903                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6904                         cb->args[1] =
6905                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6906         }
6907
6908         if (cb->args[1]) {
6909                 data = nla_data((void *)cb->args[1]);
6910                 data_len = nla_len((void *)cb->args[1]);
6911         }
6912
6913         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6914         if (!rdev) {
6915                 err = -ENOENT;
6916                 goto out_err;
6917         }
6918
6919         if (!rdev->ops->testmode_dump) {
6920                 err = -EOPNOTSUPP;
6921                 goto out_err;
6922         }
6923
6924         while (1) {
6925                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6926                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6927                                            NL80211_CMD_TESTMODE);
6928                 struct nlattr *tmdata;
6929
6930                 if (!hdr)
6931                         break;
6932
6933                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6934                         genlmsg_cancel(skb, hdr);
6935                         break;
6936                 }
6937
6938                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6939                 if (!tmdata) {
6940                         genlmsg_cancel(skb, hdr);
6941                         break;
6942                 }
6943                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6944                 nla_nest_end(skb, tmdata);
6945
6946                 if (err == -ENOBUFS || err == -ENOENT) {
6947                         genlmsg_cancel(skb, hdr);
6948                         break;
6949                 } else if (err) {
6950                         genlmsg_cancel(skb, hdr);
6951                         goto out_err;
6952                 }
6953
6954                 genlmsg_end(skb, hdr);
6955         }
6956
6957         err = skb->len;
6958         /* see above */
6959         cb->args[0] = phy_idx + 1;
6960  out_err:
6961         rtnl_unlock();
6962         return err;
6963 }
6964 #endif
6965
6966 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6967 {
6968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6969         struct net_device *dev = info->user_ptr[1];
6970         struct cfg80211_connect_params connect;
6971         struct wiphy *wiphy;
6972         struct cfg80211_cached_keys *connkeys = NULL;
6973         int err;
6974
6975         memset(&connect, 0, sizeof(connect));
6976
6977         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6978                 return -EINVAL;
6979
6980         if (!info->attrs[NL80211_ATTR_SSID] ||
6981             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6982                 return -EINVAL;
6983
6984         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6985                 connect.auth_type =
6986                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6987                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6988                                              NL80211_CMD_CONNECT))
6989                         return -EINVAL;
6990         } else
6991                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6992
6993         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6994
6995         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6996                                       NL80211_MAX_NR_CIPHER_SUITES);
6997         if (err)
6998                 return err;
6999
7000         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7001             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7002                 return -EOPNOTSUPP;
7003
7004         wiphy = &rdev->wiphy;
7005
7006         connect.bg_scan_period = -1;
7007         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7008                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7009                 connect.bg_scan_period =
7010                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7011         }
7012
7013         if (info->attrs[NL80211_ATTR_MAC])
7014                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7015         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7016         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7017
7018         if (info->attrs[NL80211_ATTR_IE]) {
7019                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7020                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7021         }
7022
7023         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7024                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7025                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7026                     connect.mfp != NL80211_MFP_NO)
7027                         return -EINVAL;
7028         } else {
7029                 connect.mfp = NL80211_MFP_NO;
7030         }
7031
7032         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7033                 connect.channel =
7034                         ieee80211_get_channel(wiphy,
7035                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
7036                 if (!connect.channel ||
7037                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
7038                         return -EINVAL;
7039         }
7040
7041         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7042                 connkeys = nl80211_parse_connkeys(rdev,
7043                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7044                 if (IS_ERR(connkeys))
7045                         return PTR_ERR(connkeys);
7046         }
7047
7048         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7049                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7050
7051         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7052                 memcpy(&connect.ht_capa_mask,
7053                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7054                        sizeof(connect.ht_capa_mask));
7055
7056         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7057                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7058                         kfree(connkeys);
7059                         return -EINVAL;
7060                 }
7061                 memcpy(&connect.ht_capa,
7062                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7063                        sizeof(connect.ht_capa));
7064         }
7065
7066         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7067                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7068
7069         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7070                 memcpy(&connect.vht_capa_mask,
7071                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7072                        sizeof(connect.vht_capa_mask));
7073
7074         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7075                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7076                         kfree(connkeys);
7077                         return -EINVAL;
7078                 }
7079                 memcpy(&connect.vht_capa,
7080                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7081                        sizeof(connect.vht_capa));
7082         }
7083
7084         wdev_lock(dev->ieee80211_ptr);
7085         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7086         wdev_unlock(dev->ieee80211_ptr);
7087         if (err)
7088                 kfree(connkeys);
7089         return err;
7090 }
7091
7092 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7093 {
7094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7095         struct net_device *dev = info->user_ptr[1];
7096         u16 reason;
7097         int ret;
7098
7099         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7100                 reason = WLAN_REASON_DEAUTH_LEAVING;
7101         else
7102                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7103
7104         if (reason == 0)
7105                 return -EINVAL;
7106
7107         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7108             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7109                 return -EOPNOTSUPP;
7110
7111         wdev_lock(dev->ieee80211_ptr);
7112         ret = cfg80211_disconnect(rdev, dev, reason, true);
7113         wdev_unlock(dev->ieee80211_ptr);
7114         return ret;
7115 }
7116
7117 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7118 {
7119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7120         struct net *net;
7121         int err;
7122         u32 pid;
7123
7124         if (!info->attrs[NL80211_ATTR_PID])
7125                 return -EINVAL;
7126
7127         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7128
7129         net = get_net_ns_by_pid(pid);
7130         if (IS_ERR(net))
7131                 return PTR_ERR(net);
7132
7133         err = 0;
7134
7135         /* check if anything to do */
7136         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7137                 err = cfg80211_switch_netns(rdev, net);
7138
7139         put_net(net);
7140         return err;
7141 }
7142
7143 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7144 {
7145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7146         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7147                         struct cfg80211_pmksa *pmksa) = NULL;
7148         struct net_device *dev = info->user_ptr[1];
7149         struct cfg80211_pmksa pmksa;
7150
7151         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7152
7153         if (!info->attrs[NL80211_ATTR_MAC])
7154                 return -EINVAL;
7155
7156         if (!info->attrs[NL80211_ATTR_PMKID])
7157                 return -EINVAL;
7158
7159         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7160         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7161
7162         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7163             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7164                 return -EOPNOTSUPP;
7165
7166         switch (info->genlhdr->cmd) {
7167         case NL80211_CMD_SET_PMKSA:
7168                 rdev_ops = rdev->ops->set_pmksa;
7169                 break;
7170         case NL80211_CMD_DEL_PMKSA:
7171                 rdev_ops = rdev->ops->del_pmksa;
7172                 break;
7173         default:
7174                 WARN_ON(1);
7175                 break;
7176         }
7177
7178         if (!rdev_ops)
7179                 return -EOPNOTSUPP;
7180
7181         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7182 }
7183
7184 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7185 {
7186         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7187         struct net_device *dev = info->user_ptr[1];
7188
7189         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7190             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7191                 return -EOPNOTSUPP;
7192
7193         if (!rdev->ops->flush_pmksa)
7194                 return -EOPNOTSUPP;
7195
7196         return rdev_flush_pmksa(rdev, dev);
7197 }
7198
7199 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7200 {
7201         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7202         struct net_device *dev = info->user_ptr[1];
7203         u8 action_code, dialog_token;
7204         u16 status_code;
7205         u8 *peer;
7206
7207         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7208             !rdev->ops->tdls_mgmt)
7209                 return -EOPNOTSUPP;
7210
7211         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7212             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7213             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7214             !info->attrs[NL80211_ATTR_IE] ||
7215             !info->attrs[NL80211_ATTR_MAC])
7216                 return -EINVAL;
7217
7218         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7219         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7220         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7221         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7222
7223         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7224                               dialog_token, status_code,
7225                               nla_data(info->attrs[NL80211_ATTR_IE]),
7226                               nla_len(info->attrs[NL80211_ATTR_IE]));
7227 }
7228
7229 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7230 {
7231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7232         struct net_device *dev = info->user_ptr[1];
7233         enum nl80211_tdls_operation operation;
7234         u8 *peer;
7235
7236         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7237             !rdev->ops->tdls_oper)
7238                 return -EOPNOTSUPP;
7239
7240         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7241             !info->attrs[NL80211_ATTR_MAC])
7242                 return -EINVAL;
7243
7244         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7245         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7246
7247         return rdev_tdls_oper(rdev, dev, peer, operation);
7248 }
7249
7250 static int nl80211_remain_on_channel(struct sk_buff *skb,
7251                                      struct genl_info *info)
7252 {
7253         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7254         struct wireless_dev *wdev = info->user_ptr[1];
7255         struct cfg80211_chan_def chandef;
7256         struct sk_buff *msg;
7257         void *hdr;
7258         u64 cookie;
7259         u32 duration;
7260         int err;
7261
7262         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7263             !info->attrs[NL80211_ATTR_DURATION])
7264                 return -EINVAL;
7265
7266         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7267
7268         if (!rdev->ops->remain_on_channel ||
7269             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7270                 return -EOPNOTSUPP;
7271
7272         /*
7273          * We should be on that channel for at least a minimum amount of
7274          * time (10ms) but no longer than the driver supports.
7275          */
7276         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7277             duration > rdev->wiphy.max_remain_on_channel_duration)
7278                 return -EINVAL;
7279
7280         err = nl80211_parse_chandef(rdev, info, &chandef);
7281         if (err)
7282                 return err;
7283
7284         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7285         if (!msg)
7286                 return -ENOMEM;
7287
7288         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7289                              NL80211_CMD_REMAIN_ON_CHANNEL);
7290         if (!hdr) {
7291                 err = -ENOBUFS;
7292                 goto free_msg;
7293         }
7294
7295         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7296                                      duration, &cookie);
7297
7298         if (err)
7299                 goto free_msg;
7300
7301         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7302                 goto nla_put_failure;
7303
7304         genlmsg_end(msg, hdr);
7305
7306         return genlmsg_reply(msg, info);
7307
7308  nla_put_failure:
7309         err = -ENOBUFS;
7310  free_msg:
7311         nlmsg_free(msg);
7312         return err;
7313 }
7314
7315 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7316                                             struct genl_info *info)
7317 {
7318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7319         struct wireless_dev *wdev = info->user_ptr[1];
7320         u64 cookie;
7321
7322         if (!info->attrs[NL80211_ATTR_COOKIE])
7323                 return -EINVAL;
7324
7325         if (!rdev->ops->cancel_remain_on_channel)
7326                 return -EOPNOTSUPP;
7327
7328         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7329
7330         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7331 }
7332
7333 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7334                            u8 *rates, u8 rates_len)
7335 {
7336         u8 i;
7337         u32 mask = 0;
7338
7339         for (i = 0; i < rates_len; i++) {
7340                 int rate = (rates[i] & 0x7f) * 5;
7341                 int ridx;
7342                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7343                         struct ieee80211_rate *srate =
7344                                 &sband->bitrates[ridx];
7345                         if (rate == srate->bitrate) {
7346                                 mask |= 1 << ridx;
7347                                 break;
7348                         }
7349                 }
7350                 if (ridx == sband->n_bitrates)
7351                         return 0; /* rate not found */
7352         }
7353
7354         return mask;
7355 }
7356
7357 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7358                                u8 *rates, u8 rates_len,
7359                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7360 {
7361         u8 i;
7362
7363         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7364
7365         for (i = 0; i < rates_len; i++) {
7366                 int ridx, rbit;
7367
7368                 ridx = rates[i] / 8;
7369                 rbit = BIT(rates[i] % 8);
7370
7371                 /* check validity */
7372                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7373                         return false;
7374
7375                 /* check availability */
7376                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7377                         mcs[ridx] |= rbit;
7378                 else
7379                         return false;
7380         }
7381
7382         return true;
7383 }
7384
7385 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7386 {
7387         u16 mcs_mask = 0;
7388
7389         switch (vht_mcs_map) {
7390         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7391                 break;
7392         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7393                 mcs_mask = 0x00FF;
7394                 break;
7395         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7396                 mcs_mask = 0x01FF;
7397                 break;
7398         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7399                 mcs_mask = 0x03FF;
7400                 break;
7401         default:
7402                 break;
7403         }
7404
7405         return mcs_mask;
7406 }
7407
7408 static void vht_build_mcs_mask(u16 vht_mcs_map,
7409                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7410 {
7411         u8 nss;
7412
7413         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7414                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7415                 vht_mcs_map >>= 2;
7416         }
7417 }
7418
7419 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7420                              struct nl80211_txrate_vht *txrate,
7421                              u16 mcs[NL80211_VHT_NSS_MAX])
7422 {
7423         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7424         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7425         u8 i;
7426
7427         if (!sband->vht_cap.vht_supported)
7428                 return false;
7429
7430         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7431
7432         /* Build vht_mcs_mask from VHT capabilities */
7433         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7434
7435         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7436                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7437                         mcs[i] = txrate->mcs[i];
7438                 else
7439                         return false;
7440         }
7441
7442         return true;
7443 }
7444
7445 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7446         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7447                                     .len = NL80211_MAX_SUPP_RATES },
7448         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7449                                 .len = NL80211_MAX_SUPP_HT_RATES },
7450         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7451 };
7452
7453 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7454                                        struct genl_info *info)
7455 {
7456         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7458         struct cfg80211_bitrate_mask mask;
7459         int rem, i;
7460         struct net_device *dev = info->user_ptr[1];
7461         struct nlattr *tx_rates;
7462         struct ieee80211_supported_band *sband;
7463         u16 vht_tx_mcs_map;
7464
7465         if (!rdev->ops->set_bitrate_mask)
7466                 return -EOPNOTSUPP;
7467
7468         memset(&mask, 0, sizeof(mask));
7469         /* Default to all rates enabled */
7470         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7471                 sband = rdev->wiphy.bands[i];
7472
7473                 if (!sband)
7474                         continue;
7475
7476                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7477                 memcpy(mask.control[i].ht_mcs,
7478                        sband->ht_cap.mcs.rx_mask,
7479                        sizeof(mask.control[i].ht_mcs));
7480
7481                 if (!sband->vht_cap.vht_supported)
7482                         continue;
7483
7484                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7485                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7486         }
7487
7488         /* if no rates are given set it back to the defaults */
7489         if (!info->attrs[NL80211_ATTR_TX_RATES])
7490                 goto out;
7491
7492         /*
7493          * The nested attribute uses enum nl80211_band as the index. This maps
7494          * directly to the enum ieee80211_band values used in cfg80211.
7495          */
7496         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7497         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7498         {
7499                 enum ieee80211_band band = nla_type(tx_rates);
7500                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7501                         return -EINVAL;
7502                 sband = rdev->wiphy.bands[band];
7503                 if (sband == NULL)
7504                         return -EINVAL;
7505                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7506                           nla_len(tx_rates), nl80211_txattr_policy);
7507                 if (tb[NL80211_TXRATE_LEGACY]) {
7508                         mask.control[band].legacy = rateset_to_mask(
7509                                 sband,
7510                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7511                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7512                         if ((mask.control[band].legacy == 0) &&
7513                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7514                                 return -EINVAL;
7515                 }
7516                 if (tb[NL80211_TXRATE_HT]) {
7517                         if (!ht_rateset_to_mask(
7518                                         sband,
7519                                         nla_data(tb[NL80211_TXRATE_HT]),
7520                                         nla_len(tb[NL80211_TXRATE_HT]),
7521                                         mask.control[band].ht_mcs))
7522                                 return -EINVAL;
7523                 }
7524                 if (tb[NL80211_TXRATE_VHT]) {
7525                         if (!vht_set_mcs_mask(
7526                                         sband,
7527                                         nla_data(tb[NL80211_TXRATE_VHT]),
7528                                         mask.control[band].vht_mcs))
7529                                 return -EINVAL;
7530                 }
7531
7532                 if (mask.control[band].legacy == 0) {
7533                         /* don't allow empty legacy rates if HT or VHT
7534                          * are not even supported.
