nl80211.c 333 KB
Newer Older
1 2 3
/*
 * This is the new netlink-based wireless configuration interface.
 *
4
 * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5
 * Copyright 2013-2014  Intel Mobile Communications GmbH
6 7 8 9 10
 */

#include <linux/if.h>
#include <linux/module.h>
#include <linux/err.h>
11
#include <linux/slab.h>
12 13 14 15 16 17
#include <linux/list.h>
#include <linux/if_ether.h>
#include <linux/ieee80211.h>
#include <linux/nl80211.h>
#include <linux/rtnetlink.h>
#include <linux/netlink.h>
18
#include <linux/etherdevice.h>
19
#include <net/net_namespace.h>
20 21
#include <net/genetlink.h>
#include <net/cfg80211.h>
22
#include <net/sock.h>
23
#include <net/inet_connection_sock.h>
24 25
#include "core.h"
#include "nl80211.h"
26
#include "reg.h"
27
#include "rdev-ops.h"
28

29 30 31 32 33
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit);

34
static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
35
			    struct genl_info *info);
36
static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
37 38
			      struct genl_info *info);

39 40
/* the netlink family */
static struct genl_family nl80211_fam = {
41 42 43 44
	.id = GENL_ID_GENERATE,		/* don't bother with a hardcoded ID */
	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
	.hdrsize = 0,			/* no private header */
	.version = 1,			/* no particular meaning now */
45
	.maxattr = NL80211_ATTR_MAX,
46
	.netnsok = true,
47 48
	.pre_doit = nl80211_pre_doit,
	.post_doit = nl80211_post_doit,
49 50
};

51 52 53 54 55 56
/* multicast groups */
enum nl80211_multicast_groups {
	NL80211_MCGRP_CONFIG,
	NL80211_MCGRP_SCAN,
	NL80211_MCGRP_REGULATORY,
	NL80211_MCGRP_MLME,
57
	NL80211_MCGRP_VENDOR,
58 59 60 61 62 63 64 65
	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
};

static const struct genl_multicast_group nl80211_mcgrps[] = {
	[NL80211_MCGRP_CONFIG] = { .name = "config", },
	[NL80211_MCGRP_SCAN] = { .name = "scan", },
	[NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
	[NL80211_MCGRP_MLME] = { .name = "mlme", },
66
	[NL80211_MCGRP_VENDOR] = { .name = "vendor", },
67 68 69 70 71
#ifdef CONFIG_NL80211_TESTMODE
	[NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
#endif
};

72 73 74
/* returns ERR_PTR values */
static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
75
{
76 77 78 79 80 81 82
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *result = NULL;
	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
	u64 wdev_id;
	int wiphy_idx = -1;
	int ifidx = -1;
83

84
	ASSERT_RTNL();
85

86 87
	if (!have_ifidx && !have_wdev_id)
		return ERR_PTR(-EINVAL);
88

89 90 91 92 93
	if (have_ifidx)
		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
	if (have_wdev_id) {
		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		wiphy_idx = wdev_id >> 32;
94 95
	}

96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		struct wireless_dev *wdev;

		if (wiphy_net(&rdev->wiphy) != netns)
			continue;

		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
			continue;

		list_for_each_entry(wdev, &rdev->wdev_list, list) {
			if (have_ifidx && wdev->netdev &&
			    wdev->netdev->ifindex == ifidx) {
				result = wdev;
				break;
			}
			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
				result = wdev;
				break;
			}
		}

		if (result)
			break;
	}

	if (result)
		return result;
	return ERR_PTR(-ENODEV);
124 125
}

126
static struct cfg80211_registered_device *
127
__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
128
{
129 130
	struct cfg80211_registered_device *rdev = NULL, *tmp;
	struct net_device *netdev;
131

132
	ASSERT_RTNL();
133

134
	if (!attrs[NL80211_ATTR_WIPHY] &&
135 136
	    !attrs[NL80211_ATTR_IFINDEX] &&
	    !attrs[NL80211_ATTR_WDEV])
137 138
		return ERR_PTR(-EINVAL);

139
	if (attrs[NL80211_ATTR_WIPHY])
140
		rdev = cfg80211_rdev_by_wiphy_idx(
141
				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
142

143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166
	if (attrs[NL80211_ATTR_WDEV]) {
		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		struct wireless_dev *wdev;
		bool found = false;

		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
		if (tmp) {
			/* make sure wdev exists */
			list_for_each_entry(wdev, &tmp->wdev_list, list) {
				if (wdev->identifier != (u32)wdev_id)
					continue;
				found = true;
				break;
			}

			if (!found)
				tmp = NULL;

			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);
			rdev = tmp;
		}
	}

167 168
	if (attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
169
		netdev = __dev_get_by_index(netns, ifindex);
170 171
		if (netdev) {
			if (netdev->ieee80211_ptr)
172 173
				tmp = wiphy_to_rdev(
					netdev->ieee80211_ptr->wiphy);
174 175 176 177 178 179 180 181 182 183 184 185
			else
				tmp = NULL;

			/* not wireless device -- return error */
			if (!tmp)
				return ERR_PTR(-EINVAL);

			/* mismatch -- return error */
			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);

			rdev = tmp;
186 187 188
		}
	}

189 190
	if (!rdev)
		return ERR_PTR(-ENODEV);
191

192 193 194 195
	if (netns != wiphy_net(&rdev->wiphy))
		return ERR_PTR(-ENODEV);

	return rdev;
196 197 198 199 200 201 202 203 204 205
}

/*
 * This function returns a pointer to the driver
 * that the genl_info item that is passed refers to.
 *
 * The result of this can be a PTR_ERR and hence must
 * be checked with IS_ERR() for errors.
 */
static struct cfg80211_registered_device *
206
cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
207
{
208
	return __cfg80211_rdev_from_attrs(netns, info->attrs);
209 210
}

211
/* policy for the attributes */
212
static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
213 214
	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
215
				      .len = 20-1 },
216
	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
217

218
	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
Sujith's avatar
Sujith committed
219
	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
220 221 222 223
	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },

224 225 226 227
	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
228
	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
229
	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
230 231 232 233

	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
234

235 236
	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
237

238
	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
239 240 241 242 243
	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
				    .len = WLAN_MAX_KEY_LEN },
	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
244
	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
245
	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
246 247 248 249 250 251 252

	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
253 254 255 256 257
	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
					       .len = NL80211_MAX_SUPP_RATES },
258
	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
259
	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
Johannes Berg's avatar
Johannes Berg committed
260
	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
261
	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
262
				   .len = IEEE80211_MAX_MESH_ID_LEN },
263
	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
264

265 266 267
	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },

268 269 270
	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
271 272
	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
					   .len = NL80211_MAX_SUPP_RATES },
273
	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
274

275
	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
276
	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
277

278
	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
279 280 281 282

	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
			      .len = IEEE80211_MAX_DATA_LEN },
283 284
	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
285 286 287 288 289

	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
				.len = IEEE80211_MAX_SSID_LEN },
	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
290
	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
291
	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
292
	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
293 294 295
	[NL80211_ATTR_STA_FLAGS2] = {
		.len = sizeof(struct nl80211_sta_flag_update),
	},
296
	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
297 298
	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
299 300 301
	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
302
	[NL80211_ATTR_PID] = { .type = NLA_U32 },
303
	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
304 305
	[NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
				 .len = WLAN_PMKID_LEN },
306 307
	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
308
	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
309 310 311
	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
				 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
312
	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
313
	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
314
	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
315
	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
316 317
	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
318
	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
319 320
	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
321
	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
322
	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
323
	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
324
	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
325
	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
326
	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
327
	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
328
	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
329
	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
330 331 332 333
	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
334
	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
335
	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
336
	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
337 338 339 340 341
	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
342
	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
343
	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
344 345
	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
				      .len = IEEE80211_MAX_DATA_LEN },
346
	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
347 348 349 350
	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
		.len = NL80211_HT_CAPABILITY_LEN
	},
351
	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
352
	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
353
	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
354
	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
355
	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
356
	[NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
357
	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
358
	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
359 360
	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
361 362
	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
363 364
	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
365
	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
366 367 368 369
	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
		.len = NL80211_VHT_CAPABILITY_LEN,
	},
370 371 372
	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
				  .len = IEEE80211_MAX_DATA_LEN },
373
	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
374 375 376
	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
377 378
	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
379 380
	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
381
	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
382
	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
383 384 385
	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
386 387
	[NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
				   .len = IEEE80211_QOS_MAP_LEN_MAX },
388 389
	[NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
390
	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
391
	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
392
	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
393
	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
394 395 396
	[NL80211_ATTR_TSID] = { .type = NLA_U8 },
	[NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
397
	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
398
	[NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
399 400
};

401
/* policy for the key attributes */
Alexey Dobriyan's avatar
Alexey Dobriyan committed
402
static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
403
	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
404 405
	[NL80211_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
406
	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
407 408
	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
409
	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
410 411 412 413 414 415 416 417
	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
};

/* policy for the key default flags */
static const struct nla_policy
nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
418 419
};

420 421 422 423 424 425 426
/* policy for WoWLAN attributes */
static const struct nla_policy
nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
427 428 429 430
	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
431
	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
432
	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451
};

static const struct nla_policy
nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
	},
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
	},
	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
452 453
};

454 455 456 457 458 459 460 461
/* policy for coalesce rule attributes */
static const struct nla_policy
nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
};

462 463 464 465 466 467 468 469
/* policy for GTK rekey offload attributes */
static const struct nla_policy
nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
	[NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
};

470 471
static const struct nla_policy
nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
472
	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
473
						 .len = IEEE80211_MAX_SSID_LEN },
474
	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
475 476
};

477 478 479 480
static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
				     struct netlink_callback *cb,
				     struct cfg80211_registered_device **rdev,
				     struct wireless_dev **wdev)
481
{
482
	int err;
483

484
	rtnl_lock();
485

486 487 488 489 490 491
	if (!cb->args[0]) {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
			goto out_unlock;
492

493 494 495 496 497 498
		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
						   nl80211_fam.attrbuf);
		if (IS_ERR(*wdev)) {
			err = PTR_ERR(*wdev);
			goto out_unlock;
		}
499
		*rdev = wiphy_to_rdev((*wdev)->wiphy);
500 501
		/* 0 is the first index - add 1 to parse only once */
		cb->args[0] = (*rdev)->wiphy_idx + 1;
502 503
		cb->args[1] = (*wdev)->identifier;
	} else {
504 505
		/* subtract the 1 again here */
		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
506
		struct wireless_dev *tmp;
507

508 509 510 511
		if (!wiphy) {
			err = -ENODEV;
			goto out_unlock;
		}
512
		*rdev = wiphy_to_rdev(wiphy);
513
		*wdev = NULL;
514

515 516 517 518 519 520
		list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
			if (tmp->identifier == cb->args[1]) {
				*wdev = tmp;
				break;
			}
		}
521

522 523 524 525
		if (!*wdev) {
			err = -ENODEV;
			goto out_unlock;
		}
526 527 528
	}

	return 0;
529
 out_unlock:
530 531 532 533
	rtnl_unlock();
	return err;
}

534
static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
535 536 537 538
{
	rtnl_unlock();
}

539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568
/* IE validation */
static bool is_valid_ie_attr(const struct nlattr *attr)
{
	const u8 *pos;
	int len;

	if (!attr)
		return true;

	pos = nla_data(attr);
	len = nla_len(attr);

	while (len) {
		u8 elemlen;

		if (len < 2)
			return false;
		len -= 2;

		elemlen = pos[1];
		if (elemlen > len)
			return false;

		len -= elemlen;
		pos += 2 + elemlen;
	}

	return true;
}

569
/* message building helper */
570
static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
571 572 573
				   int flags, u8 cmd)
{
	/* since there is no private header just add the generic one */
574
	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
575 576
}

577
static int nl80211_msg_put_channel(struct sk_buff *msg,
578 579
				   struct ieee80211_channel *chan,
				   bool large)
580
{
581 582 583 584 585 586 587
	/* Some channels must be completely excluded from the
	 * list to protect old user-space tools from breaking
	 */
	if (!large && chan->flags &
	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
		return 0;

588 589 590
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
			chan->center_freq))
		goto nla_put_failure;
591

592 593 594
	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
		goto nla_put_failure;
595 596 597 598 599 600
	if (chan->flags & IEEE80211_CHAN_NO_IR) {
		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
			goto nla_put_failure;
		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
			goto nla_put_failure;
	}
601 602 603 604 605 606 607 608 609 610 611 612 613 614
	if (chan->flags & IEEE80211_CHAN_RADAR) {
		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
			goto nla_put_failure;
		if (large) {
			u32 time;

			time = elapsed_jiffies_msecs(chan->dfs_state_entered);

			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
					chan->dfs_state))
				goto nla_put_failure;
			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
					time))
				goto nla_put_failure;
615 616 617 618
			if (nla_put_u32(msg,
					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
					chan->dfs_cac_ms))
				goto nla_put_failure;
619 620
		}
	}
621

622 623 624 625 626 627 628 629 630 631 632 633 634
	if (large) {
		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
			goto nla_put_failure;
635 636 637 638 639 640
		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
			goto nla_put_failure;
641 642 643 644 645 646
		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
			goto nla_put_failure;
647 648
	}

649 650 651
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
			DBM_TO_MBM(chan->max_power)))
		goto nla_put_failure;
652 653 654 655 656 657 658

	return 0;

 nla_put_failure:
	return -ENOBUFS;
}

659 660
/* netlink command implementations */

661 662 663
struct key_parse {
	struct key_params p;
	int idx;
664
	int type;
665
	bool def, defmgmt;
666
	bool def_uni, def_multi;
667 668 669 670 671 672 673 674 675 676 677 678 679
};

static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
{
	struct nlattr *tb[NL80211_KEY_MAX + 1];
	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
				   nl80211_key_policy);
	if (err)
		return err;

	k->def = !!tb[NL80211_KEY_DEFAULT];
	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];

680 681 682 683 684 685 686
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702
	if (tb[NL80211_KEY_IDX])
		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);

	if (tb[NL80211_KEY_DATA]) {
		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
	}

	if (tb[NL80211_KEY_SEQ]) {
		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
	}

	if (tb[NL80211_KEY_CIPHER])
		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);

703 704 705 706 707 708
	if (tb[NL80211_KEY_TYPE]) {
		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

709 710
	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
711 712 713
		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				       tb[NL80211_KEY_DEFAULT_TYPES],
				       nl80211_key_default_policy);
714 715 716 717 718 719 720
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744
	return 0;
}

static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
{
	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
	}

	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
	}

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);

	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];

745 746 747 748 749 750 751
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

752 753 754 755 756 757
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

758 759 760 761 762 763 764 765 766 767 768 769 770
	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
		int err = nla_parse_nested(
				kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
				nl80211_key_default_policy);
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

771 772 773 774 775 776 777 778 779
	return 0;
}

static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
{
	int err;

	memset(k, 0, sizeof(*k));
	k->idx = -1;
780
	k->type = -1;
781 782 783 784 785 786 787 788 789 790 791 792

	if (info->attrs[NL80211_ATTR_KEY])
		err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
	else
		err = nl80211_parse_key_old(info, k);

	if (err)
		return err;

	if (k->def && k->defmgmt)
		return -EINVAL;

793 794 795 796 797
	if (k->defmgmt) {
		if (k->def_uni || !k->def_multi)
			return -EINVAL;
	}

798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813
	if (k->idx != -1) {
		if (k->defmgmt) {
			if (k->idx < 4 || k->idx > 5)
				return -EINVAL;
		} else if (k->def) {
			if (k->idx < 0 || k->idx > 3)
				return -EINVAL;
		} else {
			if (k->idx < 0 || k->idx > 5)
				return -EINVAL;
		}
	}

	return 0;
}

814 815
static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
816
		       struct nlattr *keys, bool *no_ht)
817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846
{
	struct key_parse parse;
	struct nlattr *key;
	struct cfg80211_cached_keys *result;
	int rem, err, def = 0;

	result = kzalloc(sizeof(*result), GFP_KERNEL);
	if (!result)
		return ERR_PTR(-ENOMEM);

	result->def = -1;
	result->defmgmt = -1;

	nla_for_each_nested(key, keys, rem) {
		memset(&parse, 0, sizeof(parse));
		parse.idx = -1;

		err = nl80211_parse_key_new(key, &parse);
		if (err)
			goto error;
		err = -EINVAL;
		if (!parse.p.key)
			goto error;
		if (parse.idx < 0 || parse.idx > 4)
			goto error;
		if (parse.def) {
			if (def)
				goto error;
			def = 1;
			result->def = parse.idx;
847 848
			if (!parse.def_uni || !parse.def_multi)
				goto error;
849 850 851
		} else if (parse.defmgmt)
			goto error;
		err = cfg80211_validate_key_settings(rdev, &parse.p,
852
						     parse.idx, false, NULL);
853 854 855 856 857 858
		if (err)
			goto error;
		result->params[parse.idx].cipher = parse.p.cipher;
		result->params[parse.idx].key_len = parse.p.key_len;
		result->params[parse.idx].key = result->data[parse.idx];
		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
859 860 861 862 863 864

		if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
		    parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
			if (no_ht)
				*no_ht = true;
		}
865 866 867 868 869 870 871 872 873 874 875 876 877 878 879
	}

	return result;
 error:
	kfree(result);
	return ERR_PTR(err);
}

static int nl80211_key_allowed(struct wireless_dev *wdev)
{
	ASSERT_WDEV_LOCK(wdev);

	switch (wdev->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
880
	case NL80211_IFTYPE_P2P_GO:
881
	case NL80211_IFTYPE_MESH_POINT:
882 883 884
		break;
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_STATION:
885
	case NL80211_IFTYPE_P2P_CLIENT:
886
		if (!wdev->current_bss)
887 888
			return -ENOLINK;
		break;
889
	case NL80211_IFTYPE_UNSPECIFIED:
890
	case NL80211_IFTYPE_OCB:
891 892 893 894
	case NL80211_IFTYPE_MONITOR:
	case NL80211_IFTYPE_P2P_DEVICE:
	case NL80211_IFTYPE_WDS:
	case NUM_NL80211_IFTYPES:
895 896 897 898 899 900
		return -EINVAL;
	}

	return 0;
}

901 902 903 904 905 906 907 908 909 910 911 912 913
static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
							struct nlattr *tb)
{
	struct ieee80211_channel *chan;

	if (tb == NULL)
		return NULL;
	chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
		return NULL;
	return chan;
}

914 915 916 917 918 919 920 921 922 923
static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
{
	struct nlattr *nl_modes = nla_nest_start(msg, attr);
	int i;

	if (!nl_modes)
		goto nla_put_failure;

	i = 0;
	while (ifmodes) {
924 925
		if ((ifmodes & 1) && nla_put_flag(msg, i))
			goto nla_put_failure;
926 927 928 929 930 931 932 933 934 935 936 937
		ifmodes >>= 1;
		i++;
	}

	nla_nest_end(msg, nl_modes);
	return 0;

nla_put_failure:
	return -ENOBUFS;
}

static int nl80211_put_iface_combinations(struct wiphy *wiphy,
938 939
					  struct sk_buff *msg,
					  bool large)
940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968
{
	struct nlattr *nl_combis;
	int i, j;

	nl_combis = nla_nest_start(msg,
				NL80211_ATTR_INTERFACE_COMBINATIONS);
	if (!nl_combis)
		goto nla_put_failure;

	for (i = 0; i < wiphy->n_iface_combinations; i++) {
		const struct ieee80211_iface_combination *c;
		struct nlattr *nl_combi, *nl_limits;

		c = &wiphy->iface_combinations[i];

		nl_combi = nla_nest_start(msg, i + 1);
		if (!nl_combi)
			goto nla_put_failure;

		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
		if (!nl_limits)
			goto nla_put_failure;

		for (j = 0; j < c->n_limits; j++) {
			struct nlattr *nl_limit;

			nl_limit = nla_nest_start(msg, j + 1);
			if (!nl_limit)
				goto nla_put_failure;
969 970 971
			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
					c->limits[j].max))
				goto nla_put_failure;
972 973 974 975 976 977 978 979
			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
						c->limits[j].types))
				goto nla_put_failure;
			nla_nest_end(msg, nl_limit);
		}

		nla_nest_end(msg, nl_limits);

980 981 982 983 984 985 986 987
		if (c->beacon_int_infra_match &&
		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
			goto nla_put_failure;
		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
				c->num_different_channels) ||
		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
				c->max_interfaces))
			goto nla_put_failure;
988
		if (large &&
989 990 991 992
		    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
				c->radar_detect_widths) ||
		     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
				c->radar_detect_regions)))
993
			goto nla_put_failure;
994 995 996 997 998 999 1000 1001 1002 1003 1004

		nla_nest_end(msg, nl_combi);
	}

	nla_nest_end(msg, nl_combis);

	return 0;
nla_put_failure:
	return -ENOBUFS;
}

1005
#ifdef CONFIG_PM
1006 1007 1008
static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
					struct sk_buff *msg)
{
1009
	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
		return -ENOBUFS;

	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
				sizeof(*tcp->tok), tcp->tok))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
			tcp->wake_payload_max))
		return -ENOBUFS;

	nla_nest_end(msg, nl_tcp);
	return 0;
}

1046
static int nl80211_send_wowlan(struct sk_buff *msg,
1047
			       struct cfg80211_registered_device *rdev,
1048
			       bool large)
1049
{
1050
	struct nlattr *nl_wowlan;
1051

1052
	if (!rdev->wiphy.wowlan)
1053
		return 0;
1054

1055 1056 1057
	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
	if (!nl_wowlan)
		return -ENOBUFS;
1058

1059
	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1060
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1061
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1062
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1063
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1064
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1065
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1066
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1067
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1068
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1069
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1070
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1071
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1072
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1073
	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1074 1075
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
		return -ENOBUFS;
1076

1077
	if (rdev->wiphy.wowlan->n_patterns) {
1078
		struct nl80211_pattern_support pat = {
1079 1080 1081 1082
			.max_patterns = rdev->wiphy.wowlan->n_patterns,
			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1083
		};
1084

1085 1086 1087 1088
		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
			    sizeof(pat), &pat))
			return -ENOBUFS;
	}
1089

1090
	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1091 1092
		return -ENOBUFS;

1093 1094
	/* TODO: send wowlan net detect */

1095
	nla_nest_end(msg, nl_wowlan);
1096

1097 1098 1099
	return 0;
}
#endif
1100

1101
static int nl80211_send_coalesce(struct sk_buff *msg,
1102
				 struct cfg80211_registered_device *rdev)
1103 1104 1105
{
	struct nl80211_coalesce_rule_support rule;

1106
	if (!rdev->wiphy.coalesce)
1107 1108
		return 0;

1109 1110 1111 1112 1113 1114
	rule.max_rules = rdev->wiphy.coalesce->n_rules;
	rule.max_delay = rdev->wiphy.coalesce->max_delay;
	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1115 1116 1117 1118 1119 1120 1121

	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
		return -ENOBUFS;

	return 0;
}

1122 1123 1124 1125 1126 1127
static int nl80211_send_band_rateinfo(struct sk_buff *msg,
				      struct ieee80211_supported_band *sband)
{
	struct nlattr *nl_rates, *nl_rate;
	struct ieee80211_rate *rate;
	int i;
1128

1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140
	/* add HT info */
	if (sband->ht_cap.ht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
		     sizeof(sband->ht_cap.mcs),
		     &sband->ht_cap.mcs) ||
	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
			 sband->ht_cap.cap) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
			sband->ht_cap.ampdu_factor) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
			sband->ht_cap.ampdu_density)))
		return -ENOBUFS;
1141

1142 1143 1144 1145 1146 1147 1148 1149
	/* add VHT info */
	if (sband->vht_cap.vht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
		     sizeof(sband->vht_cap.vht_mcs),
		     &sband->vht_cap.vht_mcs) ||
	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
			 sband->vht_cap.cap)))
		return -ENOBUFS;
1150

1151 1152 1153 1154
	/* add bitrates */
	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
	if (!nl_rates)
		return -ENOBUFS;
1155

1156 1157 1158 1159
	for (i = 0; i < sband->n_bitrates; i++) {
		nl_rate = nla_nest_start(msg, i);
		if (!nl_rate)
			return -ENOBUFS;
1160

1161 1162 1163 1164 1165 1166 1167 1168
		rate = &sband->bitrates[i];
		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
				rate->bitrate))
			return -ENOBUFS;
		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
		    nla_put_flag(msg,
				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
			return -ENOBUFS;
1169

1170 1171
		nla_nest_end(msg, nl_rate);
	}
1172

1173
	nla_nest_end(msg, nl_rates);
1174

1175 1176
	return 0;
}
1177

1178 1179 1180 1181 1182 1183 1184 1185
static int
nl80211_send_mgmt_stypes(struct sk_buff *msg,
			 const struct ieee80211_txrx_stypes *mgmt_stypes)
{
	u16 stypes;
	struct nlattr *nl_ftypes, *nl_ifs;
	enum nl80211_iftype ift;
	int i;
1186

1187 1188
	if (!mgmt_stypes)
		return 0;
1189

1190 1191 1192
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1193

1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].tx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
1207
		}
1208 1209
		nla_nest_end(msg, nl_ftypes);
	}
1210

1211
	nla_nest_end(msg, nl_ifs);
1212

1213 1214 1215
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1216

1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].rx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
		}
		nla_nest_end(msg, nl_ftypes);
	}
	nla_nest_end(msg, nl_ifs);
1234

1235 1236
	return 0;
}
1237

1238 1239 1240 1241 1242 1243 1244
struct nl80211_dump_wiphy_state {
	s64 filter_wiphy;
	long start;
	long split_start, band_start, chan_start;
	bool split;
};

1245
static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1246
			      enum nl80211_commands cmd,
1247
			      struct sk_buff *msg, u32 portid, u32 seq,
1248
			      int flags, struct nl80211_dump_wiphy_state *state)
1249 1250 1251 1252 1253 1254 1255 1256 1257
{
	void *hdr;
	struct nlattr *nl_bands, *nl_band;
	struct nlattr *nl_freqs, *nl_freq;
	struct nlattr *nl_cmds;
	enum ieee80211_band band;
	struct ieee80211_channel *chan;
	int i;
	const struct ieee80211_txrx_stypes *mgmt_stypes =
1258
				rdev->wiphy.mgmt_stypes;
1259
	u32 features;
1260

1261
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1262 1263
	if (!hdr)
		return -ENOBUFS;
1264

1265 1266
	if (WARN_ON(!state))
		return -EINVAL;
1267

1268
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1269
	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1270
			   wiphy_name(&rdev->wiphy)) ||
1271 1272
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			cfg80211_rdev_list_generation))
1273 1274
		goto nla_put_failure;

1275 1276 1277
	if (cmd != NL80211_CMD_NEW_WIPHY)
		goto finish;

1278
	switch (state->split_start) {
1279 1280
	case 0:
		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1281
			       rdev->wiphy.retry_short) ||
1282
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1283
			       rdev->wiphy.retry_long) ||
1284
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1285
				rdev->wiphy.frag_threshold) ||
1286
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1287
				rdev->wiphy.rts_threshold) ||
1288
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1289
			       rdev->wiphy.coverage_class) ||
1290
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1291
			       rdev->wiphy.max_scan_ssids) ||
1292
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1293
			       rdev->wiphy.max_sched_scan_ssids) ||
1294
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1295
				rdev->wiphy.max_scan_ie_len) ||
1296
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1297
				rdev->wiphy.max_sched_scan_ie_len) ||
1298
		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1299
			       rdev->wiphy.max_match_sets))
1300
			goto nla_put_failure;
1301

1302
		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1303
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1304
			goto nla_put_failure;
1305
		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1306 1307
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
			goto nla_put_failure;
1308
		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1309 1310
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
			goto nla_put_failure;
1311
		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1312 1313
		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
			goto nla_put_failure;
1314
		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1315 1316
		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
			goto nla_put_failure;
1317
		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1318
		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1319
			goto nla_put_failure;
1320 1321
		state->split_start++;
		if (state->split)
1322 1323 1324
			break;
	case 1:
		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1325 1326
			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
			    rdev->wiphy.cipher_suites))
1327
			goto nla_put_failure;
1328

1329
		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1330
			       rdev->wiphy.max_num_pmkids))
1331
			goto nla_put_failure;
1332

1333
		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1334
		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1335
			goto nla_put_failure;
1336

1337
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1338
				rdev->wiphy.available_antennas_tx) ||
1339
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1340
				rdev->wiphy.available_antennas_rx))
1341
			goto nla_put_failure;
1342

1343
		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1344
		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1345
				rdev->wiphy.probe_resp_offload))
1346
			goto nla_put_failure;
1347

1348 1349 1350
		if ((rdev->wiphy.available_antennas_tx ||
		     rdev->wiphy.available_antennas_rx) &&
		    rdev->ops->get_antenna) {
1351 1352
			u32 tx_ant = 0, rx_ant = 0;
			int res;
1353
			res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1354 1355 1356 1357 1358 1359 1360 1361 1362 1363
			if (!res) {
				if (nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_TX,
						tx_ant) ||
				    nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_RX,
						rx_ant))
					goto nla_put_failure;
			}
		}
1364

1365 1366
		state->split_start++;
		if (state->split)
1367 1368 1369
			break;
	case 2:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1370
					rdev->wiphy.interface_modes))
1371
				goto nla_put_failure;
1372 1373
		state->split_start++;
		if (state->split)
1374 1375 1376 1377 1378
			break;
	case 3:
		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
		if (!nl_bands)
			goto nla_put_failure;
1379

1380 1381
		for (band = state->band_start;
		     band < IEEE80211_NUM_BANDS; band++) {
1382
			struct ieee80211_supported_band *sband;
1383

1384
			sband = rdev->wiphy.bands[band];
1385

1386 1387 1388 1389 1390
			if (!sband)
				continue;

			nl_band = nla_nest_start(msg, band);
			if (!nl_band)
1391
				goto nla_put_failure;
1392

1393
			switch (state->chan_start) {
1394 1395
			case 0:
				if (nl80211_send_band_rateinfo(msg, sband))
1396
					goto nla_put_failure;
1397 1398
				state->chan_start++;
				if (state->split)
1399 1400 1401 1402 1403 1404 1405 1406
					break;
			default:
				/* add frequencies */
				nl_freqs = nla_nest_start(
					msg, NL80211_BAND_ATTR_FREQS);
				if (!nl_freqs)
					goto nla_put_failure;

1407
				for (i = state->chan_start - 1;
1408 1409 1410 1411 1412 1413 1414 1415
				     i < sband->n_channels;
				     i++) {
					nl_freq = nla_nest_start(msg, i);
					if (!nl_freq)
						goto nla_put_failure;

					chan = &sband->channels[i];

1416 1417 1418
					if (nl80211_msg_put_channel(
							msg, chan,
							state->split))
1419 1420 1421
						goto nla_put_failure;

					nla_nest_end(msg, nl_freq);
1422
					if (state->split)
1423 1424 1425
						break;
				}
				if (i < sband->n_channels)
1426
					state->chan_start = i + 2;
1427
				else
1428
					state->chan_start = 0;
1429 1430 1431 1432 1433
				nla_nest_end(msg, nl_freqs);
			}

			nla_nest_end(msg, nl_band);

1434
			if (state->split) {
1435
				/* start again here */
1436
				if (state->chan_start)
1437 1438
					band--;
				break;
1439 1440
			}
		}
1441
		nla_nest_end(msg, nl_bands);
1442

1443
		if (band < IEEE80211_NUM_BANDS)
1444
			state->band_start = band + 1;
1445
		else
1446
			state->band_start = 0;
Johannes Berg's avatar
Johannes Berg committed
1447

1448
		/* if bands & channels are done, continue outside */
1449 1450 1451
		if (state->band_start == 0 && state->chan_start == 0)
			state->split_start++;
		if (state->split)
1452 1453 1454 1455
			break;
	case 4:
		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
		if (!nl_cmds)
1456 1457
			goto nla_put_failure;

1458 1459 1460
		i = 0;
#define CMD(op, n)							\
		 do {							\
1461
			if (rdev->ops->op) {				\
1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484
				i++;					\
				if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
					goto nla_put_failure;		\
			}						\
		} while (0)