7535                          */
7536                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7537                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7538                                 return -EINVAL;
7539
7540                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7541                                 if (mask.control[band].ht_mcs[i])
7542                                         goto out;
7543
7544                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7545                                 if (mask.control[band].vht_mcs[i])
7546                                         goto out;
7547
7548                         /* legacy and mcs rates may not be both empty */
7549                         return -EINVAL;
7550                 }
7551         }
7552
7553 out:
7554         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7555 }
7556
7557 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7558 {
7559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7560         struct wireless_dev *wdev = info->user_ptr[1];
7561         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7562
7563         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7564                 return -EINVAL;
7565
7566         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7567                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7568
7569         switch (wdev->iftype) {
7570         case NL80211_IFTYPE_STATION:
7571         case NL80211_IFTYPE_ADHOC:
7572         case NL80211_IFTYPE_P2P_CLIENT:
7573         case NL80211_IFTYPE_AP:
7574         case NL80211_IFTYPE_AP_VLAN:
7575         case NL80211_IFTYPE_MESH_POINT:
7576         case NL80211_IFTYPE_P2P_GO:
7577         case NL80211_IFTYPE_P2P_DEVICE:
7578                 break;
7579         default:
7580                 return -EOPNOTSUPP;
7581         }
7582
7583         /* not much point in registering if we can't reply */
7584         if (!rdev->ops->mgmt_tx)
7585                 return -EOPNOTSUPP;
7586
7587         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7588                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7589                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7590 }
7591
7592 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7593 {
7594         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7595         struct wireless_dev *wdev = info->user_ptr[1];
7596         struct cfg80211_chan_def chandef;
7597         int err;
7598         void *hdr = NULL;
7599         u64 cookie;
7600         struct sk_buff *msg = NULL;
7601         struct cfg80211_mgmt_tx_params params = {
7602                 .dont_wait_for_ack =
7603                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7604         };
7605
7606         if (!info->attrs[NL80211_ATTR_FRAME])
7607                 return -EINVAL;
7608
7609         if (!rdev->ops->mgmt_tx)
7610                 return -EOPNOTSUPP;
7611
7612         switch (wdev->iftype) {
7613         case NL80211_IFTYPE_P2P_DEVICE:
7614                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7615                         return -EINVAL;
7616         case NL80211_IFTYPE_STATION:
7617         case NL80211_IFTYPE_ADHOC:
7618         case NL80211_IFTYPE_P2P_CLIENT:
7619         case NL80211_IFTYPE_AP:
7620         case NL80211_IFTYPE_AP_VLAN:
7621         case NL80211_IFTYPE_MESH_POINT:
7622         case NL80211_IFTYPE_P2P_GO:
7623                 break;
7624         default:
7625                 return -EOPNOTSUPP;
7626         }
7627
7628         if (info->attrs[NL80211_ATTR_DURATION]) {
7629                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7630                         return -EINVAL;
7631                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7632
7633                 /*
7634                  * We should wait on the channel for at least a minimum amount
7635                  * of time (10ms) but no longer than the driver supports.
7636                  */
7637                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7638                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7639                         return -EINVAL;
7640
7641         }
7642
7643         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7644
7645         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7646                 return -EINVAL;
7647
7648         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7649
7650         /* get the channel if any has been specified, otherwise pass NULL to
7651          * the driver. The latter will use the current one
7652          */
7653         chandef.chan = NULL;
7654         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7655                 err = nl80211_parse_chandef(rdev, info, &chandef);
7656                 if (err)
7657                         return err;
7658         }
7659
7660         if (!chandef.chan && params.offchan)
7661                 return -EINVAL;
7662
7663         if (!params.dont_wait_for_ack) {
7664                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7665                 if (!msg)
7666                         return -ENOMEM;
7667
7668                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7669                                      NL80211_CMD_FRAME);
7670                 if (!hdr) {
7671                         err = -ENOBUFS;
7672                         goto free_msg;
7673                 }
7674         }
7675
7676         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7677         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7678         params.chan = chandef.chan;
7679         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7680         if (err)
7681                 goto free_msg;
7682
7683         if (msg) {
7684                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7685                         goto nla_put_failure;
7686
7687                 genlmsg_end(msg, hdr);
7688                 return genlmsg_reply(msg, info);
7689         }
7690
7691         return 0;
7692
7693  nla_put_failure:
7694         err = -ENOBUFS;
7695  free_msg:
7696         nlmsg_free(msg);
7697         return err;
7698 }
7699
7700 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7701 {
7702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7703         struct wireless_dev *wdev = info->user_ptr[1];
7704         u64 cookie;
7705
7706         if (!info->attrs[NL80211_ATTR_COOKIE])
7707                 return -EINVAL;
7708
7709         if (!rdev->ops->mgmt_tx_cancel_wait)
7710                 return -EOPNOTSUPP;
7711
7712         switch (wdev->iftype) {
7713         case NL80211_IFTYPE_STATION:
7714         case NL80211_IFTYPE_ADHOC:
7715         case NL80211_IFTYPE_P2P_CLIENT:
7716         case NL80211_IFTYPE_AP:
7717         case NL80211_IFTYPE_AP_VLAN:
7718         case NL80211_IFTYPE_P2P_GO:
7719         case NL80211_IFTYPE_P2P_DEVICE:
7720                 break;
7721         default:
7722                 return -EOPNOTSUPP;
7723         }
7724
7725         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7726
7727         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7728 }
7729
7730 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7731 {
7732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7733         struct wireless_dev *wdev;
7734         struct net_device *dev = info->user_ptr[1];
7735         u8 ps_state;
7736         bool state;
7737         int err;
7738
7739         if (!info->attrs[NL80211_ATTR_PS_STATE])
7740                 return -EINVAL;
7741
7742         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7743
7744         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7745                 return -EINVAL;
7746
7747         wdev = dev->ieee80211_ptr;
7748
7749         if (!rdev->ops->set_power_mgmt)
7750                 return -EOPNOTSUPP;
7751
7752         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7753
7754         if (state == wdev->ps)
7755                 return 0;
7756
7757         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7758         if (!err)
7759                 wdev->ps = state;
7760         return err;
7761 }
7762
7763 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7764 {
7765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7766         enum nl80211_ps_state ps_state;
7767         struct wireless_dev *wdev;
7768         struct net_device *dev = info->user_ptr[1];
7769         struct sk_buff *msg;
7770         void *hdr;
7771         int err;
7772
7773         wdev = dev->ieee80211_ptr;
7774
7775         if (!rdev->ops->set_power_mgmt)
7776                 return -EOPNOTSUPP;
7777
7778         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7779         if (!msg)
7780                 return -ENOMEM;
7781
7782         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7783                              NL80211_CMD_GET_POWER_SAVE);
7784         if (!hdr) {
7785                 err = -ENOBUFS;
7786                 goto free_msg;
7787         }
7788
7789         if (wdev->ps)
7790                 ps_state = NL80211_PS_ENABLED;
7791         else
7792                 ps_state = NL80211_PS_DISABLED;
7793
7794         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7795                 goto nla_put_failure;
7796
7797         genlmsg_end(msg, hdr);
7798         return genlmsg_reply(msg, info);
7799
7800  nla_put_failure:
7801         err = -ENOBUFS;
7802  free_msg:
7803         nlmsg_free(msg);
7804         return err;
7805 }
7806
7807 static struct nla_policy
7808 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7809         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7810         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7811         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7812         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7813         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7814         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7815 };
7816
7817 static int nl80211_set_cqm_txe(struct genl_info *info,
7818                                u32 rate, u32 pkts, u32 intvl)
7819 {
7820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7821         struct net_device *dev = info->user_ptr[1];
7822         struct wireless_dev *wdev = dev->ieee80211_ptr;
7823
7824         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7825                 return -EINVAL;
7826
7827         if (!rdev->ops->set_cqm_txe_config)
7828                 return -EOPNOTSUPP;
7829
7830         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7831             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7832                 return -EOPNOTSUPP;
7833
7834         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7835 }
7836
7837 static int nl80211_set_cqm_rssi(struct genl_info *info,
7838                                 s32 threshold, u32 hysteresis)
7839 {
7840         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7841         struct net_device *dev = info->user_ptr[1];
7842         struct wireless_dev *wdev = dev->ieee80211_ptr;
7843
7844         if (threshold > 0)
7845                 return -EINVAL;
7846
7847         /* disabling - hysteresis should also be zero then */
7848         if (threshold == 0)
7849                 hysteresis = 0;
7850
7851         if (!rdev->ops->set_cqm_rssi_config)
7852                 return -EOPNOTSUPP;
7853
7854         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7855             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7856                 return -EOPNOTSUPP;
7857
7858         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7859 }
7860
7861 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7862 {
7863         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7864         struct nlattr *cqm;
7865         int err;
7866
7867         cqm = info->attrs[NL80211_ATTR_CQM];
7868         if (!cqm)
7869                 return -EINVAL;
7870
7871         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7872                                nl80211_attr_cqm_policy);
7873         if (err)
7874                 return err;
7875
7876         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7877             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7878                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7879                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7880
7881                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7882         }
7883
7884         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7885             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7886             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7887                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7888                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7889                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7890
7891                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7892         }
7893
7894         return -EINVAL;
7895 }
7896
7897 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7898 {
7899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7900         struct net_device *dev = info->user_ptr[1];
7901         struct mesh_config cfg;
7902         struct mesh_setup setup;
7903         int err;
7904
7905         /* start with default */
7906         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7907         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7908
7909         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7910                 /* and parse parameters if given */
7911                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7912                 if (err)
7913                         return err;
7914         }
7915
7916         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7917             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7918                 return -EINVAL;
7919
7920         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7921         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7922
7923         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7924             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7925                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7926                         return -EINVAL;
7927
7928         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7929                 setup.beacon_interval =
7930                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7931                 if (setup.beacon_interval < 10 ||
7932                     setup.beacon_interval > 10000)
7933                         return -EINVAL;
7934         }
7935
7936         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7937                 setup.dtim_period =
7938                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7939                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7940                         return -EINVAL;
7941         }
7942
7943         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7944                 /* parse additional setup parameters if given */
7945                 err = nl80211_parse_mesh_setup(info, &setup);
7946                 if (err)
7947                         return err;
7948         }
7949
7950         if (setup.user_mpm)
7951                 cfg.auto_open_plinks = false;
7952
7953         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7954                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7955                 if (err)
7956                         return err;
7957         } else {
7958                 /* cfg80211_join_mesh() will sort it out */
7959                 setup.chandef.chan = NULL;
7960         }
7961
7962         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7963                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7964                 int n_rates =
7965                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7966                 struct ieee80211_supported_band *sband;
7967
7968                 if (!setup.chandef.chan)
7969                         return -EINVAL;
7970
7971                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7972
7973                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7974                                              &setup.basic_rates);
7975                 if (err)
7976                         return err;
7977         }
7978
7979         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7980 }
7981
7982 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7983 {
7984         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7985         struct net_device *dev = info->user_ptr[1];
7986
7987         return cfg80211_leave_mesh(rdev, dev);
7988 }
7989
7990 #ifdef CONFIG_PM
7991 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7992                                         struct cfg80211_registered_device *rdev)
7993 {
7994         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7995         struct nlattr *nl_pats, *nl_pat;
7996         int i, pat_len;
7997
7998         if (!wowlan->n_patterns)
7999                 return 0;
8000
8001         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8002         if (!nl_pats)
8003                 return -ENOBUFS;
8004
8005         for (i = 0; i < wowlan->n_patterns; i++) {
8006                 nl_pat = nla_nest_start(msg, i + 1);
8007                 if (!nl_pat)
8008                         return -ENOBUFS;
8009                 pat_len = wowlan->patterns[i].pattern_len;
8010                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8011                             wowlan->patterns[i].mask) ||
8012                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8013                             wowlan->patterns[i].pattern) ||
8014                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8015                                 wowlan->patterns[i].pkt_offset))
8016                         return -ENOBUFS;
8017                 nla_nest_end(msg, nl_pat);
8018         }
8019         nla_nest_end(msg, nl_pats);
8020
8021         return 0;
8022 }
8023
8024 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8025                                    struct cfg80211_wowlan_tcp *tcp)
8026 {
8027         struct nlattr *nl_tcp;
8028
8029         if (!tcp)
8030                 return 0;
8031
8032         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8033         if (!nl_tcp)
8034                 return -ENOBUFS;
8035
8036         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8037             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8038             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8039             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8040             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8041             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8042                     tcp->payload_len, tcp->payload) ||
8043             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8044                         tcp->data_interval) ||
8045             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8046                     tcp->wake_len, tcp->wake_data) ||
8047             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8048                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8049                 return -ENOBUFS;
8050
8051         if (tcp->payload_seq.len &&
8052             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8053                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8054                 return -ENOBUFS;
8055
8056         if (tcp->payload_tok.len &&
8057             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8058                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8059                     &tcp->payload_tok))
8060                 return -ENOBUFS;
8061
8062         nla_nest_end(msg, nl_tcp);
8063
8064         return 0;
8065 }
8066
8067 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8068 {
8069         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8070         struct sk_buff *msg;
8071         void *hdr;
8072         u32 size = NLMSG_DEFAULT_SIZE;
8073
8074         if (!rdev->wiphy.wowlan)
8075                 return -EOPNOTSUPP;
8076
8077         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8078                 /* adjust size to have room for all the data */
8079                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8080                         rdev->wiphy.wowlan_config->tcp->payload_len +
8081                         rdev->wiphy.wowlan_config->tcp->wake_len +
8082                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8083         }
8084
8085         msg = nlmsg_new(size, GFP_KERNEL);
8086         if (!msg)
8087                 return -ENOMEM;
8088
8089         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8090                              NL80211_CMD_GET_WOWLAN);
8091         if (!hdr)
8092                 goto nla_put_failure;
8093
8094         if (rdev->wiphy.wowlan_config) {
8095                 struct nlattr *nl_wowlan;
8096
8097                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8098                 if (!nl_wowlan)
8099                         goto nla_put_failure;
8100
8101                 if ((rdev->wiphy.wowlan_config->any &&
8102                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8103                     (rdev->wiphy.wowlan_config->disconnect &&
8104                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8105                     (rdev->wiphy.wowlan_config->magic_pkt &&
8106                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8107                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8108                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8109                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8110                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8111                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8112                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8113                     (rdev->wiphy.wowlan_config->rfkill_release &&
8114                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8115                         goto nla_put_failure;
8116
8117                 if (nl80211_send_wowlan_patterns(msg, rdev))
8118                         goto nla_put_failure;
8119
8120                 if (nl80211_send_wowlan_tcp(msg,
8121                                             rdev->wiphy.wowlan_config->tcp))
8122                         goto nla_put_failure;
8123
8124                 nla_nest_end(msg, nl_wowlan);
8125         }
8126
8127         genlmsg_end(msg, hdr);
8128         return genlmsg_reply(msg, info);
8129
8130 nla_put_failure:
8131         nlmsg_free(msg);
8132         return -ENOBUFS;
8133 }
8134
8135 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8136                                     struct nlattr *attr,
8137                                     struct cfg80211_wowlan *trig)
8138 {
8139         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8140         struct cfg80211_wowlan_tcp *cfg;