		CMD(add_virtual_intf, NEW_INTERFACE);
		CMD(change_virtual_intf, SET_INTERFACE);
		CMD(add_key, NEW_KEY);
		CMD(start_ap, START_AP);
		CMD(add_station, NEW_STATION);
		CMD(add_mpath, NEW_MPATH);
		CMD(update_mesh_config, SET_MESH_CONFIG);
		CMD(change_bss, SET_BSS);
		CMD(auth, AUTHENTICATE);
		CMD(assoc, ASSOCIATE);
		CMD(deauth, DEAUTHENTICATE);
		CMD(disassoc, DISASSOCIATE);
		CMD(join_ibss, JOIN_IBSS);
		CMD(join_mesh, JOIN_MESH);
		CMD(set_pmksa, SET_PMKSA);
		CMD(del_pmksa, DEL_PMKSA);
		CMD(flush_pmksa, FLUSH_PMKSA);
1485
		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1486 1487 1488 1489
			CMD(remain_on_channel, REMAIN_ON_CHANNEL);
		CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
		CMD(mgmt_tx, FRAME);
		CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1490
		if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1491 1492
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1493 1494
				goto nla_put_failure;
		}
1495 1496
		if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
		    rdev->ops->join_mesh) {
1497 1498 1499 1500 1501
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
				goto nla_put_failure;
		}
		CMD(set_wds_peer, SET_WDS_PEER);
1502
		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1503 1504 1505
			CMD(tdls_mgmt, TDLS_MGMT);
			CMD(tdls_oper, TDLS_OPER);
		}
1506
		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1507 1508 1509
			CMD(sched_scan_start, START_SCHED_SCAN);
		CMD(probe_client, PROBE_CLIENT);
		CMD(set_noack_map, SET_NOACK_MAP);
1510
		if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1511 1512 1513 1514 1515 1516
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
				goto nla_put_failure;
		}
		CMD(start_p2p_device, START_P2P_DEVICE);
		CMD(set_mcast_rate, SET_MCAST_RATE);
1517 1518 1519
#ifdef CONFIG_NL80211_TESTMODE
		CMD(testmode_cmd, TESTMODE);
#endif
1520
		if (state->split) {
1521 1522
			CMD(crit_proto_start, CRIT_PROTOCOL_START);
			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1523
			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1524
				CMD(channel_switch, CHANNEL_SWITCH);
1525
			CMD(set_qos_map, SET_QOS_MAP);
1526 1527
			if (rdev->wiphy.features &
					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1528
				CMD(add_tx_ts, ADD_TX_TS);
1529
		}
1530
		/* add into the if now */
1531
#undef CMD
1532

1533
		if (rdev->ops->connect || rdev->ops->auth) {
1534 1535
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1536
				goto nla_put_failure;
1537 1538
		}

1539
		if (rdev->ops->disconnect || rdev->ops->deauth) {
1540 1541 1542 1543 1544 1545
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
				goto nla_put_failure;
		}

		nla_nest_end(msg, nl_cmds);
1546 1547
		state->split_start++;
		if (state->split)
1548 1549
			break;
	case 5:
1550 1551
		if (rdev->ops->remain_on_channel &&
		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1552 1553
		    nla_put_u32(msg,
				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1554
				rdev->wiphy.max_remain_on_channel_duration))
1555 1556
			goto nla_put_failure;

1557
		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1558 1559 1560 1561 1562
		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
			goto nla_put_failure;

		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
			goto nla_put_failure;
1563 1564
		state->split_start++;
		if (state->split)
1565 1566 1567
			break;
	case 6:
#ifdef CONFIG_PM
1568
		if (nl80211_send_wowlan(msg, rdev, state->split))
1569
			goto nla_put_failure;
1570 1571
		state->split_start++;
		if (state->split)
1572 1573
			break;
#else
1574
		state->split_start++;
1575
#endif
1576 1577
	case 7:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1578
					rdev->wiphy.software_iftypes))
1579
			goto nla_put_failure;
1580

1581
		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1582
						   state->split))
1583
			goto nla_put_failure;
1584

1585 1586
		state->split_start++;
		if (state->split)
1587 1588
			break;
	case 8:
1589
		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1590
		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1591
				rdev->wiphy.ap_sme_capa))
1592
			goto nla_put_failure;
1593

1594
		features = rdev->wiphy.features;
1595 1596 1597 1598 1599
		/*
		 * We can only add the per-channel limit information if the
		 * dump is split, otherwise it makes it too big. Therefore
		 * only advertise it in that case.
		 */
1600
		if (state->split)
1601 1602
			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1603
			goto nla_put_failure;
1604

1605
		if (rdev->wiphy.ht_capa_mod_mask &&
1606
		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1607 1608
			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
			    rdev->wiphy.ht_capa_mod_mask))
1609
			goto nla_put_failure;
1610

1611 1612
		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
		    rdev->wiphy.max_acl_mac_addrs &&
1613
		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1614
				rdev->wiphy.max_acl_mac_addrs))
1615
			goto nla_put_failure;
1616

1617 1618 1619 1620 1621 1622 1623 1624 1625 1626
		/*
		 * Any information below this point is only available to
		 * applications that can deal with it being split. This
		 * helps ensure that newly added capabilities don't break
		 * older tools by overrunning their buffers.
		 *
		 * We still increment split_start so that in the split
		 * case we'll continue with more data in the next round,
		 * but break unconditionally so unsplit data stops here.
		 */
1627
		state->split_start++;
1628 1629
		break;
	case 9:
1630
		if (rdev->wiphy.extended_capabilities &&
1631
		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1632 1633
			     rdev->wiphy.extended_capabilities_len,
			     rdev->wiphy.extended_capabilities) ||
1634
		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1635 1636
			     rdev->wiphy.extended_capabilities_len,
			     rdev->wiphy.extended_capabilities_mask)))
1637
			goto nla_put_failure;
1638

1639
		if (rdev->wiphy.vht_capa_mod_mask &&
1640
		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1641 1642
			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
			    rdev->wiphy.vht_capa_mod_mask))
1643 1644
			goto nla_put_failure;

1645 1646 1647
		state->split_start++;
		break;
	case 10:
1648
		if (nl80211_send_coalesce(msg, rdev))
1649 1650
			goto nla_put_failure;

1651
		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1652 1653 1654
		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
			goto nla_put_failure;
1655

1656
		if (rdev->wiphy.max_ap_assoc_sta &&
1657
		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1658
				rdev->wiphy.max_ap_assoc_sta))
1659 1660
			goto nla_put_failure;

1661 1662 1663
		state->split_start++;
		break;
	case 11:
1664
		if (rdev->wiphy.n_vendor_commands) {
1665 1666 1667 1668 1669 1670 1671
			const struct nl80211_vendor_cmd_info *info;
			struct nlattr *nested;

			nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
			if (!nested)
				goto nla_put_failure;

1672 1673
			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
				info = &rdev->wiphy.vendor_commands[i].info;
1674 1675 1676 1677 1678 1679
				if (nla_put(msg, i + 1, sizeof(*info), info))
					goto nla_put_failure;
			}
			nla_nest_end(msg, nested);
		}

1680
		if (rdev->wiphy.n_vendor_events) {
1681 1682
			const struct nl80211_vendor_cmd_info *info;
			struct nlattr *nested;
1683

1684 1685 1686
			nested = nla_nest_start(msg,
						NL80211_ATTR_VENDOR_EVENTS);
			if (!nested)
1687
				goto nla_put_failure;
1688

1689 1690
			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
				info = &rdev->wiphy.vendor_events[i];
1691 1692 1693 1694 1695
				if (nla_put(msg, i + 1, sizeof(*info), info))
					goto nla_put_failure;
			}
			nla_nest_end(msg, nested);
		}
1696 1697 1698 1699 1700 1701 1702
		state->split_start++;
		break;
	case 12:
		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
			       rdev->wiphy.max_num_csa_counters))
			goto nla_put_failure;
1703

1704
		/* done */
1705
		state->split_start = 0;
1706 1707
		break;
	}
1708
 finish:
1709 1710 1711
	return genlmsg_end(msg, hdr);

 nla_put_failure:
1712 1713
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
1714 1715
}

1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736
static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
				    struct netlink_callback *cb,
				    struct nl80211_dump_wiphy_state *state)
{
	struct nlattr **tb = nl80211_fam.attrbuf;
	int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
			      tb, nl80211_fam.maxattr, nl80211_policy);
	/* ignore parse errors for backward compatibility */
	if (ret)
		return 0;

	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
	if (tb[NL80211_ATTR_WIPHY])
		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
	if (tb[NL80211_ATTR_WDEV])
		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
	if (tb[NL80211_ATTR_IFINDEX]) {
		struct net_device *netdev;
		struct cfg80211_registered_device *rdev;
		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);

1737
		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1738 1739 1740
		if (!netdev)
			return -ENODEV;
		if (netdev->ieee80211_ptr) {
1741
			rdev = wiphy_to_rdev(
1742 1743 1744 1745 1746 1747 1748 1749
				netdev->ieee80211_ptr->wiphy);
			state->filter_wiphy = rdev->wiphy_idx;
		}
	}

	return 0;
}

1750 1751
static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
{
1752
	int idx = 0, ret;
1753
	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1754
	struct cfg80211_registered_device *rdev;
1755

1756
	rtnl_lock();
1757 1758
	if (!state) {
		state = kzalloc(sizeof(*state), GFP_KERNEL);
1759 1760
		if (!state) {
			rtnl_unlock();
1761
			return -ENOMEM;
1762
		}
1763 1764 1765 1766 1767 1768
		state->filter_wiphy = -1;
		ret = nl80211_dump_wiphy_parse(skb, cb, state);
		if (ret) {
			kfree(state);
			rtnl_unlock();
			return ret;
1769
		}
1770
		cb->args[0] = (long)state;
1771 1772
	}

1773 1774
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1775
			continue;
1776
		if (++idx <= state->start)
1777
			continue;
1778
		if (state->filter_wiphy != -1 &&
1779
		    state->filter_wiphy != rdev->wiphy_idx)
1780 1781 1782
			continue;
		/* attempt to fit multiple wiphy data chunks into the skb */
		do {
1783 1784
			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
						 skb,
1785 1786
						 NETLINK_CB(cb->skb).portid,
						 cb->nlh->nlmsg_seq,
1787
						 NLM_F_MULTI, state);
1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802
			if (ret < 0) {
				/*
				 * If sending the wiphy data didn't fit (ENOBUFS
				 * or EMSGSIZE returned), this SKB is still
				 * empty (so it's not too big because another
				 * wiphy dataset is already in the skb) and
				 * we've not tried to adjust the dump allocation
				 * yet ... then adjust the alloc size to be
				 * bigger, and return 1 but with the empty skb.
				 * This results in an empty message being RX'ed
				 * in userspace, but that is ignored.
				 *
				 * We can then retry with the larger buffer.
				 */
				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1803
				    !skb->len && !state->split &&
1804 1805
				    cb->min_dump_alloc < 4096) {
					cb->min_dump_alloc = 4096;
1806
					state->split_start = 0;
1807
					rtnl_unlock();
1808 1809 1810 1811
					return 1;
				}
				idx--;
				break;
1812
			}
1813
		} while (state->split_start > 0);
1814
		break;
1815
	}
1816
	rtnl_unlock();
1817

1818
	state->start = idx;
1819 1820 1821 1822

	return skb->len;
}

1823 1824 1825 1826 1827 1828
static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
{
	kfree((void *)cb->args[0]);
	return 0;
}

1829 1830 1831
static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
1832
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
1833
	struct nl80211_dump_wiphy_state state = {};
1834

1835
	msg = nlmsg_new(4096, GFP_KERNEL);
1836
	if (!msg)
1837
		return -ENOMEM;
1838

1839 1840
	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
			       info->snd_portid, info->snd_seq, 0,
1841
			       &state) < 0) {
1842 1843 1844
		nlmsg_free(msg);
		return -ENOBUFS;
	}
1845

Johannes Berg's avatar
Johannes Berg committed
1846
	return genlmsg_reply(msg, info);
1847 1848
}

1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859
static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
};

static int parse_txq_params(struct nlattr *tb[],
			    struct ieee80211_txq_params *txq_params)
{
1860
	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1861 1862 1863 1864
	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
	    !tb[NL80211_TXQ_ATTR_AIFS])
		return -EINVAL;

1865
	txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1866 1867 1868 1869 1870
	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);

1871 1872 1873
	if (txq_params->ac >= NL80211_NUM_ACS)
		return -EINVAL;

1874 1875 1876
	return 0;
}

1877 1878 1879
static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
{
	/*
1880 1881 1882 1883 1884 1885 1886 1887 1888
	 * You can only set the channel explicitly for WDS interfaces,
	 * all others have their channel managed via their respective
	 * "establish a connection" command (connect, join, ...)
	 *
	 * For AP/GO and mesh mode, the channel can be set with the
	 * channel userspace API, but is only stored and passed to the
	 * low-level driver when the AP starts or the mesh is joined.
	 * This is for backward compatibility, userspace can also give
	 * the channel in the start-ap or join-mesh commands instead.
1889 1890
	 *
	 * Monitors are special as they are normally slaved to
1891 1892
	 * whatever else is going on, so they have their own special
	 * operation to set the monitor channel if possible.
1893 1894 1895 1896
	 */
	return !wdev ||
		wdev->iftype == NL80211_IFTYPE_AP ||
		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1897 1898
		wdev->iftype == NL80211_IFTYPE_MONITOR ||
		wdev->iftype == NL80211_IFTYPE_P2P_GO;
1899 1900
}

1901 1902 1903 1904
static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
				 struct genl_info *info,
				 struct cfg80211_chan_def *chandef)
{
1905
	u32 control_freq;
1906 1907 1908 1909 1910 1911 1912

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);

	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1913 1914 1915
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = control_freq;
	chandef->center_freq2 = 0;
1916 1917 1918 1919 1920

	/* Primary channel not allowed */
	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
		return -EINVAL;

1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950
	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
		enum nl80211_channel_type chantype;

		chantype = nla_get_u32(
				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);

		switch (chantype) {
		case NL80211_CHAN_NO_HT:
		case NL80211_CHAN_HT20:
		case NL80211_CHAN_HT40PLUS:
		case NL80211_CHAN_HT40MINUS:
			cfg80211_chandef_create(chandef, chandef->chan,
						chantype);
			break;
		default:
			return -EINVAL;
		}
	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
		chandef->width =
			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
			chandef->center_freq1 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
			chandef->center_freq2 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
	}

1951
	if (!cfg80211_chandef_valid(chandef))
1952 1953
		return -EINVAL;

1954 1955
	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
				     IEEE80211_CHAN_DISABLED))
1956 1957
		return -EINVAL;

1958 1959 1960 1961 1962
	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
	     chandef->width == NL80211_CHAN_WIDTH_10) &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
		return -EINVAL;

1963 1964 1965
	return 0;
}

1966
static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1967
				 struct net_device *dev,
1968 1969
				 struct genl_info *info)
{
1970
	struct cfg80211_chan_def chandef;
1971
	int result;
1972
	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1973
	struct wireless_dev *wdev = NULL;
1974

1975 1976
	if (dev)
		wdev = dev->ieee80211_ptr;
1977 1978
	if (!nl80211_can_set_dev_channel(wdev))
		return -EOPNOTSUPP;
1979 1980
	if (wdev)
		iftype = wdev->iftype;
1981

1982 1983 1984
	result = nl80211_parse_chandef(rdev, info, &chandef);
	if (result)
		return result;
1985

1986
	switch (iftype) {
1987 1988
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
1989
		if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1990 1991 1992
			result = -EINVAL;
			break;
		}
1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
		if (wdev->beacon_interval) {
			if (!dev || !rdev->ops->set_ap_chanwidth ||
			    !(rdev->wiphy.features &
			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
				result = -EBUSY;
				break;
			}

			/* Only allow dynamic channel width changes */
			if (chandef.chan != wdev->preset_chandef.chan) {
				result = -EBUSY;
				break;
			}
			result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
			if (result)
				break;
		}
2010
		wdev->preset_chandef = chandef;
2011 2012
		result = 0;
		break;
2013
	case NL80211_IFTYPE_MESH_POINT:
2014
		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2015
		break;
2016
	case NL80211_IFTYPE_MONITOR:
2017
		result = cfg80211_set_monitor_channel(rdev, &chandef);
2018
		break;
2019
	default:
2020
		result = -EINVAL;
2021 2022 2023 2024 2025 2026 2027
	}

	return result;
}

static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
{
2028 2029
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *netdev = info->user_ptr[1];
2030

2031
	return __nl80211_set_channel(rdev, netdev, info);
2032 2033
}

2034 2035
static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
{
2036 2037 2038
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
2039
	const u8 *bssid;
2040 2041 2042 2043

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

2044 2045
	if (netif_running(dev))
		return -EBUSY;
2046

2047 2048
	if (!rdev->ops->set_wds_peer)
		return -EOPNOTSUPP;
2049

2050 2051
	if (wdev->iftype != NL80211_IFTYPE_WDS)
		return -EOPNOTSUPP;
2052 2053

	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2054
	return rdev_set_wds_peer(rdev, dev, bssid);
2055 2056 2057
}


2058 2059 2060
static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
2061 2062
	struct net_device *netdev = NULL;
	struct wireless_dev *wdev;
2063
	int result = 0, rem_txq_params = 0;
2064
	struct nlattr *nl_txq_params;
2065 2066 2067
	u32 changed;
	u8 retry_short = 0, retry_long = 0;
	u32 frag_threshold = 0, rts_threshold = 0;
2068
	u8 coverage_class = 0;
2069

2070 2071
	ASSERT_RTNL();

2072 2073 2074 2075 2076 2077 2078 2079 2080
	/*
	 * Try to find the wiphy and netdev. Normally this
	 * function shouldn't need the netdev, but this is
	 * done for backward compatibility -- previously
	 * setting the channel was done per wiphy, but now
	 * it is per netdev. Previous userland like hostapd
	 * also passed a netdev to set_wiphy, so that it is
	 * possible to let that go to the right netdev!
	 */
2081

2082 2083 2084
	if (info->attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);

2085
		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2086
		if (netdev && netdev->ieee80211_ptr)
2087
			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2088
		else
2089
			netdev = NULL;
2090 2091
	}

2092
	if (!netdev) {
2093 2094
		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
						  info->attrs);
2095
		if (IS_ERR(rdev))
2096
			return PTR_ERR(rdev);
2097 2098 2099
		wdev = NULL;
		netdev = NULL;
		result = 0;
2100
	} else
2101 2102 2103 2104 2105 2106
		wdev = netdev->ieee80211_ptr;

	/*
	 * end workaround code, by now the rdev is available
	 * and locked, and wdev may or may not be NULL.
	 */
2107 2108

	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2109 2110
		result = cfg80211_dev_rename(
			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2111 2112

	if (result)
2113
		return result;
2114 2115 2116 2117 2118

	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
		struct ieee80211_txq_params txq_params;
		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];

2119 2120
		if (!rdev->ops->set_txq_params)
			return -EOPNOTSUPP;
2121

2122 2123
		if (!netdev)
			return -EINVAL;
2124

2125
		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2126 2127
		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
2128

2129 2130
		if (!netif_running(netdev))
			return -ENETDOWN;
2131

2132 2133 2134
		nla_for_each_nested(nl_txq_params,
				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
				    rem_txq_params) {
2135 2136 2137 2138 2139 2140
			result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
					   nla_data(nl_txq_params),
					   nla_len(nl_txq_params),
					   txq_params_policy);
			if (result)
				return result;
2141 2142
			result = parse_txq_params(tb, &txq_params);
			if (result)
2143
				return result;
2144

2145 2146
			result = rdev_set_txq_params(rdev, netdev,
						     &txq_params);
2147
			if (result)
2148
				return result;
2149 2150
		}
	}
2151

2152
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2153 2154 2155 2156
		result = __nl80211_set_channel(
			rdev,
			nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
			info);
2157
		if (result)
2158
			return result;
2159 2160
	}

2161
	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2162
		struct wireless_dev *txp_wdev = wdev;
2163 2164 2165
		enum nl80211_tx_power_setting type;
		int idx, mbm = 0;

2166 2167 2168
		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
			txp_wdev = NULL;

2169 2170
		if (!rdev->ops->set_tx_power)
			return -EOPNOTSUPP;
2171 2172 2173 2174 2175

		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
		type = nla_get_u32(info->attrs[idx]);

		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2176 2177
		    (type != NL80211_TX_POWER_AUTOMATIC))
			return -EINVAL;
2178 2179 2180 2181 2182 2183

		if (type != NL80211_TX_POWER_AUTOMATIC) {
			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
			mbm = nla_get_u32(info->attrs[idx]);
		}

2184
		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2185
		if (result)
2186
			return result;
2187 2188
	}

2189 2190 2191
	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
		u32 tx_ant, rx_ant;
2192 2193
		if ((!rdev->wiphy.available_antennas_tx &&
		     !rdev->wiphy.available_antennas_rx) ||
2194 2195
		    !rdev->ops->set_antenna)
			return -EOPNOTSUPP;
2196 2197 2198 2199

		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);

2200
		/* reject antenna configurations which don't match the
2201 2202
		 * available antenna masks, except for the "all" mask */
		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2203 2204
		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
			return -EINVAL;
2205

2206 2207
		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2208

2209
		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2210
		if (result)
2211
			return result;
2212 2213
	}

2214 2215 2216 2217 2218
	changed = 0;

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
		retry_short = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2219 2220 2221
		if (retry_short == 0)
			return -EINVAL;

2222 2223 2224 2225 2226 2227
		changed |= WIPHY_PARAM_RETRY_SHORT;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
		retry_long = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2228 2229 2230
		if (retry_long == 0)
			return -EINVAL;

2231 2232 2233 2234 2235 2236
		changed |= WIPHY_PARAM_RETRY_LONG;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
		frag_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2237 2238 2239
		if (frag_threshold < 256)
			return -EINVAL;

2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257
		if (frag_threshold != (u32) -1) {
			/*
			 * Fragments (apart from the last one) are required to
			 * have even length. Make the fragmentation code
			 * simpler by stripping LSB should someone try to use
			 * odd threshold value.
			 */
			frag_threshold &= ~0x1;
		}
		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
		rts_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
		changed |= WIPHY_PARAM_RTS_THRESHOLD;
	}

2258
	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2259 2260 2261
		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
			return -EINVAL;

2262 2263 2264 2265 2266
		coverage_class = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
		changed |= WIPHY_PARAM_COVERAGE_CLASS;
	}

2267 2268 2269 2270 2271
	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
			return -EOPNOTSUPP;

		changed |= WIPHY_PARAM_DYN_ACK;
2272 2273
	}

2274 2275 2276
	if (changed) {
		u8 old_retry_short, old_retry_long;
		u32 old_frag_threshold, old_rts_threshold;
2277
		u8 old_coverage_class;
2278

2279 2280
		if (!rdev->ops->set_wiphy_params)
			return -EOPNOTSUPP;
2281 2282 2283 2284 2285

		old_retry_short = rdev->wiphy.retry_short;
		old_retry_long = rdev->wiphy.retry_long;
		old_frag_threshold = rdev->wiphy.frag_threshold;
		old_rts_threshold = rdev->wiphy.rts_threshold;
2286
		old_coverage_class = rdev->wiphy.coverage_class;
2287 2288 2289 2290 2291 2292 2293 2294 2295

		if (changed & WIPHY_PARAM_RETRY_SHORT)
			rdev->wiphy.retry_short = retry_short;
		if (changed & WIPHY_PARAM_RETRY_LONG)
			rdev->wiphy.retry_long = retry_long;
		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
			rdev->wiphy.frag_threshold = frag_threshold;
		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
			rdev->wiphy.rts_threshold = rts_threshold;
2296 2297
		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
			rdev->wiphy.coverage_class = coverage_class;
2298

2299
		result = rdev_set_wiphy_params(rdev, changed);
2300 2301 2302 2303 2304
		if (result) {
			rdev->wiphy.retry_short = old_retry_short;
			rdev->wiphy.retry_long = old_retry_long;
			rdev->wiphy.frag_threshold = old_frag_threshold;
			rdev->wiphy.rts_threshold = old_rts_threshold;
2305
			rdev->wiphy.coverage_class = old_coverage_class;
2306 2307
		}
	}
2308
	return 0;
2309 2310
}

2311 2312 2313
static inline u64 wdev_id(struct wireless_dev *wdev)
{
	return (u64)wdev->identifier |
2314
	       ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2315
}
2316

2317
static int nl80211_send_chandef(struct sk_buff *msg,
2318
				const struct cfg80211_chan_def *chandef)
2319
{
2320
	WARN_ON(!cfg80211_chandef_valid(chandef));
2321

2322 2323 2324
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
			chandef->chan->center_freq))
		return -ENOBUFS;
2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341
	switch (chandef->width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
				cfg80211_get_chandef_type(chandef)))
			return -ENOBUFS;
		break;
	default:
		break;
	}
	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
		return -ENOBUFS;
	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
		return -ENOBUFS;
	if (chandef->center_freq2 &&
	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2342 2343 2344 2345
		return -ENOBUFS;
	return 0;
}

2346
static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2347
			      struct cfg80211_registered_device *rdev,
2348
			      struct wireless_dev *wdev, bool removal)
2349
{
2350
	struct net_device *dev = wdev->netdev;
2351
	u8 cmd = NL80211_CMD_NEW_INTERFACE;
2352 2353
	void *hdr;

2354 2355 2356 2357
	if (removal)
		cmd = NL80211_CMD_DEL_INTERFACE;

	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2358 2359 2360
	if (!hdr)
		return -1;

2361 2362
	if (dev &&
	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2363
	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2364 2365 2366 2367
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2368
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2369
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2370 2371 2372 2373
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			rdev->devlist_generation ^
			(cfg80211_rdev_list_generation << 2)))
		goto nla_put_failure;
2374

2375
	if (rdev->ops->get_channel) {
2376 2377 2378 2379 2380 2381 2382 2383
		int ret;
		struct cfg80211_chan_def chandef;

		ret = rdev_get_channel(rdev, wdev, &chandef);
		if (ret == 0) {
			if (nl80211_send_chandef(msg, &chandef))
				goto nla_put_failure;
		}
2384 2385
	}

2386 2387 2388 2389 2390
	if (wdev->ssid_len) {
		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
			goto nla_put_failure;
	}

2391 2392 2393
	return genlmsg_end(msg, hdr);

 nla_put_failure:
2394 2395
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
2396 2397 2398 2399 2400 2401 2402 2403
}

static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
{
	int wp_idx = 0;
	int if_idx = 0;
	int wp_start = cb->args[0];
	int if_start = cb->args[1];
2404
	struct cfg80211_registered_device *rdev;
2405 2406
	struct wireless_dev *wdev;

2407
	rtnl_lock();
2408 2409
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2410
			continue;
Johannes Berg's avatar
Johannes Berg committed
2411 2412
		if (wp_idx < wp_start) {
			wp_idx++;
2413
			continue;
Johannes Berg's avatar
Johannes Berg committed
2414
		}
2415 2416
		if_idx = 0;

2417
		list_for_each_entry(wdev, &rdev->wdev_list, list) {
Johannes Berg's avatar
Johannes Berg committed
2418 2419
			if (if_idx < if_start) {
				if_idx++;
2420
				continue;
Johannes Berg's avatar
Johannes Berg committed
2421
			}
2422
			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2423
					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2424
					       rdev, wdev, false) < 0) {
Johannes Berg's avatar
Johannes Berg committed
2425 2426 2427
				goto out;
			}
			if_idx++;
2428
		}
Johannes Berg's avatar
Johannes Berg committed
2429 2430

		wp_idx++;
2431
	}
Johannes Berg's avatar
Johannes Berg committed
2432
 out:
2433
	rtnl_unlock();
2434 2435 2436 2437 2438 2439 2440 2441 2442 2443

	cb->args[0] = wp_idx;
	cb->args[1] = if_idx;

	return skb->len;
}

static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
2444
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2445
	struct wireless_dev *wdev = info->user_ptr[1];
2446

2447
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2448
	if (!msg)
2449
		return -ENOMEM;
2450

2451
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2452
			       rdev, wdev, false) < 0) {
2453 2454 2455
		nlmsg_free(msg);
		return -ENOBUFS;
	}
2456

Johannes Berg's avatar
Johannes Berg committed
2457
	return genlmsg_reply(msg, info);
2458 2459
}

2460 2461 2462 2463 2464 2465
static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2466
	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489
};

static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
{
	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
	int flag;

	*mntrflags = 0;

	if (!nla)
		return -EINVAL;

	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
			     nla, mntr_flags_policy))
		return -EINVAL;

	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
		if (flags[flag])
			*mntrflags |= (1<<flag);

	return 0;
}

2490
static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2491 2492
			       struct net_device *netdev, u8 use_4addr,
			       enum nl80211_iftype iftype)
2493
{
2494
	if (!use_4addr) {
2495
		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2496
			return -EBUSY;
2497
		return 0;
2498
	}
2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515

	switch (iftype) {
	case NL80211_IFTYPE_AP_VLAN:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
			return 0;
		break;
	case NL80211_IFTYPE_STATION:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
			return 0;
		break;
	default:
		break;
	}

	return -EOPNOTSUPP;
}

2516 2517
static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
{
2518
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2519
	struct vif_params params;
2520
	int err;
2521
	enum nl80211_iftype otype, ntype;
2522
	struct net_device *dev = info->user_ptr[1];
2523
	u32 _flags, *flags = NULL;
2524
	bool change = false;
2525

2526 2527
	memset(&params, 0, sizeof(params));

2528
	otype = ntype = dev->ieee80211_ptr->iftype;
2529

2530
	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2531
		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2532
		if (otype != ntype)
2533
			change = true;
2534 2535
		if (ntype > NL80211_IFTYPE_MAX)
			return -EINVAL;
2536 2537
	}

2538
	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2539 2540
		struct wireless_dev *wdev = dev->ieee80211_ptr;

2541 2542
		if (ntype != NL80211_IFTYPE_MESH_POINT)
			return -EINVAL;
2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553
		if (netif_running(dev))
			return -EBUSY;

		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2554 2555
	}

2556 2557 2558
	if (info->attrs[NL80211_ATTR_4ADDR]) {
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
		change = true;
2559
		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2560
		if (err)
2561
			return err;
2562 2563 2564 2565
	} else {
		params.use_4addr = -1;
	}

2566
	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2567 2568
		if (ntype != NL80211_IFTYPE_MONITOR)
			return -EINVAL;
2569 2570
		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
					  &_flags);
2571
		if (err)
2572
			return err;
2573 2574 2575

		flags = &_flags;
		change = true;
2576
	}
Johannes Berg's avatar
Johannes Berg committed
2577

2578
	if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2579 2580 2581
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2582
	if (change)
2583
		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2584 2585
	else
		err = 0;
2586

2587 2588 2589
	if (!err && params.use_4addr != -1)
		dev->ieee80211_ptr->use_4addr = params.use_4addr;

2590 2591 2592 2593 2594
	return err;
}

static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
{
2595
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2596
	struct vif_params params;
2597
	struct wireless_dev *wdev;
2598
	struct sk_buff *msg, *event;
2599 2600
	int err;
	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2601
	u32 flags;
2602

2603 2604 2605
	/* to avoid failing a new interface creation due to pending removal */
	cfg80211_destroy_ifaces(rdev);

2606 2607
	memset(&params, 0, sizeof(params));

2608 2609 2610 2611 2612 2613 2614 2615 2616
	if (!info->attrs[NL80211_ATTR_IFNAME])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_IFTYPE]) {
		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
		if (type > NL80211_IFTYPE_MAX)
			return -EINVAL;
	}

2617
	if (!rdev->ops->add_virtual_intf ||
2618 2619
	    !(rdev->wiphy.interface_modes & (1 << type)))
		return -EOPNOTSUPP;
2620

2621 2622 2623
	if ((type == NL80211_IFTYPE_P2P_DEVICE ||
	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
	    info->attrs[NL80211_ATTR_MAC]) {
2624 2625 2626 2627 2628 2629
		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
			   ETH_ALEN);
		if (!is_valid_ether_addr(params.macaddr))
			return -EADDRNOTAVAIL;
	}

2630
	if (info->attrs[NL80211_ATTR_4ADDR]) {
2631
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2632
		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2633
		if (err)
2634
			return err;
2635
	}
2636

2637 2638 2639 2640
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

2641 2642 2643
	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
				  &flags);
2644

2645
	if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2646 2647 2648
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2649 2650 2651
	wdev = rdev_add_virtual_intf(rdev,
				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
				type, err ? NULL : &flags, &params);
2652 2653 2654 2655
	if (WARN_ON(!wdev)) {
		nlmsg_free(msg);
		return -EPROTO;
	} else if (IS_ERR(wdev)) {
2656
		nlmsg_free(msg);
2657
		return PTR_ERR(wdev);
2658
	}
2659

2660
	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2661 2662
		wdev->owner_nlportid = info->snd_portid;

2663 2664 2665 2666
	switch (type) {
	case NL80211_IFTYPE_MESH_POINT:
		if (!info->attrs[NL80211_ATTR_MESH_ID])
			break;
2667 2668 2669 2670 2671 2672 2673 2674
		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692
		break;
	case NL80211_IFTYPE_P2P_DEVICE:
		/*
		 * P2P Device doesn't have a netdev, so doesn't go
		 * through the netdev notifier and must be added here
		 */
		mutex_init(&wdev->mtx);
		INIT_LIST_HEAD(&wdev->event_list);
		spin_lock_init(&wdev->event_lock);
		INIT_LIST_HEAD(&wdev->mgmt_registrations);
		spin_lock_init(&wdev->mgmt_registrations_lock);

		wdev->identifier = ++rdev->wdev_id;
		list_add_rcu(&wdev->list, &rdev->wdev_list);
		rdev->devlist_generation++;
		break;
	default:
		break;
2693 2694
	}

2695
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2696
			       rdev, wdev, false) < 0) {
2697 2698 2699 2700
		nlmsg_free(msg);
		return -ENOBUFS;
	}

2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714
	event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (event) {
		if (nl80211_send_iface(event, 0, 0, 0,
				       rdev, wdev, false) < 0) {
			nlmsg_free(event);
			goto out;
		}

		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
					event, 0, NL80211_MCGRP_CONFIG,
					GFP_KERNEL);
	}

out:
2715
	return genlmsg_reply(msg, info);
2716 2717 2718 2719
}

static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
{
2720
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2721
	struct wireless_dev *wdev = info->user_ptr[1];
2722 2723
	struct sk_buff *msg;
	int status;
2724