8141         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8142         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8143         u32 size;
8144         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8145         int err, port;
8146
8147         if (!rdev->wiphy.wowlan->tcp)
8148                 return -EINVAL;
8149
8150         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8151                         nla_data(attr), nla_len(attr),
8152                         nl80211_wowlan_tcp_policy);
8153         if (err)
8154                 return err;
8155
8156         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8157             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8158             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8159             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8160             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8161             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8162             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8163             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8164                 return -EINVAL;
8165
8166         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8167         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8168                 return -EINVAL;
8169
8170         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8171                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8172             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8173                 return -EINVAL;
8174
8175         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8176         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8177                 return -EINVAL;
8178
8179         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8180         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8181                 return -EINVAL;
8182
8183         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8184                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8185
8186                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8187                 tokens_size = tokln - sizeof(*tok);
8188
8189                 if (!tok->len || tokens_size % tok->len)
8190                         return -EINVAL;
8191                 if (!rdev->wiphy.wowlan->tcp->tok)
8192                         return -EINVAL;
8193                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8194                         return -EINVAL;
8195                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8196                         return -EINVAL;
8197                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8198                         return -EINVAL;
8199                 if (tok->offset + tok->len > data_size)
8200                         return -EINVAL;
8201         }
8202
8203         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8204                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8205                 if (!rdev->wiphy.wowlan->tcp->seq)
8206                         return -EINVAL;
8207                 if (seq->len == 0 || seq->len > 4)
8208                         return -EINVAL;
8209                 if (seq->len + seq->offset > data_size)
8210                         return -EINVAL;
8211         }
8212
8213         size = sizeof(*cfg);
8214         size += data_size;
8215         size += wake_size + wake_mask_size;
8216         size += tokens_size;
8217
8218         cfg = kzalloc(size, GFP_KERNEL);
8219         if (!cfg)
8220                 return -ENOMEM;
8221         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8222         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8223         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8224                ETH_ALEN);
8225         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8226                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8227         else
8228                 port = 0;
8229 #ifdef CONFIG_INET
8230         /* allocate a socket and port for it and use it */
8231         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8232                             IPPROTO_TCP, &cfg->sock, 1);
8233         if (err) {
8234                 kfree(cfg);
8235                 return err;
8236         }
8237         if (inet_csk_get_port(cfg->sock->sk, port)) {
8238                 sock_release(cfg->sock);
8239                 kfree(cfg);
8240                 return -EADDRINUSE;
8241         }
8242         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8243 #else
8244         if (!port) {
8245                 kfree(cfg);
8246                 return -EINVAL;
8247         }
8248         cfg->src_port = port;
8249 #endif
8250
8251         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8252         cfg->payload_len = data_size;
8253         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8254         memcpy((void *)cfg->payload,
8255                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8256                data_size);
8257         if (seq)
8258                 cfg->payload_seq = *seq;
8259         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8260         cfg->wake_len = wake_size;
8261         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8262         memcpy((void *)cfg->wake_data,
8263                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8264                wake_size);
8265         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8266                          data_size + wake_size;
8267         memcpy((void *)cfg->wake_mask,
8268                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8269                wake_mask_size);
8270         if (tok) {
8271                 cfg->tokens_size = tokens_size;
8272                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8273         }
8274
8275         trig->tcp = cfg;
8276
8277         return 0;
8278 }
8279
8280 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8281 {
8282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8283         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8284         struct cfg80211_wowlan new_triggers = {};
8285         struct cfg80211_wowlan *ntrig;
8286         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8287         int err, i;
8288         bool prev_enabled = rdev->wiphy.wowlan_config;
8289
8290         if (!wowlan)
8291                 return -EOPNOTSUPP;
8292
8293         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8294                 cfg80211_rdev_free_wowlan(rdev);
8295                 rdev->wiphy.wowlan_config = NULL;
8296                 goto set_wakeup;
8297         }
8298
8299         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8300                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8301                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8302                         nl80211_wowlan_policy);
8303         if (err)
8304                 return err;
8305
8306         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8307                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8308                         return -EINVAL;
8309                 new_triggers.any = true;
8310         }
8311
8312         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8313                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8314                         return -EINVAL;
8315                 new_triggers.disconnect = true;
8316         }
8317
8318         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8319                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8320                         return -EINVAL;
8321                 new_triggers.magic_pkt = true;
8322         }
8323
8324         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8325                 return -EINVAL;
8326
8327         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8328                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8329                         return -EINVAL;
8330                 new_triggers.gtk_rekey_failure = true;
8331         }
8332
8333         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8334                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8335                         return -EINVAL;
8336                 new_triggers.eap_identity_req = true;
8337         }
8338
8339         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8340                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8341                         return -EINVAL;
8342                 new_triggers.four_way_handshake = true;
8343         }
8344
8345         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8346                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8347                         return -EINVAL;
8348                 new_triggers.rfkill_release = true;
8349         }
8350
8351         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8352                 struct nlattr *pat;
8353                 int n_patterns = 0;
8354                 int rem, pat_len, mask_len, pkt_offset;
8355                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8356
8357                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8358                                     rem)
8359                         n_patterns++;
8360                 if (n_patterns > wowlan->n_patterns)
8361                         return -EINVAL;
8362
8363                 new_triggers.patterns = kcalloc(n_patterns,
8364                                                 sizeof(new_triggers.patterns[0]),
8365                                                 GFP_KERNEL);
8366                 if (!new_triggers.patterns)
8367                         return -ENOMEM;
8368
8369                 new_triggers.n_patterns = n_patterns;
8370                 i = 0;
8371
8372                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8373                                     rem) {
8374                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8375                                   nla_len(pat), NULL);
8376                         err = -EINVAL;
8377                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8378                             !pat_tb[NL80211_PKTPAT_PATTERN])
8379                                 goto error;
8380                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8381                         mask_len = DIV_ROUND_UP(pat_len, 8);
8382                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8383                                 goto error;
8384                         if (pat_len > wowlan->pattern_max_len ||
8385                             pat_len < wowlan->pattern_min_len)
8386                                 goto error;
8387
8388                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8389                                 pkt_offset = 0;
8390                         else
8391                                 pkt_offset = nla_get_u32(
8392                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8393                         if (pkt_offset > wowlan->max_pkt_offset)
8394                                 goto error;
8395                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8396
8397                         new_triggers.patterns[i].mask =
8398                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8399                         if (!new_triggers.patterns[i].mask) {
8400                                 err = -ENOMEM;
8401                                 goto error;
8402                         }
8403                         new_triggers.patterns[i].pattern =
8404                                 new_triggers.patterns[i].mask + mask_len;
8405                         memcpy(new_triggers.patterns[i].mask,
8406                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8407                                mask_len);
8408                         new_triggers.patterns[i].pattern_len = pat_len;
8409                         memcpy(new_triggers.patterns[i].pattern,
8410                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8411                                pat_len);
8412                         i++;
8413                 }
8414         }
8415
8416         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8417                 err = nl80211_parse_wowlan_tcp(
8418                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8419                         &new_triggers);
8420                 if (err)
8421                         goto error;
8422         }
8423
8424         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8425         if (!ntrig) {
8426                 err = -ENOMEM;
8427                 goto error;
8428         }
8429         cfg80211_rdev_free_wowlan(rdev);
8430         rdev->wiphy.wowlan_config = ntrig;
8431
8432  set_wakeup:
8433         if (rdev->ops->set_wakeup &&
8434             prev_enabled != !!rdev->wiphy.wowlan_config)
8435                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8436
8437         return 0;
8438  error:
8439         for (i = 0; i < new_triggers.n_patterns; i++)
8440                 kfree(new_triggers.patterns[i].mask);
8441         kfree(new_triggers.patterns);
8442         if (new_triggers.tcp && new_triggers.tcp->sock)
8443                 sock_release(new_triggers.tcp->sock);
8444         kfree(new_triggers.tcp);
8445         return err;
8446 }
8447 #endif
8448
8449 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8450                                        struct cfg80211_registered_device *rdev)
8451 {
8452         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8453         int i, j, pat_len;
8454         struct cfg80211_coalesce_rules *rule;
8455
8456         if (!rdev->coalesce->n_rules)
8457                 return 0;
8458
8459         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8460         if (!nl_rules)
8461                 return -ENOBUFS;
8462
8463         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8464                 nl_rule = nla_nest_start(msg, i + 1);
8465                 if (!nl_rule)
8466                         return -ENOBUFS;
8467
8468                 rule = &rdev->coalesce->rules[i];
8469                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8470                                 rule->delay))
8471                         return -ENOBUFS;
8472
8473                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8474                                 rule->condition))
8475                         return -ENOBUFS;
8476
8477                 nl_pats = nla_nest_start(msg,
8478                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8479                 if (!nl_pats)
8480                         return -ENOBUFS;
8481
8482                 for (j = 0; j < rule->n_patterns; j++) {
8483                         nl_pat = nla_nest_start(msg, j + 1);
8484                         if (!nl_pat)
8485                                 return -ENOBUFS;
8486                         pat_len = rule->patterns[j].pattern_len;
8487                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8488                                     DIV_ROUND_UP(pat_len, 8),
8489                                     rule->patterns[j].mask) ||
8490                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8491                                     rule->patterns[j].pattern) ||
8492                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8493                                         rule->patterns[j].pkt_offset))
8494                                 return -ENOBUFS;
8495                         nla_nest_end(msg, nl_pat);
8496                 }
8497                 nla_nest_end(msg, nl_pats);
8498                 nla_nest_end(msg, nl_rule);
8499         }
8500         nla_nest_end(msg, nl_rules);
8501
8502         return 0;
8503 }
8504
8505 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8506 {
8507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8508         struct sk_buff *msg;
8509         void *hdr;
8510
8511         if (!rdev->wiphy.coalesce)
8512                 return -EOPNOTSUPP;
8513
8514         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8515         if (!msg)
8516                 return -ENOMEM;
8517
8518         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8519                              NL80211_CMD_GET_COALESCE);
8520         if (!hdr)
8521                 goto nla_put_failure;
8522
8523         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8524                 goto nla_put_failure;
8525
8526         genlmsg_end(msg, hdr);
8527         return genlmsg_reply(msg, info);
8528
8529 nla_put_failure:
8530         nlmsg_free(msg);
8531         return -ENOBUFS;
8532 }
8533
8534 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8535 {
8536         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8537         int i, j;
8538         struct cfg80211_coalesce_rules *rule;
8539
8540         if (!coalesce)
8541                 return;
8542
8543         for (i = 0; i < coalesce->n_rules; i++) {
8544                 rule = &coalesce->rules[i];
8545                 for (j = 0; j < rule->n_patterns; j++)
8546                         kfree(rule->patterns[j].mask);
8547                 kfree(rule->patterns);
8548         }
8549         kfree(coalesce->rules);
8550         kfree(coalesce);
8551         rdev->coalesce = NULL;
8552 }
8553
8554 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8555                                        struct nlattr *rule,
8556                                        struct cfg80211_coalesce_rules *new_rule)
8557 {
8558         int err, i;
8559         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8560         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8561         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8562         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8563
8564         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8565                         nla_len(rule), nl80211_coalesce_policy);
8566         if (err)
8567                 return err;
8568
8569         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8570                 new_rule->delay =
8571                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8572         if (new_rule->delay > coalesce->max_delay)
8573                 return -EINVAL;
8574
8575         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8576                 new_rule->condition =
8577                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8578         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8579             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8580                 return -EINVAL;
8581
8582         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8583                 return -EINVAL;
8584
8585         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8586                             rem)
8587                 n_patterns++;
8588         if (n_patterns > coalesce->n_patterns)
8589                 return -EINVAL;
8590
8591         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8592                                      GFP_KERNEL);
8593         if (!new_rule->patterns)
8594                 return -ENOMEM;
8595
8596         new_rule->n_patterns = n_patterns;
8597         i = 0;
8598
8599         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8600                             rem) {
8601                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8602                           nla_len(pat), NULL);
8603                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8604                     !pat_tb[NL80211_PKTPAT_PATTERN])
8605                         return -EINVAL;
8606                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8607                 mask_len = DIV_ROUND_UP(pat_len, 8);
8608                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8609                         return -EINVAL;
8610                 if (pat_len > coalesce->pattern_max_len ||
8611                     pat_len < coalesce->pattern_min_len)
8612                         return -EINVAL;
8613
8614                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8615                         pkt_offset = 0;
8616                 else
8617                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8618                 if (pkt_offset > coalesce->max_pkt_offset)
8619                         return -EINVAL;
8620                 new_rule->patterns[i].pkt_offset = pkt_offset;
8621
8622                 new_rule->patterns[i].mask =
8623                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8624                 if (!new_rule->patterns[i].mask)
8625                         return -ENOMEM;
8626                 new_rule->patterns[i].pattern =
8627                         new_rule->patterns[i].mask + mask_len;
8628                 memcpy(new_rule->patterns[i].mask,
8629                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8630                 new_rule->patterns[i].pattern_len = pat_len;
8631                 memcpy(new_rule->patterns[i].pattern,
8632                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8633                 i++;
8634         }
8635
8636         return 0;
8637 }
8638
8639 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8640 {
8641         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8642         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8643         struct cfg80211_coalesce new_coalesce = {};
8644         struct cfg80211_coalesce *n_coalesce;
8645         int err, rem_rule, n_rules = 0, i, j;
8646         struct nlattr *rule;
8647         struct cfg80211_coalesce_rules *tmp_rule;
8648
8649         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8650                 return -EOPNOTSUPP;
8651
8652         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8653                 cfg80211_rdev_free_coalesce(rdev);
8654                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8655                 return 0;
8656         }
8657
8658         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8659                             rem_rule)
8660                 n_rules++;
8661         if (n_rules > coalesce->n_rules)
8662                 return -EINVAL;
8663
8664         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8665                                      GFP_KERNEL);
8666         if (!new_coalesce.rules)
8667                 return -ENOMEM;
8668
8669         new_coalesce.n_rules = n_rules;
8670         i = 0;
8671
8672         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8673                             rem_rule) {
8674                 err = nl80211_parse_coalesce_rule(rdev, rule,
8675                                                   &new_coalesce.rules[i]);
8676                 if (err)
8677                         goto error;
8678
8679                 i++;
8680         }
8681
8682         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8683         if (err)
8684                 goto error;
8685
8686         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8687         if (!n_coalesce) {
8688                 err = -ENOMEM;
8689                 goto error;
8690         }
8691         cfg80211_rdev_free_coalesce(rdev);
8692         rdev->coalesce = n_coalesce;
8693
8694         return 0;
8695 error:
8696         for (i = 0; i < new_coalesce.n_rules; i++) {
8697                 tmp_rule = &new_coalesce.rules[i];
8698                 for (j = 0; j < tmp_rule->n_patterns; j++)
8699                         kfree(tmp_rule->patterns[j].mask);
8700                 kfree(tmp_rule->patterns);
8701         }
8702         kfree(new_coalesce.rules);
8703
8704         return err;
8705 }
8706
8707 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8708 {
8709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8710         struct net_device *dev = info->user_ptr[1];
8711         struct wireless_dev *wdev = dev->ieee80211_ptr;
8712         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8713         struct cfg80211_gtk_rekey_data rekey_data;
8714         int err;
8715
8716         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8717                 return -EINVAL;
8718
8719         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8720                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8721                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8722                         nl80211_rekey_policy);
8723         if (err)
8724                 return err;
8725
8726         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8727                 return -ERANGE;
8728         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8729                 return -ERANGE;
8730         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8731                 return -ERANGE;
8732
8733         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8734                NL80211_KEK_LEN);
8735         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8736                NL80211_KCK_LEN);
8737         memcpy(rekey_data.replay_ctr,
8738                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8739                NL80211_REPLAY_CTR_LEN);
8740
8741         wdev_lock(wdev);
8742         if (!wdev->current_bss) {
8743                 err = -ENOTCONN;
8744                 goto out;
8745         }
8746
8747         if (!rdev->ops->set_rekey_data) {
8748                 err = -EOPNOTSUPP;
8749                 goto out;
8750         }
8751
8752         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8753  out:
8754         wdev_unlock(wdev);
8755         return err;
8756 }
8757
8758 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8759                                              struct genl_info *info)
8760 {
8761         struct net_device *dev = info->user_ptr[1];
8762         struct wireless_dev *wdev = dev->ieee80211_ptr;
8763
8764         if (wdev->iftype != NL80211_IFTYPE_AP &&
8765             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8766                 return -EINVAL;
8767
8768         if (wdev->ap_unexpected_nlportid)
8769                 return -EBUSY;
8770
8771         wdev->ap_unexpected_nlportid = info->snd_portid;
8772         return 0;
8773 }
8774
8775 static int nl80211_probe_client(struct sk_buff *skb,
8776                                 struct genl_info *info)
8777 {
8778         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8779         struct net_device *dev = info->user_ptr[1];
8780         struct wireless_dev *wdev = dev->ieee80211_ptr;
8781         struct sk_buff *msg;
8782         void *hdr;
8783         const u8 *addr;
8784         u64 cookie;
8785         int err;
8786
8787         if (wdev->iftype != NL80211_IFTYPE_AP &&
8788             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8789                 return -EOPNOTSUPP;
8790
8791         if (!info->attrs[NL80211_ATTR_MAC])
8792                 return -EINVAL;
8793
8794         if (!rdev->ops->probe_client)
8795                 return -EOPNOTSUPP;
8796
8797         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8798         if (!msg)
8799                 return -ENOMEM;
8800
8801         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8802                              NL80211_CMD_PROBE_CLIENT);
8803         if (!hdr) {
8804                 err = -ENOBUFS;
8805                 goto free_msg;
8806         }
8807
8808         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8809
8810         err = rdev_probe_client(rdev, dev, addr, &cookie);
8811         if (err)
8812                 goto free_msg;
8813
8814         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8815                 goto nla_put_failure;
8816
8817         genlmsg_end(msg, hdr);
8818
8819         return genlmsg_reply(msg, info);
8820
8821  nla_put_failure:
8822         err = -ENOBUFS;
8823  free_msg:
8824         nlmsg_free(msg);
8825         return err;
8826 }
8827
8828 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8829 {
8830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8831         struct cfg80211_beacon_registration *reg, *nreg;
8832         int rv;
8833
8834         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8835                 return -EOPNOTSUPP;
8836
8837         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8838         if (!nreg)
8839                 return -ENOMEM;
8840
8841         /* First, check if already registered. */
8842         spin_lock_bh(&rdev->beacon_registrations_lock);
8843         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8844                 if (reg->nlportid == info->snd_portid) {
8845                         rv = -EALREADY;
8846                         goto out_err;
8847                 }
8848         }
8849         /* Add it to the list */
8850         nreg->nlportid = info->snd_portid;
8851         list_add(&nreg->list, &rdev->beacon_registrations);
8852
8853         spin_unlock_bh(&rdev->beacon_registrations_lock);
8854
8855         return 0;
8856 out_err:
8857         spin_unlock_bh(&rdev->beacon_registrations_lock);
8858         kfree(nreg);
8859         return rv;
8860 }
8861
8862 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8863 {
8864         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8865         struct wireless_dev *wdev = info->user_ptr[1];
8866         int err;
8867
8868         if (!rdev->ops->start_p2p_device)
8869                 return -EOPNOTSUPP;
8870
8871         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8872                 return -EOPNOTSUPP;
8873
8874         if (wdev->p2p_started)
8875                 return 0;
8876
8877         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8878         if (err)
8879                 return err;
8880
8881         err = rdev_start_p2p_device(rdev, wdev);
8882         if (err)
8883                 return err;
8884
8885         wdev->p2p_started = true;
8886         rdev->opencount++;
8887
8888         return 0;
8889 }
8890
8891 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8892 {
8893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8894         struct wireless_dev *wdev = info->user_ptr[1];
8895
8896         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8897                 return -EOPNOTSUPP;
8898
8899         if (!rdev->ops->stop_p2p_device)
8900                 return -EOPNOTSUPP;
8901
8902         cfg80211_stop_p2p_device(rdev, wdev);
8903
8904         return 0;
8905 }
8906
8907 static int nl80211_get_protocol_features(struct sk_buff *skb,
8908                                          struct genl_info *info)
8909 {
8910         void *hdr;
8911         struct sk_buff *msg;
8912
8913         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8914         if (!msg)
8915                 return -ENOMEM;
8916
8917         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8918                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8919         if (!hdr)
8920                 goto nla_put_failure;
8921
8922         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8923                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8924                 goto nla_put_failure;
8925
8926         genlmsg_end(msg, hdr);
8927         return genlmsg_reply(msg, info);
8928
8929  nla_put_failure:
8930         kfree_skb(msg);
8931         return -ENOBUFS;
8932 }
8933
8934 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8935 {
8936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8937         struct cfg80211_update_ft_ies_params ft_params;
8938         struct net_device *dev = info->user_ptr[1];
8939
8940         if (!rdev->ops->update_ft_ies)
8941                 return -EOPNOTSUPP;
8942
8943         if (!info->attrs[NL80211_ATTR_MDID] ||
8944             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8945                 return -EINVAL;
8946
8947         memset(&ft_params, 0, sizeof(ft_params));
8948         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8949         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8950         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8951
8952         return rdev_update_ft_ies(rdev, dev, &ft_params);
8953 }
8954
8955 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8956                                        struct genl_info *info)
8957 {
8958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8959         struct wireless_dev *wdev = info->user_ptr[1];
8960         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8961         u16 duration;
8962         int ret;
8963
8964         if (!rdev->ops->crit_proto_start)
8965                 return -EOPNOTSUPP;
8966
8967         if (WARN_ON(!rdev->ops->crit_proto_stop))
8968                 return -EINVAL;
8969
8970         if (rdev->crit_proto_nlportid)
8971                 return -EBUSY;
8972
8973         /* determine protocol if provided */
8974         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8975                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8976
8977         if (proto >= NUM_NL80211_CRIT_PROTO)
8978                 return -EINVAL;
8979
8980         /* timeout must be provided */
8981         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8982                 return -EINVAL;
8983
8984         duration =
8985                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8986
8987         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8988                 return -ERANGE;
8989
8990         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8991         if (!ret)
8992                 rdev->crit_proto_nlportid = info->snd_portid;
8993
8994         return ret;
8995 }
8996
8997 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8998                                       struct genl_info *info)
8999 {
9000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9001         struct wireless_dev *wdev = info->user_ptr[1];
9002
9003         if (!rdev->ops->crit_proto_stop)
9004                 return -EOPNOTSUPP;
9005
9006         if (rdev->crit_proto_nlportid) {
9007                 rdev->crit_proto_nlportid = 0;
9008                 rdev_crit_proto_stop(rdev, wdev);
9009         }
9010         return 0;
9011 }
9012
9013 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9014 {
9015         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9016         struct wireless_dev *wdev =
9017                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9018         int i, err;
9019         u32 vid, subcmd;
9020
9021         if (!rdev->wiphy.vendor_commands)
9022                 return -EOPNOTSUPP;
9023
9024         if (IS_ERR(wdev)) {
9025                 err = PTR_ERR(wdev);
9026                 if (err != -EINVAL)
9027                         return err;
9028                 wdev = NULL;
9029         } else if (wdev->wiphy != &rdev->wiphy) {
9030                 return -EINVAL;
9031         }
9032
9033         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9034             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9035                 return -EINVAL;
9036
9037         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9038         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9039         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9040                 const struct wiphy_vendor_command *vcmd;
9041                 void *data = NULL;
9042                 int len = 0;
9043
9044                 vcmd = &rdev->wiphy.vendor_commands[i];
9045
9046                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9047                         continue;
9048
9049                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9050                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9051                         if (!wdev)
9052                                 return -EINVAL;
9053                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9054                             !wdev->netdev)
9055                                 return -EINVAL;
9056
9057                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9058                                 if (wdev->netdev &&
9059                                     !netif_running(wdev->netdev))
9060                                         return -ENETDOWN;
9061                                 if (!wdev->netdev && !wdev->p2p_started)
9062                                         return -ENETDOWN;
9063                         }
9064                 } else {
9065                         wdev = NULL;
9066                 }
9067
9068                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9069                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9070                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9071                 }
9072
9073                 rdev->cur_cmd_info = info;
9074                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9075                                                           data, len);
9076                 rdev->cur_cmd_info = NULL;
9077                 return err;
9078         }
9079
9080         return -EOPNOTSUPP;
9081 }
9082
9083 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9084                                            enum nl80211_commands cmd,
9085                                            enum nl80211_attrs attr,
9086                                            int approxlen)
9087 {
9088         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9089
9090         if (WARN_ON(!rdev->cur_cmd_info))
9091                 return NULL;
9092
9093         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9094                                            rdev->cur_cmd_info->snd_portid,
9095                                            rdev->cur_cmd_info->snd_seq,
9096                                            cmd, attr, NULL, GFP_KERNEL);
9097 }
9098 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9099
9100 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9101 {
9102         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9103         void *hdr = ((void **)skb->cb)[1];
9104         struct nlattr *data = ((void **)skb->cb)[2];
9105
9106         if (WARN_ON(!rdev->cur_cmd_info)) {
9107                 kfree_skb(skb);
9108                 return -EINVAL;
9109         }
9110
9111         nla_nest_end(skb, data);
9112         genlmsg_end(skb, hdr);
9113         return genlmsg_reply(skb, rdev->cur_cmd_info);
9114 }
9115 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9116
9117
9118 static int nl80211_set_qos_map(struct sk_buff *skb,
9119                                struct genl_info *info)
9120 {
9121         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9122         struct cfg80211_qos_map *qos_map = NULL;
9123         struct net_device *dev = info->user_ptr[1];
9124         u8 *pos, len, num_des, des_len, des;
9125         int ret;
9126
9127         if (!rdev->ops->set_qos_map)
9128                 return -EOPNOTSUPP;
9129
9130         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9131                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9132                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9133
9134                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9135                     len > IEEE80211_QOS_MAP_LEN_MAX)
9136                         return -EINVAL;
9137
9138                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9139                 if (!qos_map)
9140                         return -ENOMEM;
9141
9142                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9143                 if (num_des) {
9144                         des_len = num_des *
9145                                 sizeof(struct cfg80211_dscp_exception);
9146                         memcpy(qos_map->dscp_exception, pos, des_len);
9147                         qos_map->num_des = num_des;
9148                         for (des = 0; des < num_des; des++) {
9149                                 if (qos_map->dscp_exception[des].up > 7) {
9150                                         kfree(qos_map);
9151                                         return -EINVAL;
9152                                 }
9153                         }
9154                         pos += des_len;
9155                 }
9156                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9157         }
9158
9159         wdev_lock(dev->ieee80211_ptr);
9160         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9161         if (!ret)
9162                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9163         wdev_unlock(dev->ieee80211_ptr);
9164
9165         kfree(qos_map);
9166         return ret;
9167 }
9168
9169 #define NL80211_FLAG_NEED_WIPHY         0x01
9170 #define NL80211_FLAG_NEED_NETDEV        0x02
9171 #define NL80211_FLAG_NEED_RTNL          0x04
9172 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9173 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9174                                          NL80211_FLAG_CHECK_NETDEV_UP)
9175 #define NL80211_FLAG_NEED_WDEV          0x10
9176 /* If a netdev is associated, it must be UP, P2P must be started */
9177 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9178                                          NL80211_FLAG_CHECK_NETDEV_UP)
9179
9180 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9181                             struct genl_info *info)
9182 {
9183         struct cfg80211_registered_device *rdev;
9184         struct wireless_dev *wdev;
9185         struct net_device *dev;
9186         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9187
9188         if (rtnl)
9189                 rtnl_lock();
9190
9191         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9192                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9193                 if (IS_ERR(rdev)) {
9194                         if (rtnl)
9195                                 rtnl_unlock();
9196                         return PTR_ERR(rdev);
9197                 }
9198                 info->user_ptr[0] = rdev;
9199         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9200                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9201                 ASSERT_RTNL();
9202
9203                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9204                                                   info->attrs);
9205                 if (IS_ERR(wdev)) {
9206                         if (rtnl)
9207                                 rtnl_unlock();
9208                         return PTR_ERR(wdev);
9209                 }
9210
9211                 dev = wdev->netdev;
9212                 rdev = wiphy_to_dev(wdev->wiphy);
9213
9214                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9215                         if (!dev) {
9216                                 if (rtnl)
9217                                         rtnl_unlock();
9218                                 return -EINVAL;
9219                         }
9220
9221                         info->user_ptr[1] = dev;
9222                 } else {
9223                         info->user_ptr[1] = wdev;
9224                 }
9225
9226                 if (dev) {
9227                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9228                             !netif_running(dev)) {
9229                                 if (rtnl)
9230                                         rtnl_unlock();
9231                                 return -ENETDOWN;
9232                         }
9233
9234                         dev_hold(dev);
9235                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9236                         if (!wdev->p2p_started) {
9237                                 if (rtnl)
9238                                         rtnl_unlock();
9239                                 return -ENETDOWN;
9240                         }
9241                 }
9242
9243                 info->user_ptr[0] = rdev;
9244         }
9245
9246         return 0;
9247 }
9248
9249 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9250                               struct genl_info *info)
9251 {
9252         if (info->user_ptr[1]) {
9253                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9254                         struct wireless_dev *wdev = info->user_ptr[1];
9255
9256                         if (wdev->netdev)
9257                                 dev_put(wdev->netdev);
9258                 } else {
9259                         dev_put(info->user_ptr[1]);
9260                 }
9261         }
9262         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9263                 rtnl_unlock();
9264 }
9265
9266 static const struct genl_ops nl80211_ops[] = {
9267         {
9268                 .cmd = NL80211_CMD_GET_WIPHY,
9269                 .doit = nl80211_get_wiphy,
9270                 .dumpit = nl80211_dump_wiphy,
9271                 .done = nl80211_dump_wiphy_done,
9272                 .policy = nl80211_policy,
9273                 /* can be retrieved by unprivileged users */
9274                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9275                                   NL80211_FLAG_NEED_RTNL,
9276         },
9277         {
9278                 .cmd = NL80211_CMD_SET_WIPHY,
9279                 .doit = nl80211_set_wiphy,
9280                 .policy = nl80211_policy,
9281                 .flags = GENL_ADMIN_PERM,
9282                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9283         },
9284         {
9285                 .cmd = NL80211_CMD_GET_INTERFACE,
9286                 .doit = nl80211_get_interface,
9287                 .dumpit = nl80211_dump_interface,
9288                 .policy = nl80211_policy,
9289                 /* can be retrieved by unprivileged users */
9290                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9291                                   NL80211_FLAG_NEED_RTNL,
9292         },
9293         {
9294                 .cmd = NL80211_CMD_SET_INTERFACE,
9295                 .doit = nl80211_set_interface,
9296                 .policy = nl80211_policy,
9297                 .flags = GENL_ADMIN_PERM,
9298                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9299                                   NL80211_FLAG_NEED_RTNL,
9300         },
9301         {
9302                 .cmd = NL80211_CMD_NEW_INTERFACE,
9303                 .doit = nl80211_new_interface,
9304                 .policy = nl80211_policy,
9305                 .flags = GENL_ADMIN_PERM,
9306                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9307                                   NL80211_FLAG_NEED_RTNL,