2725 2726
	if (!rdev->ops->del_virtual_intf)
		return -EOPNOTSUPP;
2727

2728 2729 2730 2731 2732 2733
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
		nlmsg_free(msg);
		msg = NULL;
	}

2734 2735 2736 2737 2738 2739 2740 2741 2742 2743
	/*
	 * If we remove a wireless device without a netdev then clear
	 * user_ptr[1] so that nl80211_post_doit won't dereference it
	 * to check if it needs to do dev_put(). Otherwise it crashes
	 * since the wdev has been freed, unlike with a netdev where
	 * we need the dev_put() for the netdev to really be freed.
	 */
	if (!wdev->netdev)
		info->user_ptr[1] = NULL;

2744 2745 2746 2747 2748 2749 2750 2751 2752
	status = rdev_del_virtual_intf(rdev, wdev);
	if (status >= 0 && msg)
		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
					msg, 0, NL80211_MCGRP_CONFIG,
					GFP_KERNEL);
	else
		nlmsg_free(msg);

	return status;
2753 2754
}

2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768
static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u16 noack_map;

	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
		return -EINVAL;

	if (!rdev->ops->set_noack_map)
		return -EOPNOTSUPP;

	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);

2769
	return rdev_set_noack_map(rdev, dev, noack_map);
2770 2771
}

2772 2773 2774
struct get_key_cookie {
	struct sk_buff *msg;
	int error;
2775
	int idx;
2776 2777 2778 2779
};

static void get_key_callback(void *c, struct key_params *params)
{
2780
	struct nlattr *key;
2781 2782
	struct get_key_cookie *cookie = c;

2783 2784 2785 2786 2787 2788 2789 2790 2791 2792
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2793

2794 2795 2796 2797
	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
	if (!key)
		goto nla_put_failure;

2798 2799 2800 2801 2802 2803 2804 2805 2806 2807
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2808

2809 2810
	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
		goto nla_put_failure;
2811 2812 2813

	nla_nest_end(cookie->msg, key);

2814 2815 2816 2817 2818 2819 2820
	return;
 nla_put_failure:
	cookie->error = 1;
}

static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
{
2821
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2822
	int err;
2823
	struct net_device *dev = info->user_ptr[1];
2824
	u8 key_idx = 0;
2825 2826
	const u8 *mac_addr = NULL;
	bool pairwise;
2827 2828 2829 2830 2831 2832 2833 2834 2835
	struct get_key_cookie cookie = {
		.error = 0,
	};
	void *hdr;
	struct sk_buff *msg;

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

2836
	if (key_idx > 5)
2837 2838 2839 2840 2841
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852
	pairwise = !!mac_addr;
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (kt >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
		if (kt != NL80211_KEYTYPE_GROUP &&
		    kt != NL80211_KEYTYPE_PAIRWISE)
			return -EINVAL;
		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
	}

2853 2854
	if (!rdev->ops->get_key)
		return -EOPNOTSUPP;
2855

2856
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2857 2858
	if (!msg)
		return -ENOMEM;
2859

2860
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2861
			     NL80211_CMD_NEW_KEY);
2862
	if (!hdr)
2863
		goto nla_put_failure;
2864 2865

	cookie.msg = msg;
2866
	cookie.idx = key_idx;
2867

2868 2869 2870 2871 2872 2873
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
		goto nla_put_failure;
	if (mac_addr &&
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
2874

2875 2876 2877 2878
	if (pairwise && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		return -ENOENT;

2879 2880
	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
			   get_key_callback);
2881 2882

	if (err)
Niko Jokinen's avatar
Niko Jokinen committed
2883
		goto free_msg;
2884 2885 2886 2887 2888

	if (cookie.error)
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
2889
	return genlmsg_reply(msg, info);
2890 2891 2892

 nla_put_failure:
	err = -ENOBUFS;
Niko Jokinen's avatar
Niko Jokinen committed
2893
 free_msg:
2894 2895 2896 2897 2898 2899
	nlmsg_free(msg);
	return err;
}

static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
{
2900
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2901
	struct key_parse key;
2902
	int err;
2903
	struct net_device *dev = info->user_ptr[1];
2904

2905 2906 2907
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2908

2909
	if (key.idx < 0)
2910 2911
		return -EINVAL;

2912 2913
	/* only support setting default key */
	if (!key.def && !key.defmgmt)
2914 2915
		return -EINVAL;

2916
	wdev_lock(dev->ieee80211_ptr);
2917

2918 2919 2920 2921 2922
	if (key.def) {
		if (!rdev->ops->set_default_key) {
			err = -EOPNOTSUPP;
			goto out;
		}
2923

2924 2925 2926 2927
		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2928
		err = rdev_set_default_key(rdev, dev, key.idx,
2929 2930 2931 2932
						 key.def_uni, key.def_multi);

		if (err)
			goto out;
2933

Johannes Berg's avatar
Johannes Berg committed
2934
#ifdef CONFIG_CFG80211_WEXT
2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951
		dev->ieee80211_ptr->wext.default_key = key.idx;
#endif
	} else {
		if (key.def_uni || !key.def_multi) {
			err = -EINVAL;
			goto out;
		}

		if (!rdev->ops->set_default_mgmt_key) {
			err = -EOPNOTSUPP;
			goto out;
		}

		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2952
		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2953 2954 2955 2956 2957
		if (err)
			goto out;

#ifdef CONFIG_CFG80211_WEXT
		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2958
#endif
2959 2960 2961
	}

 out:
2962
	wdev_unlock(dev->ieee80211_ptr);
2963 2964 2965 2966 2967 2968

	return err;
}

static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
{
2969
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2970
	int err;
2971
	struct net_device *dev = info->user_ptr[1];
2972
	struct key_parse key;
2973
	const u8 *mac_addr = NULL;
2974

2975 2976 2977
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2978

2979
	if (!key.p.key)
2980 2981 2982 2983 2984
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2985 2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

2997 2998
	if (!rdev->ops->add_key)
		return -EOPNOTSUPP;
2999

3000 3001 3002
	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
					   key.type == NL80211_KEYTYPE_PAIRWISE,
					   mac_addr))
3003
		return -EINVAL;
3004

3005 3006 3007
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
	if (!err)
3008 3009 3010
		err = rdev_add_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				    mac_addr, &key.p);
3011
	wdev_unlock(dev->ieee80211_ptr);
3012 3013 3014 3015 3016 3017

	return err;
}

static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
{
3018
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3019
	int err;
3020
	struct net_device *dev = info->user_ptr[1];
3021
	u8 *mac_addr = NULL;
3022
	struct key_parse key;
3023

3024 3025 3026
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
3027 3028 3029 3030

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

3031 3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

3043 3044
	if (!rdev->ops->del_key)
		return -EOPNOTSUPP;
3045

3046 3047
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
3048 3049 3050 3051 3052

	if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		err = -ENOENT;

3053
	if (!err)
3054 3055 3056
		err = rdev_del_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				   mac_addr);
3057

Johannes Berg's avatar
Johannes Berg committed
3058
#ifdef CONFIG_CFG80211_WEXT
3059
	if (!err) {
3060
		if (key.idx == dev->ieee80211_ptr->wext.default_key)
3061
			dev->ieee80211_ptr->wext.default_key = -1;
3062
		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3063 3064 3065
			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
	}
#endif
3066
	wdev_unlock(dev->ieee80211_ptr);
3067

3068 3069 3070
	return err;
}

3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161
/* This function returns an error or the number of nested attributes */
static int validate_acl_mac_addrs(struct nlattr *nl_attr)
{
	struct nlattr *attr;
	int n_entries = 0, tmp;

	nla_for_each_nested(attr, nl_attr, tmp) {
		if (nla_len(attr) != ETH_ALEN)
			return -EINVAL;

		n_entries++;
	}

	return n_entries;
}

/*
 * This function parses ACL information and allocates memory for ACL data.
 * On successful return, the calling function is responsible to free the
 * ACL buffer returned by this function.
 */
static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
						struct genl_info *info)
{
	enum nl80211_acl_policy acl_policy;
	struct nlattr *attr;
	struct cfg80211_acl_data *acl;
	int i = 0, n_entries, tmp;

	if (!wiphy->max_acl_mac_addrs)
		return ERR_PTR(-EOPNOTSUPP);

	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
		return ERR_PTR(-EINVAL);

	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
		return ERR_PTR(-EINVAL);

	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
		return ERR_PTR(-EINVAL);

	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
	if (n_entries < 0)
		return ERR_PTR(n_entries);

	if (n_entries > wiphy->max_acl_mac_addrs)
		return ERR_PTR(-ENOTSUPP);

	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
		      GFP_KERNEL);
	if (!acl)
		return ERR_PTR(-ENOMEM);

	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
		i++;
	}

	acl->n_acl_entries = n_entries;
	acl->acl_policy = acl_policy;

	return acl;
}

static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct cfg80211_acl_data *acl;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!dev->ieee80211_ptr->beacon_interval)
		return -EINVAL;

	acl = parse_acl_data(&rdev->wiphy, info);
	if (IS_ERR(acl))
		return PTR_ERR(acl);

	err = rdev_set_mac_acl(rdev, dev, acl);

	kfree(acl);

	return err;
}

3162
static int nl80211_parse_beacon(struct nlattr *attrs[],
3163
				struct cfg80211_beacon_data *bcn)
3164
{
3165
	bool haveinfo = false;
3166

3167 3168 3169 3170
	if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3171 3172
		return -EINVAL;

3173
	memset(bcn, 0, sizeof(*bcn));
3174

3175 3176 3177
	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3178 3179 3180
		if (!bcn->head_len)
			return -EINVAL;
		haveinfo = true;
3181 3182
	}

3183 3184 3185
	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3186
		haveinfo = true;
3187 3188
	}

3189 3190
	if (!haveinfo)
		return -EINVAL;
Johannes Berg's avatar
Johannes Berg committed
3191

3192 3193 3194
	if (attrs[NL80211_ATTR_IE]) {
		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3195 3196
	}

3197
	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3198
		bcn->proberesp_ies =
3199
			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3200
		bcn->proberesp_ies_len =
3201
			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3202 3203
	}

3204
	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3205
		bcn->assocresp_ies =
3206
			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3207
		bcn->assocresp_ies_len =
3208
			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3209 3210
	}

3211 3212 3213
	if (attrs[NL80211_ATTR_PROBE_RESP]) {
		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3214 3215
	}

3216 3217 3218
	return 0;
}

3219 3220 3221 3222 3223 3224
static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
				   struct cfg80211_ap_settings *params)
{
	struct wireless_dev *wdev;
	bool ret = false;

3225
	list_for_each_entry(wdev, &rdev->wdev_list, list) {
3226 3227 3228 3229
		if (wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
			continue;

3230
		if (!wdev->preset_chandef.chan)
3231 3232
			continue;

3233
		params->chandef = wdev->preset_chandef;
3234 3235 3236 3237 3238 3239 3240
		ret = true;
		break;
	}

	return ret;
}

3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264
static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
				    enum nl80211_auth_type auth_type,
				    enum nl80211_commands cmd)
{
	if (auth_type > NL80211_AUTHTYPE_MAX)
		return false;

	switch (cmd) {
	case NL80211_CMD_AUTHENTICATE:
		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
		    auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	case NL80211_CMD_CONNECT:
	case NL80211_CMD_START_AP:
		/* SAE not supported yet */
		if (auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	default:
		return false;
	}
}

3265 3266 3267 3268 3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290
static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_ap_settings params;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->start_ap)
		return -EOPNOTSUPP;

	if (wdev->beacon_interval)
		return -EALREADY;

	memset(&params, 0, sizeof(params));

	/* these are required for START_AP */
	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
		return -EINVAL;

3291
	err = nl80211_parse_beacon(info->attrs, &params.beacon);
3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333
	if (err)
		return err;

	params.beacon_interval =
		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
	params.dtim_period =
		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);

	err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
	if (err)
		return err;

	/*
	 * In theory, some of these attributes should be required here
	 * but since they were not used when the command was originally
	 * added, keep them optional for old user space programs to let
	 * them continue to work with drivers that do not need the
	 * additional information -- drivers must check!
	 */
	if (info->attrs[NL80211_ATTR_SSID]) {
		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
		params.ssid_len =
			nla_len(info->attrs[NL80211_ATTR_SSID]);
		if (params.ssid_len == 0 ||
		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
		params.hidden_ssid = nla_get_u32(
			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
			return -EINVAL;
	}

	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		params.auth_type = nla_get_u32(
			info->attrs[NL80211_ATTR_AUTH_TYPE]);
3334 3335
		if (!nl80211_valid_auth_type(rdev, params.auth_type,
					     NL80211_CMD_START_AP))
3336 3337 3338 3339 3340 3341 3342 3343 3344
			return -EINVAL;
	} else
		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	err = nl80211_crypto_settings(rdev, info, &params.crypto,
				      NL80211_MAX_NR_CIPHER_SUITES);
	if (err)
		return err;

3345 3346 3347 3348 3349 3350 3351
	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
			return -EOPNOTSUPP;
		params.inactivity_timeout = nla_get_u16(
			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
	}

3352 3353 3354 3355 3356 3357 3358 3359 3360 3361 3362 3363 3364 3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375 3376 3377
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow > 127)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

3378
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3379 3380 3381 3382 3383
		err = nl80211_parse_chandef(rdev, info, &params.chandef);
		if (err)
			return err;
	} else if (wdev->preset_chandef.chan) {
		params.chandef = wdev->preset_chandef;
3384
	} else if (!nl80211_get_ap_channel(rdev, &params))
3385 3386
		return -EINVAL;

3387 3388
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
				     wdev->iftype))
3389 3390
		return -EINVAL;

3391 3392 3393 3394 3395 3396
	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
		params.acl = parse_acl_data(&rdev->wiphy, info);
		if (IS_ERR(params.acl))
			return PTR_ERR(params.acl);
	}

3397 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419
	if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
		params.smps_mode =
			nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
		switch (params.smps_mode) {
		case NL80211_SMPS_OFF:
			break;
		case NL80211_SMPS_STATIC:
			if (!(rdev->wiphy.features &
			      NL80211_FEATURE_STATIC_SMPS))
				return -EINVAL;
			break;
		case NL80211_SMPS_DYNAMIC:
			if (!(rdev->wiphy.features &
			      NL80211_FEATURE_DYNAMIC_SMPS))
				return -EINVAL;
			break;
		default:
			return -EINVAL;
		}
	} else {
		params.smps_mode = NL80211_SMPS_OFF;
	}

3420
	wdev_lock(wdev);
3421
	err = rdev_start_ap(rdev, dev, &params);
3422
	if (!err) {
3423
		wdev->preset_chandef = params.chandef;
3424
		wdev->beacon_interval = params.beacon_interval;
3425
		wdev->chandef = params.chandef;
3426 3427
		wdev->ssid_len = params.ssid_len;
		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3428
	}
3429
	wdev_unlock(wdev);
3430 3431 3432

	kfree(params.acl);

3433
	return err;
3434 3435
}

3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 3453
static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_beacon_data params;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->change_beacon)
		return -EOPNOTSUPP;

	if (!wdev->beacon_interval)
		return -EINVAL;

3454
	err = nl80211_parse_beacon(info->attrs, &params);
3455 3456 3457
	if (err)
		return err;

3458 3459 3460 3461 3462
	wdev_lock(wdev);
	err = rdev_change_beacon(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
3463 3464 3465
}

static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3466
{
3467 3468
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3469

3470
	return cfg80211_stop_ap(rdev, dev, false);
3471 3472
}

3473 3474 3475 3476
static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3477
	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3478
	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3479
	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3480 3481
};

3482
static int parse_station_flags(struct genl_info *info,
3483
			       enum nl80211_iftype iftype,
3484
			       struct station_parameters *params)
3485 3486
{
	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3487
	struct nlattr *nla;
3488 3489
	int flag;

3490 3491 3492 3493 3494 3495 3496 3497 3498 3499 3500
	/*
	 * Try parsing the new attribute first so userspace
	 * can specify both for older kernels.
	 */
	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
	if (nla) {
		struct nl80211_sta_flag_update *sta_flags;

		sta_flags = nla_data(nla);
		params->sta_flags_mask = sta_flags->mask;
		params->sta_flags_set = sta_flags->set;
3501
		params->sta_flags_set &= params->sta_flags_mask;
3502 3503 3504 3505 3506 3507 3508
		if ((params->sta_flags_mask |
		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
			return -EINVAL;
		return 0;
	}

	/* if present, parse the old attribute */
3509

3510
	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3511 3512 3513 3514 3515 3516 3517
	if (!nla)
		return 0;

	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
			     nla, sta_flags_policy))
		return -EINVAL;

3518 3519 3520 3521 3522 3523 3524 3525 3526 3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544
	/*
	 * Only allow certain flags for interface types so that
	 * other attributes are silently ignored. Remember that
	 * this is backward compatibility code with old userspace
	 * and shouldn't be hit in other cases anyway.
	 */
	switch (iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
					 BIT(NL80211_STA_FLAG_WME) |
					 BIT(NL80211_STA_FLAG_MFP);
		break;
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_STATION:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	case NL80211_IFTYPE_MESH_POINT:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
					 BIT(NL80211_STA_FLAG_MFP) |
					 BIT(NL80211_STA_FLAG_AUTHORIZED);
	default:
		return -EINVAL;
	}
3545

3546 3547
	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
		if (flags[flag]) {
3548
			params->sta_flags_set |= (1<<flag);
3549

3550 3551 3552 3553 3554 3555
			/* no longer support new API additions in old API */
			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
				return -EINVAL;
		}
	}

3556 3557 3558
	return 0;
}

3559 3560 3561 3562
static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
				 int attr)
{
	struct nlattr *rate;
3563 3564
	u32 bitrate;
	u16 bitrate_compat;
3565 3566 3567

	rate = nla_nest_start(msg, attr);
	if (!rate)
3568
		return false;
3569 3570 3571

	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
	bitrate = cfg80211_calculate_bitrate(info);
3572 3573
	/* report 16-bit bitrate only if we can */
	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610
	if (bitrate > 0 &&
	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
		return false;
	if (bitrate_compat > 0 &&
	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
		return false;

	if (info->flags & RATE_INFO_FLAGS_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
			return false;
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	}
3611 3612 3613 3614 3615

	nla_nest_end(msg, rate);
	return true;
}

3616 3617 3618 3619 3620 3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631 3632 3633 3634 3635 3636 3637 3638 3639 3640 3641
static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
			       int id)
{
	void *attr;
	int i = 0;

	if (!mask)
		return true;

	attr = nla_nest_start(msg, id);
	if (!attr)
		return false;

	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
		if (!(mask & BIT(i)))
			continue;

		if (nla_put_u8(msg, i, signal[i]))
			return false;
	}

	nla_nest_end(msg, attr);

	return true;
}

3642
static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3643 3644 3645
				int flags,
				struct cfg80211_registered_device *rdev,
				struct net_device *dev,
3646
				const u8 *mac_addr, struct station_info *sinfo)
3647 3648
{
	void *hdr;
3649
	struct nlattr *sinfoattr, *bss_param;
3650

3651
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3652 3653 3654
	if (!hdr)
		return -1;

3655 3656 3657 3658
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
		goto nla_put_failure;
3659

3660 3661
	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
	if (!sinfoattr)
3662
		goto nla_put_failure;
3663 3664 3665 3666 3667 3668 3669 3670
	if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
			sinfo->connected_time))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
			sinfo->inactive_time))
		goto nla_put_failure;
3671 3672
	if ((sinfo->filled & (STATION_INFO_RX_BYTES |
			      STATION_INFO_RX_BYTES64)) &&
3673
	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3674
			(u32)sinfo->rx_bytes))
3675
		goto nla_put_failure;
3676
	if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3677
			      STATION_INFO_TX_BYTES64)) &&
3678
	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3679 3680 3681 3682 3683 3684 3685 3686
			(u32)sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
			sinfo->rx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698
			sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_LLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
	    nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
		       sinfo->plink_state))
		goto nla_put_failure;
3699 3700
	switch (rdev->wiphy.signal_type) {
	case CFG80211_SIGNAL_TYPE_MBM:
3701 3702 3703 3704 3705 3706 3707 3708
		if ((sinfo->filled & STATION_INFO_SIGNAL) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
			       sinfo->signal))
			goto nla_put_failure;
		if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
			       sinfo->signal_avg))
			goto nla_put_failure;
3709 3710 3711 3712
		break;
	default:
		break;
	}
3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal,
					NL80211_STA_INFO_CHAIN_SIGNAL))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal_avg,
					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
			goto nla_put_failure;
	}
3725
	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3726 3727 3728 3729 3730 3731 3732
		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
					  NL80211_STA_INFO_TX_BITRATE))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_RX_BITRATE) {
		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
					  NL80211_STA_INFO_RX_BITRATE))
3733 3734
			goto nla_put_failure;
	}
3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750
	if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
			sinfo->rx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
			sinfo->tx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
			sinfo->tx_retries))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
			sinfo->tx_failed))
		goto nla_put_failure;
3751 3752 3753 3754
	if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
	    nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
			sinfo->expected_throughput))
		goto nla_put_failure;
3755 3756 3757 3758
	if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
	    nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
			sinfo->beacon_loss_count))
		goto nla_put_failure;
3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770
	if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
			sinfo->local_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
			sinfo->peer_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
			sinfo->nonpeer_pm))
		goto nla_put_failure;
3771 3772 3773 3774 3775
	if (sinfo->filled & STATION_INFO_BSS_PARAM) {
		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
		if (!bss_param)
			goto nla_put_failure;

3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786
		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
			       sinfo->bss_param.dtim_period) ||
		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
				sinfo->bss_param.beacon_interval))
			goto nla_put_failure;
3787 3788 3789

		nla_nest_end(msg, bss_param);
	}
3790 3791 3792 3793 3794
	if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
		    sizeof(struct nl80211_sta_flag_update),
		    &sinfo->sta_flags))
		goto nla_put_failure;
3795 3796 3797 3798
	if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
		nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
			    sinfo->t_offset))
		goto nla_put_failure;
3799
	nla_nest_end(msg, sinfoattr);
3800

3801 3802 3803 3804
	if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
		    sinfo->assoc_req_ies))
		goto nla_put_failure;
3805

3806 3807 3808
	return genlmsg_end(msg, hdr);

 nla_put_failure:
3809 3810
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
3811 3812
}

3813
static int nl80211_dump_station(struct sk_buff *skb,
Johannes Berg's avatar
Johannes Berg committed
3814
				struct netlink_callback *cb)
3815 3816
{
	struct station_info sinfo;
3817
	struct cfg80211_registered_device *rdev;
3818
	struct wireless_dev *wdev;
3819
	u8 mac_addr[ETH_ALEN];
3820
	int sta_idx = cb->args[2];
3821 3822
	int err;

3823
	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3824 3825
	if (err)
		return err;
Johannes Berg's avatar
Johannes Berg committed
3826

3827 3828 3829 3830 3831
	if (!wdev->netdev) {
		err = -EINVAL;
		goto out_err;
	}

3832
	if (!rdev->ops->dump_station) {
3833
		err = -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
3834 3835 3836 3837
		goto out_err;
	}

	while (1) {
3838
		memset(&sinfo, 0, sizeof(sinfo));
3839
		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3840
					mac_addr, &sinfo);
Johannes Berg's avatar
Johannes Berg committed
3841 3842 3843
		if (err == -ENOENT)
			break;
		if (err)
Johannes Berg's avatar
Johannes Berg committed
3844
			goto out_err;
Johannes Berg's avatar
Johannes Berg committed
3845 3846

		if (nl80211_send_station(skb,
3847
				NETLINK_CB(cb->skb).portid,
Johannes Berg's avatar
Johannes Berg committed
3848
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
3849
				rdev, wdev->netdev, mac_addr,
Johannes Berg's avatar
Johannes Berg committed
3850 3851 3852 3853 3854 3855 3856 3857
				&sinfo) < 0)
			goto out;

		sta_idx++;
	}


 out:
3858
	cb->args[2] = sta_idx;
Johannes Berg's avatar
Johannes Berg committed
3859 3860
	err = skb->len;
 out_err:
3861
	nl80211_finish_wdev_dump(rdev);
Johannes Berg's avatar
Johannes Berg committed
3862 3863

	return err;
3864
}
3865

3866 3867
static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
{
3868 3869
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3870
	struct station_info sinfo;
3871 3872
	struct sk_buff *msg;
	u8 *mac_addr = NULL;
3873
	int err;
3874

3875
	memset(&sinfo, 0, sizeof(sinfo));
3876 3877 3878 3879 3880 3881

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

3882 3883
	if (!rdev->ops->get_station)
		return -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
3884

3885
	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3886
	if (err)
3887
		return err;
3888

3889
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3890
	if (!msg)
3891
		return -ENOMEM;
3892

3893
	if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3894
				 rdev, dev, mac_addr, &sinfo) < 0) {
3895 3896 3897
		nlmsg_free(msg);
		return -ENOBUFS;
	}
Johannes Berg's avatar
Johannes Berg committed
3898

3899
	return genlmsg_reply(msg, info);
3900 3901
}

3902 3903 3904 3905 3906 3907
int cfg80211_check_station_change(struct wiphy *wiphy,
				  struct station_parameters *params,
				  enum cfg80211_station_type statype)
{
	if (params->listen_interval != -1)
		return -EINVAL;
3908 3909
	if (params->aid &&
	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3910 3911 3912 3913 3914 3915
		return -EINVAL;

	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

	switch (statype) {
3916 3917
	case CFG80211_STA_MESH_PEER_KERNEL:
	case CFG80211_STA_MESH_PEER_USER:
3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018
		/*
		 * No ignoring the TDLS flag here -- the userspace mesh
		 * code doesn't have the bug of including TDLS in the
		 * mask everywhere.
		 */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_MFP) |
				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* ignore since it can't change */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	default:
		/* disallow mesh-specific things */
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		if (params->local_pm)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
		/* TDLS can't be set, ... */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
			return -EINVAL;
		/*
		 * ... but don't bother the driver with it. This works around
		 * a hostapd/wpa_supplicant issue -- it always includes the
		 * TLDS_PEER flag in the mask even for AP mode.
		 */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
		/* reject other things that can't change */
		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
			return -EINVAL;
		if (params->supported_rates)
			return -EINVAL;
		if (params->ext_capab || params->ht_capa || params->vht_capa)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_AP_CLIENT) {
		if (params->vlan)
			return -EINVAL;
	}

	switch (statype) {
	case CFG80211_STA_AP_MLME_CLIENT:
		/* Use this only for authorizing/unauthorizing a station */
		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EOPNOTSUPP;
		break;
	case CFG80211_STA_AP_CLIENT:
		/* accept only the listed bits */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
				  BIT(NL80211_STA_FLAG_WME) |
				  BIT(NL80211_STA_FLAG_MFP)))
			return -EINVAL;

		/* but authenticated/associated only if driver handles it */
		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params->sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;
		break;
	case CFG80211_STA_IBSS:
	case CFG80211_STA_AP_STA:
		/* reject any changes other than AUTHORIZED */
		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
		/* reject any changes other than AUTHORIZED or WME */
		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
					       BIT(NL80211_STA_FLAG_WME)))
			return -EINVAL;
		/* force (at least) rates when authorizing */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
		    !params->supported_rates)
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		/* reject any changes */
		return -EINVAL;
4019
	case CFG80211_STA_MESH_PEER_KERNEL:
4020 4021 4022
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
		break;
4023
	case CFG80211_STA_MESH_PEER_USER:
4024 4025 4026 4027 4028 4029 4030 4031 4032
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		break;
	}

	return 0;
}
EXPORT_SYMBOL(cfg80211_check_station_change);

4033
/*
4034
 * Get vlan interface making sure it is running and on the right wiphy.
4035
 */
4036 4037
static struct net_device *get_vlan(struct genl_info *info,
				   struct cfg80211_registered_device *rdev)
4038
{
4039
	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4040 4041 4042 4043 4044 4045 4046 4047 4048 4049 4050 4051 4052
	struct net_device *v;
	int ret;

	if (!vlanattr)
		return NULL;

	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
	if (!v)
		return ERR_PTR(-ENODEV);

	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
		ret = -EINVAL;
		goto error;
4053
	}
4054

4055 4056 4057 4058 4059 4060 4061
	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
		ret = -EINVAL;
		goto error;
	}

4062 4063 4064 4065 4066 4067 4068 4069 4070
	if (!netif_running(v)) {
		ret = -ENETDOWN;
		goto error;
	}

	return v;
 error:
	dev_put(v);
	return ERR_PTR(ret);
4071 4072
}

4073 4074
static const struct nla_policy
nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4075 4076 4077 4078
	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
};

4079 4080
static int nl80211_parse_sta_wme(struct genl_info *info,
				 struct station_parameters *params)
4081 4082 4083 4084 4085 4086 4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112
{
	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
	struct nlattr *nla;
	int err;

	/* parse WME attributes if present */
	if (!info->attrs[NL80211_ATTR_STA_WME])
		return 0;

	nla = info->attrs[NL80211_ATTR_STA_WME];
	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
			       nl80211_sta_wme_policy);
	if (err)
		return err;

	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
		params->uapsd_queues = nla_get_u8(
			tb[NL80211_STA_WME_UAPSD_QUEUES]);
	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
		return -EINVAL;

	if (tb[NL80211_STA_WME_MAX_SP])
		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);

	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
		return -EINVAL;

	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;

	return 0;
}

4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143 4144 4145 4146 4147
static int nl80211_parse_sta_channel_info(struct genl_info *info,
				      struct station_parameters *params)
{
	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
		params->supported_channels =
		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
		params->supported_channels_len =
		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
		/*
		 * Need to include at least one (first channel, number of
		 * channels) tuple for each subband, and must have proper
		 * tuples for the rest of the data as well.
		 */
		if (params->supported_channels_len < 2)
			return -EINVAL;
		if (params->supported_channels_len % 2)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
		params->supported_oper_classes =
		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
		params->supported_oper_classes_len =
		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
		/*
		 * The value of the Length field of the Supported Operating
		 * Classes element is between 2 and 253.
		 */
		if (params->supported_oper_classes_len < 2 ||
		    params->supported_oper_classes_len > 253)
			return -EINVAL;
	}
	return 0;
}

4148 4149 4150
static int nl80211_set_station_tdls(struct genl_info *info,
				    struct station_parameters *params)
{
4151
	int err;
4152
	/* Dummy STA entry gets updated once the peer capabilities are known */
4153 4154
	if (info->attrs[NL80211_ATTR_PEER_AID])
		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4155 4156 4157 4158 4159 4160 4161
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params->ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params->vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

4162 4163 4164 4165
	err = nl80211_parse_sta_channel_info(info, params);
	if (err)
		return err;

4166 4167 4168
	return nl80211_parse_sta_wme(info, params);
}

4169 4170
static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
{
4171 4172
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4173
	struct station_parameters params;
4174 4175
	u8 *mac_addr;
	int err;
4176 4177 4178 4179 4180

	memset(&params, 0, sizeof(params));

	params.listen_interval = -1;

4181 4182 4183
	if (!rdev->ops->change_station)
		return -EOPNOTSUPP;

4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198
	if (info->attrs[NL80211_ATTR_STA_AID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
		params.supported_rates =
			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
		params.supported_rates_len =
			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	}

4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

4212
	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4213
		return -EINVAL;
4214

4215
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4216 4217
		return -EINVAL;

4218
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4219
		params.plink_action =
4220 4221 4222 4223
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
4224

4225
	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4226
		params.plink_state =
4227 4228 4229 4230 4231
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
			return -EINVAL;
		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
	}
4232

4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243
	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
		enum nl80211_mesh_power_mode pm = nla_get_u32(
			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);

		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
		    pm > NL80211_MESH_POWER_MAX)
			return -EINVAL;

		params.local_pm = pm;
	}

4244 4245 4246 4247 4248 4249 4250 4251 4252
	/* Include parameters for TDLS peer (will check later) */
	err = nl80211_set_station_tdls(info, &params);
	if (err)
		return err;

	params.vlan = get_vlan(info, rdev);
	if (IS_ERR(params.vlan))
		return PTR_ERR(params.vlan);

4253 4254 4255
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
4256 4257
	case NL80211_IFTYPE_P2P_GO:
	case NL80211_IFTYPE_P2P_CLIENT:
4258
	case NL80211_IFTYPE_STATION:
4259
	case NL80211_IFTYPE_ADHOC:
4260 4261 4262
	case NL80211_IFTYPE_MESH_POINT:
		break;
	default:
4263 4264
		err = -EOPNOTSUPP;
		goto out_put_vlan;
4265 4266
	}

4267
	/* driver will call cfg80211_check_station_change() */
4268
	err = rdev_change_station(rdev, dev, mac_addr, &params);
4269

4270
 out_put_vlan:
4271 4272
	if (params.vlan)
		dev_put(params.vlan);
Johannes Berg's avatar
Johannes Berg committed
4273

4274 4275 4276 4277 4278
	return err;
}

static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
{
4279
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4280
	int err;
4281
	struct net_device *dev = info->user_ptr[1];
4282 4283 4284 4285 4286
	struct station_parameters params;
	u8 *mac_addr = NULL;

	memset(&params, 0, sizeof(params));

4287 4288 4289
	if (!rdev->ops->add_station)
		return -EOPNOTSUPP;

4290 4291 4292 4293 4294 4295 4296 4297 4298
	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
		return -EINVAL;