9308         },
9309         {
9310                 .cmd = NL80211_CMD_DEL_INTERFACE,
9311                 .doit = nl80211_del_interface,
9312                 .policy = nl80211_policy,
9313                 .flags = GENL_ADMIN_PERM,
9314                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9315                                   NL80211_FLAG_NEED_RTNL,
9316         },
9317         {
9318                 .cmd = NL80211_CMD_GET_KEY,
9319                 .doit = nl80211_get_key,
9320                 .policy = nl80211_policy,
9321                 .flags = GENL_ADMIN_PERM,
9322                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9323                                   NL80211_FLAG_NEED_RTNL,
9324         },
9325         {
9326                 .cmd = NL80211_CMD_SET_KEY,
9327                 .doit = nl80211_set_key,
9328                 .policy = nl80211_policy,
9329                 .flags = GENL_ADMIN_PERM,
9330                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9331                                   NL80211_FLAG_NEED_RTNL,
9332         },
9333         {
9334                 .cmd = NL80211_CMD_NEW_KEY,
9335                 .doit = nl80211_new_key,
9336                 .policy = nl80211_policy,
9337                 .flags = GENL_ADMIN_PERM,
9338                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9339                                   NL80211_FLAG_NEED_RTNL,
9340         },
9341         {
9342                 .cmd = NL80211_CMD_DEL_KEY,
9343                 .doit = nl80211_del_key,
9344                 .policy = nl80211_policy,
9345                 .flags = GENL_ADMIN_PERM,
9346                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9347                                   NL80211_FLAG_NEED_RTNL,
9348         },
9349         {
9350                 .cmd = NL80211_CMD_SET_BEACON,
9351                 .policy = nl80211_policy,
9352                 .flags = GENL_ADMIN_PERM,
9353                 .doit = nl80211_set_beacon,
9354                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9355                                   NL80211_FLAG_NEED_RTNL,
9356         },
9357         {
9358                 .cmd = NL80211_CMD_START_AP,
9359                 .policy = nl80211_policy,
9360                 .flags = GENL_ADMIN_PERM,
9361                 .doit = nl80211_start_ap,
9362                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9363                                   NL80211_FLAG_NEED_RTNL,
9364         },
9365         {
9366                 .cmd = NL80211_CMD_STOP_AP,
9367                 .policy = nl80211_policy,
9368                 .flags = GENL_ADMIN_PERM,
9369                 .doit = nl80211_stop_ap,
9370                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9371                                   NL80211_FLAG_NEED_RTNL,
9372         },
9373         {
9374                 .cmd = NL80211_CMD_GET_STATION,
9375                 .doit = nl80211_get_station,
9376                 .dumpit = nl80211_dump_station,
9377                 .policy = nl80211_policy,
9378                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9379                                   NL80211_FLAG_NEED_RTNL,
9380         },
9381         {
9382                 .cmd = NL80211_CMD_SET_STATION,
9383                 .doit = nl80211_set_station,
9384                 .policy = nl80211_policy,
9385                 .flags = GENL_ADMIN_PERM,
9386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9387                                   NL80211_FLAG_NEED_RTNL,
9388         },
9389         {
9390                 .cmd = NL80211_CMD_NEW_STATION,
9391                 .doit = nl80211_new_station,
9392                 .policy = nl80211_policy,
9393                 .flags = GENL_ADMIN_PERM,
9394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9395                                   NL80211_FLAG_NEED_RTNL,
9396         },
9397         {
9398                 .cmd = NL80211_CMD_DEL_STATION,
9399                 .doit = nl80211_del_station,
9400                 .policy = nl80211_policy,
9401                 .flags = GENL_ADMIN_PERM,
9402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9403                                   NL80211_FLAG_NEED_RTNL,
9404         },
9405         {
9406                 .cmd = NL80211_CMD_GET_MPATH,
9407                 .doit = nl80211_get_mpath,
9408                 .dumpit = nl80211_dump_mpath,
9409                 .policy = nl80211_policy,
9410                 .flags = GENL_ADMIN_PERM,
9411                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9412                                   NL80211_FLAG_NEED_RTNL,
9413         },
9414         {
9415                 .cmd = NL80211_CMD_SET_MPATH,
9416                 .doit = nl80211_set_mpath,
9417                 .policy = nl80211_policy,
9418                 .flags = GENL_ADMIN_PERM,
9419                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9420                                   NL80211_FLAG_NEED_RTNL,
9421         },
9422         {
9423                 .cmd = NL80211_CMD_NEW_MPATH,
9424                 .doit = nl80211_new_mpath,
9425                 .policy = nl80211_policy,
9426                 .flags = GENL_ADMIN_PERM,
9427                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9428                                   NL80211_FLAG_NEED_RTNL,
9429         },
9430         {
9431                 .cmd = NL80211_CMD_DEL_MPATH,
9432                 .doit = nl80211_del_mpath,
9433                 .policy = nl80211_policy,
9434                 .flags = GENL_ADMIN_PERM,
9435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9436                                   NL80211_FLAG_NEED_RTNL,
9437         },
9438         {
9439                 .cmd = NL80211_CMD_SET_BSS,
9440                 .doit = nl80211_set_bss,
9441                 .policy = nl80211_policy,
9442                 .flags = GENL_ADMIN_PERM,
9443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9444                                   NL80211_FLAG_NEED_RTNL,
9445         },
9446         {
9447                 .cmd = NL80211_CMD_GET_REG,
9448                 .doit = nl80211_get_reg,
9449                 .policy = nl80211_policy,
9450                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9451                 /* can be retrieved by unprivileged users */
9452         },
9453         {
9454                 .cmd = NL80211_CMD_SET_REG,
9455                 .doit = nl80211_set_reg,
9456                 .policy = nl80211_policy,
9457                 .flags = GENL_ADMIN_PERM,
9458                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9459         },
9460         {
9461                 .cmd = NL80211_CMD_REQ_SET_REG,
9462                 .doit = nl80211_req_set_reg,
9463                 .policy = nl80211_policy,
9464                 .flags = GENL_ADMIN_PERM,
9465         },
9466         {
9467                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9468                 .doit = nl80211_get_mesh_config,
9469                 .policy = nl80211_policy,
9470                 /* can be retrieved by unprivileged users */
9471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9472                                   NL80211_FLAG_NEED_RTNL,
9473         },
9474         {
9475                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9476                 .doit = nl80211_update_mesh_config,
9477                 .policy = nl80211_policy,
9478                 .flags = GENL_ADMIN_PERM,
9479                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9480                                   NL80211_FLAG_NEED_RTNL,
9481         },
9482         {
9483                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9484                 .doit = nl80211_trigger_scan,
9485                 .policy = nl80211_policy,
9486                 .flags = GENL_ADMIN_PERM,
9487                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9488                                   NL80211_FLAG_NEED_RTNL,
9489         },
9490         {
9491                 .cmd = NL80211_CMD_GET_SCAN,
9492                 .policy = nl80211_policy,
9493                 .dumpit = nl80211_dump_scan,
9494         },
9495         {
9496                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9497                 .doit = nl80211_start_sched_scan,
9498                 .policy = nl80211_policy,
9499                 .flags = GENL_ADMIN_PERM,
9500                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9501                                   NL80211_FLAG_NEED_RTNL,
9502         },
9503         {
9504                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9505                 .doit = nl80211_stop_sched_scan,
9506                 .policy = nl80211_policy,
9507                 .flags = GENL_ADMIN_PERM,
9508                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9509                                   NL80211_FLAG_NEED_RTNL,
9510         },
9511         {
9512                 .cmd = NL80211_CMD_AUTHENTICATE,
9513                 .doit = nl80211_authenticate,
9514                 .policy = nl80211_policy,
9515                 .flags = GENL_ADMIN_PERM,
9516                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9517                                   NL80211_FLAG_NEED_RTNL,
9518         },
9519         {
9520                 .cmd = NL80211_CMD_ASSOCIATE,
9521                 .doit = nl80211_associate,
9522                 .policy = nl80211_policy,
9523                 .flags = GENL_ADMIN_PERM,
9524                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9525                                   NL80211_FLAG_NEED_RTNL,
9526         },
9527         {
9528                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9529                 .doit = nl80211_deauthenticate,
9530                 .policy = nl80211_policy,
9531                 .flags = GENL_ADMIN_PERM,
9532                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9533                                   NL80211_FLAG_NEED_RTNL,
9534         },
9535         {
9536                 .cmd = NL80211_CMD_DISASSOCIATE,
9537                 .doit = nl80211_disassociate,
9538                 .policy = nl80211_policy,
9539                 .flags = GENL_ADMIN_PERM,
9540                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9541                                   NL80211_FLAG_NEED_RTNL,
9542         },
9543         {
9544                 .cmd = NL80211_CMD_JOIN_IBSS,
9545                 .doit = nl80211_join_ibss,
9546                 .policy = nl80211_policy,
9547                 .flags = GENL_ADMIN_PERM,
9548                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9549                                   NL80211_FLAG_NEED_RTNL,
9550         },
9551         {
9552                 .cmd = NL80211_CMD_LEAVE_IBSS,
9553                 .doit = nl80211_leave_ibss,
9554                 .policy = nl80211_policy,
9555                 .flags = GENL_ADMIN_PERM,
9556                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9557                                   NL80211_FLAG_NEED_RTNL,
9558         },
9559 #ifdef CONFIG_NL80211_TESTMODE
9560         {
9561                 .cmd = NL80211_CMD_TESTMODE,
9562                 .doit = nl80211_testmode_do,
9563                 .dumpit = nl80211_testmode_dump,
9564                 .policy = nl80211_policy,
9565                 .flags = GENL_ADMIN_PERM,
9566                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9567                                   NL80211_FLAG_NEED_RTNL,
9568         },
9569 #endif
9570         {
9571                 .cmd = NL80211_CMD_CONNECT,
9572                 .doit = nl80211_connect,
9573                 .policy = nl80211_policy,
9574                 .flags = GENL_ADMIN_PERM,
9575                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9576                                   NL80211_FLAG_NEED_RTNL,
9577         },
9578         {
9579                 .cmd = NL80211_CMD_DISCONNECT,
9580                 .doit = nl80211_disconnect,
9581                 .policy = nl80211_policy,
9582                 .flags = GENL_ADMIN_PERM,
9583                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9584                                   NL80211_FLAG_NEED_RTNL,
9585         },
9586         {
9587                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9588                 .doit = nl80211_wiphy_netns,
9589                 .policy = nl80211_policy,
9590                 .flags = GENL_ADMIN_PERM,
9591                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9592                                   NL80211_FLAG_NEED_RTNL,
9593         },
9594         {
9595                 .cmd = NL80211_CMD_GET_SURVEY,
9596                 .policy = nl80211_policy,
9597                 .dumpit = nl80211_dump_survey,
9598         },
9599         {
9600                 .cmd = NL80211_CMD_SET_PMKSA,
9601                 .doit = nl80211_setdel_pmksa,
9602                 .policy = nl80211_policy,
9603                 .flags = GENL_ADMIN_PERM,
9604                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9605                                   NL80211_FLAG_NEED_RTNL,
9606         },
9607         {
9608                 .cmd = NL80211_CMD_DEL_PMKSA,
9609                 .doit = nl80211_setdel_pmksa,
9610                 .policy = nl80211_policy,
9611                 .flags = GENL_ADMIN_PERM,
9612                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9613                                   NL80211_FLAG_NEED_RTNL,
9614         },
9615         {
9616                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9617                 .doit = nl80211_flush_pmksa,
9618                 .policy = nl80211_policy,
9619                 .flags = GENL_ADMIN_PERM,
9620                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9621                                   NL80211_FLAG_NEED_RTNL,
9622         },
9623         {
9624                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9625                 .doit = nl80211_remain_on_channel,
9626                 .policy = nl80211_policy,
9627                 .flags = GENL_ADMIN_PERM,
9628                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9629                                   NL80211_FLAG_NEED_RTNL,
9630         },
9631         {
9632                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9633                 .doit = nl80211_cancel_remain_on_channel,
9634                 .policy = nl80211_policy,
9635                 .flags = GENL_ADMIN_PERM,
9636                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9637                                   NL80211_FLAG_NEED_RTNL,
9638         },
9639         {
9640                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9641                 .doit = nl80211_set_tx_bitrate_mask,
9642                 .policy = nl80211_policy,
9643                 .flags = GENL_ADMIN_PERM,
9644                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9645                                   NL80211_FLAG_NEED_RTNL,
9646         },
9647         {
9648                 .cmd = NL80211_CMD_REGISTER_FRAME,
9649                 .doit = nl80211_register_mgmt,
9650                 .policy = nl80211_policy,
9651                 .flags = GENL_ADMIN_PERM,
9652                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9653                                   NL80211_FLAG_NEED_RTNL,
9654         },
9655         {
9656                 .cmd = NL80211_CMD_FRAME,
9657                 .doit = nl80211_tx_mgmt,
9658                 .policy = nl80211_policy,
9659                 .flags = GENL_ADMIN_PERM,
9660                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9661                                   NL80211_FLAG_NEED_RTNL,
9662         },
9663         {
9664                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9665                 .doit = nl80211_tx_mgmt_cancel_wait,
9666                 .policy = nl80211_policy,
9667                 .flags = GENL_ADMIN_PERM,
9668                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9669                                   NL80211_FLAG_NEED_RTNL,
9670         },
9671         {
9672                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9673                 .doit = nl80211_set_power_save,
9674                 .policy = nl80211_policy,
9675                 .flags = GENL_ADMIN_PERM,
9676                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9677                                   NL80211_FLAG_NEED_RTNL,
9678         },
9679         {
9680                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9681                 .doit = nl80211_get_power_save,
9682                 .policy = nl80211_policy,
9683                 /* can be retrieved by unprivileged users */
9684                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9685                                   NL80211_FLAG_NEED_RTNL,
9686         },
9687         {
9688                 .cmd = NL80211_CMD_SET_CQM,
9689                 .doit = nl80211_set_cqm,
9690                 .policy = nl80211_policy,
9691                 .flags = GENL_ADMIN_PERM,
9692                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9693                                   NL80211_FLAG_NEED_RTNL,
9694         },
9695         {
9696                 .cmd = NL80211_CMD_SET_CHANNEL,
9697                 .doit = nl80211_set_channel,
9698                 .policy = nl80211_policy,
9699                 .flags = GENL_ADMIN_PERM,
9700                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9701                                   NL80211_FLAG_NEED_RTNL,
9702         },
9703         {
9704                 .cmd = NL80211_CMD_SET_WDS_PEER,
9705                 .doit = nl80211_set_wds_peer,
9706                 .policy = nl80211_policy,
9707                 .flags = GENL_ADMIN_PERM,
9708                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9709                                   NL80211_FLAG_NEED_RTNL,
9710         },
9711         {
9712                 .cmd = NL80211_CMD_JOIN_MESH,
9713                 .doit = nl80211_join_mesh,
9714                 .policy = nl80211_policy,
9715                 .flags = GENL_ADMIN_PERM,
9716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9717                                   NL80211_FLAG_NEED_RTNL,
9718         },
9719         {
9720                 .cmd = NL80211_CMD_LEAVE_MESH,
9721                 .doit = nl80211_leave_mesh,
9722                 .policy = nl80211_policy,
9723                 .flags = GENL_ADMIN_PERM,
9724                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9725                                   NL80211_FLAG_NEED_RTNL,
9726         },
9727 #ifdef CONFIG_PM
9728         {
9729                 .cmd = NL80211_CMD_GET_WOWLAN,
9730                 .doit = nl80211_get_wowlan,
9731                 .policy = nl80211_policy,
9732                 /* can be retrieved by unprivileged users */
9733                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9734                                   NL80211_FLAG_NEED_RTNL,
9735         },
9736         {
9737                 .cmd = NL80211_CMD_SET_WOWLAN,
9738                 .doit = nl80211_set_wowlan,
9739                 .policy = nl80211_policy,
9740                 .flags = GENL_ADMIN_PERM,
9741                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9742                                   NL80211_FLAG_NEED_RTNL,
9743         },
9744 #endif
9745         {
9746                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9747                 .doit = nl80211_set_rekey_data,
9748                 .policy = nl80211_policy,
9749                 .flags = GENL_ADMIN_PERM,
9750                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9751                                   NL80211_FLAG_NEED_RTNL,
9752         },
9753         {
9754                 .cmd = NL80211_CMD_TDLS_MGMT,
9755                 .doit = nl80211_tdls_mgmt,
9756                 .policy = nl80211_policy,
9757                 .flags = GENL_ADMIN_PERM,
9758                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9759                                   NL80211_FLAG_NEED_RTNL,
9760         },
9761         {
9762                 .cmd = NL80211_CMD_TDLS_OPER,
9763                 .doit = nl80211_tdls_oper,
9764                 .policy = nl80211_policy,
9765                 .flags = GENL_ADMIN_PERM,
9766                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9767                                   NL80211_FLAG_NEED_RTNL,
9768         },
9769         {
9770                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9771                 .doit = nl80211_register_unexpected_frame,
9772                 .policy = nl80211_policy,
9773                 .flags = GENL_ADMIN_PERM,
9774                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9775                                   NL80211_FLAG_NEED_RTNL,
9776         },
9777         {
9778                 .cmd = NL80211_CMD_PROBE_CLIENT,
9779                 .doit = nl80211_probe_client,
9780                 .policy = nl80211_policy,
9781                 .flags = GENL_ADMIN_PERM,
9782                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9783                                   NL80211_FLAG_NEED_RTNL,
9784         },
9785         {
9786                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9787                 .doit = nl80211_register_beacons,
9788                 .policy = nl80211_policy,
9789                 .flags = GENL_ADMIN_PERM,
9790                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9791                                   NL80211_FLAG_NEED_RTNL,
9792         },
9793         {
9794                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9795                 .doit = nl80211_set_noack_map,
9796                 .policy = nl80211_policy,
9797                 .flags = GENL_ADMIN_PERM,
9798                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9799                                   NL80211_FLAG_NEED_RTNL,
9800         },
9801         {
9802                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9803                 .doit = nl80211_start_p2p_device,
9804                 .policy = nl80211_policy,
9805                 .flags = GENL_ADMIN_PERM,
9806                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9807                                   NL80211_FLAG_NEED_RTNL,
9808         },
9809         {
9810                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9811                 .doit = nl80211_stop_p2p_device,
9812                 .policy = nl80211_policy,
9813                 .flags = GENL_ADMIN_PERM,
9814                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9815                                   NL80211_FLAG_NEED_RTNL,
9816         },
9817         {
9818                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9819                 .doit = nl80211_set_mcast_rate,
9820                 .policy = nl80211_policy,
9821                 .flags = GENL_ADMIN_PERM,
9822                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9823                                   NL80211_FLAG_NEED_RTNL,
9824         },
9825         {
9826                 .cmd = NL80211_CMD_SET_MAC_ACL,
9827                 .doit = nl80211_set_mac_acl,
9828                 .policy = nl80211_policy,
9829                 .flags = GENL_ADMIN_PERM,
9830                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9831                                   NL80211_FLAG_NEED_RTNL,
9832         },
9833         {
9834                 .cmd = NL80211_CMD_RADAR_DETECT,
9835                 .doit = nl80211_start_radar_detection,
9836                 .policy = nl80211_policy,
9837                 .flags = GENL_ADMIN_PERM,
9838                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9839                                   NL80211_FLAG_NEED_RTNL,
9840         },
9841         {
9842                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9843                 .doit = nl80211_get_protocol_features,
9844                 .policy = nl80211_policy,
9845         },
9846         {
9847                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9848                 .doit = nl80211_update_ft_ies,
9849                 .policy = nl80211_policy,
9850                 .flags = GENL_ADMIN_PERM,
9851                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9852                                   NL80211_FLAG_NEED_RTNL,
9853         },
9854         {
9855                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9856                 .doit = nl80211_crit_protocol_start,
9857                 .policy = nl80211_policy,
9858                 .flags = GENL_ADMIN_PERM,
9859                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9860                                   NL80211_FLAG_NEED_RTNL,
9861         },
9862         {
9863                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9864                 .doit = nl80211_crit_protocol_stop,
9865                 .policy = nl80211_policy,
9866                 .flags = GENL_ADMIN_PERM,
9867                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9868                                   NL80211_FLAG_NEED_RTNL,
9869         },
9870         {
9871                 .cmd = NL80211_CMD_GET_COALESCE,
9872                 .doit = nl80211_get_coalesce,
9873                 .policy = nl80211_policy,
9874                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9875                                   NL80211_FLAG_NEED_RTNL,
9876         },
9877         {
9878                 .cmd = NL80211_CMD_SET_COALESCE,
9879                 .doit = nl80211_set_coalesce,
9880                 .policy = nl80211_policy,
9881                 .flags = GENL_ADMIN_PERM,
9882                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9883                                   NL80211_FLAG_NEED_RTNL,
9884         },
9885         {
9886                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9887                 .doit = nl80211_channel_switch,
9888                 .policy = nl80211_policy,
9889                 .flags = GENL_ADMIN_PERM,
9890                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9891                                   NL80211_FLAG_NEED_RTNL,
9892         },
9893         {
9894                 .cmd = NL80211_CMD_VENDOR,
9895                 .doit = nl80211_vendor_cmd,
9896                 .policy = nl80211_policy,
9897                 .flags = GENL_ADMIN_PERM,
9898                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9899                                   NL80211_FLAG_NEED_RTNL,
9900         },
9901         {
9902                 .cmd = NL80211_CMD_SET_QOS_MAP,
9903                 .doit = nl80211_set_qos_map,
9904                 .policy = nl80211_policy,
9905                 .flags = GENL_ADMIN_PERM,
9906                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9907                                   NL80211_FLAG_NEED_RTNL,
9908         },
9909 };
9910
9911 /* notification functions */
9912
9913 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9914 {
9915         struct sk_buff *msg;
9916         struct nl80211_dump_wiphy_state state = {};
9917
9918         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9919         if (!msg)
9920                 return;
9921
9922         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9923                 nlmsg_free(msg);
9924                 return;
9925         }
9926
9927         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9928                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
9929 }
9930
9931 static int nl80211_add_scan_req(struct sk_buff *msg,
9932                                 struct cfg80211_registered_device *rdev)
9933 {
9934         struct cfg80211_scan_request *req = rdev->scan_req;
9935         struct nlattr *nest;
9936         int i;
9937
9938         if (WARN_ON(!req))
9939                 return 0;
9940
9941         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9942         if (!nest)
9943                 goto nla_put_failure;
9944         for (i = 0; i < req->n_ssids; i++) {
9945                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9946                         goto nla_put_failure;
9947         }
9948         nla_nest_end(msg, nest);
9949
9950         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9951         if (!nest)
9952                 goto nla_put_failure;
9953         for (i = 0; i < req->n_channels; i++) {
9954                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9955                         goto nla_put_failure;
9956         }
9957         nla_nest_end(msg, nest);
9958
9959         if (req->ie &&
9960             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9961                 goto nla_put_failure;
9962
9963         if (req->flags &&
9964             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
9965                 goto nla_put_failure;
9966
9967         return 0;
9968  nla_put_failure:
9969         return -ENOBUFS;
9970 }
9971
9972 static int nl80211_send_scan_msg(struct sk_buff *msg,
9973                                  struct cfg80211_registered_device *rdev,
9974                                  struct wireless_dev *wdev,
9975                                  u32 portid, u32 seq, int flags,
9976                                  u32 cmd)
9977 {
9978         void *hdr;
9979
9980         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9981         if (!hdr)
9982                 return -1;
9983
9984         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9985             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9986                                          wdev->netdev->ifindex)) ||
9987             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9988                 goto nla_put_failure;
9989
9990         /* ignore errors and send incomplete event anyway */
9991         nl80211_add_scan_req(msg, rdev);
9992
9993         return genlmsg_end(msg, hdr);
9994
9995  nla_put_failure:
9996         genlmsg_cancel(msg, hdr);
9997         return -EMSGSIZE;
9998 }
9999
10000 static int
10001 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10002                             struct cfg80211_registered_device *rdev,
10003                             struct net_device *netdev,
10004                             u32 portid, u32 seq, int flags, u32 cmd)
10005 {
10006         void *hdr;
10007
10008         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10009         if (!hdr)
10010                 return -1;
10011
10012         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10013             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10014                 goto nla_put_failure;
10015
10016         return genlmsg_end(msg, hdr);
10017
10018  nla_put_failure:
10019         genlmsg_cancel(msg, hdr);
10020         return -EMSGSIZE;
10021 }
10022
10023 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10024                              struct wireless_dev *wdev)
10025 {
10026         struct sk_buff *msg;
10027
10028         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10029         if (!msg)
10030                 return;
10031
10032         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10033                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10034                 nlmsg_free(msg);
10035                 return;
10036         }
10037
10038         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10039                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10040 }
10041
10042 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
10043                             struct wireless_dev *wdev)
10044 {
10045         struct sk_buff *msg;
10046
10047         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10048         if (!msg)
10049                 return;
10050
10051         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10052                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10053                 nlmsg_free(msg);
10054                 return;
10055         }
10056
10057         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10058                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10059 }
10060
10061 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
10062                                struct wireless_dev *wdev)
10063 {
10064         struct sk_buff *msg;
10065
10066         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10067         if (!msg)
10068                 return;
10069
10070         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10071                                   NL80211_CMD_SCAN_ABORTED) < 0) {
10072                 nlmsg_free(msg);
10073                 return;
10074         }
10075
10076         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10077                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10078 }
10079
10080 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10081                                      struct net_device *netdev)
10082 {
10083         struct sk_buff *msg;
10084
10085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10086         if (!msg)
10087                 return;
10088
10089         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10090                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10091                 nlmsg_free(msg);
10092                 return;
10093         }
10094
10095         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10096                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10097 }
10098
10099 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10100                              struct net_device *netdev, u32 cmd)
10101 {
10102         struct sk_buff *msg;
10103
10104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10105         if (!msg)
10106                 return;
10107
10108         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10109                 nlmsg_free(msg);
10110                 return;
10111         }
10112
10113         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10114                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10115 }
10116
10117 /*
10118  * This can happen on global regulatory changes or device specific settings
10119  * based on custom world regulatory domains.
10120  */
10121 void nl80211_send_reg_change_event(struct regulatory_request *request)
10122 {
10123         struct sk_buff *msg;
10124         void *hdr;
10125
10126         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10127         if (!msg)
10128                 return;
10129
10130         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10131         if (!hdr) {
10132                 nlmsg_free(msg);
10133                 return;
10134         }
10135
10136         /* Userspace can always count this one always being set */
10137         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10138                 goto nla_put_failure;
10139
10140         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10141                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10142                                NL80211_REGDOM_TYPE_WORLD))
10143                         goto nla_put_failure;
10144         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10145                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10146                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10147                         goto nla_put_failure;
10148         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10149                    request->intersect) {
10150                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10151                                NL80211_REGDOM_TYPE_INTERSECTION))
10152                         goto nla_put_failure;
10153         } else {
10154                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10155                                NL80211_REGDOM_TYPE_COUNTRY) ||
10156                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10157                                    request->alpha2))
10158                         goto nla_put_failure;
10159         }
10160
10161         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10162             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10163                 goto nla_put_failure;
10164
10165         genlmsg_end(msg, hdr);
10166
10167         rcu_read_lock();
10168         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10169                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10170         rcu_read_unlock();
10171
10172         return;
10173
10174 nla_put_failure:
10175         genlmsg_cancel(msg, hdr);
10176         nlmsg_free(msg);
10177 }
10178
10179 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10180                                     struct net_device *netdev,
10181                                     const u8 *buf, size_t len,
10182                                     enum nl80211_commands cmd, gfp_t gfp)
10183 {
10184         struct sk_buff *msg;
10185         void *hdr;
10186
10187         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10188         if (!msg)
10189                 return;
10190
10191         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10192         if (!hdr) {
10193                 nlmsg_free(msg);
10194                 return;
10195         }
10196
10197         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10198             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10199             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10200                 goto nla_put_failure;
10201
10202         genlmsg_end(msg, hdr);
10203
10204         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10205                                 NL80211_MCGRP_MLME, gfp);
10206         return;
10207
10208  nla_put_failure:
10209         genlmsg_cancel(msg, hdr);
10210         nlmsg_free(msg);
10211 }
10212
10213 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10214                           struct net_device *netdev, const u8 *buf,
10215                           size_t len, gfp_t gfp)
10216 {
10217         nl80211_send_mlme_event(rdev, netdev, buf, len,
10218                                 NL80211_CMD_AUTHENTICATE, gfp);
10219 }
10220
10221 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10222                            struct net_device *netdev, const u8 *buf,
10223                            size_t len, gfp_t gfp)
10224 {
10225         nl80211_send_mlme_event(rdev, netdev, buf, len,
10226                                 NL80211_CMD_ASSOCIATE, gfp);
10227 }
10228
10229 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10230                          struct net_device *netdev, const u8 *buf,
10231                          size_t len, gfp_t gfp)
10232 {
10233         nl80211_send_mlme_event(rdev, netdev, buf, len,
10234                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10235 }
10236
10237 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10238                            struct net_device *netdev, const u8 *buf,
10239                            size_t len, gfp_t gfp)
10240 {
10241         nl80211_send_mlme_event(rdev, netdev, buf, len,
10242                                 NL80211_CMD_DISASSOCIATE, gfp);
10243 }
10244
10245 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10246                                   size_t len)
10247 {
10248         struct wireless_dev *wdev = dev->ieee80211_ptr;
10249         struct wiphy *wiphy = wdev->wiphy;
10250         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10251         const struct ieee80211_mgmt *mgmt = (void *)buf;
10252         u32 cmd;
10253
10254         if (WARN_ON(len < 2))
10255                 return;
10256
10257         if (ieee80211_is_deauth(mgmt->frame_control))
10258                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10259         else
10260                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10261
10262         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10263         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10264 }
10265 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10266
10267 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10268                                       struct net_device *netdev, int cmd,
10269                                       const u8 *addr, gfp_t gfp)
10270 {
10271         struct sk_buff *msg;
10272         void *hdr;
10273
10274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10275         if (!msg)
10276                 return;
10277
10278         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10279         if (!hdr) {
10280                 nlmsg_free(msg);
10281                 return;
10282         }
10283
10284         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10285             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10286             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10287             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10288                 goto nla_put_failure;
10289
10290         genlmsg_end(msg, hdr);
10291
10292         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10293                                 NL80211_MCGRP_MLME, gfp);
10294         return;
10295
10296  nla_put_failure:
10297         genlmsg_cancel(msg, hdr);
10298         nlmsg_free(msg);
10299 }
10300
10301 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10302                                struct net_device *netdev, const u8 *addr,
10303                                gfp_t gfp)
10304 {
10305         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10306                                   addr, gfp);
10307 }
10308
10309 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10310                                 struct net_device *netdev, const u8 *addr,
10311                                 gfp_t gfp)
10312 {
10313         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10314                                   addr, gfp);
10315 }
10316
10317 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10318                                  struct net_device *netdev, const u8 *bssid,
10319                                  const u8 *req_ie, size_t req_ie_len,
10320                                  const u8 *resp_ie, size_t resp_ie_len,
10321                                  u16 status, gfp_t gfp)
10322 {
10323         struct sk_buff *msg;
10324         void *hdr;
10325
10326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10327         if (!msg)
10328                 return;
10329
10330         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10331         if (!hdr) {
10332                 nlmsg_free(msg);
10333                 return;
10334         }
10335
10336         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10337             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10338             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10339             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10340             (req_ie &&
10341              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10342             (resp_ie &&
10343              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10344                 goto nla_put_failure;
10345
10346         genlmsg_end(msg, hdr);
10347
10348         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10349                                 NL80211_MCGRP_MLME, gfp);
10350         return;
10351
10352  nla_put_failure:
10353         genlmsg_cancel(msg, hdr);
10354         nlmsg_free(msg);
10355
10356 }
10357
10358 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10359                          struct net_device *netdev, const u8 *bssid,
10360                          const u8 *req_ie, size_t req_ie_len,
10361                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10362 {
10363         struct sk_buff *msg;
10364         void *hdr;
10365
10366         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10367         if (!msg)
10368                 return;
10369
10370         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10371         if (!hdr) {
10372                 nlmsg_free(msg);
10373                 return;
10374         }
10375
10376         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10377             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10378             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10379             (req_ie &&
10380              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10381             (resp_ie &&
10382              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10383                 goto nla_put_failure;
10384
10385         genlmsg_end(msg, hdr);
10386
10387         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10388                                 NL80211_MCGRP_MLME, gfp);
10389         return;
10390
10391  nla_put_failure:
10392         genlmsg_cancel(msg, hdr);
10393         nlmsg_free(msg);
10394
10395 }
10396
10397 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10398                                struct net_device *netdev, u16 reason,
10399                                const u8 *ie, size_t ie_len, bool from_ap)
10400 {
10401         struct sk_buff *msg;
10402         void *hdr;
10403
10404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10405         if (!msg)
10406                 return;
10407
10408         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10409         if (!hdr) {
10410                 nlmsg_free(msg);
10411                 return;
10412         }
10413
10414         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10415             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10416             (from_ap && reason &&
10417              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10418             (from_ap &&
10419              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10420             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10421                 goto nla_put_failure;
10422
10423         genlmsg_end(msg, hdr);
10424
10425         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10426                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10427         return;
10428
10429  nla_put_failure:
10430         genlmsg_cancel(msg, hdr);