4299 4300
	if (!info->attrs[NL80211_ATTR_STA_AID] &&
	    !info->attrs[NL80211_ATTR_PEER_AID])
4301 4302
		return -EINVAL;

4303 4304 4305 4306 4307 4308 4309
	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
	params.supported_rates =
		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.supported_rates_len =
		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.listen_interval =
		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4310

4311
	if (info->attrs[NL80211_ATTR_PEER_AID])
4312
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4313 4314
	else
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4315 4316
	if (!params.aid || params.aid > IEEE80211_MAX_AID)
		return -EINVAL;
4317

4318 4319 4320 4321 4322 4323 4324 4325 4326 4327 4328 4329 4330
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

4331 4332 4333
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params.ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4334

4335 4336 4337 4338
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params.vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

4339 4340 4341 4342 4343 4344
	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
		params.opmode_notif_used = true;
		params.opmode_notif =
			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
	}

4345
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4346
		params.plink_action =
4347 4348 4349 4350
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
4351

4352 4353 4354 4355
	err = nl80211_parse_sta_channel_info(info, &params);
	if (err)
		return err;

4356 4357 4358
	err = nl80211_parse_sta_wme(info, &params);
	if (err)
		return err;
4359

4360
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4361 4362
		return -EINVAL;

4363 4364 4365
	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

4366 4367 4368 4369
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
4370 4371 4372 4373
		/* ignore WME attributes if iface/sta is not capable */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4374

4375
		/* TDLS peers cannot be added */
4376 4377
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4378
			return -EINVAL;
4379 4380
		/* but don't bother the driver with it */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4381

4382 4383 4384 4385 4386 4387 4388 4389
		/* allow authenticated/associated only if driver handles it */
		if (!(rdev->wiphy.features &
				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;

4390 4391 4392 4393 4394 4395
		/* must be last in here for error handling */
		params.vlan = get_vlan(info, rdev);
		if (IS_ERR(params.vlan))
			return PTR_ERR(params.vlan);
		break;
	case NL80211_IFTYPE_MESH_POINT:
4396 4397 4398
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4399 4400 4401
		/* associated is disallowed */
		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
			return -EINVAL;
4402
		/* TDLS peers cannot be added */
4403 4404
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4405 4406 4407
			return -EINVAL;
		break;
	case NL80211_IFTYPE_STATION:
4408
	case NL80211_IFTYPE_P2P_CLIENT:
4409 4410 4411
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4412 4413 4414 4415
		/* these are disallowed */
		if (params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4416
			return -EINVAL;
4417 4418 4419 4420 4421 4422 4423 4424 4425
		/* Only TDLS peers can be added */
		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* Can only add if TDLS ... */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
			return -EOPNOTSUPP;
		/* ... with external setup is supported */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
			return -EOPNOTSUPP;
4426 4427 4428 4429 4430
		/*
		 * Older wpa_supplicant versions always mark the TDLS peer
		 * as authorized, but it shouldn't yet be.
		 */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4431 4432 4433
		break;
	default:
		return -EOPNOTSUPP;
4434 4435
	}

4436
	/* be aware of params.vlan when changing code here */
4437

4438
	err = rdev_add_station(rdev, dev, mac_addr, &params);
4439 4440 4441 4442 4443 4444 4445 4446

	if (params.vlan)
		dev_put(params.vlan);
	return err;
}

static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
{
4447 4448
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4449 4450 4451
	struct station_del_parameters params;

	memset(&params, 0, sizeof(params));
4452 4453

	if (info->attrs[NL80211_ATTR_MAC])
4454
		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4455

4456
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4457
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4458
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4459 4460
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;
4461

4462 4463
	if (!rdev->ops->del_station)
		return -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
4464

4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475 4476 4477 4478 4479 4480 4481 4482 4483 4484 4485
	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
		params.subtype =
			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
			return -EINVAL;
	} else {
		/* Default to Deauthentication frame */
		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
	}

	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
		params.reason_code =
			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
		if (params.reason_code == 0)
			return -EINVAL; /* 0 is reserved */
	} else {
		/* Default to reason code 2 */
		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
	}

4486
	return rdev_del_station(rdev, dev, &params);
4487 4488
}

4489
static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4490 4491 4492 4493 4494 4495 4496
				int flags, struct net_device *dev,
				u8 *dst, u8 *next_hop,
				struct mpath_info *pinfo)
{
	void *hdr;
	struct nlattr *pinfoattr;

4497
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4498 4499 4500
	if (!hdr)
		return -1;

4501 4502 4503 4504 4505
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
		goto nla_put_failure;
4506

4507 4508 4509
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
	if (!pinfoattr)
		goto nla_put_failure;
4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531
	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
			pinfo->frame_qlen))
		goto nla_put_failure;
	if (((pinfo->filled & MPATH_INFO_SN) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
	    ((pinfo->filled & MPATH_INFO_METRIC) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
			 pinfo->metric)) ||
	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
			 pinfo->exptime)) ||
	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
			pinfo->flags)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
			 pinfo->discovery_timeout)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
			pinfo->discovery_retries)))
		goto nla_put_failure;
4532 4533 4534 4535 4536 4537

	nla_nest_end(msg, pinfoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
4538 4539
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
4540 4541 4542
}

static int nl80211_dump_mpath(struct sk_buff *skb,
Johannes Berg's avatar
Johannes Berg committed
4543
			      struct netlink_callback *cb)
4544 4545
{
	struct mpath_info pinfo;
4546
	struct cfg80211_registered_device *rdev;
4547
	struct wireless_dev *wdev;
4548 4549
	u8 dst[ETH_ALEN];
	u8 next_hop[ETH_ALEN];
4550
	int path_idx = cb->args[2];
4551 4552
	int err;

4553
	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4554 4555
	if (err)
		return err;
Johannes Berg's avatar
Johannes Berg committed
4556

4557
	if (!rdev->ops->dump_mpath) {
4558
		err = -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
4559 4560 4561
		goto out_err;
	}

4562
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4563
		err = -EOPNOTSUPP;
4564
		goto out_err;
4565 4566
	}

Johannes Berg's avatar
Johannes Berg committed
4567
	while (1) {
4568
		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4569
				      next_hop, &pinfo);
Johannes Berg's avatar
Johannes Berg committed
4570
		if (err == -ENOENT)
4571
			break;
Johannes Berg's avatar
Johannes Berg committed
4572
		if (err)
Johannes Berg's avatar
Johannes Berg committed
4573
			goto out_err;
4574

4575
		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
Johannes Berg's avatar
Johannes Berg committed
4576
				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
4577
				       wdev->netdev, dst, next_hop,
Johannes Berg's avatar
Johannes Berg committed
4578 4579
				       &pinfo) < 0)
			goto out;
4580

Johannes Berg's avatar
Johannes Berg committed
4581
		path_idx++;
4582 4583 4584
	}


Johannes Berg's avatar
Johannes Berg committed
4585
 out:
4586
	cb->args[2] = path_idx;
Johannes Berg's avatar
Johannes Berg committed
4587 4588
	err = skb->len;
 out_err:
4589
	nl80211_finish_wdev_dump(rdev);
Johannes Berg's avatar
Johannes Berg committed
4590
	return err;
4591 4592 4593 4594
}

static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
{
4595
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4596
	int err;
4597
	struct net_device *dev = info->user_ptr[1];
4598 4599 4600 4601 4602 4603 4604 4605 4606 4607 4608 4609
	struct mpath_info pinfo;
	struct sk_buff *msg;
	u8 *dst = NULL;
	u8 next_hop[ETH_ALEN];

	memset(&pinfo, 0, sizeof(pinfo));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4610 4611
	if (!rdev->ops->get_mpath)
		return -EOPNOTSUPP;
4612

4613 4614
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4615

4616
	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4617
	if (err)
4618
		return err;
4619

4620
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4621
	if (!msg)
4622
		return -ENOMEM;
4623

4624
	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4625 4626 4627 4628
				 dev, dst, next_hop, &pinfo) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}
Johannes Berg's avatar
Johannes Berg committed
4629

4630
	return genlmsg_reply(msg, info);
4631 4632 4633 4634
}

static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
{
4635 4636
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4649 4650
	if (!rdev->ops->change_mpath)
		return -EOPNOTSUPP;
4651

4652 4653
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4654

4655
	return rdev_change_mpath(rdev, dev, dst, next_hop);
4656
}
4657

4658 4659
static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
{
4660 4661
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4662 4663 4664 4665 4666 4667 4668 4669 4670 4671 4672 4673
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4674 4675
	if (!rdev->ops->add_mpath)
		return -EOPNOTSUPP;
4676

4677 4678
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4679

4680
	return rdev_add_mpath(rdev, dev, dst, next_hop);
4681 4682 4683 4684
}

static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
{
4685 4686
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4687 4688 4689 4690 4691
	u8 *dst = NULL;

	if (info->attrs[NL80211_ATTR_MAC])
		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4692 4693
	if (!rdev->ops->del_mpath)
		return -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
4694

4695
	return rdev_del_mpath(rdev, dev, dst);
4696 4697
}

4698 4699 4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716 4717 4718 4719 4720 4721 4722 4723 4724 4725 4726 4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738 4739 4740 4741 4742 4743 4744 4745 4746 4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759 4760 4761 4762 4763 4764 4765 4766 4767 4768 4769 4770 4771 4772 4773 4774 4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785 4786 4787
static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	int err;
	struct net_device *dev = info->user_ptr[1];
	struct mpath_info pinfo;
	struct sk_buff *msg;
	u8 *dst = NULL;
	u8 mpp[ETH_ALEN];

	memset(&pinfo, 0, sizeof(pinfo));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

	if (!rdev->ops->get_mpp)
		return -EOPNOTSUPP;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
	if (err)
		return err;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
			       dev, dst, mpp, &pinfo) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}

	return genlmsg_reply(msg, info);
}

static int nl80211_dump_mpp(struct sk_buff *skb,
			    struct netlink_callback *cb)
{
	struct mpath_info pinfo;
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *wdev;
	u8 dst[ETH_ALEN];
	u8 mpp[ETH_ALEN];
	int path_idx = cb->args[2];
	int err;

	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
	if (err)
		return err;

	if (!rdev->ops->dump_mpp) {
		err = -EOPNOTSUPP;
		goto out_err;
	}

	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
		err = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
				    mpp, &pinfo);
		if (err == -ENOENT)
			break;
		if (err)
			goto out_err;

		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
				       wdev->netdev, dst, mpp,
				       &pinfo) < 0)
			goto out;

		path_idx++;
	}

 out:
	cb->args[2] = path_idx;
	err = skb->len;
 out_err:
	nl80211_finish_wdev_dump(rdev);
	return err;
}

4788 4789
static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
{
4790 4791
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4792
	struct wireless_dev *wdev = dev->ieee80211_ptr;
4793
	struct bss_parameters params;
4794
	int err;
4795 4796 4797 4798 4799 4800

	memset(&params, 0, sizeof(params));
	/* default to not changing parameters */
	params.use_cts_prot = -1;
	params.use_short_preamble = -1;
	params.use_short_slot_time = -1;
4801
	params.ap_isolate = -1;
4802
	params.ht_opmode = -1;
4803 4804
	params.p2p_ctwindow = -1;
	params.p2p_opp_ps = -1;
4805 4806 4807 4808 4809 4810 4811 4812 4813 4814

	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
		params.use_cts_prot =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
		params.use_short_preamble =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
		params.use_short_slot_time =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4815 4816 4817 4818 4819 4820
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		params.basic_rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		params.basic_rates_len =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
	}
4821 4822
	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4823 4824 4825
	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
		params.ht_opmode =
			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4826

4827 4828 4829 4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841 4842 4843 4844 4845 4846 4847 4848 4849 4850 4851 4852
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow < 0)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

4853 4854
	if (!rdev->ops->change_bss)
		return -EOPNOTSUPP;
4855

4856
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4857 4858
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;
Johannes Berg's avatar
Johannes Berg committed
4859

4860 4861 4862 4863 4864
	wdev_lock(wdev);
	err = rdev_change_bss(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
4865 4866
}

Alexey Dobriyan's avatar
Alexey Dobriyan committed
4867
static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4868 4869 4870 4871 4872 4873
	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
4874
	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
4875 4876 4877 4878 4879 4880 4881 4882 4883 4884 4885 4886 4887 4888
};

static int parse_reg_rule(struct nlattr *tb[],
	struct ieee80211_reg_rule *reg_rule)
{
	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;

	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
		return -EINVAL;
4889 4890
	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
		return -EINVAL;
4891 4892 4893 4894 4895 4896 4897 4898 4899
	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
		return -EINVAL;

	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);

	freq_range->start_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
	freq_range->end_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4900 4901
	freq_range->max_bandwidth_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4902 4903 4904 4905 4906 4907 4908 4909

	power_rule->max_eirp =
		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);

	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
		power_rule->max_antenna_gain =
			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);

4910 4911 4912 4913
	if (tb[NL80211_ATTR_DFS_CAC_TIME])
		reg_rule->dfs_cac_ms =
			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);

4914 4915 4916 4917 4918 4919
	return 0;
}

static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	char *data = NULL;
4920
	enum nl80211_user_reg_hint_type user_reg_hint_type;
4921

4922 4923 4924 4925 4926 4927
	/*
	 * You should only get this when cfg80211 hasn't yet initialized
	 * completely when built-in to the kernel right between the time
	 * window between nl80211_init() and regulatory_init(), if that is
	 * even possible.
	 */
4928
	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4929
		return -EINPROGRESS;
4930

4931 4932 4933 4934 4935 4936 4937 4938 4939
	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
		user_reg_hint_type =
		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
	else
		user_reg_hint_type = NL80211_USER_REG_HINT_USER;

	switch (user_reg_hint_type) {
	case NL80211_USER_REG_HINT_USER:
	case NL80211_USER_REG_HINT_CELL_BASE:
4940 4941 4942 4943 4944 4945 4946
		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
			return -EINVAL;

		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
		return regulatory_hint_user(data, user_reg_hint_type);
	case NL80211_USER_REG_HINT_INDOOR:
		return regulatory_hint_indoor_user();
4947 4948 4949
	default:
		return -EINVAL;
	}
4950 4951
}

4952
static int nl80211_get_mesh_config(struct sk_buff *skb,
4953
				   struct genl_info *info)
4954
{
4955 4956
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4957 4958 4959
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct mesh_config cur_params;
	int err = 0;
4960 4961 4962 4963
	void *hdr;
	struct nlattr *pinfoattr;
	struct sk_buff *msg;

4964 4965 4966
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

4967
	if (!rdev->ops->get_mesh_config)
4968
		return -EOPNOTSUPP;
4969

4970 4971 4972 4973 4974
	wdev_lock(wdev);
	/* If not connected, get default parameters */
	if (!wdev->mesh_id_len)
		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
	else
4975
		err = rdev_get_mesh_config(rdev, dev, &cur_params);
4976 4977
	wdev_unlock(wdev);

4978
	if (err)
4979
		return err;
4980 4981

	/* Draw up a netlink message to send back */
4982
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4983 4984
	if (!msg)
		return -ENOMEM;
4985
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4986
			     NL80211_CMD_GET_MESH_CONFIG);
4987
	if (!hdr)
4988
		goto out;
4989
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4990 4991
	if (!pinfoattr)
		goto nla_put_failure;
4992 4993 4994 4995 4996 4997 4998 4999 5000 5001 5002 5003 5004 5005 5006 5007 5008
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
			cur_params.dot11MeshRetryTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
			cur_params.dot11MeshConfirmTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
			cur_params.dot11MeshHoldingTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
			cur_params.dot11MeshMaxPeerLinks) ||
	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
		       cur_params.dot11MeshMaxRetries) ||
	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
		       cur_params.dot11MeshTTL) ||
	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
		       cur_params.element_ttl) ||
	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
		       cur_params.auto_open_plinks) ||
5009 5010
	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5011 5012 5013 5014 5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029 5030 5031 5032 5033
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
		       cur_params.dot11MeshHWMPmaxPREQretries) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
			cur_params.path_refresh_time) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
			cur_params.min_discovery_timeout) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
			cur_params.dot11MeshHWMPpreqMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
			cur_params.dot11MeshHWMPperrMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
		       cur_params.dot11MeshHWMPRootMode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
			cur_params.dot11MeshHWMPRannInterval) ||
	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
		       cur_params.dot11MeshGateAnnouncementProtocol) ||
	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
		       cur_params.dot11MeshForwarding) ||
	    nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5034 5035
			cur_params.rssi_threshold) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5036 5037 5038 5039
			cur_params.ht_opmode) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5040 5041
			cur_params.dot11MeshHWMProotInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5042 5043 5044 5045
			cur_params.dot11MeshHWMPconfirmationInterval) ||
	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
			cur_params.power_mode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5046 5047 5048
			cur_params.dot11MeshAwakeWindowDuration) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
			cur_params.plink_timeout))
5049
		goto nla_put_failure;
5050 5051
	nla_nest_end(msg, pinfoattr);
	genlmsg_end(msg, hdr);
5052
	return genlmsg_reply(msg, info);
5053

Johannes Berg's avatar
Johannes Berg committed
5054
 nla_put_failure:
5055
	genlmsg_cancel(msg, hdr);
5056
 out:
Yuri Ershov's avatar
Yuri Ershov committed
5057
	nlmsg_free(msg);
5058
	return -ENOBUFS;
5059 5060
}

Alexey Dobriyan's avatar
Alexey Dobriyan committed
5061
static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5062 5063 5064 5065 5066 5067
	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5068
	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5069
	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5070
	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5071 5072 5073 5074 5075
	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5076
	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5077
	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5078
	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5079
	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5080
	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5081
	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5082 5083
	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5084 5085
	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5086
	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5087 5088
	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5089
	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5090 5091
};

5092 5093
static const struct nla_policy
	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5094
	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5095 5096
	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5097
	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5098
	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5099
	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5100
	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5101
				    .len = IEEE80211_MAX_DATA_LEN },
5102
	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5103 5104
};

5105
static int nl80211_parse_mesh_config(struct genl_info *info,
5106 5107
				     struct mesh_config *cfg,
				     u32 *mask_out)
5108 5109
{
	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5110
	u32 mask = 0;
5111

5112 5113 5114 5115 5116 5117 5118 5119 5120
#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
do {									    \
	if (tb[attr]) {							    \
		if (fn(tb[attr]) < min || fn(tb[attr]) > max)		    \
			return -EINVAL;					    \
		cfg->param = fn(tb[attr]);				    \
		mask |= (1 << (attr - 1));				    \
	}								    \
} while (0)
5121 5122


5123
	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5124 5125
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5126
			     info->attrs[NL80211_ATTR_MESH_CONFIG],
5127
			     nl80211_meshconf_params_policy))
5128 5129 5130 5131 5132 5133 5134
		return -EINVAL;

	/* This makes sure that there aren't more than 32 mesh config
	 * parameters (otherwise our bitfield scheme would not work.) */
	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);

	/* Fill in the params struct */
5135
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5136 5137
				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
				  nla_get_u16);
5138
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5139 5140
				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
				  nla_get_u16);
5141
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5142 5143
				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
				  nla_get_u16);
5144
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5145 5146
				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
				  nla_get_u16);
5147
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5148 5149
				  mask, NL80211_MESHCONF_MAX_RETRIES,
				  nla_get_u8);
5150
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5151
				  mask, NL80211_MESHCONF_TTL, nla_get_u8);
5152
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5153 5154
				  mask, NL80211_MESHCONF_ELEMENT_TTL,
				  nla_get_u8);
5155
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5156 5157
				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
				  nla_get_u8);
5158 5159
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
				  1, 255, mask,
5160 5161
				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
				  nla_get_u32);
5162
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5163 5164
				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
				  nla_get_u8);
5165
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5166 5167
				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
				  nla_get_u32);
5168
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5169 5170
				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
				  nla_get_u16);
5171 5172
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
				  1, 65535, mask,
5173 5174
				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
				  nla_get_u32);
5175
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5176 5177
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5178
				  nla_get_u16);
5179
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5180 5181
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5182
				  nla_get_u16);
5183
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5184 5185
				  dot11MeshHWMPnetDiameterTraversalTime,
				  1, 65535, mask,
5186 5187
				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
				  nla_get_u16);
5188 5189 5190 5191 5192
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
				  nla_get_u8);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5193
				  nla_get_u16);
5194
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5195 5196
				  dot11MeshGateAnnouncementProtocol, 0, 1,
				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5197
				  nla_get_u8);
5198
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5199 5200
				  mask, NL80211_MESHCONF_FORWARDING,
				  nla_get_u8);
5201
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5202
				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5203
				  nla_get_s32);
5204
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5205
				  mask, NL80211_MESHCONF_HT_OPMODE,
5206 5207
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5208
				  1, 65535, mask,
5209 5210
				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
				  nla_get_u32);
5211
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5212
				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5213 5214
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5215 5216
				  dot11MeshHWMPconfirmationInterval,
				  1, 65535, mask,
5217
				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5218
				  nla_get_u16);
5219 5220 5221 5222 5223 5224 5225 5226
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
				  NL80211_MESH_POWER_ACTIVE,
				  NL80211_MESH_POWER_MAX,
				  mask, NL80211_MESHCONF_POWER_MODE,
				  nla_get_u32);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
				  0, 65535, mask,
				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5227 5228 5229
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
				  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
				  nla_get_u32);
5230 5231
	if (mask_out)
		*mask_out = mask;
5232

5233 5234 5235 5236 5237
	return 0;

#undef FILL_IN_MESH_PARAM_IF_SET
}

5238 5239 5240
static int nl80211_parse_mesh_setup(struct genl_info *info,
				     struct mesh_setup *setup)
{
5241
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5242 5243 5244 5245 5246 5247 5248 5249 5250
	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];

	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
			     info->attrs[NL80211_ATTR_MESH_SETUP],
			     nl80211_mesh_setup_params_policy))
		return -EINVAL;

5251 5252 5253 5254 5255 5256
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
		setup->sync_method =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
		 IEEE80211_SYNC_METHOD_VENDOR :
		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;

5257 5258 5259 5260 5261 5262 5263 5264 5265 5266 5267 5268
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
		setup->path_sel_proto =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
		 IEEE80211_PATH_PROTOCOL_VENDOR :
		 IEEE80211_PATH_PROTOCOL_HWMP;

	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
		setup->path_metric =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
		 IEEE80211_PATH_METRIC_VENDOR :
		 IEEE80211_PATH_METRIC_AIRTIME;

5269 5270

	if (tb[NL80211_MESH_SETUP_IE]) {
5271
		struct nlattr *ieattr =
5272
			tb[NL80211_MESH_SETUP_IE];
5273 5274
		if (!is_valid_ie_attr(ieattr))
			return -EINVAL;
5275 5276
		setup->ie = nla_data(ieattr);
		setup->ie_len = nla_len(ieattr);
5277
	}
5278 5279 5280 5281
	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
		return -EINVAL;
	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5282 5283
	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5284 5285
	if (setup->is_secure)
		setup->user_mpm = true;
5286

5287 5288 5289 5290 5291 5292 5293
	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
		if (!setup->user_mpm)
			return -EINVAL;
		setup->auth_id =
			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
	}

5294 5295 5296
	return 0;
}

5297
static int nl80211_update_mesh_config(struct sk_buff *skb,
5298
				      struct genl_info *info)
5299 5300 5301
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
5302
	struct wireless_dev *wdev = dev->ieee80211_ptr;
5303 5304 5305 5306
	struct mesh_config cfg;
	u32 mask;
	int err;

5307 5308 5309
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

5310
	if (!rdev->ops->update_mesh_config)
5311 5312
		return -EOPNOTSUPP;

5313
	err = nl80211_parse_mesh_config(info, &cfg, &mask);
5314 5315 5316
	if (err)
		return err;

5317 5318 5319 5320 5321
	wdev_lock(wdev);
	if (!wdev->mesh_id_len)
		err = -ENOLINK;

	if (!err)
5322
		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5323 5324 5325 5326

	wdev_unlock(wdev);

	return err;
5327 5328
}

5329 5330
static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
{
5331
	const struct ieee80211_regdomain *regdom;
5332 5333 5334 5335 5336 5337
	struct sk_buff *msg;
	void *hdr = NULL;
	struct nlattr *nl_reg_rules;
	unsigned int i;

	if (!cfg80211_regdomain)
5338
		return -EINVAL;
5339

5340
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5341 5342
	if (!msg)
		return -ENOBUFS;
5343

5344
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5345 5346
			     NL80211_CMD_GET_REG);
	if (!hdr)
5347
		goto put_failure;
5348

5349 5350 5351 5352 5353
	if (reg_last_request_cell_base() &&
	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
			NL80211_USER_REG_HINT_CELL_BASE))
		goto nla_put_failure;

5354 5355 5356 5357 5358 5359 5360 5361
	rcu_read_lock();
	regdom = rcu_dereference(cfg80211_regdomain);

	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
	    (regdom->dfs_region &&
	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
		goto nla_put_failure_rcu;

5362 5363
	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
	if (!nl_reg_rules)
5364
		goto nla_put_failure_rcu;
5365

5366
	for (i = 0; i < regdom->n_reg_rules; i++) {
5367 5368 5369 5370
		struct nlattr *nl_reg_rule;
		const struct ieee80211_reg_rule *reg_rule;
		const struct ieee80211_freq_range *freq_range;
		const struct ieee80211_power_rule *power_rule;
5371
		unsigned int max_bandwidth_khz;
5372

5373
		reg_rule = &regdom->reg_rules[i];
5374 5375 5376 5377 5378
		freq_range = &reg_rule->freq_range;
		power_rule = &reg_rule->power_rule;

		nl_reg_rule = nla_nest_start(msg, i);
		if (!nl_reg_rule)
5379
			goto nla_put_failure_rcu;
5380

5381 5382 5383 5384 5385
		max_bandwidth_khz = freq_range->max_bandwidth_khz;
		if (!max_bandwidth_khz)
			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
								  reg_rule);

5386 5387 5388 5389 5390 5391 5392
		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
				reg_rule->flags) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
				freq_range->start_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
				freq_range->end_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5393
				max_bandwidth_khz) ||
5394 5395 5396
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
				power_rule->max_antenna_gain) ||
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5397 5398 5399
				power_rule->max_eirp) ||
		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
				reg_rule->dfs_cac_ms))
5400
			goto nla_put_failure_rcu;
5401 5402 5403

		nla_nest_end(msg, nl_reg_rule);
	}
5404
	rcu_read_unlock();
5405 5406 5407 5408

	nla_nest_end(msg, nl_reg_rules);

	genlmsg_end(msg, hdr);
5409
	return genlmsg_reply(msg, info);
5410

5411 5412
nla_put_failure_rcu:
	rcu_read_unlock();
5413 5414
nla_put_failure:
	genlmsg_cancel(msg, hdr);
5415
put_failure:
Yuri Ershov's avatar
Yuri Ershov committed
5416
	nlmsg_free(msg);
5417
	return -EMSGSIZE;
5418 5419
}

5420 5421 5422 5423 5424 5425 5426
static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
	struct nlattr *nl_reg_rule;
	char *alpha2 = NULL;
	int rem_reg_rules = 0, r = 0;
	u32 num_rules = 0, rule_idx = 0, size_of_regd;
5427
	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5428 5429 5430 5431 5432 5433 5434 5435 5436 5437
	struct ieee80211_regdomain *rd = NULL;

	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REG_RULES])
		return -EINVAL;

	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);

5438 5439 5440
	if (info->attrs[NL80211_ATTR_DFS_REGION])
		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);

5441
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
Johannes Berg's avatar
Johannes Berg committed
5442
			    rem_reg_rules) {
5443 5444
		num_rules++;
		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5445
			return -EINVAL;
5446 5447
	}

5448 5449 5450
	if (!reg_is_valid_request(alpha2))
		return -EINVAL;

5451
	size_of_regd = sizeof(struct ieee80211_regdomain) +
Johannes Berg's avatar
Johannes Berg committed
5452
		       num_rules * sizeof(struct ieee80211_reg_rule);
5453 5454

	rd = kzalloc(size_of_regd, GFP_KERNEL);
5455 5456
	if (!rd)
		return -ENOMEM;
5457 5458 5459 5460 5461

	rd->n_reg_rules = num_rules;
	rd->alpha2[0] = alpha2[0];
	rd->alpha2[1] = alpha2[1];

5462 5463 5464 5465 5466 5467 5468
	/*
	 * Disable DFS master mode if the DFS region was
	 * not supported or known on this kernel.
	 */
	if (reg_supported_dfs_region(dfs_region))
		rd->dfs_region = dfs_region;

5469
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
Johannes Berg's avatar
Johannes Berg committed
5470
			    rem_reg_rules) {
5471 5472 5473 5474 5475
		r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
			      nla_data(nl_reg_rule), nla_len(nl_reg_rule),
			      reg_rule_policy);
		if (r)
			goto bad_reg;
5476 5477 5478 5479 5480 5481
		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
		if (r)
			goto bad_reg;

		rule_idx++;

5482 5483
		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
			r = -EINVAL;
5484
			goto bad_reg;
5485
		}
5486 5487 5488
	}

	r = set_regdom(rd);
5489
	/* set_regdom took ownership */
Johannes Berg's avatar
Johannes Berg committed
5490
	rd = NULL;
5491

5492
 bad_reg:
5493
	kfree(rd);
5494
	return r;
5495 5496
}

5497 5498 5499 5500 5501 5502 5503 5504 5505 5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520 5521
static int validate_scan_freqs(struct nlattr *freqs)
{
	struct nlattr *attr1, *attr2;
	int n_channels = 0, tmp1, tmp2;

	nla_for_each_nested(attr1, freqs, tmp1) {
		n_channels++;
		/*
		 * Some hardware has a limited channel list for
		 * scanning, and it is pretty much nonsensical
		 * to scan for a channel twice, so disallow that
		 * and don't require drivers to check that the
		 * channel list they get isn't longer than what
		 * they can scan, as long as they can scan all
		 * the channels they registered at once.
		 */
		nla_for_each_nested(attr2, freqs, tmp2)
			if (attr1 != attr2 &&
			    nla_get_u32(attr1) == nla_get_u32(attr2))
				return 0;
	}

	return n_channels;
}

5522 5523 5524 5525 5526 5527 5528 5529 5530 5531 5532 5533 5534 5535 5536 5537 5538 5539 5540 5541 5542 5543 5544 5545 5546 5547 5548 5549 5550 5551 5552 5553 5554 5555 5556 5557 5558
static int nl80211_parse_random_mac(struct nlattr **attrs,
				    u8 *mac_addr, u8 *mac_addr_mask)
{
	int i;

	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
		memset(mac_addr, 0, ETH_ALEN);
		memset(mac_addr_mask, 0, ETH_ALEN);
		mac_addr[0] = 0x2;
		mac_addr_mask[0] = 0x3;

		return 0;
	}

	/* need both or none */
	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
		return -EINVAL;

	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);

	/* don't allow or configure an mcast address */
	if (!is_multicast_ether_addr(mac_addr_mask) ||
	    is_multicast_ether_addr(mac_addr))
		return -EINVAL;

	/*
	 * allow users to pass a MAC address that has bits set outside
	 * of the mask, but don't bother drivers with having to deal
	 * with such bits
	 */
	for (i = 0; i < ETH_ALEN; i++)
		mac_addr[i] &= mac_addr_mask[i];

	return 0;
}

5559 5560
static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
{
5561
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5562
	struct wireless_dev *wdev = info->user_ptr[1];
5563 5564 5565
	struct cfg80211_scan_request *request;
	struct nlattr *attr;
	struct wiphy *wiphy;
5566
	int err, tmp, n_ssids = 0, n_channels, i;
5567
	size_t ie_len;
5568

5569 5570 5571
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

5572
	wiphy = &rdev->wiphy;
5573

5574 5575
	if (!rdev->ops->scan)
		return -EOPNOTSUPP;
5576

5577
	if (rdev->scan_req || rdev->scan_msg) {
5578 5579 5580
		err = -EBUSY;
		goto unlock;
	}
5581 5582

	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5583 5584
		n_channels = validate_scan_freqs(
				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5585 5586 5587 5588
		if (!n_channels) {
			err = -EINVAL;
			goto unlock;
		}
5589
	} else {
5590
		n_channels = ieee80211_get_num_supported_channels(wiphy);
5591 5592 5593 5594 5595 5596
	}

	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
			n_ssids++;

5597 5598 5599 5600
	if (n_ssids > wiphy->max_scan_ssids) {
		err = -EINVAL;
		goto unlock;
	}
5601

5602 5603 5604 5605 5606
	if (info->attrs[NL80211_ATTR_IE])
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	else
		ie_len = 0;

5607 5608 5609 5610
	if (ie_len > wiphy->max_scan_ie_len) {
		err = -EINVAL;
		goto unlock;
	}
5611

5612
	request = kzalloc(sizeof(*request)
5613 5614
			+ sizeof(*request->ssids) * n_ssids
			+ sizeof(*request->channels) * n_channels
5615
			+ ie_len, GFP_KERNEL);
5616 5617 5618 5619
	if (!request) {
		err = -ENOMEM;
		goto unlock;
	}
5620 5621

	if (n_ssids)
5622
		request->ssids = (void *)&request->channels[n_channels];
5623
	request->n_ssids = n_ssids;
5624 5625 5626 5627 5628 5629
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}
5630

5631
	i = 0;
5632 5633 5634
	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5635 5636 5637 5638 5639
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
5640 5641 5642
				err = -EINVAL;
				goto out_free;
			}
5643 5644 5645 5646 5647 5648