10431         nlmsg_free(msg);
10432
10433 }
10434
10435 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10436                              struct net_device *netdev, const u8 *bssid,
10437                              gfp_t gfp)
10438 {
10439         struct sk_buff *msg;
10440         void *hdr;
10441
10442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10443         if (!msg)
10444                 return;
10445
10446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10447         if (!hdr) {
10448                 nlmsg_free(msg);
10449                 return;
10450         }
10451
10452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10453             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10454             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10455                 goto nla_put_failure;
10456
10457         genlmsg_end(msg, hdr);
10458
10459         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10460                                 NL80211_MCGRP_MLME, gfp);
10461         return;
10462
10463  nla_put_failure:
10464         genlmsg_cancel(msg, hdr);
10465         nlmsg_free(msg);
10466 }
10467
10468 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10469                                         const u8* ie, u8 ie_len, gfp_t gfp)
10470 {
10471         struct wireless_dev *wdev = dev->ieee80211_ptr;
10472         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10473         struct sk_buff *msg;
10474         void *hdr;
10475
10476         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10477                 return;
10478
10479         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10480
10481         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10482         if (!msg)
10483                 return;
10484
10485         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10486         if (!hdr) {
10487                 nlmsg_free(msg);
10488                 return;
10489         }
10490
10491         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10494             (ie_len && ie &&
10495              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10496                 goto nla_put_failure;
10497
10498         genlmsg_end(msg, hdr);
10499
10500         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10501                                 NL80211_MCGRP_MLME, gfp);
10502         return;
10503
10504  nla_put_failure:
10505         genlmsg_cancel(msg, hdr);
10506         nlmsg_free(msg);
10507 }
10508 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10509
10510 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10511                                  struct net_device *netdev, const u8 *addr,
10512                                  enum nl80211_key_type key_type, int key_id,
10513                                  const u8 *tsc, gfp_t gfp)
10514 {
10515         struct sk_buff *msg;
10516         void *hdr;
10517
10518         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10519         if (!msg)
10520                 return;
10521
10522         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10523         if (!hdr) {
10524                 nlmsg_free(msg);
10525                 return;
10526         }
10527
10528         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10529             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10530             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10531             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10532             (key_id != -1 &&
10533              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10534             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10535                 goto nla_put_failure;
10536
10537         genlmsg_end(msg, hdr);
10538
10539         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10540                                 NL80211_MCGRP_MLME, gfp);
10541         return;
10542
10543  nla_put_failure:
10544         genlmsg_cancel(msg, hdr);
10545         nlmsg_free(msg);
10546 }
10547
10548 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10549                                     struct ieee80211_channel *channel_before,
10550                                     struct ieee80211_channel *channel_after)
10551 {
10552         struct sk_buff *msg;
10553         void *hdr;
10554         struct nlattr *nl_freq;
10555
10556         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10557         if (!msg)
10558                 return;
10559
10560         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10561         if (!hdr) {
10562                 nlmsg_free(msg);
10563                 return;
10564         }
10565
10566         /*
10567          * Since we are applying the beacon hint to a wiphy we know its
10568          * wiphy_idx is valid
10569          */
10570         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10571                 goto nla_put_failure;
10572
10573         /* Before */
10574         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10575         if (!nl_freq)
10576                 goto nla_put_failure;
10577         if (nl80211_msg_put_channel(msg, channel_before, false))
10578                 goto nla_put_failure;
10579         nla_nest_end(msg, nl_freq);
10580
10581         /* After */
10582         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10583         if (!nl_freq)
10584                 goto nla_put_failure;
10585         if (nl80211_msg_put_channel(msg, channel_after, false))
10586                 goto nla_put_failure;
10587         nla_nest_end(msg, nl_freq);
10588
10589         genlmsg_end(msg, hdr);
10590
10591         rcu_read_lock();
10592         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10593                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10594         rcu_read_unlock();
10595
10596         return;
10597
10598 nla_put_failure:
10599         genlmsg_cancel(msg, hdr);
10600         nlmsg_free(msg);
10601 }
10602
10603 static void nl80211_send_remain_on_chan_event(
10604         int cmd, struct cfg80211_registered_device *rdev,
10605         struct wireless_dev *wdev, u64 cookie,
10606         struct ieee80211_channel *chan,
10607         unsigned int duration, gfp_t gfp)
10608 {
10609         struct sk_buff *msg;
10610         void *hdr;
10611
10612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10613         if (!msg)
10614                 return;
10615
10616         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10617         if (!hdr) {
10618                 nlmsg_free(msg);
10619                 return;
10620         }
10621
10622         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10623             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10624                                          wdev->netdev->ifindex)) ||
10625             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10626             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10627             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10628                         NL80211_CHAN_NO_HT) ||
10629             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10630                 goto nla_put_failure;
10631
10632         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10633             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10634                 goto nla_put_failure;
10635
10636         genlmsg_end(msg, hdr);
10637
10638         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10639                                 NL80211_MCGRP_MLME, gfp);
10640         return;
10641
10642  nla_put_failure:
10643         genlmsg_cancel(msg, hdr);
10644         nlmsg_free(msg);
10645 }
10646
10647 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10648                                struct ieee80211_channel *chan,
10649                                unsigned int duration, gfp_t gfp)
10650 {
10651         struct wiphy *wiphy = wdev->wiphy;
10652         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10653
10654         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10655         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10656                                           rdev, wdev, cookie, chan,
10657                                           duration, gfp);
10658 }
10659 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10660
10661 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10662                                         struct ieee80211_channel *chan,
10663                                         gfp_t gfp)
10664 {
10665         struct wiphy *wiphy = wdev->wiphy;
10666         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10667
10668         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10669         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10670                                           rdev, wdev, cookie, chan, 0, gfp);
10671 }
10672 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10673
10674 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10675                       struct station_info *sinfo, gfp_t gfp)
10676 {
10677         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10678         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10679         struct sk_buff *msg;
10680
10681         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10682
10683         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10684         if (!msg)
10685                 return;
10686
10687         if (nl80211_send_station(msg, 0, 0, 0,
10688                                  rdev, dev, mac_addr, sinfo) < 0) {
10689                 nlmsg_free(msg);
10690                 return;
10691         }
10692
10693         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10694                                 NL80211_MCGRP_MLME, gfp);
10695 }
10696 EXPORT_SYMBOL(cfg80211_new_sta);
10697
10698 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10699 {
10700         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10701         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10702         struct sk_buff *msg;
10703         void *hdr;
10704
10705         trace_cfg80211_del_sta(dev, mac_addr);
10706
10707         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10708         if (!msg)
10709                 return;
10710
10711         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10712         if (!hdr) {
10713                 nlmsg_free(msg);
10714                 return;
10715         }
10716
10717         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10718             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10719                 goto nla_put_failure;
10720
10721         genlmsg_end(msg, hdr);
10722
10723         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10724                                 NL80211_MCGRP_MLME, gfp);
10725         return;
10726
10727  nla_put_failure:
10728         genlmsg_cancel(msg, hdr);
10729         nlmsg_free(msg);
10730 }
10731 EXPORT_SYMBOL(cfg80211_del_sta);
10732
10733 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10734                           enum nl80211_connect_failed_reason reason,
10735                           gfp_t gfp)
10736 {
10737         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10738         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10739         struct sk_buff *msg;
10740         void *hdr;
10741
10742         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10743         if (!msg)
10744                 return;
10745
10746         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10747         if (!hdr) {
10748                 nlmsg_free(msg);
10749                 return;
10750         }
10751
10752         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10753             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10754             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10755                 goto nla_put_failure;
10756
10757         genlmsg_end(msg, hdr);
10758
10759         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10760                                 NL80211_MCGRP_MLME, gfp);
10761         return;
10762
10763  nla_put_failure:
10764         genlmsg_cancel(msg, hdr);
10765         nlmsg_free(msg);
10766 }
10767 EXPORT_SYMBOL(cfg80211_conn_failed);
10768
10769 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10770                                        const u8 *addr, gfp_t gfp)
10771 {
10772         struct wireless_dev *wdev = dev->ieee80211_ptr;
10773         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10774         struct sk_buff *msg;
10775         void *hdr;
10776         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10777
10778         if (!nlportid)
10779                 return false;
10780
10781         msg = nlmsg_new(100, gfp);
10782         if (!msg)
10783                 return true;
10784
10785         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10786         if (!hdr) {
10787                 nlmsg_free(msg);
10788                 return true;
10789         }
10790
10791         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10792             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10793             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10794                 goto nla_put_failure;
10795
10796         genlmsg_end(msg, hdr);
10797         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10798         return true;
10799
10800  nla_put_failure:
10801         genlmsg_cancel(msg, hdr);
10802         nlmsg_free(msg);
10803         return true;
10804 }
10805
10806 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10807                                 const u8 *addr, gfp_t gfp)
10808 {
10809         struct wireless_dev *wdev = dev->ieee80211_ptr;
10810         bool ret;
10811
10812         trace_cfg80211_rx_spurious_frame(dev, addr);
10813
10814         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10815                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10816                 trace_cfg80211_return_bool(false);
10817                 return false;
10818         }
10819         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10820                                          addr, gfp);
10821         trace_cfg80211_return_bool(ret);
10822         return ret;
10823 }
10824 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10825
10826 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10827                                         const u8 *addr, gfp_t gfp)
10828 {
10829         struct wireless_dev *wdev = dev->ieee80211_ptr;
10830         bool ret;
10831
10832         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10833
10834         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10835                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10836                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10837                 trace_cfg80211_return_bool(false);
10838                 return false;
10839         }
10840         ret = __nl80211_unexpected_frame(dev,
10841                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10842                                          addr, gfp);
10843         trace_cfg80211_return_bool(ret);
10844         return ret;
10845 }
10846 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10847
10848 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10849                       struct wireless_dev *wdev, u32 nlportid,
10850                       int freq, int sig_dbm,
10851                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10852 {
10853         struct net_device *netdev = wdev->netdev;
10854         struct sk_buff *msg;
10855         void *hdr;
10856
10857         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10858         if (!msg)
10859                 return -ENOMEM;
10860
10861         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10862         if (!hdr) {
10863                 nlmsg_free(msg);
10864                 return -ENOMEM;
10865         }
10866
10867         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10868             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10869                                         netdev->ifindex)) ||
10870             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10871             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10872             (sig_dbm &&
10873              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10874             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10875             (flags &&
10876              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10877                 goto nla_put_failure;
10878
10879         genlmsg_end(msg, hdr);
10880
10881         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10882
10883  nla_put_failure:
10884         genlmsg_cancel(msg, hdr);
10885         nlmsg_free(msg);
10886         return -ENOBUFS;
10887 }
10888
10889 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10890                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10891 {
10892         struct wiphy *wiphy = wdev->wiphy;
10893         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10894         struct net_device *netdev = wdev->netdev;
10895         struct sk_buff *msg;
10896         void *hdr;
10897
10898         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10899
10900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10901         if (!msg)
10902                 return;
10903
10904         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10905         if (!hdr) {
10906                 nlmsg_free(msg);
10907                 return;
10908         }
10909
10910         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10911             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10912                                    netdev->ifindex)) ||
10913             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10914             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10915             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10916             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10917                 goto nla_put_failure;
10918
10919         genlmsg_end(msg, hdr);
10920
10921         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10922                                 NL80211_MCGRP_MLME, gfp);
10923         return;
10924
10925  nla_put_failure:
10926         genlmsg_cancel(msg, hdr);
10927         nlmsg_free(msg);
10928 }
10929 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10930
10931 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10932                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10933                               gfp_t gfp)
10934 {
10935         struct wireless_dev *wdev = dev->ieee80211_ptr;
10936         struct wiphy *wiphy = wdev->wiphy;
10937         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10938         struct sk_buff *msg;
10939         struct nlattr *pinfoattr;
10940         void *hdr;
10941
10942         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10943
10944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10945         if (!msg)
10946                 return;
10947
10948         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10949         if (!hdr) {
10950                 nlmsg_free(msg);
10951                 return;
10952         }
10953
10954         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10955             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10956                 goto nla_put_failure;
10957
10958         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10959         if (!pinfoattr)
10960                 goto nla_put_failure;
10961
10962         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10963                         rssi_event))
10964                 goto nla_put_failure;
10965
10966         nla_nest_end(msg, pinfoattr);
10967
10968         genlmsg_end(msg, hdr);
10969
10970         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10971                                 NL80211_MCGRP_MLME, gfp);
10972         return;
10973
10974  nla_put_failure:
10975         genlmsg_cancel(msg, hdr);
10976         nlmsg_free(msg);
10977 }
10978 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10979
10980 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10981                                      struct net_device *netdev, const u8 *bssid,
10982                                      const u8 *replay_ctr, gfp_t gfp)
10983 {
10984         struct sk_buff *msg;
10985         struct nlattr *rekey_attr;
10986         void *hdr;
10987
10988         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10989         if (!msg)
10990                 return;
10991
10992         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10993         if (!hdr) {
10994                 nlmsg_free(msg);
10995                 return;
10996         }
10997
10998         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10999             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11000             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11001                 goto nla_put_failure;
11002
11003         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11004         if (!rekey_attr)
11005                 goto nla_put_failure;
11006
11007         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11008                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11009                 goto nla_put_failure;
11010
11011         nla_nest_end(msg, rekey_attr);
11012
11013         genlmsg_end(msg, hdr);
11014
11015         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11016                                 NL80211_MCGRP_MLME, gfp);
11017         return;
11018
11019  nla_put_failure:
11020         genlmsg_cancel(msg, hdr);
11021         nlmsg_free(msg);
11022 }
11023
11024 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11025                                const u8 *replay_ctr, gfp_t gfp)
11026 {
11027         struct wireless_dev *wdev = dev->ieee80211_ptr;
11028         struct wiphy *wiphy = wdev->wiphy;
11029         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11030
11031         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11032         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11033 }
11034 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11035
11036 static void
11037 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11038                                struct net_device *netdev, int index,
11039                                const u8 *bssid, bool preauth, gfp_t gfp)
11040 {
11041         struct sk_buff *msg;
11042         struct nlattr *attr;
11043         void *hdr;
11044
11045         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11046         if (!msg)
11047                 return;
11048
11049         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11050         if (!hdr) {
11051                 nlmsg_free(msg);
11052                 return;
11053         }
11054
11055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11056             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11057                 goto nla_put_failure;
11058
11059         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11060         if (!attr)