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
5649 5650 5651
			i++;
		}
	} else {
5652 5653
		enum ieee80211_band band;

5654 5655 5656 5657 5658 5659
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5660 5661 5662 5663 5664 5665 5666 5667
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
5668 5669 5670 5671 5672
				i++;
			}
		}
	}

5673 5674 5675 5676 5677 5678 5679
	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

5680 5681 5682
	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5683
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5684 5685 5686
				err = -EINVAL;
				goto out_free;
			}
5687
			request->ssids[i].ssid_len = nla_len(attr);
5688 5689 5690 5691 5692
			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
			i++;
		}
	}

5693 5694
	if (info->attrs[NL80211_ATTR_IE]) {
		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5695 5696
		memcpy((void *)request->ie,
		       nla_data(info->attrs[NL80211_ATTR_IE]),
5697 5698 5699
		       request->ie_len);
	}

5700
	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5701 5702 5703
		if (wiphy->bands[i])
			request->rates[i] =
				(1 << wiphy->bands[i]->n_bitrates) - 1;
5704 5705 5706 5707 5708 5709 5710

	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
				    tmp) {
			enum ieee80211_band band = nla_type(attr);

5711
			if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5712 5713 5714
				err = -EINVAL;
				goto out_free;
			}
5715 5716 5717 5718

			if (!wiphy->bands[band])
				continue;

5719 5720 5721 5722 5723 5724 5725 5726 5727
			err = ieee80211_get_ratemask(wiphy->bands[band],
						     nla_data(attr),
						     nla_len(attr),
						     &request->rates[band]);
			if (err)
				goto out_free;
		}
	}

5728
	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5729 5730
		request->flags = nla_get_u32(
			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5731 5732
		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5733 5734 5735
			err = -EOPNOTSUPP;
			goto out_free;
		}
5736 5737 5738 5739 5740 5741 5742 5743 5744 5745 5746 5747 5748 5749 5750 5751 5752 5753 5754

		if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
			if (!(wiphy->features &
					NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
				err = -EOPNOTSUPP;
				goto out_free;
			}

			if (wdev->current_bss) {
				err = -EOPNOTSUPP;
				goto out_free;
			}

			err = nl80211_parse_random_mac(info->attrs,
						       request->mac_addr,
						       request->mac_addr_mask);
			if (err)
				goto out_free;
		}
5755
	}
5756

5757 5758 5759
	request->no_cck =
		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);

5760
	request->wdev = wdev;
5761
	request->wiphy = &rdev->wiphy;
5762
	request->scan_start = jiffies;
5763

5764
	rdev->scan_req = request;
5765
	err = rdev_scan(rdev, request);
5766

5767
	if (!err) {
5768 5769 5770
		nl80211_send_scan_start(rdev, wdev);
		if (wdev->netdev)
			dev_hold(wdev->netdev);
5771
	} else {
5772
 out_free:
5773
		rdev->scan_req = NULL;
5774 5775
		kfree(request);
	}
Johannes Berg's avatar
Johannes Berg committed
5776

5777
 unlock:
5778 5779 5780
	return err;
}

5781
static struct cfg80211_sched_scan_request *
5782
nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
5783
			 struct nlattr **attrs)
5784 5785 5786
{
	struct cfg80211_sched_scan_request *request;
	struct nlattr *attr;
5787
	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5788
	u32 interval;
5789 5790
	enum ieee80211_band band;
	size_t ie_len;
5791
	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5792
	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5793

5794 5795
	if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
		return ERR_PTR(-EINVAL);
5796

5797 5798
	if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
		return ERR_PTR(-EINVAL);
5799

5800
	interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5801
	if (interval == 0)
5802
		return ERR_PTR(-EINVAL);
5803

5804
	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5805
		n_channels = validate_scan_freqs(
5806
				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5807
		if (!n_channels)
5808
			return ERR_PTR(-EINVAL);
5809
	} else {
5810
		n_channels = ieee80211_get_num_supported_channels(wiphy);
5811 5812
	}

5813 5814
	if (attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5815 5816 5817
				    tmp)
			n_ssids++;

5818
	if (n_ssids > wiphy->max_sched_scan_ssids)
5819
		return ERR_PTR(-EINVAL);
5820

5821 5822 5823 5824 5825 5826 5827 5828 5829
	/*
	 * First, count the number of 'real' matchsets. Due to an issue with
	 * the old implementation, matchsets containing only the RSSI attribute
	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
	 * RSSI for all matchsets, rather than their own matchset for reporting
	 * all APs with a strong RSSI. This is needed to be compatible with
	 * older userspace that treated a matchset with only the RSSI as the
	 * global RSSI for all other matchsets - if there are other matchsets.
	 */
5830
	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5831
		nla_for_each_nested(attr,
5832
				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5833 5834 5835 5836 5837 5838 5839
				    tmp) {
			struct nlattr *rssi;

			err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
					nla_data(attr), nla_len(attr),
					nl80211_match_policy);
			if (err)
5840
				return ERR_PTR(err);
5841 5842 5843 5844 5845 5846 5847 5848 5849 5850 5851 5852 5853 5854
			/* add other standalone attributes here */
			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
				n_match_sets++;
				continue;
			}
			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
			if (rssi)
				default_match_rssi = nla_get_s32(rssi);
		}
	}

	/* However, if there's no other matchset, add the RSSI one */
	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
		n_match_sets = 1;
5855 5856

	if (n_match_sets > wiphy->max_match_sets)
5857
		return ERR_PTR(-EINVAL);
5858

5859 5860
	if (attrs[NL80211_ATTR_IE])
		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
5861 5862 5863
	else
		ie_len = 0;

5864
	if (ie_len > wiphy->max_sched_scan_ie_len)
5865
		return ERR_PTR(-EINVAL);
5866

5867
	request = kzalloc(sizeof(*request)
5868
			+ sizeof(*request->ssids) * n_ssids
5869
			+ sizeof(*request->match_sets) * n_match_sets
5870
			+ sizeof(*request->channels) * n_channels
5871
			+ ie_len, GFP_KERNEL);
5872 5873
	if (!request)
		return ERR_PTR(-ENOMEM);
5874 5875 5876 5877 5878 5879 5880 5881 5882 5883 5884

	if (n_ssids)
		request->ssids = (void *)&request->channels[n_channels];
	request->n_ssids = n_ssids;
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}

5885 5886 5887 5888 5889 5890 5891 5892 5893 5894 5895 5896
	if (n_match_sets) {
		if (request->ie)
			request->match_sets = (void *)(request->ie + ie_len);
		else if (request->ssids)
			request->match_sets =
				(void *)(request->ssids + n_ssids);
		else
			request->match_sets =
				(void *)(request->channels + n_channels);
	}
	request->n_match_sets = n_match_sets;

5897
	i = 0;
5898
	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5899 5900
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr,
5901
				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5902 5903 5904 5905 5906 5907 5908 5909 5910 5911 5912 5913 5914 5915 5916 5917 5918 5919 5920 5921 5922 5923 5924 5925 5926 5927 5928 5929 5930 5931 5932 5933 5934 5935 5936 5937 5938 5939 5940 5941 5942 5943 5944 5945 5946
				    tmp) {
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
				err = -EINVAL;
				goto out_free;
			}

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
			i++;
		}
	} else {
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
				i++;
			}
		}
	}

	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

	i = 0;
5947 5948
	if (attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5949
				    tmp) {
5950
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5951 5952 5953
				err = -EINVAL;
				goto out_free;
			}
5954
			request->ssids[i].ssid_len = nla_len(attr);
5955 5956 5957 5958 5959 5960
			memcpy(request->ssids[i].ssid, nla_data(attr),
			       nla_len(attr));
			i++;
		}
	}

5961
	i = 0;
5962
	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5963
		nla_for_each_nested(attr,
5964
				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5965
				    tmp) {
5966
			struct nlattr *ssid, *rssi;
5967

5968 5969 5970 5971 5972
			err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
					nla_data(attr), nla_len(attr),
					nl80211_match_policy);
			if (err)
				goto out_free;
5973
			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5974
			if (ssid) {
5975 5976 5977 5978 5979 5980 5981 5982 5983
				if (WARN_ON(i >= n_match_sets)) {
					/* this indicates a programming error,
					 * the loop above should have verified
					 * things properly
					 */
					err = -EINVAL;
					goto out_free;
				}

5984 5985 5986 5987 5988 5989 5990 5991
				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
					err = -EINVAL;
					goto out_free;
				}
				memcpy(request->match_sets[i].ssid.ssid,
				       nla_data(ssid), nla_len(ssid));
				request->match_sets[i].ssid.ssid_len =
					nla_len(ssid);
5992 5993 5994 5995 5996 5997 5998
				/* special attribute - old implemenation w/a */
				request->match_sets[i].rssi_thold =
					default_match_rssi;
				rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
				if (rssi)
					request->match_sets[i].rssi_thold =
						nla_get_s32(rssi);
5999 6000 6001
			}
			i++;
		}
6002 6003 6004 6005 6006 6007 6008 6009 6010 6011 6012 6013

		/* there was no other matchset, so the RSSI one is alone */
		if (i == 0)
			request->match_sets[0].rssi_thold = default_match_rssi;

		request->min_rssi_thold = INT_MAX;
		for (i = 0; i < n_match_sets; i++)
			request->min_rssi_thold =
				min(request->match_sets[i].rssi_thold,
				    request->min_rssi_thold);
	} else {
		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6014 6015
	}

6016 6017
	if (ie_len) {
		request->ie_len = ie_len;
6018
		memcpy((void *)request->ie,
6019
		       nla_data(attrs[NL80211_ATTR_IE]),
6020 6021 6022
		       request->ie_len);
	}

6023
	if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6024
		request->flags = nla_get_u32(
6025
			attrs[NL80211_ATTR_SCAN_FLAGS]);
6026 6027
		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6028 6029 6030
			err = -EOPNOTSUPP;
			goto out_free;
		}
6031 6032 6033 6034 6035 6036 6037 6038 6039 6040 6041 6042 6043 6044 6045 6046 6047 6048 6049 6050 6051 6052

		if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
			u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;

			if (!wdev) /* must be net-detect */
				flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;

			if (!(wiphy->features & flg)) {
				err = -EOPNOTSUPP;
				goto out_free;
			}

			if (wdev && wdev->current_bss) {
				err = -EOPNOTSUPP;
				goto out_free;
			}

			err = nl80211_parse_random_mac(attrs, request->mac_addr,
						       request->mac_addr_mask);
			if (err)
				goto out_free;
		}
6053
	}
6054

6055
	request->interval = interval;
6056
	request->scan_start = jiffies;
6057

6058
	return request;
6059 6060 6061

out_free:
	kfree(request);
6062 6063 6064 6065 6066 6067 6068 6069
	return ERR_PTR(err);
}

static int nl80211_start_sched_scan(struct sk_buff *skb,
				    struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6070
	struct wireless_dev *wdev = dev->ieee80211_ptr;
6071 6072 6073 6074 6075 6076 6077 6078 6079
	int err;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_start)
		return -EOPNOTSUPP;

	if (rdev->sched_scan_req)
		return -EINPROGRESS;

6080
	rdev->sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6081 6082 6083 6084 6085 6086 6087 6088 6089 6090 6091 6092 6093 6094 6095 6096 6097 6098 6099 6100
							info->attrs);
	err = PTR_ERR_OR_ZERO(rdev->sched_scan_req);
	if (err)
		goto out_err;

	err = rdev_sched_scan_start(rdev, dev, rdev->sched_scan_req);
	if (err)
		goto out_free;

	rdev->sched_scan_req->dev = dev;
	rdev->sched_scan_req->wiphy = &rdev->wiphy;

	nl80211_send_sched_scan(rdev, dev,
				NL80211_CMD_START_SCHED_SCAN);
	return 0;

out_free:
	kfree(rdev->sched_scan_req);
out_err:
	rdev->sched_scan_req = NULL;
6101 6102 6103 6104 6105 6106 6107 6108 6109 6110 6111 6112
	return err;
}

static int nl80211_stop_sched_scan(struct sk_buff *skb,
				   struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_stop)
		return -EOPNOTSUPP;

6113
	return __cfg80211_stop_sched_scan(rdev, false);
6114 6115
}

6116 6117 6118 6119 6120 6121 6122
static int nl80211_start_radar_detection(struct sk_buff *skb,
					 struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_chan_def chandef;
6123
	enum nl80211_dfs_regions dfs_region;
6124
	unsigned int cac_time_ms;
6125 6126
	int err;

6127 6128 6129 6130
	dfs_region = reg_get_dfs_region(wdev->wiphy);
	if (dfs_region == NL80211_DFS_UNSET)
		return -EINVAL;

6131 6132 6133 6134
	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;

6135 6136 6137
	if (netif_carrier_ok(dev))
		return -EBUSY;

6138 6139 6140
	if (wdev->cac_started)
		return -EBUSY;

6141
	err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6142
					    wdev->iftype);
6143 6144 6145 6146 6147 6148
	if (err < 0)
		return err;

	if (err == 0)
		return -EINVAL;

6149
	if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6150 6151 6152 6153 6154
		return -EINVAL;

	if (!rdev->ops->start_radar_detection)
		return -EOPNOTSUPP;

6155 6156 6157 6158 6159 6160
	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
	if (WARN_ON(!cac_time_ms))
		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;

	err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
					       cac_time_ms);
6161
	if (!err) {
6162
		wdev->chandef = chandef;
6163 6164
		wdev->cac_started = true;
		wdev->cac_start_time = jiffies;
6165
		wdev->cac_time_ms = cac_time_ms;
6166 6167 6168 6169
	}
	return err;
}

6170 6171 6172 6173 6174 6175 6176 6177 6178 6179 6180
static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_csa_settings params;
	/* csa_attrs is defined static to avoid waste of stack size - this
	 * function is called under RTNL lock, so this should not be a problem.
	 */
	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
	int err;
6181
	bool need_new_beacon = false;
6182
	int len, i;
6183
	u32 cs_count;
6184 6185 6186 6187 6188

	if (!rdev->ops->channel_switch ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
		return -EOPNOTSUPP;

6189 6190 6191 6192 6193 6194 6195
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
		need_new_beacon = true;

		/* useless if AP is not running */
		if (!wdev->beacon_interval)
6196
			return -ENOTCONN;
6197 6198
		break;
	case NL80211_IFTYPE_ADHOC:
6199 6200 6201
		if (!wdev->ssid_len)
			return -ENOTCONN;
		break;
6202
	case NL80211_IFTYPE_MESH_POINT:
6203 6204
		if (!wdev->mesh_id_len)
			return -ENOTCONN;
6205 6206
		break;
	default:
6207
		return -EOPNOTSUPP;
6208
	}
6209 6210 6211 6212 6213 6214 6215 6216

	memset(&params, 0, sizeof(params));

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
		return -EINVAL;

	/* only important for AP, IBSS and mesh create IEs internally */
6217
	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6218 6219
		return -EINVAL;

6220 6221 6222 6223 6224 6225 6226 6227
	/* Even though the attribute is u32, the specification says
	 * u8, so let's make sure we don't overflow.
	 */
	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
	if (cs_count > 255)
		return -EINVAL;

	params.count = cs_count;
6228

6229 6230 6231
	if (!need_new_beacon)
		goto skip_beacons;

6232 6233 6234 6235 6236 6237 6238 6239 6240 6241 6242 6243 6244 6245 6246 6247 6248
	err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
	if (err)
		return err;

	err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
			       info->attrs[NL80211_ATTR_CSA_IES],
			       nl80211_policy);
	if (err)
		return err;

	err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
	if (err)
		return err;

	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
		return -EINVAL;

6249 6250
	len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
	if (!len || (len % sizeof(u16)))
6251 6252
		return -EINVAL;

6253 6254 6255 6256
	params.n_counter_offsets_beacon = len / sizeof(u16);
	if (rdev->wiphy.max_num_csa_counters &&
	    (params.n_counter_offsets_beacon >
	     rdev->wiphy.max_num_csa_counters))
6257 6258
		return -EINVAL;

6259 6260 6261 6262 6263 6264 6265 6266 6267 6268 6269 6270 6271 6272
	params.counter_offsets_beacon =
		nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);

	/* sanity checks - counters should fit and be the same */
	for (i = 0; i < params.n_counter_offsets_beacon; i++) {
		u16 offset = params.counter_offsets_beacon[i];

		if (offset >= params.beacon_csa.tail_len)
			return -EINVAL;

		if (params.beacon_csa.tail[offset] != params.count)
			return -EINVAL;
	}

6273
	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6274 6275
		len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
		if (!len || (len % sizeof(u16)))
6276 6277
			return -EINVAL;

6278 6279 6280 6281
		params.n_counter_offsets_presp = len / sizeof(u16);
		if (rdev->wiphy.max_num_csa_counters &&
		    (params.n_counter_offsets_beacon >
		     rdev->wiphy.max_num_csa_counters))
6282
			return -EINVAL;
6283 6284 6285 6286 6287 6288 6289 6290 6291 6292 6293 6294 6295 6296 6297

		params.counter_offsets_presp =
			nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);

		/* sanity checks - counters should fit and be the same */
		for (i = 0; i < params.n_counter_offsets_presp; i++) {
			u16 offset = params.counter_offsets_presp[i];

			if (offset >= params.beacon_csa.probe_resp_len)
				return -EINVAL;

			if (params.beacon_csa.probe_resp[offset] !=
			    params.count)
				return -EINVAL;
		}
6298 6299
	}

6300
skip_beacons:
6301 6302 6303 6304
	err = nl80211_parse_chandef(rdev, info, &params.chandef);
	if (err)
		return err;

6305 6306
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
				     wdev->iftype))
6307 6308
		return -EINVAL;

6309 6310 6311 6312 6313 6314
	err = cfg80211_chandef_dfs_required(wdev->wiphy,
					    &params.chandef,
					    wdev->iftype);
	if (err < 0)
		return err;

6315
	if (err > 0)
6316
		params.radar_required = true;
6317 6318 6319 6320

	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
		params.block_tx = true;

6321 6322 6323 6324 6325
	wdev_lock(wdev);
	err = rdev_channel_switch(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
6326 6327
}

6328 6329
static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
			    u32 seq, int flags,
6330
			    struct cfg80211_registered_device *rdev,
Johannes Berg's avatar
Johannes Berg committed
6331 6332
			    struct wireless_dev *wdev,
			    struct cfg80211_internal_bss *intbss)
6333
{
Johannes Berg's avatar
Johannes Berg committed
6334
	struct cfg80211_bss *res = &intbss->pub;
6335
	const struct cfg80211_bss_ies *ies;
6336 6337
	void *hdr;
	struct nlattr *bss;
Johannes Berg's avatar
Johannes Berg committed
6338 6339

	ASSERT_WDEV_LOCK(wdev);
6340

6341
	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6342 6343 6344 6345
			     NL80211_CMD_NEW_SCAN_RESULTS);
	if (!hdr)
		return -1;

6346 6347
	genl_dump_check_consistent(cb, hdr, &nl80211_fam);

6348 6349 6350
	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
		goto nla_put_failure;
	if (wdev->netdev &&
6351 6352
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
		goto nla_put_failure;
6353 6354
	if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;
6355 6356 6357 6358

	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
	if (!bss)
		goto nla_put_failure;
6359
	if ((!is_zero_ether_addr(res->bssid) &&
6360
	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6361
		goto nla_put_failure;
6362 6363

	rcu_read_lock();
6364 6365 6366 6367 6368 6369 6370 6371
	/* indicate whether we have probe response data or not */
	if (rcu_access_pointer(res->proberesp_ies) &&
	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
		goto fail_unlock_rcu;

	/* this pointer prefers to be pointed to probe response data
	 * but is always valid
	 */
6372
	ies = rcu_dereference(res->ies);
Johannes Berg's avatar
Johannes Berg committed
6373 6374 6375 6376 6377 6378
	if (ies) {
		if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
			goto fail_unlock_rcu;
		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
					ies->len, ies->data))
			goto fail_unlock_rcu;
6379
	}
6380 6381

	/* and this pointer is always (unless driver didn't know) beacon data */
6382
	ies = rcu_dereference(res->beacon_ies);
6383 6384
	if (ies && ies->from_beacon) {
		if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
Johannes Berg's avatar
Johannes Berg committed
6385 6386 6387 6388
			goto fail_unlock_rcu;
		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
					ies->len, ies->data))
			goto fail_unlock_rcu;
6389 6390 6391
	}
	rcu_read_unlock();

6392 6393 6394 6395 6396
	if (res->beacon_interval &&
	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
		goto nla_put_failure;
	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6397
	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6398 6399 6400
	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
			jiffies_to_msecs(jiffies - intbss->ts)))
		goto nla_put_failure;
6401

6402
	switch (rdev->wiphy.signal_type) {
6403
	case CFG80211_SIGNAL_TYPE_MBM:
6404 6405
		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
			goto nla_put_failure;
6406 6407
		break;
	case CFG80211_SIGNAL_TYPE_UNSPEC:
6408 6409
		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
			goto nla_put_failure;
6410 6411 6412 6413 6414
		break;
	default:
		break;
	}

Johannes Berg's avatar
Johannes Berg committed
6415
	switch (wdev->iftype) {
6416
	case NL80211_IFTYPE_P2P_CLIENT:
Johannes Berg's avatar
Johannes Berg committed
6417
	case NL80211_IFTYPE_STATION:
6418 6419 6420 6421
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_ASSOCIATED))
			goto nla_put_failure;
Johannes Berg's avatar
Johannes Berg committed
6422 6423
		break;
	case NL80211_IFTYPE_ADHOC:
6424 6425 6426 6427
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_IBSS_JOINED))
			goto nla_put_failure;
Johannes Berg's avatar
Johannes Berg committed
6428 6429 6430 6431 6432
		break;
	default:
		break;
	}

6433 6434 6435 6436
	nla_nest_end(msg, bss);

	return genlmsg_end(msg, hdr);

Johannes Berg's avatar
Johannes Berg committed
6437 6438
 fail_unlock_rcu:
	rcu_read_unlock();
6439 6440 6441 6442 6443
 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

6444
static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6445
{
Johannes Berg's avatar
Johannes Berg committed
6446
	struct cfg80211_registered_device *rdev;
6447
	struct cfg80211_internal_bss *scan;
Johannes Berg's avatar
Johannes Berg committed
6448
	struct wireless_dev *wdev;
6449
	int start = cb->args[2], idx = 0;
6450 6451
	int err;

6452
	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6453 6454
	if (err)
		return err;
6455

Johannes Berg's avatar
Johannes Berg committed
6456 6457 6458 6459
	wdev_lock(wdev);
	spin_lock_bh(&rdev->bss_lock);
	cfg80211_bss_expire(rdev);

6460 6461
	cb->seq = rdev->bss_generation;

Johannes Berg's avatar
Johannes Berg committed
6462
	list_for_each_entry(scan, &rdev->bss_list, list) {
6463 6464
		if (++idx <= start)
			continue;
6465
		if (nl80211_send_bss(skb, cb,
6466
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
Johannes Berg's avatar
Johannes Berg committed
6467
				rdev, wdev, scan) < 0) {
6468
			idx--;
6469
			break;
6470 6471 6472
		}
	}

Johannes Berg's avatar
Johannes Berg committed
6473 6474
	spin_unlock_bh(&rdev->bss_lock);
	wdev_unlock(wdev);
6475

6476 6477
	cb->args[2] = idx;
	nl80211_finish_wdev_dump(rdev);
6478

6479
	return skb->len;
6480 6481
}

6482
static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6483 6484 6485 6486 6487 6488
				int flags, struct net_device *dev,
				struct survey_info *survey)
{
	void *hdr;
	struct nlattr *infoattr;

6489
	hdr = nl80211hdr_put(msg, portid, seq, flags,
6490 6491 6492 6493
			     NL80211_CMD_NEW_SURVEY_RESULTS);
	if (!hdr)
		return -ENOMEM;

6494 6495
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
		goto nla_put_failure;
6496 6497 6498 6499 6500

	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
	if (!infoattr)
		goto nla_put_failure;

6501 6502 6503 6504 6505 6506 6507 6508 6509 6510 6511 6512 6513 6514 6515 6516 6517 6518 6519 6520 6521 6522 6523 6524 6525 6526 6527 6528 6529 6530
	if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
			survey->channel->center_freq))
		goto nla_put_failure;

	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_IN_USE) &&
	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
			survey->channel_time))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
			survey->channel_time_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
			survey->channel_time_ext_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
			survey->channel_time_rx))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
			survey->channel_time_tx))
		goto nla_put_failure;
6531 6532 6533 6534 6535 6536 6537 6538 6539 6540 6541 6542 6543 6544

	nla_nest_end(msg, infoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

static int nl80211_dump_survey(struct sk_buff *skb,
			struct netlink_callback *cb)
{
	struct survey_info survey;
6545
	struct cfg80211_registered_device *rdev;
6546 6547
	struct wireless_dev *wdev;
	int survey_idx = cb->args[2];
6548 6549
	int res;

6550
	res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6551 6552
	if (res)
		return res;
6553

6554 6555 6556 6557 6558
	if (!wdev->netdev) {
		res = -EINVAL;
		goto out_err;
	}

6559
	if (!rdev->ops->dump_survey) {
6560 6561 6562 6563 6564
		res = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
6565
		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6566 6567 6568 6569 6570
		if (res == -ENOENT)
			break;
		if (res)
			goto out_err;

6571 6572 6573 6574 6575 6576
		/* Survey without a channel doesn't make sense */
		if (!survey.channel) {
			res = -EINVAL;
			goto out;
		}

6577
		if (survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6578 6579 6580 6581
			survey_idx++;
			continue;
		}

6582
		if (nl80211_send_survey(skb,
6583
				NETLINK_CB(cb->skb).portid,
6584
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
6585
				wdev->netdev, &survey) < 0)
6586 6587 6588 6589 6590
			goto out;
		survey_idx++;
	}

 out:
6591
	cb->args[2] = survey_idx;
6592 6593
	res = skb->len;
 out_err:
6594
	nl80211_finish_wdev_dump(rdev);
6595 6596 6597
	return res;
}

6598 6599 6600 6601 6602 6603
static bool nl80211_valid_wpa_versions(u32 wpa_versions)
{
	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
				  NL80211_WPA_VERSION_2));
}

6604 6605
static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
{
6606 6607
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6608
	struct ieee80211_channel *chan;
6609 6610
	const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
	int err, ssid_len, ie_len = 0, sae_data_len = 0;
6611
	enum nl80211_auth_type auth_type;
6612
	struct key_parse key;
6613
	bool local_state_change;
6614

6615 6616 6617 6618 6619 6620
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

6621 6622 6623
	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
		return -EINVAL;

6624 6625 6626 6627 6628 6629
	if (!info->attrs[NL80211_ATTR_SSID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

6630 6631 6632 6633 6634
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;

	if (key.idx >= 0) {
6635 6636
		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
			return -EINVAL;
6637 6638 6639 6640 6641 6642 6643 6644 6645 6646 6647 6648 6649 6650
		if (!key.p.key || !key.p.key_len)
			return -EINVAL;
		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP104))
			return -EINVAL;
		if (key.idx > 4)
			return -EINVAL;
	} else {
		key.p.key_len = 0;
		key.p.key = NULL;
	}

6651 6652 6653 6654 6655 6656 6657 6658 6659
	if (key.idx >= 0) {
		int i;
		bool ok = false;
		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
				ok = true;
				break;
			}
		}
6660 6661
		if (!ok)
			return -EINVAL;
6662 6663
	}

6664 6665
	if (!rdev->ops->auth)
		return -EOPNOTSUPP;
6666

6667
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6668 6669
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6670

6671
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6672 6673 6674
	chan = nl80211_get_valid_chan(&rdev->wiphy,
				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
	if (!chan)
6675
		return -EINVAL;
6676

6677 6678
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6679 6680

	if (info->attrs[NL80211_ATTR_IE]) {
6681 6682
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6683 6684
	}

6685
	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6686
	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6687
		return -EINVAL;
6688

6689 6690 6691 6692 6693 6694 6695 6696 6697 6698 6699 6700 6701 6702
	if (auth_type == NL80211_AUTHTYPE_SAE &&
	    !info->attrs[NL80211_ATTR_SAE_DATA])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_SAE_DATA]) {
		if (auth_type != NL80211_AUTHTYPE_SAE)
			return -EINVAL;
		sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
		sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
		/* need to include at least Auth Transaction and Status Code */
		if (sae_data_len < 4)
			return -EINVAL;
	}

6703 6704
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6705 6706 6707 6708 6709 6710 6711
	/*
	 * Since we no longer track auth state, ignore
	 * requests to only change local state.
	 */
	if (local_state_change)
		return 0;

6712 6713 6714 6715 6716 6717 6718
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
				 ssid, ssid_len, ie, ie_len,
				 key.p.key, key.p.key_len, key.idx,
				 sae_data, sae_data_len);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6719 6720
}

6721 6722
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
6723 6724
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit)
6725
{
6726 6727
	memset(settings, 0, sizeof(*settings));

6728 6729
	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];

6730 6731 6732 6733 6734 6735 6736 6737 6738 6739 6740 6741 6742
	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
		u16 proto;
		proto = nla_get_u16(
			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
		settings->control_port_ethertype = cpu_to_be16(proto);
		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
		    proto != ETH_P_PAE)
			return -EINVAL;
		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
			settings->control_port_no_encrypt = true;
	} else
		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);

6743 6744 6745 6746 6747 6748 6749 6750 6751 6752 6753
	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
		void *data;
		int len, i;

		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		settings->n_ciphers_pairwise = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6754
		if (settings->n_ciphers_pairwise > cipher_limit)
6755 6756 6757 6758 6759
			return -EINVAL;

		memcpy(settings->ciphers_pairwise, data, len);

		for (i = 0; i < settings->n_ciphers_pairwise; i++)
6760 6761
			if (!cfg80211_supported_cipher_suite(
					&rdev->wiphy,
6762 6763 6764 6765 6766 6767 6768
					settings->ciphers_pairwise[i]))
				return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
		settings->cipher_group =
			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6769 6770
		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
						     settings->cipher_group))
6771 6772 6773 6774 6775 6776 6777 6778 6779 6780 6781 6782
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
		settings->wpa_versions =
			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
		void *data;
6783
		int len;
6784 6785 6786 6787 6788 6789 6790 6791

		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
		settings->n_akm_suites = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6792 6793 6794
		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
			return -EINVAL;

6795 6796 6797 6798 6799 6800
		memcpy(settings->akm_suites, data, len);
	}

	return 0;
}

6801 6802
static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
{
6803 6804
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6805
	struct ieee80211_channel *chan;
6806 6807 6808
	struct cfg80211_assoc_request req = {};
	const u8 *bssid, *ssid;
	int err, ssid_len = 0;
6809

6810 6811 6812 6813
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC] ||
6814 6815
	    !info->attrs[NL80211_ATTR_SSID] ||
	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6816 6817
		return -EINVAL;

6818 6819
	if (!rdev->ops->assoc)
		return -EOPNOTSUPP;
6820

6821
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6822 6823
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6824

6825
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6826

6827 6828 6829
	chan = nl80211_get_valid_chan(&rdev->wiphy,
				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
	if (!chan)
6830
		return -EINVAL;
6831

6832 6833
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6834 6835

	if (info->attrs[NL80211_ATTR_IE]) {
6836 6837
		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6838 6839
	}

6840
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
6841
		enum nl80211_mfp mfp =
6842
			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6843
		if (mfp == NL80211_MFP_REQUIRED)
6844
			req.use_mfp = true;
6845 6846
		else if (mfp != NL80211_MFP_NO)
			return -EINVAL;
6847 6848
	}

6849
	if (info->attrs[NL80211_ATTR_PREV_BSSID])
6850
		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6851

6852
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6853
		req.flags |= ASSOC_REQ_DISABLE_HT;
6854 6855

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6856 6857 6858
		memcpy(&req.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(req.ht_capa_mask));
6859 6860

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6861
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6862
			return -EINVAL;
6863 6864 6865
		memcpy(&req.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(req.ht_capa));
6866 6867
	}

6868
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6869
		req.flags |= ASSOC_REQ_DISABLE_VHT;
6870 6871

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6872 6873 6874
		memcpy(&req.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(req.vht_capa_mask));
6875 6876

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6877
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6878
			return -EINVAL;
6879 6880 6881
		memcpy(&req.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(req.vht_capa));
6882 6883
	}

6884 6885 6886 6887 6888 6889 6890 6891
	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
		if (!(rdev->wiphy.features &
		      NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
		    !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
			return -EINVAL;
		req.flags |= ASSOC_REQ_USE_RRM;
	}

6892
	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6893 6894
	if (!err) {
		wdev_lock(dev->ieee80211_ptr);
6895 6896
		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
					  ssid, ssid_len, &req);
6897 6898
		wdev_unlock(dev->ieee80211_ptr);
	}
6899 6900 6901 6902 6903 6904

	return err;
}

static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
{
6905 6906
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6907
	const u8 *ie = NULL, *bssid;
6908
	int ie_len = 0, err;
6909
	u16 reason_code;
6910
	bool local_state_change;
6911

6912 6913 6914 6915 6916 6917 6918 6919 6920
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6921 6922
	if (!rdev->ops->deauth)
		return -EOPNOTSUPP;
6923

6924
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6925 6926
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6927

6928
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6929

6930 6931
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6932
		/* Reason Code 0 is reserved */
6933
		return -EINVAL;
6934
	}
6935 6936

	if (info->attrs[NL80211_ATTR_IE]) {
6937 6938
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6939 6940
	}

6941 6942
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6943 6944 6945 6946 6947
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
				   local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6948 6949 6950 6951
}

static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
{
6952 6953
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6954
	const u8 *ie = NULL, *bssid;
6955
	int ie_len = 0, err;
6956
	u16 reason_code;
6957
	bool local_state_change;
6958

6959 6960 6961 6962 6963 6964 6965 6966 6967
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6968 6969
	if (!rdev->ops->disassoc)
		return -EOPNOTSUPP;
6970

6971
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6972 6973
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6974

6975
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6976

6977 6978
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6979
		/* Reason Code 0 is reserved */
6980
		return -EINVAL;
6981
	}
6982 6983

	if (info->attrs[NL80211_ATTR_IE]) {
6984 6985
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6986 6987
	}

6988 6989
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6990 6991 6992 6993 6994
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
				     local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6995 6996
}

6997 6998 6999 7000 7001 7002 7003 7004 7005 7006 7007 7008 7009 7010 7011 7012 7013 7014 7015 7016 7017 7018 7019 7020 7021 7022 7023 7024
static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
			 int mcast_rate[IEEE80211_NUM_BANDS],
			 int rateval)
{
	struct wiphy *wiphy = &rdev->wiphy;
	bool found = false;
	int band, i;

	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
		struct ieee80211_supported_band *sband;

		sband = wiphy->bands[band];
		if (!sband)
			continue;

		for (i = 0; i < sband->n_bitrates; i++) {
			if (sband->bitrates[i].bitrate == rateval) {
				mcast_rate[band] = i + 1;
				found = true;
				break;
			}
		}
	}

	return found;
}

7025 7026
static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
{
7027 7028
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7029 7030
	struct cfg80211_ibss_params ibss;
	struct wiphy *wiphy;
7031
	struct cfg80211_cached_keys *connkeys = NULL;
7032 7033
	int err;

7034 7035
	memset(&ibss, 0, sizeof(ibss));

7036 7037 7038
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

7039
	if (!info->attrs[NL80211_ATTR_SSID] ||
7040 7041 7042
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

7043 7044 7045 7046 7047 7048 7049 7050 7051
	ibss.beacon_interval = 100;

	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		ibss.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
			return -EINVAL;
	}

7052 7053
	if (!rdev->ops->join_ibss)
		return -EOPNOTSUPP;
7054

7055 7056
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
7057

7058
	wiphy = &rdev->wiphy;
7059

7060
	if (info->attrs[NL80211_ATTR_MAC]) {
7061
		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7062 7063 7064 7065

		if (!is_valid_ether_addr(ibss.bssid))
			return -EINVAL;
	}
7066 7067 7068 7069 7070 7071 7072 7073
	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

7074 7075 7076
	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
	if (err)
		return err;
7077

7078 7079
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
				     NL80211_IFTYPE_ADHOC))
7080 7081
		return -EINVAL;

7082
	switch (ibss.chandef.width) {
7083 7084
	case NL80211_CHAN_WIDTH_5:
	case NL80211_CHAN_WIDTH_10:
7085 7086 7087 7088 7089 7090 7091
	case NL80211_CHAN_WIDTH_20_NOHT:
		break;
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
			break;
	default:
7092
		return -EINVAL;
7093
	}
7094

7095
	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7096 7097
	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

7098 7099 7100 7101 7102 7103
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband =
7104
			wiphy->bands[ibss.chandef.chan->band];
7105

7106 7107 7108 7109
		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &ibss.basic_rates);
		if (err)
			return err;
7110
	}
7111

7112 7113 7114 7115 7116 7117 7118 7119 7120 7121 7122 7123 7124
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&ibss.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(ibss.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
			return -EINVAL;
		memcpy(&ibss.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(ibss.ht_capa));
	}

7125 7126 7127 7128
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
		return -EINVAL;
7129

7130
	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7131 7132
		bool no_ht = false;

7133
		connkeys = nl80211_parse_connkeys(rdev,
7134 7135
					  info->attrs[NL80211_ATTR_KEYS],
					  &no_ht);
7136 7137
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
7138

7139 7140
		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
		    no_ht) {
7141 7142 7143
			kfree(connkeys);
			return -EINVAL;
		}
7144
	}
7145

7146 7147 7148
	ibss.control_port =
		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);

7149 7150 7151
	ibss.userspace_handles_dfs =
		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);

7152
	err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7153
	if (err)
7154
		kzfree(connkeys);
7155 7156 7157 7158 7159
	return err;
}

static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
{
7160 7161
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7162

7163 7164
	if (!rdev->ops->leave_ibss)
		return -EOPNOTSUPP;
7165

7166 7167
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
7168

7169
	return cfg80211_leave_ibss(rdev, dev, false);
7170 7171
}

7172 7173 7174 7175 7176 7177 7178 7179 7180 7181 7182 7183 7184 7185 7186 7187 7188 7189 7190 7191 7192 7193 7194 7195 7196 7197 7198 7199 7200
static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	int mcast_rate[IEEE80211_NUM_BANDS];
	u32 nla_rate;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

	if (!rdev->ops->set_mcast_rate)
		return -EOPNOTSUPP;

	memset(mcast_rate, 0, sizeof(mcast_rate));

	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
		return -EINVAL;

	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
		return -EINVAL;

	err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);

	return err;
}

7201 7202 7203 7204
static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
			    int approxlen, u32 portid, u32 seq,
			    enum nl80211_commands cmd,
7205 7206 7207
			    enum nl80211_attrs attr,
			    const struct nl80211_vendor_cmd_info *info,
			    gfp_t gfp)
7208 7209 7210 7211 7212 7213 7214 7215 7216 7217 7218 7219 7220 7221 7222 7223 7224
{
	struct sk_buff *skb;
	void *hdr;
	struct nlattr *data;

	skb = nlmsg_new(approxlen + 100, gfp);
	if (!skb)
		return NULL;

	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
	if (!hdr) {
		kfree_skb(skb);
		return NULL;
	}

	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;
7225 7226 7227 7228 7229 7230 7231 7232 7233 7234

	if (info) {
		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
				info->vendor_id))
			goto nla_put_failure;
		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
				info->subcmd))
			goto nla_put_failure;
	}

7235 7236 7237 7238 7239 7240 7241 7242 7243 7244 7245 7246
	data = nla_nest_start(skb, attr);

	((void **)skb->cb)[0] = rdev;
	((void **)skb->cb)[1] = hdr;
	((void **)skb->cb)[2] = data;

	return skb;

 nla_put_failure:
	kfree_skb(skb);
	return NULL;
}
7247

7248 7249 7250 7251 7252 7253
struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
					   enum nl80211_commands cmd,
					   enum nl80211_attrs attr,
					   int vendor_event_idx,
					   int approxlen, gfp_t gfp)
{
7254
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7255 7256 7257 7258 7259 7260 7261 7262 7263 7264 7265 7266 7267 7268 7269 7270 7271 7272 7273 7274 7275 7276 7277 7278 7279 7280 7281 7282 7283 7284 7285
	const struct nl80211_vendor_cmd_info *info;

	switch (cmd) {
	case NL80211_CMD_TESTMODE:
		if (WARN_ON(vendor_event_idx != -1))
			return NULL;
		info = NULL;
		break;
	case NL80211_CMD_VENDOR:
		if (WARN_ON(vendor_event_idx < 0 ||
			    vendor_event_idx >= wiphy->n_vendor_events))
			return NULL;
		info = &wiphy->vendor_events[vendor_event_idx];
		break;
	default:
		WARN_ON(1);
		return NULL;
	}

	return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
					   cmd, attr, info, gfp);
}
EXPORT_SYMBOL(__cfg80211_alloc_event_skb);

void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];
	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;

7286 7287 7288
	/* clear CB data for netlink core to own from now on */
	memset(skb->cb, 0, sizeof(skb->cb));

7289 7290 7291 7292 7293 7294 7295 7296 7297 7298 7299
	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);

	if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
		mcgrp = NL80211_MCGRP_VENDOR;

	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
				mcgrp, gfp);
}
EXPORT_SYMBOL(__cfg80211_send_event_skb);

7300 7301 7302
#ifdef CONFIG_NL80211_TESTMODE
static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
{
7303
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7304 7305
	struct wireless_dev *wdev =
		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7306 7307
	int err;

7308 7309 7310 7311 7312 7313 7314 7315 7316 7317 7318 7319
	if (!rdev->ops->testmode_cmd)
		return -EOPNOTSUPP;

	if (IS_ERR(wdev)) {
		err = PTR_ERR(wdev);
		if (err != -EINVAL)
			return err;
		wdev = NULL;
	} else if (wdev->wiphy != &rdev->wiphy) {
		return -EINVAL;
	}

7320 7321 7322
	if (!info->attrs[NL80211_ATTR_TESTDATA])
		return -EINVAL;

7323
	rdev->cur_cmd_info = info;
7324
	err = rdev_testmode_cmd(rdev, wdev,
7325 7326
				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7327
	rdev->cur_cmd_info = NULL;
7328 7329 7330 7331

	return err;
}

7332 7333 7334
static int nl80211_testmode_dump(struct sk_buff *skb,
				 struct netlink_callback *cb)
{
7335
	struct cfg80211_registered_device *rdev;
7336 7337 7338 7339 7340
	int err;
	long phy_idx;
	void *data = NULL;
	int data_len = 0;

7341 7342
	rtnl_lock();

7343 7344 7345 7346 7347 7348 7349 7350 7351 7352 7353
	if (cb->args[0]) {
		/*
		 * 0 is a valid index, but not valid for args[0],
		 * so we need to offset by 1.
		 */
		phy_idx = cb->args[0] - 1;
	} else {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
7354
			goto out_err;
7355

7356 7357 7358
		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
						  nl80211_fam.attrbuf);
		if (IS_ERR(rdev)) {
7359 7360
			err = PTR_ERR(rdev);
			goto out_err;
7361
		}
7362 7363 7364
		phy_idx = rdev->wiphy_idx;
		rdev = NULL;

7365 7366 7367 7368 7369 7370 7371 7372 7373 7374
		if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
			cb->args[1] =
				(long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
	}

	if (cb->args[1]) {
		data = nla_data((void *)cb->args[1]);
		data_len = nla_len((void *)cb->args[1]);
	}

7375 7376
	rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
	if (!rdev) {
7377 7378
		err = -ENOENT;
		goto out_err;
7379 7380
	}

7381
	if (!rdev->ops->testmode_dump) {
7382 7383 7384 7385 7386
		err = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
7387
		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7388 7389 7390 7391
					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
					   NL80211_CMD_TESTMODE);
		struct nlattr *tmdata;

7392 7393 7394
		if (!hdr)
			break;

7395
		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7396 7397 7398 7399 7400 7401 7402 7403 7404
			genlmsg_cancel(skb, hdr);
			break;
		}

		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
		if (!tmdata) {
			genlmsg_cancel(skb, hdr);
			break;
		}
7405
		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7406 7407 7408 7409 7410 7411 7412 7413 7414 7415 7416 7417 7418 7419 7420 7421 7422
		nla_nest_end(skb, tmdata);

		if (err == -ENOBUFS || err == -ENOENT) {
			genlmsg_cancel(skb, hdr);
			break;
		} else if (err) {
			genlmsg_cancel(skb, hdr);
			goto out_err;
		}

		genlmsg_end(skb, hdr);
	}

	err = skb->len;
	/* see above */
	cb->args[0] = phy_idx + 1;
 out_err:
7423
	rtnl_unlock();
7424 7425
	return err;
}
7426 7427
#endif

7428 7429
static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
{
7430 7431
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7432 7433
	struct cfg80211_connect_params connect;
	struct wiphy *wiphy;
7434
	struct cfg80211_cached_keys *connkeys = NULL;
7435 7436 7437 7438 7439 7440 7441 7442 7443 7444 7445 7446 7447 7448
	int err;

	memset(&connect, 0, sizeof(connect));

	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_SSID] ||
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		connect.auth_type =
			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7449 7450
		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
					     NL80211_CMD_CONNECT))
7451 7452 7453 7454 7455 7456
			return -EINVAL;
	} else
		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];

7457
	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7458
				      NL80211_MAX_NR_CIPHER_SUITES);
7459 7460 7461
	if (err)
		return err;

7462
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7463 7464
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7465

7466
	wiphy = &rdev->wiphy;
7467

7468 7469 7470 7471 7472 7473 7474
	connect.bg_scan_period = -1;
	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
		connect.bg_scan_period =
			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
	}

7475 7476
	if (info->attrs[NL80211_ATTR_MAC])
		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7477 7478 7479
	else if (info->attrs[NL80211_ATTR_MAC_HINT])
		connect.bssid_hint =
			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7480 7481 7482 7483 7484 7485 7486 7487
	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

7488 7489 7490 7491 7492 7493 7494 7495 7496
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
		if (connect.mfp != NL80211_MFP_REQUIRED &&
		    connect.mfp != NL80211_MFP_NO)
			return -EINVAL;
	} else {
		connect.mfp = NL80211_MFP_NO;
	}

7497
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7498 7499 7500
		connect.channel = nl80211_get_valid_chan(
			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
		if (!connect.channel)
7501 7502
			return -EINVAL;
	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7503 7504 7505
		connect.channel_hint = nl80211_get_valid_chan(
			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
		if (!connect.channel_hint)
7506
			return -EINVAL;
7507 7508
	}

7509 7510
	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
		connkeys = nl80211_parse_connkeys(rdev,
7511
					  info->attrs[NL80211_ATTR_KEYS], NULL);
7512 7513
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
7514 7515
	}

7516 7517 7518 7519 7520 7521 7522 7523 7524
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
		connect.flags |= ASSOC_REQ_DISABLE_HT;

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&connect.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(connect.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7525
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7526
			kzfree(connkeys);
7527
			return -EINVAL;
7528
		}
7529 7530 7531 7532 7533
		memcpy(&connect.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(connect.ht_capa));
	}

7534 7535 7536 7537 7538 7539 7540 7541 7542 7543
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
		connect.flags |= ASSOC_REQ_DISABLE_VHT;

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
		memcpy(&connect.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(connect.vht_capa_mask));

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7544
			kzfree(connkeys);
7545 7546 7547 7548 7549 7550 7551
			return -EINVAL;
		}
		memcpy(&connect.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(connect.vht_capa));
	}

7552 7553 7554 7555 7556 7557 7558 7559
	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
		if (!(rdev->wiphy.features &
		      NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
		    !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
			return -EINVAL;
		connect.flags |= ASSOC_REQ_USE_RRM;
	}

7560 7561 7562
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
	wdev_unlock(dev->ieee80211_ptr);
7563
	if (err)
7564
		kzfree(connkeys);
7565 7566 7567 7568 7569
	return err;
}

static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
{
7570 7571
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7572
	u16 reason;
7573
	int ret;
7574 7575 7576 7577 7578 7579 7580 7581 7582

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		reason = WLAN_REASON_DEAUTH_LEAVING;
	else
		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);

	if (reason == 0)
		return -EINVAL;

7583
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7584 7585
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7586

7587 7588 7589 7590
	wdev_lock(dev->ieee80211_ptr);
	ret = cfg80211_disconnect(rdev, dev, reason, true);
	wdev_unlock(dev->ieee80211_ptr);
	return ret;
7591 7592
}

7593 7594
static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
{
7595
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7596 7597 7598 7599 7600 7601 7602 7603 7604 7605
	struct net *net;
	int err;
	u32 pid;

	if (!info->attrs[NL80211_ATTR_PID])
		return -EINVAL;

	pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);

	net = get_net_ns_by_pid(pid);
7606 7607
	if (IS_ERR(net))
		return PTR_ERR(net);
7608 7609 7610 7611

	err = 0;

	/* check if anything to do */
7612 7613
	if (!net_eq(wiphy_net(&rdev->wiphy), net))
		err = cfg80211_switch_netns(rdev, net);
7614 7615 7616 7617 7618

	put_net(net);
	return err;
}

7619 7620
static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7621
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7622 7623
	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
			struct cfg80211_pmksa *pmksa) = NULL;
7624
	struct net_device *dev = info->user_ptr[1];
7625 7626 7627 7628 7629 7630 7631 7632 7633 7634 7635 7636 7637
	struct cfg80211_pmksa pmksa;

	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_PMKID])
		return -EINVAL;

	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
	pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);

7638
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7639 7640
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7641 7642 7643 7644 7645 7646 7647 7648 7649 7650 7651 7652 7653

	switch (info->genlhdr->cmd) {
	case NL80211_CMD_SET_PMKSA:
		rdev_ops = rdev->ops->set_pmksa;
		break;
	case NL80211_CMD_DEL_PMKSA:
		rdev_ops = rdev->ops->del_pmksa;
		break;
	default:
		WARN_ON(1);
		break;
	}

7654 7655
	if (!rdev_ops)
		return -EOPNOTSUPP;
7656

7657
	return rdev_ops(&rdev->wiphy, dev, &pmksa);
7658 7659 7660 7661
}

static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7662 7663
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7664

7665
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7666 7667
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7668

7669 7670
	if (!rdev->ops->flush_pmksa)
		return -EOPNOTSUPP;
7671

7672
	return rdev_flush_pmksa(rdev, dev);
7673 7674
}

7675 7676 7677 7678 7679
static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u8 action_code, dialog_token;
7680
	u32 peer_capability = 0;
7681 7682
	u16 status_code;
	u8 *peer;
7683
	bool initiator;
7684 7685 7686 7687 7688 7689 7690 7691 7692 7693 7694 7695 7696 7697 7698 7699

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_mgmt)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
	    !info->attrs[NL80211_ATTR_IE] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7700
	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7701 7702 7703
	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
		peer_capability =
			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7704

7705
	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7706
			      dialog_token, status_code, peer_capability,
7707
			      initiator,
7708 7709
			      nla_data(info->attrs[NL80211_ATTR_IE]),
			      nla_len(info->attrs[NL80211_ATTR_IE]));
7710 7711 7712 7713 7714 7715 7716 7717 7718 7719 7720 7721 7722 7723 7724 7725 7726 7727 7728 7729
}

static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	enum nl80211_tdls_operation operation;
	u8 *peer;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_oper)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);

7730
	return rdev_tdls_oper(rdev, dev, peer, operation);
7731 7732
}

7733 7734 7735
static int nl80211_remain_on_channel(struct sk_buff *skb,
				     struct genl_info *info)
{
7736
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7737
	struct wireless_dev *wdev = info->user_ptr[1];
7738
	struct cfg80211_chan_def chandef;
7739 7740 7741
	struct sk_buff *msg;
	void *hdr;
	u64 cookie;
7742
	u32 duration;
7743 7744 7745 7746 7747 7748 7749 7750
	int err;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_DURATION])
		return -EINVAL;

	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);

7751 7752 7753 7754
	if (!rdev->ops->remain_on_channel ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
		return -EOPNOTSUPP;

7755
	/*
7756 7757
	 * We should be on that channel for at least a minimum amount of
	 * time (10ms) but no longer than the driver supports.
7758
	 */
7759
	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7760
	    duration > rdev->wiphy.max_remain_on_channel_duration)
7761 7762
		return -EINVAL;

7763 7764 7765
	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;
7766 7767

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7768 7769
	if (!msg)
		return -ENOMEM;
7770

7771
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7772
			     NL80211_CMD_REMAIN_ON_CHANNEL);
7773 7774
	if (!hdr) {
		err = -ENOBUFS;
7775 7776 7777
		goto free_msg;
	}

7778 7779
	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
				     duration, &cookie);
7780 7781 7782 7783

	if (err)
		goto free_msg;

7784 7785
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
7786 7787

	genlmsg_end(msg, hdr);
7788 7789

	return genlmsg_reply(msg, info);
7790 7791 7792 7793 7794 7795 7796 7797 7798 7799 7800

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
					    struct genl_info *info)
{
7801
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7802
	struct wireless_dev *wdev = info->user_ptr[1];
7803 7804 7805 7806 7807
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

7808 7809
	if (!rdev->ops->cancel_remain_on_channel)
		return -EOPNOTSUPP;
7810 7811 7812

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

7813
	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7814 7815
}

7816 7817 7818 7819 7820 7821 7822 7823 7824 7825 7826 7827 7828 7829 7830 7831 7832 7833 7834 7835 7836 7837 7838 7839
static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
			   u8 *rates, u8 rates_len)
{
	u8 i;
	u32 mask = 0;

	for (i = 0; i < rates_len; i++) {
		int rate = (rates[i] & 0x7f) * 5;
		int ridx;
		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
			struct ieee80211_rate *srate =
				&sband->bitrates[ridx];
			if (rate == srate->bitrate) {
				mask |= 1 << ridx;
				break;
			}
		}
		if (ridx == sband->n_bitrates)
			return 0; /* rate not found */
	}

	return mask;
}

7840 7841 7842 7843 7844 7845 7846 7847 7848 7849 7850 7851 7852 7853 7854
static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
			       u8 *rates, u8 rates_len,
			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
{
	u8 i;

	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);

	for (i = 0; i < rates_len; i++) {
		int ridx, rbit;

		ridx = rates[i] / 8;
		rbit = BIT(rates[i] % 8);

		/* check validity */
7855
		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7856 7857 7858 7859 7860 7861 7862 7863 7864 7865 7866 7867
			return false;

		/* check availability */
		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
			mcs[ridx] |= rbit;
		else
			return false;
	}

	return true;
}

7868 7869 7870 7871 7872 7873 7874 7875 7876 7877 7878 7879 7880 7881 7882 7883 7884 7885 7886 7887 7888 7889 7890 7891 7892 7893 7894 7895 7896 7897 7898 7899 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 7921 7922 7923 7924 7925 7926 7927
static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
{
	u16 mcs_mask = 0;

	switch (vht_mcs_map) {
	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
		break;
	case IEEE80211_VHT_MCS_SUPPORT_0_7:
		mcs_mask = 0x00FF;
		break;
	case IEEE80211_VHT_MCS_SUPPORT_0_8:
		mcs_mask = 0x01FF;
		break;
	case IEEE80211_VHT_MCS_SUPPORT_0_9:
		mcs_mask = 0x03FF;
		break;
	default:
		break;
	}

	return mcs_mask;
}

static void vht_build_mcs_mask(u16 vht_mcs_map,
			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
{
	u8 nss;

	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
		vht_mcs_map >>= 2;
	}
}

static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
			     struct nl80211_txrate_vht *txrate,
			     u16 mcs[NL80211_VHT_NSS_MAX])
{
	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
	u8 i;

	if (!sband->vht_cap.vht_supported)
		return false;

	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);

	/* Build vht_mcs_mask from VHT capabilities */
	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);

	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
			mcs[i] = txrate->mcs[i];
		else
			return false;
	}

	return true;
}

Alexey Dobriyan's avatar
Alexey Dobriyan committed
7928
static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7929 7930
	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
				    .len = NL80211_MAX_SUPP_RATES },
7931 7932
	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
				.len = NL80211_MAX_SUPP_HT_RATES },
7933
	[NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7934
	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
7935 7936 7937 7938 7939 7940
};

static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7941
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7942
	struct cfg80211_bitrate_mask mask;
7943 7944
	int rem, i;
	struct net_device *dev = info->user_ptr[1];
7945 7946
	struct nlattr *tx_rates;
	struct ieee80211_supported_band *sband;
7947
	u16 vht_tx_mcs_map;
7948

7949 7950
	if (!rdev->ops->set_bitrate_mask)
		return -EOPNOTSUPP;
7951 7952 7953 7954 7955

	memset(&mask, 0, sizeof(mask));
	/* Default to all rates enabled */
	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
		sband = rdev->wiphy.bands[i];
7956 7957 7958 7959 7960

		if (!sband)
			continue;

		mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7961
		memcpy(mask.control[i].ht_mcs,
7962
		       sband->ht_cap.mcs.rx_mask,
7963
		       sizeof(mask.control[i].ht_mcs));
7964 7965 7966 7967 7968 7969

		if (!sband->vht_cap.vht_supported)
			continue;

		vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
		vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7970 7971
	}

7972 7973 7974 7975
	/* if no rates are given set it back to the defaults */
	if (!info->attrs[NL80211_ATTR_TX_RATES])
		goto out;

7976 7977 7978 7979
	/*
	 * The nested attribute uses enum nl80211_band as the index. This maps
	 * directly to the enum ieee80211_band values used in cfg80211.
	 */
7980
	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7981
	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7982
		enum ieee80211_band band = nla_type(tx_rates);
7983 7984
		int err;

7985 7986
		if (band < 0 || band >= IEEE80211_NUM_BANDS)
			return -EINVAL;
7987
		sband = rdev->wiphy.bands[band];
7988 7989
		if (sband == NULL)
			return -EINVAL;
7990 7991 7992 7993
		err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
				nla_len(tx_rates), nl80211_txattr_policy);
		if (err)
			return err;
7994 7995 7996 7997 7998
		if (tb[NL80211_TXRATE_LEGACY]) {
			mask.control[band].legacy = rateset_to_mask(
				sband,
				nla_data(tb[NL80211_TXRATE_LEGACY]),
				nla_len(tb[NL80211_TXRATE_LEGACY]));
7999 8000 8001
			if ((mask.control[band].legacy == 0) &&
			    nla_len(tb[NL80211_TXRATE_LEGACY]))
				return -EINVAL;
8002
		}
8003
		if (tb[NL80211_TXRATE_HT]) {
8004 8005
			if (!ht_rateset_to_mask(
					sband,
8006 8007 8008
					nla_data(tb[NL80211_TXRATE_HT]),
					nla_len(tb[NL80211_TXRATE_HT]),
					mask.control[band].ht_mcs))
8009 8010
				return -EINVAL;
		}
8011 8012 8013 8014 8015 8016 8017
		if (tb[NL80211_TXRATE_VHT]) {
			if (!vht_set_mcs_mask(
					sband,
					nla_data(tb[NL80211_TXRATE_VHT]),
					mask.control[band].vht_mcs))
				return -EINVAL;
		}
8018 8019 8020 8021 8022 8023
		if (tb[NL80211_TXRATE_GI]) {
			mask.control[band].gi =
				nla_get_u8(tb[NL80211_TXRATE_GI]);
			if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
				return -EINVAL;
		}
8024 8025

		if (mask.control[band].legacy == 0) {
8026 8027 8028 8029 8030
			/* don't allow empty legacy rates if HT or VHT
			 * are not even supported.
			 */
			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
			      rdev->wiphy.bands[band]->vht_cap.vht_supported))
8031 8032 8033
				return -EINVAL;

			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8034
				if (mask.control[band].ht_mcs[i])
8035 8036 8037 8038 8039
					goto out;

			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
				if (mask.control[band].vht_mcs[i])
					goto out;
8040 8041

			/* legacy and mcs rates may not be both empty */
8042
			return -EINVAL;
8043 8044 8045
		}
	}

8046
out:
8047
	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8048 8049
}

8050
static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8051
{
8052
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8053
	struct wireless_dev *wdev = info->user_ptr[1];
8054
	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8055 8056 8057 8058

	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
		return -EINVAL;

8059 8060
	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8061

8062 8063 8064 8065 8066 8067 8068 8069
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
8070
	case NL80211_IFTYPE_P2P_DEVICE:
8071 8072
		break;
	default:
8073
		return -EOPNOTSUPP;
8074
	}
8075 8076

	/* not much point in registering if we can't reply */
8077 8078
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
8079

8080
	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8081 8082 8083 8084
			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
}

8085
static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8086
{
8087
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8088
	struct wireless_dev *wdev = info->user_ptr[1];
8089
	struct cfg80211_chan_def chandef;
8090
	int err;
8091
	void *hdr = NULL;
8092
	u64 cookie;
8093
	struct sk_buff *msg = NULL;
8094 8095 8096 8097
	struct cfg80211_mgmt_tx_params params = {
		.dont_wait_for_ack =
			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
	};
8098

8099
	if (!info->attrs[NL80211_ATTR_FRAME])
8100 8101
		return -EINVAL;

8102 8103
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
8104

8105
	switch (wdev->iftype) {
8106 8107 8108
	case NL80211_IFTYPE_P2P_DEVICE:
		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
			return -EINVAL;
8109 8110 8111 8112 8113 8114 8115 8116 8117
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
		break;
	default:
8118
		return -EOPNOTSUPP;
8119
	}
8120

8121
	if (info->attrs[NL80211_ATTR_DURATION]) {
8122
		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8123
			return -EINVAL;
8124
		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8125 8126 8127 8128 8129

		/*
		 * We should wait on the channel for at least a minimum amount
		 * of time (10ms) but no longer than the driver supports.
		 */
8130 8131
		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
8132 8133
			return -EINVAL;

8134 8135
	}

8136
	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8137

8138
	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8139 8140
		return -EINVAL;

8141
	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8142

8143 8144 8145 8146 8147 8148 8149 8150 8151 8152
	/* get the channel if any has been specified, otherwise pass NULL to
	 * the driver. The latter will use the current one
	 */
	chandef.chan = NULL;
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
		err = nl80211_parse_chandef(rdev, info, &chandef);
		if (err)
			return err;
	}

8153
	if (!chandef.chan && params.offchan)
8154
		return -EINVAL;
8155

8156 8157 8158 8159 8160 8161 8162 8163 8164 8165 8166 8167 8168 8169 8170 8171 8172 8173 8174 8175 8176
	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);

	if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
		int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
		int i;

		if (len % sizeof(u16))
			return -EINVAL;

		params.n_csa_offsets = len / sizeof(u16);
		params.csa_offsets =
			nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);

		/* check that all the offsets fit the frame */
		for (i = 0; i < params.n_csa_offsets; i++) {
			if (params.csa_offsets[i] >= params.len)
				return -EINVAL;
		}
	}

8177
	if (!params.dont_wait_for_ack) {
8178 8179 8180
		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (!msg)
			return -ENOMEM;
8181

8182
		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8183
				     NL80211_CMD_FRAME);
8184 8185
		if (!hdr) {
			err = -ENOBUFS;
8186 8187
			goto free_msg;
		}
8188
	}
8189

8190 8191
	params.chan = chandef.chan;
	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8192 8193 8194
	if (err)
		goto free_msg;

8195
	if (msg) {
8196 8197
		if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
			goto nla_put_failure;
8198

8199 8200 8201 8202 8203
		genlmsg_end(msg, hdr);
		return genlmsg_reply(msg, info);
	}

	return 0;
8204 8205 8206 8207 8208 8209 8210 8211

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

8212 8213 8214
static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8215
	struct wireless_dev *wdev = info->user_ptr[1];
8216 8217 8218 8219 8220 8221 8222 8223
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

	if (!rdev->ops->mgmt_tx_cancel_wait)
		return -EOPNOTSUPP;

8224 8225 8226 8227 8228 8229 8230
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
8231
	case NL80211_IFTYPE_P2P_DEVICE:
8232 8233
		break;
	default:
8234
		return -EOPNOTSUPP;
8235
	}
8236 8237 8238

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

8239
	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8240 8241
}

8242 8243
static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
{
8244
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8245
	struct wireless_dev *wdev;
8246
	struct net_device *dev = info->user_ptr[1];
8247 8248 8249 8250
	u8 ps_state;
	bool state;
	int err;

8251 8252
	if (!info->attrs[NL80211_ATTR_PS_STATE])
		return -EINVAL;
8253 8254 8255

	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);

8256 8257
	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
		return -EINVAL;
8258 8259 8260

	wdev = dev->ieee80211_ptr;

8261 8262
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
8263 8264 8265 8266

	state = (ps_state == NL80211_PS_ENABLED) ? true : false;

	if (state == wdev->ps)
8267
		return 0;
8268

8269
	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8270 8271
	if (!err)
		wdev->ps = state;
8272 8273 8274 8275 8276
	return err;
}

static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
{
8277
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8278 8279
	enum nl80211_ps_state ps_state;
	struct wireless_dev *wdev;
8280
	struct net_device *dev = info->user_ptr[1];
8281 8282 8283 8284 8285 8286
	struct sk_buff *msg;
	void *hdr;
	int err;

	wdev = dev->ieee80211_ptr;

8287 8288
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
8289 8290

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8291 8292
	if (!msg)
		return -ENOMEM;
8293

8294
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8295 8296
			     NL80211_CMD_GET_POWER_SAVE);
	if (!hdr) {
8297
		err = -ENOBUFS;
8298 8299 8300 8301 8302 8303 8304 8305
		goto free_msg;
	}

	if (wdev->ps)
		ps_state = NL80211_PS_ENABLED;
	else
		ps_state = NL80211_PS_DISABLED;

8306 8307
	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
		goto nla_put_failure;
8308 8309

	genlmsg_end(msg, hdr);
8310
	return genlmsg_reply(msg, info);
8311

8312
 nla_put_failure:
8313
	err = -ENOBUFS;
8314
 free_msg:
8315 8316 8317 8318
	nlmsg_free(msg);
	return err;
}

8319 8320
static const struct nla_policy
nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8321 8322 8323
	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8324 8325 8326
	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8327 8328
};

8329
static int nl80211_set_cqm_txe(struct genl_info *info,
8330
			       u32 rate, u32 pkts, u32 intvl)
8331 8332 8333
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
8334
	struct wireless_dev *wdev = dev->ieee80211_ptr;
8335