11061                 goto nla_put_failure;
11062
11063         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11064             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11065             (preauth &&
11066              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11067                 goto nla_put_failure;
11068
11069         nla_nest_end(msg, attr);
11070
11071         genlmsg_end(msg, hdr);
11072
11073         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11074                                 NL80211_MCGRP_MLME, gfp);
11075         return;
11076
11077  nla_put_failure:
11078         genlmsg_cancel(msg, hdr);
11079         nlmsg_free(msg);
11080 }
11081
11082 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11083                                      const u8 *bssid, bool preauth, gfp_t gfp)
11084 {
11085         struct wireless_dev *wdev = dev->ieee80211_ptr;
11086         struct wiphy *wiphy = wdev->wiphy;
11087         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11088
11089         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11090         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11091 }
11092 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11093
11094 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11095                                      struct net_device *netdev,
11096                                      struct cfg80211_chan_def *chandef,
11097                                      gfp_t gfp)
11098 {
11099         struct sk_buff *msg;
11100         void *hdr;
11101
11102         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11103         if (!msg)
11104                 return;
11105
11106         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11107         if (!hdr) {
11108                 nlmsg_free(msg);
11109                 return;
11110         }
11111
11112         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11113                 goto nla_put_failure;
11114
11115         if (nl80211_send_chandef(msg, chandef))
11116                 goto nla_put_failure;
11117
11118         genlmsg_end(msg, hdr);
11119
11120         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11121                                 NL80211_MCGRP_MLME, gfp);
11122         return;
11123
11124  nla_put_failure:
11125         genlmsg_cancel(msg, hdr);
11126         nlmsg_free(msg);
11127 }
11128
11129 void cfg80211_ch_switch_notify(struct net_device *dev,
11130                                struct cfg80211_chan_def *chandef)
11131 {
11132         struct wireless_dev *wdev = dev->ieee80211_ptr;
11133         struct wiphy *wiphy = wdev->wiphy;
11134         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11135
11136         ASSERT_WDEV_LOCK(wdev);
11137
11138         trace_cfg80211_ch_switch_notify(dev, chandef);
11139
11140         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11141                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11142                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11143                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11144                 return;
11145
11146         wdev->channel = chandef->chan;
11147         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11148 }
11149 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11150
11151 void cfg80211_cqm_txe_notify(struct net_device *dev,
11152                              const u8 *peer, u32 num_packets,
11153                              u32 rate, u32 intvl, gfp_t gfp)
11154 {
11155         struct wireless_dev *wdev = dev->ieee80211_ptr;
11156         struct wiphy *wiphy = wdev->wiphy;
11157         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11158         struct sk_buff *msg;
11159         struct nlattr *pinfoattr;
11160         void *hdr;
11161
11162         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11163         if (!msg)
11164                 return;
11165
11166         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11167         if (!hdr) {
11168                 nlmsg_free(msg);
11169                 return;
11170         }
11171
11172         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11173             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11174             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11175                 goto nla_put_failure;
11176
11177         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11178         if (!pinfoattr)
11179                 goto nla_put_failure;
11180
11181         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11182                 goto nla_put_failure;
11183
11184         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11185                 goto nla_put_failure;
11186
11187         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11188                 goto nla_put_failure;
11189
11190         nla_nest_end(msg, pinfoattr);
11191
11192         genlmsg_end(msg, hdr);
11193
11194         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11195                                 NL80211_MCGRP_MLME, gfp);
11196         return;
11197
11198  nla_put_failure:
11199         genlmsg_cancel(msg, hdr);
11200         nlmsg_free(msg);
11201 }
11202 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11203
11204 void
11205 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11206                      const struct cfg80211_chan_def *chandef,
11207                      enum nl80211_radar_event event,
11208                      struct net_device *netdev, gfp_t gfp)
11209 {
11210         struct sk_buff *msg;
11211         void *hdr;
11212
11213         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11214         if (!msg)
11215                 return;
11216
11217         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11218         if (!hdr) {
11219                 nlmsg_free(msg);
11220                 return;
11221         }
11222
11223         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11224                 goto nla_put_failure;
11225
11226         /* NOP and radar events don't need a netdev parameter */
11227         if (netdev) {
11228                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11229
11230                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11231                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11232                         goto nla_put_failure;
11233         }
11234
11235         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11236                 goto nla_put_failure;
11237
11238         if (nl80211_send_chandef(msg, chandef))
11239                 goto nla_put_failure;
11240
11241         genlmsg_end(msg, hdr);
11242
11243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11244                                 NL80211_MCGRP_MLME, gfp);
11245         return;
11246
11247  nla_put_failure:
11248         genlmsg_cancel(msg, hdr);
11249         nlmsg_free(msg);
11250 }
11251
11252 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11253                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11254 {
11255         struct wireless_dev *wdev = dev->ieee80211_ptr;
11256         struct wiphy *wiphy = wdev->wiphy;
11257         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11258         struct sk_buff *msg;
11259         struct nlattr *pinfoattr;
11260         void *hdr;
11261
11262         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11263
11264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11265         if (!msg)
11266                 return;
11267
11268         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11269         if (!hdr) {
11270                 nlmsg_free(msg);
11271                 return;
11272         }
11273
11274         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11275             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11276             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11277                 goto nla_put_failure;
11278
11279         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11280         if (!pinfoattr)
11281                 goto nla_put_failure;
11282
11283         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11284                 goto nla_put_failure;
11285
11286         nla_nest_end(msg, pinfoattr);
11287
11288         genlmsg_end(msg, hdr);
11289
11290         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11291                                 NL80211_MCGRP_MLME, gfp);
11292         return;
11293
11294  nla_put_failure:
11295         genlmsg_cancel(msg, hdr);
11296         nlmsg_free(msg);
11297 }
11298 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11299
11300 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11301                            u64 cookie, bool acked, gfp_t gfp)
11302 {
11303         struct wireless_dev *wdev = dev->ieee80211_ptr;
11304         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11305         struct sk_buff *msg;
11306         void *hdr;
11307
11308         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11309
11310         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11311
11312         if (!msg)
11313                 return;
11314
11315         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11316         if (!hdr) {
11317                 nlmsg_free(msg);
11318                 return;
11319         }
11320
11321         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11322             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11323             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11324             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11325             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11326                 goto nla_put_failure;
11327
11328         genlmsg_end(msg, hdr);
11329
11330         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11331                                 NL80211_MCGRP_MLME, gfp);
11332         return;
11333
11334  nla_put_failure:
11335         genlmsg_cancel(msg, hdr);
11336         nlmsg_free(msg);
11337 }
11338 EXPORT_SYMBOL(cfg80211_probe_status);
11339
11340 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11341                                  const u8 *frame, size_t len,
11342                                  int freq, int sig_dbm)
11343 {
11344         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11345         struct sk_buff *msg;
11346         void *hdr;
11347         struct cfg80211_beacon_registration *reg;
11348
11349         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11350
11351         spin_lock_bh(&rdev->beacon_registrations_lock);
11352         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11353                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11354                 if (!msg) {
11355                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11356                         return;
11357                 }
11358
11359                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11360                 if (!hdr)
11361                         goto nla_put_failure;
11362
11363                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11364                     (freq &&
11365                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11366                     (sig_dbm &&
11367                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11368                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11369                         goto nla_put_failure;
11370
11371                 genlmsg_end(msg, hdr);
11372
11373                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11374         }
11375         spin_unlock_bh(&rdev->beacon_registrations_lock);
11376         return;
11377
11378  nla_put_failure:
11379         spin_unlock_bh(&rdev->beacon_registrations_lock);
11380         if (hdr)
11381                 genlmsg_cancel(msg, hdr);
11382         nlmsg_free(msg);
11383 }
11384 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11385
11386 #ifdef CONFIG_PM
11387 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11388                                    struct cfg80211_wowlan_wakeup *wakeup,
11389                                    gfp_t gfp)
11390 {
11391         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11392         struct sk_buff *msg;
11393         void *hdr;
11394         int size = 200;
11395
11396         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11397
11398         if (wakeup)
11399                 size += wakeup->packet_present_len;
11400
11401         msg = nlmsg_new(size, gfp);
11402         if (!msg)
11403                 return;
11404
11405         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11406         if (!hdr)
11407                 goto free_msg;
11408
11409         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11410             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11411                 goto free_msg;
11412
11413         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11414                                         wdev->netdev->ifindex))
11415                 goto free_msg;
11416
11417         if (wakeup) {
11418                 struct nlattr *reasons;
11419
11420                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11421                 if (!reasons)
11422                         goto free_msg;
11423
11424                 if (wakeup->disconnect &&
11425                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11426                         goto free_msg;
11427                 if (wakeup->magic_pkt &&
11428                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11429                         goto free_msg;
11430                 if (wakeup->gtk_rekey_failure &&
11431                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11432                         goto free_msg;
11433                 if (wakeup->eap_identity_req &&
11434                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11435                         goto free_msg;
11436                 if (wakeup->four_way_handshake &&
11437                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11438                         goto free_msg;
11439                 if (wakeup->rfkill_release &&
11440                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11441                         goto free_msg;
11442
11443                 if (wakeup->pattern_idx >= 0 &&
11444                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11445                                 wakeup->pattern_idx))
11446                         goto free_msg;
11447
11448                 if (wakeup->tcp_match &&
11449                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11450                         goto free_msg;
11451
11452                 if (wakeup->tcp_connlost &&
11453                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11454                         goto free_msg;
11455
11456                 if (wakeup->tcp_nomoretokens &&
11457                     nla_put_flag(msg,
11458                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11459                         goto free_msg;
11460
11461                 if (wakeup->packet) {
11462                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11463                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11464
11465                         if (!wakeup->packet_80211) {
11466                                 pkt_attr =
11467                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11468                                 len_attr =
11469                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11470                         }
11471
11472                         if (wakeup->packet_len &&
11473                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11474                                 goto free_msg;
11475
11476                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11477                                     wakeup->packet))
11478                                 goto free_msg;
11479                 }
11480
11481                 nla_nest_end(msg, reasons);
11482         }
11483
11484         genlmsg_end(msg, hdr);
11485
11486         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11487                                 NL80211_MCGRP_MLME, gfp);
11488         return;
11489
11490  free_msg:
11491         nlmsg_free(msg);
11492 }
11493 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11494 #endif
11495
11496 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11497                                 enum nl80211_tdls_operation oper,
11498                                 u16 reason_code, gfp_t gfp)
11499 {
11500         struct wireless_dev *wdev = dev->ieee80211_ptr;
11501         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11502         struct sk_buff *msg;
11503         void *hdr;
11504
11505         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11506                                          reason_code);
11507
11508         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11509         if (!msg)
11510                 return;
11511
11512         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11513         if (!hdr) {
11514                 nlmsg_free(msg);
11515                 return;
11516         }
11517
11518         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11519             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11520             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11521             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11522             (reason_code > 0 &&
11523              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11524                 goto nla_put_failure;
11525
11526         genlmsg_end(msg, hdr);
11527
11528         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11529                                 NL80211_MCGRP_MLME, gfp);
11530         return;
11531
11532  nla_put_failure:
11533         genlmsg_cancel(msg, hdr);
11534         nlmsg_free(msg);
11535 }
11536 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11537
11538 static int nl80211_netlink_notify(struct notifier_block * nb,
11539                                   unsigned long state,
11540                                   void *_notify)
11541 {
11542         struct netlink_notify *notify = _notify;
11543         struct cfg80211_registered_device *rdev;
11544         struct wireless_dev *wdev;
11545         struct cfg80211_beacon_registration *reg, *tmp;
11546
11547         if (state != NETLINK_URELEASE)
11548                 return NOTIFY_DONE;
11549
11550         rcu_read_lock();
11551
11552         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11553                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11554                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11555
11556                 spin_lock_bh(&rdev->beacon_registrations_lock);
11557                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11558                                          list) {
11559                         if (reg->nlportid == notify->portid) {
11560                                 list_del(&reg->list);
11561                                 kfree(reg);
11562                                 break;
11563                         }
11564                 }
11565                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11566         }
11567
11568         rcu_read_unlock();
11569
11570         return NOTIFY_DONE;
11571 }
11572
11573 static struct notifier_block nl80211_netlink_notifier = {
11574         .notifier_call = nl80211_netlink_notify,
11575 };
11576
11577 void cfg80211_ft_event(struct net_device *netdev,
11578                        struct cfg80211_ft_event_params *ft_event)
11579 {
11580         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11581         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11582         struct sk_buff *msg;
11583         void *hdr;
11584
11585         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11586
11587         if (!ft_event->target_ap)
11588                 return;
11589
11590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11591         if (!msg)
11592                 return;
11593
11594         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11595         if (!hdr)
11596                 goto out;
11597
11598         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11599             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11600             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11601                 goto out;
11602
11603         if (ft_event->ies &&
11604             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11605                 goto out;
11606         if (ft_event->ric_ies &&
11607             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11608                     ft_event->ric_ies))
11609                 goto out;
11610
11611         genlmsg_end(msg, hdr);
11612
11613         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11614                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11615         return;
11616  out:
11617         nlmsg_free(msg);
11618 }
11619 EXPORT_SYMBOL(cfg80211_ft_event);
11620
11621 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11622 {
11623         struct cfg80211_registered_device *rdev;
11624         struct sk_buff *msg;
11625         void *hdr;
11626         u32 nlportid;
11627
11628         rdev = wiphy_to_dev(wdev->wiphy);
11629         if (!rdev->crit_proto_nlportid)
11630                 return;
11631
11632         nlportid = rdev->crit_proto_nlportid;
11633         rdev->crit_proto_nlportid = 0;
11634
11635         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11636         if (!msg)
11637                 return;
11638
11639         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11640         if (!hdr)
11641                 goto nla_put_failure;
11642
11643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11644             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11645                 goto nla_put_failure;
11646
11647         genlmsg_end(msg, hdr);
11648
11649         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11650         return;
11651
11652  nla_put_failure:
11653         if (hdr)
11654                 genlmsg_cancel(msg, hdr);
11655         nlmsg_free(msg);
11656
11657 }
11658 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11659
11660 /* initialisation/exit functions */
11661
11662 int nl80211_init(void)
11663 {
11664         int err;
11665
11666         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11667                                                    nl80211_mcgrps);
11668         if (err)
11669                 return err;
11670
11671         err = netlink_register_notifier(&nl80211_netlink_notifier);
11672         if (err)
11673                 goto err_out;
11674
11675         return 0;
11676  err_out:
11677         genl_unregister_family(&nl80211_fam);
11678         return err;
11679 }
11680
11681 void nl80211_exit(void)
11682 {
11683         netlink_unregister_notifier(&nl80211_netlink_notifier);
11684         genl_unregister_family(&nl80211_fam);
11685 }