8336
	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8337 8338 8339 8340 8341 8342 8343 8344 8345
		return -EINVAL;

	if (!rdev->ops->set_cqm_txe_config)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_STATION &&
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;

8346
	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8347 8348
}

8349 8350 8351
static int nl80211_set_cqm_rssi(struct genl_info *info,
				s32 threshold, u32 hysteresis)
{
8352 8353
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
8354
	struct wireless_dev *wdev = dev->ieee80211_ptr;
8355 8356 8357 8358

	if (threshold > 0)
		return -EINVAL;

8359 8360 8361
	/* disabling - hysteresis should also be zero then */
	if (threshold == 0)
		hysteresis = 0;
8362

8363 8364
	if (!rdev->ops->set_cqm_rssi_config)
		return -EOPNOTSUPP;
8365

8366
	if (wdev->iftype != NL80211_IFTYPE_STATION &&
8367 8368
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
8369

8370
	return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8371 8372 8373 8374 8375 8376 8377 8378 8379
}

static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
	struct nlattr *cqm;
	int err;

	cqm = info->attrs[NL80211_ATTR_CQM];
8380 8381
	if (!cqm)
		return -EINVAL;
8382 8383 8384 8385

	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
			       nl80211_attr_cqm_policy);
	if (err)
8386
		return err;
8387 8388 8389

	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8390 8391
		s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8392

8393 8394 8395 8396 8397 8398 8399 8400 8401 8402 8403 8404 8405 8406
		return nl80211_set_cqm_rssi(info, threshold, hysteresis);
	}

	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);

		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
	}

	return -EINVAL;
8407 8408
}

8409 8410 8411 8412 8413 8414 8415 8416 8417 8418 8419 8420 8421 8422 8423 8424 8425 8426 8427 8428 8429 8430
static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct ocb_setup setup = {};
	int err;

	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
	if (err)
		return err;

	return cfg80211_join_ocb(rdev, dev, &setup);
}

static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];

	return cfg80211_leave_ocb(rdev, dev);
}

8431 8432 8433 8434 8435
static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct mesh_config cfg;
8436
	struct mesh_setup setup;
8437 8438 8439 8440
	int err;

	/* start with default */
	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8441
	memcpy(&setup, &default_mesh_setup, sizeof(setup));
8442

8443
	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8444
		/* and parse parameters if given */
8445
		err = nl80211_parse_mesh_config(info, &cfg, NULL);
8446 8447 8448 8449 8450 8451 8452 8453
		if (err)
			return err;
	}

	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
		return -EINVAL;

8454 8455 8456
	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);

8457 8458 8459 8460 8461
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
			return -EINVAL;

8462 8463 8464 8465 8466 8467 8468 8469 8470 8471 8472 8473 8474 8475 8476
	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		setup.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (setup.beacon_interval < 10 ||
		    setup.beacon_interval > 10000)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
		setup.dtim_period =
			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
		if (setup.dtim_period < 1 || setup.dtim_period > 100)
			return -EINVAL;
	}

8477 8478 8479 8480 8481 8482 8483
	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
		/* parse additional setup parameters if given */
		err = nl80211_parse_mesh_setup(info, &setup);
		if (err)
			return err;
	}

8484 8485 8486
	if (setup.user_mpm)
		cfg.auto_open_plinks = false;

8487
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8488 8489 8490
		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
		if (err)
			return err;
8491 8492
	} else {
		/* cfg80211_join_mesh() will sort it out */
8493
		setup.chandef.chan = NULL;
8494 8495
	}

8496 8497 8498 8499 8500 8501 8502 8503 8504 8505 8506 8507 8508 8509 8510 8511 8512
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband;

		if (!setup.chandef.chan)
			return -EINVAL;

		sband = rdev->wiphy.bands[setup.chandef.chan->band];

		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &setup.basic_rates);
		if (err)
			return err;
	}

8513
	return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8514 8515 8516 8517 8518 8519 8520 8521 8522 8523
}

static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];

	return cfg80211_leave_mesh(rdev, dev);
}

8524
#ifdef CONFIG_PM
8525 8526 8527
static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
					struct cfg80211_registered_device *rdev)
{
8528
	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8529 8530 8531
	struct nlattr *nl_pats, *nl_pat;
	int i, pat_len;

8532
	if (!wowlan->n_patterns)
8533 8534 8535 8536 8537 8538
		return 0;

	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
	if (!nl_pats)
		return -ENOBUFS;

8539
	for (i = 0; i < wowlan->n_patterns; i++) {
8540 8541 8542
		nl_pat = nla_nest_start(msg, i + 1);
		if (!nl_pat)
			return -ENOBUFS;
8543
		pat_len = wowlan->patterns[i].pattern_len;
8544
		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8545
			    wowlan->patterns[i].mask) ||
8546 8547 8548
		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
			    wowlan->patterns[i].pattern) ||
		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8549
				wowlan->patterns[i].pkt_offset))
8550 8551 8552 8553 8554 8555 8556 8557
			return -ENOBUFS;
		nla_nest_end(msg, nl_pat);
	}
	nla_nest_end(msg, nl_pats);

	return 0;
}

8558 8559 8560 8561 8562 8563 8564 8565 8566 8567 8568 8569 8570 8571 8572 8573 8574 8575 8576 8577 8578 8579 8580 8581 8582 8583 8584 8585 8586 8587 8588 8589 8590 8591 8592 8593 8594 8595
static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
				   struct cfg80211_wowlan_tcp *tcp)
{
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
	    nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
		    tcp->payload_len, tcp->payload) ||
	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
		    tcp->wake_len, tcp->wake_data) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
		return -ENOBUFS;

	if (tcp->payload_seq.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
		    sizeof(tcp->payload_seq), &tcp->payload_seq))
		return -ENOBUFS;

	if (tcp->payload_tok.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
		    sizeof(tcp->payload_tok) + tcp->tokens_size,
		    &tcp->payload_tok))
		return -ENOBUFS;

8596 8597
	nla_nest_end(msg, nl_tcp);

8598 8599 8600
	return 0;
}

8601 8602 8603 8604 8605
static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;
8606
	u32 size = NLMSG_DEFAULT_SIZE;
8607

8608
	if (!rdev->wiphy.wowlan)
8609 8610
		return -EOPNOTSUPP;

8611
	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8612
		/* adjust size to have room for all the data */
8613 8614 8615 8616
		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
			rdev->wiphy.wowlan_config->tcp->payload_len +
			rdev->wiphy.wowlan_config->tcp->wake_len +
			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8617 8618 8619
	}

	msg = nlmsg_new(size, GFP_KERNEL);
8620 8621 8622
	if (!msg)
		return -ENOMEM;

8623
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8624 8625 8626 8627
			     NL80211_CMD_GET_WOWLAN);
	if (!hdr)
		goto nla_put_failure;

8628
	if (rdev->wiphy.wowlan_config) {
8629 8630 8631 8632 8633 8634
		struct nlattr *nl_wowlan;

		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
		if (!nl_wowlan)
			goto nla_put_failure;

8635
		if ((rdev->wiphy.wowlan_config->any &&
8636
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8637
		    (rdev->wiphy.wowlan_config->disconnect &&
8638
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8639
		    (rdev->wiphy.wowlan_config->magic_pkt &&
8640
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8641
		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8642
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8643
		    (rdev->wiphy.wowlan_config->eap_identity_req &&
8644
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8645
		    (rdev->wiphy.wowlan_config->four_way_handshake &&
8646
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8647
		    (rdev->wiphy.wowlan_config->rfkill_release &&
8648 8649
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
			goto nla_put_failure;
8650

8651 8652
		if (nl80211_send_wowlan_patterns(msg, rdev))
			goto nla_put_failure;
8653

8654 8655
		if (nl80211_send_wowlan_tcp(msg,
					    rdev->wiphy.wowlan_config->tcp))
8656 8657
			goto nla_put_failure;

8658 8659 8660 8661 8662 8663 8664 8665 8666 8667 8668
		nla_nest_end(msg, nl_wowlan);
	}

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

8669 8670 8671 8672 8673 8674 8675 8676 8677 8678 8679 8680
static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
				    struct nlattr *attr,
				    struct cfg80211_wowlan *trig)
{
	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
	struct cfg80211_wowlan_tcp *cfg;
	struct nl80211_wowlan_tcp_data_token *tok = NULL;
	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
	u32 size;
	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
	int err, port;

8681
	if (!rdev->wiphy.wowlan->tcp)
8682 8683 8684 8685 8686 8687 8688 8689 8690 8691 8692 8693 8694 8695 8696 8697 8698 8699 8700
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
			nla_data(attr), nla_len(attr),
			nl80211_wowlan_tcp_policy);
	if (err)
		return err;

	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
		return -EINVAL;

	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8701
	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8702 8703 8704
		return -EINVAL;

	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8705
			rdev->wiphy.wowlan->tcp->data_interval_max ||
8706
	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8707 8708 8709
		return -EINVAL;

	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8710
	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8711 8712 8713 8714 8715 8716 8717 8718 8719 8720 8721 8722 8723 8724
		return -EINVAL;

	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);

		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
		tokens_size = tokln - sizeof(*tok);

		if (!tok->len || tokens_size % tok->len)
			return -EINVAL;
8725
		if (!rdev->wiphy.wowlan->tcp->tok)
8726
			return -EINVAL;
8727
		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8728
			return -EINVAL;
8729
		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8730
			return -EINVAL;
8731
		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8732 8733 8734 8735 8736 8737 8738
			return -EINVAL;
		if (tok->offset + tok->len > data_size)
			return -EINVAL;
	}

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8739
		if (!rdev->wiphy.wowlan->tcp->seq)
8740 8741 8742 8743 8744 8745 8746 8747 8748 8749 8750 8751 8752 8753 8754 8755 8756 8757 8758 8759 8760 8761 8762 8763 8764 8765 8766 8767 8768 8769 8770 8771 8772 8773 8774 8775 8776 8777 8778 8779 8780 8781 8782 8783 8784 8785 8786 8787 8788 8789 8790 8791 8792 8793 8794 8795 8796 8797 8798 8799 8800 8801 8802 8803 8804 8805 8806 8807 8808 8809 8810 8811 8812 8813
			return -EINVAL;
		if (seq->len == 0 || seq->len > 4)
			return -EINVAL;
		if (seq->len + seq->offset > data_size)
			return -EINVAL;
	}

	size = sizeof(*cfg);
	size += data_size;
	size += wake_size + wake_mask_size;
	size += tokens_size;

	cfg = kzalloc(size, GFP_KERNEL);
	if (!cfg)
		return -ENOMEM;
	cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
	cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
	       ETH_ALEN);
	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
	else
		port = 0;
#ifdef CONFIG_INET
	/* allocate a socket and port for it and use it */
	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
			    IPPROTO_TCP, &cfg->sock, 1);
	if (err) {
		kfree(cfg);
		return err;
	}
	if (inet_csk_get_port(cfg->sock->sk, port)) {
		sock_release(cfg->sock);
		kfree(cfg);
		return -EADDRINUSE;
	}
	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
#else
	if (!port) {
		kfree(cfg);
		return -EINVAL;
	}
	cfg->src_port = port;
#endif

	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
	cfg->payload_len = data_size;
	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
	memcpy((void *)cfg->payload,
	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
	       data_size);
	if (seq)
		cfg->payload_seq = *seq;
	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
	cfg->wake_len = wake_size;
	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
	memcpy((void *)cfg->wake_data,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
	       wake_size);
	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
			 data_size + wake_size;
	memcpy((void *)cfg->wake_mask,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
	       wake_mask_size);
	if (tok) {
		cfg->tokens_size = tokens_size;
		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
	}

	trig->tcp = cfg;

	return 0;
}

8814 8815 8816 8817 8818 8819 8820 8821 8822 8823 8824 8825 8826 8827 8828 8829 8830 8831 8832 8833 8834 8835 8836
static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
				   const struct wiphy_wowlan_support *wowlan,
				   struct nlattr *attr,
				   struct cfg80211_wowlan *trig)
{
	struct nlattr **tb;
	int err;

	tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
	if (!tb)
		return -ENOMEM;

	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
		err = -EOPNOTSUPP;
		goto out;
	}

	err = nla_parse(tb, NL80211_ATTR_MAX,
			nla_data(attr), nla_len(attr),
			nl80211_policy);
	if (err)
		goto out;

8837
	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
8838 8839 8840 8841 8842 8843 8844 8845 8846
	err = PTR_ERR_OR_ZERO(trig->nd_config);
	if (err)
		trig->nd_config = NULL;

out:
	kfree(tb);
	return err;
}

8847 8848 8849 8850 8851
static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
	struct cfg80211_wowlan new_triggers = {};
8852
	struct cfg80211_wowlan *ntrig;
8853
	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8854
	int err, i;
8855
	bool prev_enabled = rdev->wiphy.wowlan_config;
8856

8857
	if (!wowlan)
8858 8859
		return -EOPNOTSUPP;

8860 8861
	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
		cfg80211_rdev_free_wowlan(rdev);
8862
		rdev->wiphy.wowlan_config = NULL;
8863 8864
		goto set_wakeup;
	}
8865 8866 8867 8868 8869 8870 8871 8872 8873 8874 8875 8876 8877 8878 8879 8880 8881 8882 8883 8884 8885 8886 8887 8888 8889 8890

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
			nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nl80211_wowlan_policy);
	if (err)
		return err;

	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
			return -EINVAL;
		new_triggers.any = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
			return -EINVAL;
		new_triggers.disconnect = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
			return -EINVAL;
		new_triggers.magic_pkt = true;
	}

8891 8892 8893 8894 8895 8896 8897 8898 8899 8900 8901 8902 8903 8904 8905 8906 8907 8908 8909 8910 8911 8912 8913 8914 8915 8916 8917
	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
			return -EINVAL;
		new_triggers.gtk_rekey_failure = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
			return -EINVAL;
		new_triggers.eap_identity_req = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
			return -EINVAL;
		new_triggers.four_way_handshake = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
			return -EINVAL;
		new_triggers.rfkill_release = true;
	}

8918 8919 8920
	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
		struct nlattr *pat;
		int n_patterns = 0;
8921
		int rem, pat_len, mask_len, pkt_offset;
8922
		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8923 8924 8925 8926 8927 8928 8929 8930 8931 8932 8933 8934 8935 8936 8937 8938 8939 8940

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem)
			n_patterns++;
		if (n_patterns > wowlan->n_patterns)
			return -EINVAL;

		new_triggers.patterns = kcalloc(n_patterns,
						sizeof(new_triggers.patterns[0]),
						GFP_KERNEL);
		if (!new_triggers.patterns)
			return -ENOMEM;

		new_triggers.n_patterns = n_patterns;
		i = 0;

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem) {
8941 8942
			u8 *mask_pat;

8943 8944
			nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
				  nla_len(pat), NULL);
8945
			err = -EINVAL;
8946 8947
			if (!pat_tb[NL80211_PKTPAT_MASK] ||
			    !pat_tb[NL80211_PKTPAT_PATTERN])
8948
				goto error;
8949
			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8950
			mask_len = DIV_ROUND_UP(pat_len, 8);
8951
			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8952 8953 8954 8955 8956
				goto error;
			if (pat_len > wowlan->pattern_max_len ||
			    pat_len < wowlan->pattern_min_len)
				goto error;

8957
			if (!pat_tb[NL80211_PKTPAT_OFFSET])
8958 8959 8960
				pkt_offset = 0;
			else
				pkt_offset = nla_get_u32(
8961
					pat_tb[NL80211_PKTPAT_OFFSET]);
8962 8963 8964 8965
			if (pkt_offset > wowlan->max_pkt_offset)
				goto error;
			new_triggers.patterns[i].pkt_offset = pkt_offset;

8966 8967
			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
			if (!mask_pat) {
8968 8969 8970
				err = -ENOMEM;
				goto error;
			}
8971 8972
			new_triggers.patterns[i].mask = mask_pat;
			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8973
			       mask_len);
8974 8975
			mask_pat += mask_len;
			new_triggers.patterns[i].pattern = mask_pat;
8976
			new_triggers.patterns[i].pattern_len = pat_len;
8977
			memcpy(mask_pat,
8978
			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8979 8980 8981 8982 8983
			       pat_len);
			i++;
		}
	}

8984 8985 8986 8987 8988 8989 8990 8991
	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
		err = nl80211_parse_wowlan_tcp(
			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
			&new_triggers);
		if (err)
			goto error;
	}

8992 8993 8994 8995 8996 8997 8998 8999
	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
		err = nl80211_parse_wowlan_nd(
			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
			&new_triggers);
		if (err)
			goto error;
	}

9000 9001 9002 9003
	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
	if (!ntrig) {
		err = -ENOMEM;
		goto error;
9004
	}
9005
	cfg80211_rdev_free_wowlan(rdev);
9006
	rdev->wiphy.wowlan_config = ntrig;
9007

9008
 set_wakeup:
9009 9010 9011
	if (rdev->ops->set_wakeup &&
	    prev_enabled != !!rdev->wiphy.wowlan_config)
		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9012

9013 9014 9015 9016 9017
	return 0;
 error:
	for (i = 0; i < new_triggers.n_patterns; i++)
		kfree(new_triggers.patterns[i].mask);
	kfree(new_triggers.patterns);
9018 9019 9020
	if (new_triggers.tcp && new_triggers.tcp->sock)
		sock_release(new_triggers.tcp->sock);
	kfree(new_triggers.tcp);
9021 9022
	return err;
}
9023
#endif
9024

9025 9026 9027 9028 9029 9030 9031 9032 9033 9034 9035 9036 9037 9038 9039 9040 9041 9042 9043 9044 9045 9046 9047 9048 9049 9050 9051 9052 9053 9054 9055 9056 9057 9058 9059 9060 9061 9062 9063 9064 9065 9066 9067 9068 9069 9070 9071 9072 9073 9074 9075 9076 9077 9078 9079 9080 9081 9082 9083 9084 9085 9086 9087 9088 9089 9090 9091 9092 9093 9094 9095 9096 9097 9098 9099 9100 9101 9102 9103 9104 9105 9106 9107 9108 9109 9110 9111 9112 9113 9114 9115 9116 9117 9118 9119 9120 9121 9122 9123 9124 9125 9126 9127 9128 9129 9130 9131 9132 9133 9134 9135 9136 9137 9138 9139 9140 9141 9142 9143 9144 9145 9146 9147 9148 9149 9150 9151 9152 9153 9154 9155 9156 9157 9158 9159 9160 9161 9162 9163 9164 9165 9166 9167 9168 9169 9170 9171 9172 9173 9174 9175 9176
static int nl80211_send_coalesce_rules(struct sk_buff *msg,
				       struct cfg80211_registered_device *rdev)
{
	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
	int i, j, pat_len;
	struct cfg80211_coalesce_rules *rule;

	if (!rdev->coalesce->n_rules)
		return 0;

	nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
	if (!nl_rules)
		return -ENOBUFS;

	for (i = 0; i < rdev->coalesce->n_rules; i++) {
		nl_rule = nla_nest_start(msg, i + 1);
		if (!nl_rule)
			return -ENOBUFS;

		rule = &rdev->coalesce->rules[i];
		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
				rule->delay))
			return -ENOBUFS;

		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
				rule->condition))
			return -ENOBUFS;

		nl_pats = nla_nest_start(msg,
				NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
		if (!nl_pats)
			return -ENOBUFS;

		for (j = 0; j < rule->n_patterns; j++) {
			nl_pat = nla_nest_start(msg, j + 1);
			if (!nl_pat)
				return -ENOBUFS;
			pat_len = rule->patterns[j].pattern_len;
			if (nla_put(msg, NL80211_PKTPAT_MASK,
				    DIV_ROUND_UP(pat_len, 8),
				    rule->patterns[j].mask) ||
			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
				    rule->patterns[j].pattern) ||
			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
					rule->patterns[j].pkt_offset))
				return -ENOBUFS;
			nla_nest_end(msg, nl_pat);
		}
		nla_nest_end(msg, nl_pats);
		nla_nest_end(msg, nl_rule);
	}
	nla_nest_end(msg, nl_rules);

	return 0;
}

static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;

	if (!rdev->wiphy.coalesce)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_COALESCE);
	if (!hdr)
		goto nla_put_failure;

	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
{
	struct cfg80211_coalesce *coalesce = rdev->coalesce;
	int i, j;
	struct cfg80211_coalesce_rules *rule;

	if (!coalesce)
		return;

	for (i = 0; i < coalesce->n_rules; i++) {
		rule = &coalesce->rules[i];
		for (j = 0; j < rule->n_patterns; j++)
			kfree(rule->patterns[j].mask);
		kfree(rule->patterns);
	}
	kfree(coalesce->rules);
	kfree(coalesce);
	rdev->coalesce = NULL;
}

static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
				       struct nlattr *rule,
				       struct cfg80211_coalesce_rules *new_rule)
{
	int err, i;
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];

	err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
			nla_len(rule), nl80211_coalesce_policy);
	if (err)
		return err;

	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
		new_rule->delay =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
	if (new_rule->delay > coalesce->max_delay)
		return -EINVAL;

	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
		new_rule->condition =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
	if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
	    new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
		return -EINVAL;

	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
		return -EINVAL;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem)
		n_patterns++;
	if (n_patterns > coalesce->n_patterns)
		return -EINVAL;

	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
				     GFP_KERNEL);
	if (!new_rule->patterns)
		return -ENOMEM;

	new_rule->n_patterns = n_patterns;
	i = 0;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem) {
9177 9178
		u8 *mask_pat;

9179 9180 9181 9182 9183 9184 9185 9186 9187 9188 9189 9190 9191 9192 9193 9194 9195 9196 9197 9198 9199
		nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
			  nla_len(pat), NULL);
		if (!pat_tb[NL80211_PKTPAT_MASK] ||
		    !pat_tb[NL80211_PKTPAT_PATTERN])
			return -EINVAL;
		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
		mask_len = DIV_ROUND_UP(pat_len, 8);
		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
			return -EINVAL;
		if (pat_len > coalesce->pattern_max_len ||
		    pat_len < coalesce->pattern_min_len)
			return -EINVAL;

		if (!pat_tb[NL80211_PKTPAT_OFFSET])
			pkt_offset = 0;
		else
			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
		if (pkt_offset > coalesce->max_pkt_offset)
			return -EINVAL;
		new_rule->patterns[i].pkt_offset = pkt_offset;

9200 9201
		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
		if (!mask_pat)
9202
			return -ENOMEM;
9203 9204 9205 9206 9207 9208 9209

		new_rule->patterns[i].mask = mask_pat;
		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
		       mask_len);

		mask_pat += mask_len;
		new_rule->patterns[i].pattern = mask_pat;
9210
		new_rule->patterns[i].pattern_len = pat_len;
9211 9212
		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
		       pat_len);
9213 9214 9215 9216 9217 9218 9219 9220 9221 9222 9223 9224 9225 9226 9227 9228 9229 9230 9231 9232 9233 9234 9235 9236 9237 9238 9239 9240 9241 9242 9243 9244 9245 9246 9247 9248 9249 9250 9251 9252 9253 9254 9255 9256 9257 9258 9259 9260 9261 9262 9263 9264 9265 9266 9267 9268 9269 9270 9271 9272 9273 9274 9275 9276 9277 9278 9279 9280 9281 9282 9283 9284 9285 9286
		i++;
	}

	return 0;
}

static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct cfg80211_coalesce new_coalesce = {};
	struct cfg80211_coalesce *n_coalesce;
	int err, rem_rule, n_rules = 0, i, j;
	struct nlattr *rule;
	struct cfg80211_coalesce_rules *tmp_rule;

	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
		cfg80211_rdev_free_coalesce(rdev);
		rdev->ops->set_coalesce(&rdev->wiphy, NULL);
		return 0;
	}

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule)
		n_rules++;
	if (n_rules > coalesce->n_rules)
		return -EINVAL;

	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
				     GFP_KERNEL);
	if (!new_coalesce.rules)
		return -ENOMEM;

	new_coalesce.n_rules = n_rules;
	i = 0;

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule) {
		err = nl80211_parse_coalesce_rule(rdev, rule,
						  &new_coalesce.rules[i]);
		if (err)
			goto error;

		i++;
	}

	err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
	if (err)
		goto error;

	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
	if (!n_coalesce) {
		err = -ENOMEM;
		goto error;
	}
	cfg80211_rdev_free_coalesce(rdev);
	rdev->coalesce = n_coalesce;

	return 0;
error:
	for (i = 0; i < new_coalesce.n_rules; i++) {
		tmp_rule = &new_coalesce.rules[i];
		for (j = 0; j < tmp_rule->n_patterns; j++)
			kfree(tmp_rule->patterns[j].mask);
		kfree(tmp_rule->patterns);
	}
	kfree(new_coalesce.rules);

	return err;
}

9287 9288 9289 9290 9291 9292 9293 9294 9295 9296 9297 9298 9299 9300 9301 9302 9303 9304 9305 9306 9307 9308 9309 9310 9311 9312
static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
	struct cfg80211_gtk_rekey_data rekey_data;
	int err;

	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
			nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nl80211_rekey_policy);
	if (err)
		return err;

	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
		return -ERANGE;

9313 9314 9315
	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9316 9317 9318 9319 9320 9321 9322 9323 9324 9325 9326 9327

	wdev_lock(wdev);
	if (!wdev->current_bss) {
		err = -ENOTCONN;
		goto out;
	}

	if (!rdev->ops->set_rekey_data) {
		err = -EOPNOTSUPP;
		goto out;
	}

9328
	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9329 9330 9331 9332 9333
 out:
	wdev_unlock(wdev);
	return err;
}

9334 9335 9336 9337 9338 9339 9340 9341 9342 9343
static int nl80211_register_unexpected_frame(struct sk_buff *skb,
					     struct genl_info *info)
{
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;

9344
	if (wdev->ap_unexpected_nlportid)
9345 9346
		return -EBUSY;

9347
	wdev->ap_unexpected_nlportid = info->snd_portid;
9348 9349 9350
	return 0;
}

9351 9352 9353 9354 9355 9356 9357 9358 9359 9360 9361 9362 9363 9364 9365 9366 9367 9368 9369 9370 9371 9372 9373 9374 9375 9376
static int nl80211_probe_client(struct sk_buff *skb,
				struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct sk_buff *msg;
	void *hdr;
	const u8 *addr;
	u64 cookie;
	int err;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!rdev->ops->probe_client)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

9377
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9378
			     NL80211_CMD_PROBE_CLIENT);
9379 9380
	if (!hdr) {
		err = -ENOBUFS;
9381 9382 9383 9384 9385
		goto free_msg;
	}

	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

9386
	err = rdev_probe_client(rdev, dev, addr, &cookie);
9387 9388 9389
	if (err)
		goto free_msg;

9390 9391
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
9392 9393 9394 9395 9396 9397 9398 9399 9400 9401 9402 9403

	genlmsg_end(msg, hdr);

	return genlmsg_reply(msg, info);

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

9404 9405 9406
static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9407 9408
	struct cfg80211_beacon_registration *reg, *nreg;
	int rv;
9409 9410 9411 9412

	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
		return -EOPNOTSUPP;

9413 9414 9415 9416 9417 9418 9419 9420 9421 9422 9423 9424 9425 9426 9427
	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
	if (!nreg)
		return -ENOMEM;

	/* First, check if already registered. */
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		if (reg->nlportid == info->snd_portid) {
			rv = -EALREADY;
			goto out_err;
		}
	}
	/* Add it to the list */
	nreg->nlportid = info->snd_portid;
	list_add(&nreg->list, &rdev->beacon_registrations);
9428

9429
	spin_unlock_bh(&rdev->beacon_registrations_lock);
9430 9431

	return 0;
9432 9433 9434 9435
out_err:
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	kfree(nreg);
	return rv;
9436 9437
}

9438 9439 9440 9441 9442 9443 9444 9445 9446 9447 9448 9449 9450 9451 9452
static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	int err;

	if (!rdev->ops->start_p2p_device)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (wdev->p2p_started)
		return 0;

9453 9454
	if (rfkill_blocked(rdev->rfkill))
		return -ERFKILL;
9455

9456
	err = rdev_start_p2p_device(rdev, wdev);
9457 9458 9459 9460 9461 9462 9463 9464 9465 9466 9467 9468 9469 9470 9471 9472 9473 9474 9475 9476
	if (err)
		return err;

	wdev->p2p_started = true;
	rdev->opencount++;

	return 0;
}

static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (!rdev->ops->stop_p2p_device)
		return -EOPNOTSUPP;

9477
	cfg80211_stop_p2p_device(rdev, wdev);
9478 9479 9480 9481

	return 0;
}

9482 9483 9484 9485 9486 9487 9488 9489 9490 9491 9492 9493 9494 9495 9496 9497 9498 9499 9500 9501 9502 9503 9504 9505 9506 9507 9508
static int nl80211_get_protocol_features(struct sk_buff *skb,
					 struct genl_info *info)
{
	void *hdr;
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_PROTOCOL_FEATURES);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

 nla_put_failure:
	kfree_skb(msg);
	return -ENOBUFS;
}

9509 9510 9511 9512 9513 9514 9515 9516 9517 9518 9519 9520 9521 9522 9523 9524 9525 9526 9527 9528 9529
static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct cfg80211_update_ft_ies_params ft_params;
	struct net_device *dev = info->user_ptr[1];

	if (!rdev->ops->update_ft_ies)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MDID] ||
	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	memset(&ft_params, 0, sizeof(ft_params));
	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);

	return rdev_update_ft_ies(rdev, dev, &ft_params);
}

9530 9531 9532 9533 9534 9535 9536 9537 9538 9539 9540 9541 9542 9543 9544 9545 9546 9547 9548 9549 9550 9551 9552 9553 9554 9555 9556 9557 9558 9559 9560 9561 9562 9563 9564 9565 9566 9567 9568 9569 9570 9571 9572 9573 9574 9575 9576 9577 9578 9579 9580 9581 9582 9583 9584 9585 9586 9587
static int nl80211_crit_protocol_start(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
	u16 duration;
	int ret;

	if (!rdev->ops->crit_proto_start)
		return -EOPNOTSUPP;

	if (WARN_ON(!rdev->ops->crit_proto_stop))
		return -EINVAL;

	if (rdev->crit_proto_nlportid)
		return -EBUSY;

	/* determine protocol if provided */
	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);

	if (proto >= NUM_NL80211_CRIT_PROTO)
		return -EINVAL;

	/* timeout must be provided */
	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
		return -EINVAL;

	duration =
		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);

	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
		return -ERANGE;

	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
	if (!ret)
		rdev->crit_proto_nlportid = info->snd_portid;

	return ret;
}

static int nl80211_crit_protocol_stop(struct sk_buff *skb,
				      struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (!rdev->ops->crit_proto_stop)
		return -EOPNOTSUPP;

	if (rdev->crit_proto_nlportid) {
		rdev->crit_proto_nlportid = 0;
		rdev_crit_proto_stop(rdev, wdev);
	}
	return 0;
}

9588 9589 9590 9591 9592 9593 9594 9595 9596 9597 9598 9599 9600 9601 9602 9603 9604 9605 9606 9607 9608 9609 9610 9611 9612 9613 9614 9615 9616 9617 9618 9619 9620 9621 9622 9623 9624 9625 9626 9627 9628 9629 9630 9631 9632 9633 9634 9635 9636 9637 9638 9639 9640 9641 9642 9643 9644 9645 9646 9647 9648 9649 9650 9651 9652 9653 9654 9655 9656 9657 9658 9659 9660 9661 9662
static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev =
		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
	int i, err;
	u32 vid, subcmd;

	if (!rdev->wiphy.vendor_commands)
		return -EOPNOTSUPP;

	if (IS_ERR(wdev)) {
		err = PTR_ERR(wdev);
		if (err != -EINVAL)
			return err;
		wdev = NULL;
	} else if (wdev->wiphy != &rdev->wiphy) {
		return -EINVAL;
	}

	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
		return -EINVAL;

	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
		const struct wiphy_vendor_command *vcmd;
		void *data = NULL;
		int len = 0;

		vcmd = &rdev->wiphy.vendor_commands[i];

		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
			continue;

		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
			if (!wdev)
				return -EINVAL;
			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
			    !wdev->netdev)
				return -EINVAL;

			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
				if (wdev->netdev &&
				    !netif_running(wdev->netdev))
					return -ENETDOWN;
				if (!wdev->netdev && !wdev->p2p_started)
					return -ENETDOWN;
			}
		} else {
			wdev = NULL;
		}

		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
		}

		rdev->cur_cmd_info = info;
		err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
							  data, len);
		rdev->cur_cmd_info = NULL;
		return err;
	}

	return -EOPNOTSUPP;
}

struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
					   enum nl80211_commands cmd,
					   enum nl80211_attrs attr,
					   int approxlen)
{
9663
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9664 9665 9666 9667 9668 9669 9670

	if (WARN_ON(!rdev->cur_cmd_info))
		return NULL;

	return __cfg80211_alloc_vendor_skb(rdev, approxlen,
					   rdev->cur_cmd_info->snd_portid,
					   rdev->cur_cmd_info->snd_seq,
9671
					   cmd, attr, NULL, GFP_KERNEL);
9672 9673 9674 9675 9676 9677 9678 9679 9680
}
EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);

int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
{
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];

9681 9682 9683
	/* clear CB data for netlink core to own from now on */
	memset(skb->cb, 0, sizeof(skb->cb));

9684 9685 9686 9687 9688 9689 9690 9691 9692 9693 9694 9695
	if (WARN_ON(!rdev->cur_cmd_info)) {
		kfree_skb(skb);
		return -EINVAL;
	}

	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);
	return genlmsg_reply(skb, rdev->cur_cmd_info);
}
EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);


9696 9697 9698 9699 9700 9701 9702 9703 9704 9705 9706 9707 9708 9709 9710 9711 9712 9713 9714 9715 9716 9717 9718 9719 9720 9721 9722 9723 9724 9725 9726 9727 9728 9729 9730 9731 9732 9733 9734 9735 9736 9737 9738 9739 9740 9741 9742 9743 9744 9745 9746
static int nl80211_set_qos_map(struct sk_buff *skb,
			       struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct cfg80211_qos_map *qos_map = NULL;
	struct net_device *dev = info->user_ptr[1];
	u8 *pos, len, num_des, des_len, des;
	int ret;

	if (!rdev->ops->set_qos_map)
		return -EOPNOTSUPP;

	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);

		if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
		    len > IEEE80211_QOS_MAP_LEN_MAX)
			return -EINVAL;

		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
		if (!qos_map)
			return -ENOMEM;

		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
		if (num_des) {
			des_len = num_des *
				sizeof(struct cfg80211_dscp_exception);
			memcpy(qos_map->dscp_exception, pos, des_len);
			qos_map->num_des = num_des;
			for (des = 0; des < num_des; des++) {
				if (qos_map->dscp_exception[des].up > 7) {
					kfree(qos_map);
					return -EINVAL;
				}
			}
			pos += des_len;
		}
		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
	}

	wdev_lock(dev->ieee80211_ptr);
	ret = nl80211_key_allowed(dev->ieee80211_ptr);
	if (!ret)
		ret = rdev_set_qos_map(rdev, dev, qos_map);
	wdev_unlock(dev->ieee80211_ptr);

	kfree(qos_map);
	return ret;
}

9747 9748 9749 9750 9751 9752 9753 9754 9755 9756
static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	const u8 *peer;
	u8 tsid, up;
	u16 admitted_time = 0;
	int err;

9757
	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
9758 9759 9760 9761 9762 9763 9764 9765 9766 9767 9768 9769 9770 9771 9772
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
	    !info->attrs[NL80211_ATTR_USER_PRIO])
		return -EINVAL;

	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
	if (tsid >= IEEE80211_NUM_TIDS)
		return -EINVAL;

	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
	if (up >= IEEE80211_NUM_UPS)
		return -EINVAL;

	/* WMM uses TIDs 0-7 even for TSPEC */
9773
	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
9774
		/* TODO: handle 802.11 TSPEC/admission control
9775 9776
		 * need more attributes for that (e.g. BA session requirement);
		 * change the WMM adminssion test above to allow both then
9777 9778 9779 9780 9781 9782 9783 9784 9785 9786 9787 9788 9789 9790 9791 9792 9793 9794 9795 9796 9797 9798 9799 9800 9801 9802 9803 9804 9805 9806 9807 9808 9809 9810 9811 9812 9813 9814 9815 9816 9817 9818 9819 9820 9821 9822 9823 9824 9825 9826 9827 9828 9829 9830 9831
		 */
		return -EINVAL;
	}

	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);

	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
		admitted_time =
			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
		if (!admitted_time)
			return -EINVAL;
	}

	wdev_lock(wdev);
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_P2P_CLIENT:
		if (wdev->current_bss)
			break;
		err = -ENOTCONN;
		goto out;
	default:
		err = -EOPNOTSUPP;
		goto out;
	}

	err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);

 out:
	wdev_unlock(wdev);
	return err;
}

static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	const u8 *peer;
	u8 tsid;
	int err;

	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);

	wdev_lock(wdev);
	err = rdev_del_tx_ts(rdev, dev, tsid, peer);
	wdev_unlock(wdev);

	return err;
}

9832 9833 9834 9835 9836 9837 9838 9839 9840 9841 9842 9843 9844 9845 9846 9847 9848 9849 9850 9851 9852 9853 9854 9855 9856 9857 9858 9859 9860 9861 9862 9863 9864 9865 9866 9867 9868 9869 9870 9871 9872 9873 9874 9875 9876 9877 9878 9879 9880 9881 9882 9883 9884 9885 9886 9887 9888 9889 9890 9891 9892 9893 9894 9895 9896 9897 9898 9899 9900 9901 9902 9903 9904 9905 9906 9907 9908 9909 9910 9911 9912 9913 9914 9915 9916 9917 9918 9919 9920 9921 9922 9923
static int nl80211_tdls_channel_switch(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_chan_def chandef = {};
	const u8 *addr;
	u8 oper_class;
	int err;

	if (!rdev->ops->tdls_channel_switch ||
	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
		return -EOPNOTSUPP;

	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_P2P_CLIENT:
		break;
	default:
		return -EOPNOTSUPP;
	}

	if (!info->attrs[NL80211_ATTR_MAC] ||
	    !info->attrs[NL80211_ATTR_OPER_CLASS])
		return -EINVAL;

	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;

	/*
	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
	 * specification is not defined for them.
	 */
	if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
	    chandef.width != NL80211_CHAN_WIDTH_20)
		return -EINVAL;

	/* we will be active on the TDLS link */
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
		return -EINVAL;

	/* don't allow switching to DFS channels */
	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
		return -EINVAL;

	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);

	wdev_lock(wdev);
	err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
	wdev_unlock(wdev);

	return err;
}

static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
					      struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	const u8 *addr;

	if (!rdev->ops->tdls_channel_switch ||
	    !rdev->ops->tdls_cancel_channel_switch ||
	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
		return -EOPNOTSUPP;

	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_P2P_CLIENT:
		break;
	default:
		return -EOPNOTSUPP;
	}

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

	wdev_lock(wdev);
	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
	wdev_unlock(wdev);

	return 0;
}

9924 9925 9926
#define NL80211_FLAG_NEED_WIPHY		0x01
#define NL80211_FLAG_NEED_NETDEV	0x02
#define NL80211_FLAG_NEED_RTNL		0x04
9927 9928 9929
#define NL80211_FLAG_CHECK_NETDEV_UP	0x08
#define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
9930
#define NL80211_FLAG_NEED_WDEV		0x10
9931
/* If a netdev is associated, it must be UP, P2P must be started */
9932 9933
#define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
9934
#define NL80211_FLAG_CLEAR_SKB		0x20
9935

9936
static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9937 9938 9939
			    struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
9940
	struct wireless_dev *wdev;
9941 9942 9943 9944 9945 9946 9947
	struct net_device *dev;
	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;

	if (rtnl)
		rtnl_lock();

	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9948
		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9949 9950 9951 9952 9953 9954
		if (IS_ERR(rdev)) {
			if (rtnl)
				rtnl_unlock();
			return PTR_ERR(rdev);
		}
		info->user_ptr[0] = rdev;
9955 9956
	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9957 9958
		ASSERT_RTNL();

9959 9960 9961
		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
						  info->attrs);
		if (IS_ERR(wdev)) {
9962 9963
			if (rtnl)
				rtnl_unlock();
9964
			return PTR_ERR(wdev);
9965
		}
9966 9967

		dev = wdev->netdev;
9968
		rdev = wiphy_to_rdev(wdev->wiphy);
9969

9970 9971 9972 9973 9974 9975 9976 9977 9978 9979
		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
			if (!dev) {
				if (rtnl)
					rtnl_unlock();
				return -EINVAL;
			}

			info->user_ptr[1] = dev;
		} else {
			info->user_ptr[1] = wdev;
9980
		}
9981 9982 9983 9984 9985 9986 9987 9988 9989 9990

		if (dev) {
			if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
			    !netif_running(dev)) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}

			dev_hold(dev);
9991 9992 9993 9994 9995 9996
		} else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
			if (!wdev->p2p_started) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}
9997
		}
9998

9999 10000 10001 10002 10003 10004
		info->user_ptr[0] = rdev;
	}

	return 0;
}

10005
static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10006 10007
			      struct genl_info *info)
{
10008 10009 10010 10011 10012 10013 10014 10015 10016 10017
	if (info->user_ptr[1]) {
		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
			struct wireless_dev *wdev = info->user_ptr[1];

			if (wdev->netdev)
				dev_put(wdev->netdev);
		} else {
			dev_put(info->user_ptr[1]);
		}
	}
10018

10019 10020
	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
		rtnl_unlock();
10021 10022 10023 10024 10025 10026 10027 10028 10029 10030 10031

	/* If needed, clear the netlink message payload from the SKB
	 * as it might contain key data that shouldn't stick around on
	 * the heap after the SKB is freed. The netlink message header
	 * is still needed for further processing, so leave it intact.
	 */
	if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
		struct nlmsghdr *nlh = nlmsg_hdr(skb);

		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
	}
10032 10033
}

10034
static const struct genl_ops nl80211_ops[] = {
10035 10036 10037 10038
	{
		.cmd = NL80211_CMD_GET_WIPHY,
		.doit = nl80211_get_wiphy,
		.dumpit = nl80211_dump_wiphy,
10039
		.done = nl80211_dump_wiphy_done,
10040 10041
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
10042 10043
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
10044 10045 10046 10047 10048 10049
	},
	{
		.cmd = NL80211_CMD_SET_WIPHY,
		.doit = nl80211_set_wiphy,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10050
		.internal_flags = NL80211_FLAG_NEED_RTNL,
10051 10052 10053 10054 10055 10056 10057
	},
	{
		.cmd = NL80211_CMD_GET_INTERFACE,
		.doit = nl80211_get_interface,
		.dumpit = nl80211_dump_interface,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
10058 10059
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
10060 10061 10062 10063 10064 10065
	},
	{
		.cmd = NL80211_CMD_SET_INTERFACE,
		.doit = nl80211_set_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10066 10067
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10068 10069 10070 10071 10072 10073
	},
	{
		.cmd = NL80211_CMD_NEW_INTERFACE,
		.doit = nl80211_new_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10074 10075
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
10076 10077 10078 10079 10080
	},
	{
		.cmd = NL80211_CMD_DEL_INTERFACE,
		.doit = nl80211_del_interface,
		.policy = nl80211_policy,
10081
		.flags = GENL_ADMIN_PERM,
10082
		.internal_flags = NL80211_FLAG_NEED_WDEV |
10083
				  NL80211_FLAG_NEED_RTNL,
10084 10085 10086 10087 10088 10089
	},
	{
		.cmd = NL80211_CMD_GET_KEY,
		.doit = nl80211_get_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10090
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10091
				  NL80211_FLAG_NEED_RTNL,
10092 10093 10094 10095 10096 10097
	},
	{
		.cmd = NL80211_CMD_SET_KEY,
		.doit = nl80211_set_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10098
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10099 10100
				  NL80211_FLAG_NEED_RTNL |
				  NL80211_FLAG_CLEAR_SKB,
10101 10102 10103 10104 10105 10106
	},
	{
		.cmd = NL80211_CMD_NEW_KEY,
		.doit = nl80211_new_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10107
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10108 10109
				  NL80211_FLAG_NEED_RTNL |
				  NL80211_FLAG_CLEAR_SKB,
10110 10111 10112 10113 10114
	},
	{
		.cmd = NL80211_CMD_DEL_KEY,
		.doit = nl80211_del_key,
		.policy = nl80211_policy,
10115
		.flags = GENL_ADMIN_PERM,
10116
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10117
				  NL80211_FLAG_NEED_RTNL,
10118
	},
10119 10120 10121 10122
	{
		.cmd = NL80211_CMD_SET_BEACON,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10123
		.doit = nl80211_set_beacon,
10124
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10125
				  NL80211_FLAG_NEED_RTNL,
10126 10127
	},
	{
10128
		.cmd = NL80211_CMD_START_AP,
10129 10130
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10131
		.doit = nl80211_start_ap,
10132
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10133
				  NL80211_FLAG_NEED_RTNL,
10134 10135
	},
	{
10136
		.cmd = NL80211_CMD_STOP_AP,
10137 10138
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10139
		.doit = nl80211_stop_ap,
10140
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10141
				  NL80211_FLAG_NEED_RTNL,
10142
	},
10143 10144 10145
	{
		.cmd = NL80211_CMD_GET_STATION,
		.doit = nl80211_get_station,
10146
		.dumpit = nl80211_dump_station,
10147
		.policy = nl80211_policy,
10148 10149
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10150 10151 10152 10153 10154 10155
	},
	{
		.cmd = NL80211_CMD_SET_STATION,
		.doit = nl80211_set_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10156
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10157
				  NL80211_FLAG_NEED_RTNL,
10158 10159 10160 10161 10162 10163
	},
	{
		.cmd = NL80211_CMD_NEW_STATION,
		.doit = nl80211_new_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10164
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10165
				  NL80211_FLAG_NEED_RTNL,
10166 10167 10168 10169 10170
	},
	{
		.cmd = NL80211_CMD_DEL_STATION,
		.doit = nl80211_del_station,
		.policy = nl80211_policy,
10171
		.flags = GENL_ADMIN_PERM,
10172
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10173
				  NL80211_FLAG_NEED_RTNL,
10174 10175 10176 10177 10178 10179 10180
	},
	{
		.cmd = NL80211_CMD_GET_MPATH,
		.doit = nl80211_get_mpath,
		.dumpit = nl80211_dump_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10181
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10182
				  NL80211_FLAG_NEED_RTNL,
10183
	},
10184 10185 10186 10187 10188 10189 10190 10191 10192
	{
		.cmd = NL80211_CMD_GET_MPP,
		.doit = nl80211_get_mpp,
		.dumpit = nl80211_dump_mpp,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10193 10194 10195 10196 10197
	{
		.cmd = NL80211_CMD_SET_MPATH,
		.doit = nl80211_set_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10198
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10199
				  NL80211_FLAG_NEED_RTNL,
10200 10201 10202 10203 10204 10205
	},
	{
		.cmd = NL80211_CMD_NEW_MPATH,
		.doit = nl80211_new_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10206
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10207
				  NL80211_FLAG_NEED_RTNL,
10208 10209 10210 10211 10212
	},
	{
		.cmd = NL80211_CMD_DEL_MPATH,
		.doit = nl80211_del_mpath,
		.policy = nl80211_policy,
10213
		.flags = GENL_ADMIN_PERM,
10214
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10215
				  NL80211_FLAG_NEED_RTNL,
10216 10217 10218 10219 10220
	},
	{
		.cmd = NL80211_CMD_SET_BSS,
		.doit = nl80211_set_bss,
		.policy = nl80211_policy,
10221
		.flags = GENL_ADMIN_PERM,
10222
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10223
				  NL80211_FLAG_NEED_RTNL,
10224
	},
10225 10226 10227 10228
	{
		.cmd = NL80211_CMD_GET_REG,
		.doit = nl80211_get_reg,
		.policy = nl80211_policy,
10229
		.internal_flags = NL80211_FLAG_NEED_RTNL,
10230 10231
		/* can be retrieved by unprivileged users */
	},
10232 10233 10234 10235 10236
	{
		.cmd = NL80211_CMD_SET_REG,
		.doit = nl80211_set_reg,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10237
		.internal_flags = NL80211_FLAG_NEED_RTNL,
10238 10239 10240 10241 10242
	},
	{
		.cmd = NL80211_CMD_REQ_SET_REG,
		.doit = nl80211_req_set_reg,
		.policy = nl80211_policy,
10243 10244 10245
		.flags = GENL_ADMIN_PERM,
	},
	{
10246 10247
		.cmd = NL80211_CMD_GET_MESH_CONFIG,
		.doit = nl80211_get_mesh_config,
10248 10249
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
10250
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10251
				  NL80211_FLAG_NEED_RTNL,
10252 10253
	},
	{
10254 10255
		.cmd = NL80211_CMD_SET_MESH_CONFIG,
		.doit = nl80211_update_mesh_config,
10256
		.policy = nl80211_policy,
10257
		.flags = GENL_ADMIN_PERM,
10258
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10259
				  NL80211_FLAG_NEED_RTNL,
10260
	},
10261 10262 10263 10264 10265
	{
		.cmd = NL80211_CMD_TRIGGER_SCAN,
		.doit = nl80211_trigger_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10266
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10267
				  NL80211_FLAG_NEED_RTNL,
10268 10269 10270 10271 10272 10273
	},
	{
		.cmd = NL80211_CMD_GET_SCAN,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_scan,
	},
10274 10275 10276 10277 10278 10279 10280 10281 10282 10283 10284 10285 10286 10287 10288 10289
	{
		.cmd = NL80211_CMD_START_SCHED_SCAN,
		.doit = nl80211_start_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
		.doit = nl80211_stop_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10290 10291 10292 10293 10294
	{
		.cmd = NL80211_CMD_AUTHENTICATE,
		.doit = nl80211_authenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10295
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10296 10297
				  NL80211_FLAG_NEED_RTNL |
				  NL80211_FLAG_CLEAR_SKB,
10298 10299 10300 10301 10302 10303
	},
	{
		.cmd = NL80211_CMD_ASSOCIATE,
		.doit = nl80211_associate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10304
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10305
				  NL80211_FLAG_NEED_RTNL,
10306 10307 10308 10309 10310 10311
	},
	{
		.cmd = NL80211_CMD_DEAUTHENTICATE,
		.doit = nl80211_deauthenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10312
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10313
				  NL80211_FLAG_NEED_RTNL,
10314 10315 10316 10317 10318 10319
	},
	{
		.cmd = NL80211_CMD_DISASSOCIATE,
		.doit = nl80211_disassociate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10320
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10321
				  NL80211_FLAG_NEED_RTNL,
10322
	},
10323 10324 10325 10326 10327
	{
		.cmd = NL80211_CMD_JOIN_IBSS,
		.doit = nl80211_join_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10328
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10329
				  NL80211_FLAG_NEED_RTNL,
10330 10331 10332 10333 10334 10335
	},
	{
		.cmd = NL80211_CMD_LEAVE_IBSS,
		.doit = nl80211_leave_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10336
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10337
				  NL80211_FLAG_NEED_RTNL,
10338
	},
10339 10340 10341 10342
#ifdef CONFIG_NL80211_TESTMODE
	{
		.cmd = NL80211_CMD_TESTMODE,
		.doit = nl80211_testmode_do,
10343
		.dumpit = nl80211_testmode_dump,
10344 10345
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10346 10347
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
10348 10349
	},
#endif
10350 10351 10352 10353 10354
	{
		.cmd = NL80211_CMD_CONNECT,
		.doit = nl80211_connect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10355
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10356
				  NL80211_FLAG_NEED_RTNL,
10357 10358 10359 10360 10361 10362
	},
	{
		.cmd = NL80211_CMD_DISCONNECT,
		.doit = nl80211_disconnect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10363
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10364
				  NL80211_FLAG_NEED_RTNL,
10365
	},
10366 10367 10368 10369 10370
	{
		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
		.doit = nl80211_wiphy_netns,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10371 10372
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
10373
	},
10374 10375 10376 10377 10378
	{
		.cmd = NL80211_CMD_GET_SURVEY,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_survey,
	},
10379 10380 10381 10382 10383
	{
		.cmd = NL80211_CMD_SET_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10384
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10385
				  NL80211_FLAG_NEED_RTNL,
10386 10387 10388 10389 10390 10391
	},
	{
		.cmd = NL80211_CMD_DEL_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10392
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10393
				  NL80211_FLAG_NEED_RTNL,
10394 10395 10396 10397 10398 10399
	},
	{
		.cmd = NL80211_CMD_FLUSH_PMKSA,
		.doit = nl80211_flush_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10400
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10401
				  NL80211_FLAG_NEED_RTNL,
10402
	},
10403 10404 10405 10406 10407
	{
		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
		.doit = nl80211_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10408
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10409
				  NL80211_FLAG_NEED_RTNL,
10410 10411 10412 10413 10414 10415
	},
	{
		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
		.doit = nl80211_cancel_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10416
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10417
				  NL80211_FLAG_NEED_RTNL,
10418
	},
10419 10420 10421 10422 10423
	{
		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
		.doit = nl80211_set_tx_bitrate_mask,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10424 10425
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10426
	},
10427
	{
10428 10429
		.cmd = NL80211_CMD_REGISTER_FRAME,
		.doit = nl80211_register_mgmt,
10430 10431
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10432
		.internal_flags = NL80211_FLAG_NEED_WDEV |
10433
				  NL80211_FLAG_NEED_RTNL,
10434 10435
	},
	{
10436 10437
		.cmd = NL80211_CMD_FRAME,
		.doit = nl80211_tx_mgmt,
10438
		.policy = nl80211_policy,
10439
		.flags = GENL_ADMIN_PERM,
10440
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10441 10442 10443 10444 10445 10446
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
		.doit = nl80211_tx_mgmt_cancel_wait,
		.policy = nl80211_policy,
10447
		.flags = GENL_ADMIN_PERM,
10448
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10449
				  NL80211_FLAG_NEED_RTNL,
10450
	},
10451 10452 10453 10454 10455
	{
		.cmd = NL80211_CMD_SET_POWER_SAVE,
		.doit = nl80211_set_power_save,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10456 10457
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10458 10459 10460 10461 10462 10463
	},
	{
		.cmd = NL80211_CMD_GET_POWER_SAVE,
		.doit = nl80211_get_power_save,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
10464 10465
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10466
	},
10467 10468 10469 10470 10471
	{
		.cmd = NL80211_CMD_SET_CQM,
		.doit = nl80211_set_cqm,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10472 10473
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10474
	},
10475 10476 10477 10478 10479
	{
		.cmd = NL80211_CMD_SET_CHANNEL,
		.doit = nl80211_set_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10480 10481
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10482
	},
10483 10484 10485 10486 10487
	{
		.cmd = NL80211_CMD_SET_WDS_PEER,
		.doit = nl80211_set_wds_peer,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10488 10489
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
10490
	},
10491 10492 10493 10494 10495 10496 10497 10498 10499 10500 10501 10502 10503 10504 10505 10506
	{
		.cmd = NL80211_CMD_JOIN_MESH,
		.doit = nl80211_join_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_LEAVE_MESH,
		.doit = nl80211_leave_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10507 10508 10509 10510 10511 10512 10513 10514 10515 10516 10517 10518 10519 10520 10521 10522
	{
		.cmd = NL80211_CMD_JOIN_OCB,
		.doit = nl80211_join_ocb,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_LEAVE_OCB,
		.doit = nl80211_leave_ocb,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10523
#ifdef CONFIG_PM
10524 10525 10526 10527 10528 10529 10530 10531 10532 10533 10534 10535 10536 10537 10538 10539
	{
		.cmd = NL80211_CMD_GET_WOWLAN,
		.doit = nl80211_get_wowlan,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_WOWLAN,
		.doit = nl80211_set_wowlan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
10540
#endif
10541 10542 10543 10544 10545 10546
	{
		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
		.doit = nl80211_set_rekey_data,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10547 10548
				  NL80211_FLAG_NEED_RTNL |
				  NL80211_FLAG_CLEAR_SKB,
10549
	},
10550 10551 10552 10553 10554 10555 10556 10557 10558 10559 10560 10561 10562 10563 10564 10565
	{
		.cmd = NL80211_CMD_TDLS_MGMT,
		.doit = nl80211_tdls_mgmt,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_TDLS_OPER,
		.doit = nl80211_tdls_oper,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10566 10567 10568 10569 10570 10571 10572 10573
	{
		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
		.doit = nl80211_register_unexpected_frame,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
10574 10575 10576 10577 10578
	{
		.cmd = NL80211_CMD_PROBE_CLIENT,
		.doit = nl80211_probe_client,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
10579
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10580 10581
				  NL80211_FLAG_NEED_RTNL,
	},
10582 10583 10584 10585 10586 10587 10588 10589
	{
		.cmd = NL80211_CMD_REGISTER_BEACONS,
		.doit = nl80211_register_beacons,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
10590 10591 10592 10593 10594 10595 10596 10597
	{
		.cmd = NL80211_CMD_SET_NOACK_MAP,
		.doit = nl80211_set_noack_map,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
10598 10599 10600 10601 10602 10603 10604 10605 10606 10607 10608 10609 10610 10611 10612 10613
	{
		.cmd = NL80211_CMD_START_P2P_DEVICE,
		.doit = nl80211_start_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
		.doit = nl80211_stop_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10614 10615 10616
	{
		.cmd = NL80211_CMD_SET_MCAST_RATE,
		.doit = nl80211_set_mcast_rate,
10617 10618 10619 10620 10621 10622 10623 10624
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_MAC_ACL,
		.doit = nl80211_set_mac_acl,
10625 10626 10627 10628 10629
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
10630 10631 10632 10633 10634 10635 10636 10637
	{
		.cmd = NL80211_CMD_RADAR_DETECT,
		.doit = nl80211_start_radar_detection,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10638 10639 10640 10641 10642
	{
		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
		.doit = nl80211_get_protocol_features,
		.policy = nl80211_policy,
	},
10643 10644 10645 10646 10647 10648 10649 10650
	{
		.cmd = NL80211_CMD_UPDATE_FT_IES,
		.doit = nl80211_update_ft_ies,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10651 10652 10653 10654 10655 10656 10657 10658 10659 10660 10661 10662 10663 10664 10665
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
		.doit = nl80211_crit_protocol_start,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
		.doit = nl80211_crit_protocol_stop,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
10666 10667 10668 10669 10670 10671 10672 10673 10674 10675 10676 10677 10678 10679 10680
	},
	{
		.cmd = NL80211_CMD_GET_COALESCE,
		.doit = nl80211_get_coalesce,
		.policy = nl80211_policy,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_COALESCE,
		.doit = nl80211_set_coalesce,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
10681 10682 10683 10684 10685 10686 10687 10688 10689
	},
	{
		.cmd = NL80211_CMD_CHANNEL_SWITCH,
		.doit = nl80211_channel_switch,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10690 10691 10692 10693 10694 10695 10696 10697
	{
		.cmd = NL80211_CMD_VENDOR,
		.doit = nl80211_vendor_cmd,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
10698 10699 10700 10701 10702 10703 10704 10705
	{
		.cmd = NL80211_CMD_SET_QOS_MAP,
		.doit = nl80211_set_qos_map,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10706 10707 10708 10709 10710 10711 10712 10713 10714 10715 10716 10717 10718 10719 10720 10721
	{
		.cmd = NL80211_CMD_ADD_TX_TS,
		.doit = nl80211_add_tx_ts,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_DEL_TX_TS,
		.doit = nl80211_del_tx_ts,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10722 10723 10724 10725 10726 10727 10728 10729 10730 10731 10732 10733 10734 10735 10736 10737
	{
		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
		.doit = nl80211_tdls_channel_switch,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
		.doit = nl80211_tdls_cancel_channel_switch,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
10738
};
10739

10740 10741
/* notification functions */

10742 10743
void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
			  enum nl80211_commands cmd)
10744 10745
{
	struct sk_buff *msg;
10746
	struct nl80211_dump_wiphy_state state = {};
10747

10748 10749 10750
	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
		cmd != NL80211_CMD_DEL_WIPHY);

10751
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10752 10753 10754
	if (!msg)
		return;

10755
	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10756 10757 10758 10759
		nlmsg_free(msg);
		return;
	}

10760
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10761
				NL80211_MCGRP_CONFIG, GFP_KERNEL);
10762 10763
}

10764 10765 10766 10767 10768 10769 10770 10771 10772 10773 10774 10775 10776
static int nl80211_add_scan_req(struct sk_buff *msg,
				struct cfg80211_registered_device *rdev)
{
	struct cfg80211_scan_request *req = rdev->scan_req;
	struct nlattr *nest;
	int i;

	if (WARN_ON(!req))
		return 0;

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
	if (!nest)
		goto nla_put_failure;
10777 10778 10779 10780
	for (i = 0; i < req->n_ssids; i++) {
		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
			goto nla_put_failure;
	}
10781 10782 10783 10784 10785
	nla_nest_end(msg, nest);

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
	if (!nest)
		goto nla_put_failure;
10786 10787 10788 10789
	for (i = 0; i < req->n_channels; i++) {
		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
			goto nla_put_failure;
	}
10790 10791
	nla_nest_end(msg, nest);

10792 10793 10794
	if (req->ie &&
	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
		goto nla_put_failure;
10795

10796 10797 10798
	if (req->flags &&
	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
		goto nla_put_failure;
10799

10800 10801 10802 10803 10804
	return 0;
 nla_put_failure:
	return -ENOBUFS;
}

10805 10806
static int nl80211_send_scan_msg(struct sk_buff *msg,
				 struct cfg80211_registered_device *rdev,
10807
				 struct wireless_dev *wdev,
10808
				 u32 portid, u32 seq, int flags,
10809
				 u32 cmd)
10810 10811 10812
{
	void *hdr;

10813
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10814 10815 10816
	if (!hdr)
		return -1;

10817
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10818 10819 10820
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10821
		goto nla_put_failure;
10822

10823 10824
	/* ignore errors and send incomplete event anyway */
	nl80211_add_scan_req(msg, rdev);
10825 10826 10827 10828 10829 10830 10831 10832

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

10833 10834 10835 10836
static int
nl80211_send_sched_scan_msg(struct sk_buff *msg,
			    struct cfg80211_registered_device *rdev,
			    struct net_device *netdev,
10837
			    u32 portid, u32 seq, int flags, u32 cmd)
10838 10839 10840
{
	void *hdr;

10841
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10842 10843 10844
	if (!hdr)
		return -1;

10845 10846 10847
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
10848 10849 10850 10851 10852 10853 10854 10855

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

10856
void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10857
			     struct wireless_dev *wdev)
10858 10859 10860
{
	struct sk_buff *msg;

10861
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10862 10863 10864
	if (!msg)
		return;

10865
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10866 10867 10868 10869 10870
				  NL80211_CMD_TRIGGER_SCAN) < 0) {
		nlmsg_free(msg);
		return;
	}

10871
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10872
				NL80211_MCGRP_SCAN, GFP_KERNEL);
10873 10874
}

10875 10876
struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
				       struct wireless_dev *wdev, bool aborted)
10877 10878 10879
{
	struct sk_buff *msg;

10880
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10881
	if (!msg)
10882
		return NULL;
10883

10884
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10885 10886
				  aborted ? NL80211_CMD_SCAN_ABORTED :
					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10887
		nlmsg_free(msg);
10888
		return NULL;
10889 10890
	}

10891
	return msg;
10892 10893
}

10894 10895
void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
			      struct sk_buff *msg)
10896 10897 10898 10899
{
	if (!msg)
		return;

10900
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10901
				NL80211_MCGRP_SCAN, GFP_KERNEL);
10902 10903
}

10904 10905 10906 10907 10908 10909 10910 10911 10912 10913 10914 10915 10916 10917 10918
void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev)
{
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
					NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
		nlmsg_free(msg);
		return;
	}

10919
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10920
				NL80211_MCGRP_SCAN, GFP_KERNEL);
10921 10922 10923 10924 10925 10926 10927
}

void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, u32 cmd)
{
	struct sk_buff *msg;

10928
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10929 10930 10931 10932 10933 10934 10935 10936
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
		nlmsg_free(msg);
		return;
	}

10937
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10938
				NL80211_MCGRP_SCAN, GFP_KERNEL);
10939 10940
}

10941 10942 10943 10944 10945 10946 10947 10948 10949
/*
 * This can happen on global regulatory changes or device specific settings
 * based on custom world regulatory domains.
 */
void nl80211_send_reg_change_event(struct regulatory_request *request)
{
	struct sk_buff *msg;
	void *hdr;

10950
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10951 10952 10953 10954 10955 10956 10957 10958 10959 10960
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/* Userspace can always count this one always being set */
10961 10962 10963 10964 10965 10966 10967 10968 10969 10970 10971 10972 10973 10974 10975 10976 10977 10978 10979 10980 10981 10982 10983 10984
	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
		goto nla_put_failure;

	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_WORLD))
			goto nla_put_failure;
	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
			goto nla_put_failure;
	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
		   request->intersect) {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_INTERSECTION))
			goto nla_put_failure;
	} else {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_COUNTRY) ||
		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
				   request->alpha2))
			goto nla_put_failure;
	}

10985
	if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10986 10987
	    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
		goto nla_put_failure;
10988

10989
	genlmsg_end(msg, hdr);
10990

10991
	rcu_read_lock();
10992
	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10993
				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10994
	rcu_read_unlock();
10995 10996 10997 10998 10999 11000 11001 11002

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11003 11004 11005
static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
				    struct net_device *netdev,
				    const u8 *buf, size_t len,
11006 11007
				    enum nl80211_commands cmd, gfp_t gfp,
				    int uapsd_queues)
11008 11009 11010 11011
{
	struct sk_buff *msg;
	void *hdr;

11012
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11013 11014 11015 11016 11017 11018 11019 11020 11021
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11022 11023 11024 11025
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
		goto nla_put_failure;
11026

11027 11028 11029 11030 11031 11032 11033 11034 11035 11036 11037 11038 11039
	if (uapsd_queues >= 0) {
		struct nlattr *nla_wmm =
			nla_nest_start(msg, NL80211_ATTR_STA_WME);
		if (!nla_wmm)
			goto nla_put_failure;

		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
			       uapsd_queues))
			goto nla_put_failure;

		nla_nest_end(msg, nla_wmm);
	}

11040
	genlmsg_end(msg, hdr);
11041

11042
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11043
				NL80211_MCGRP_MLME, gfp);
11044 11045 11046 11047 11048 11049 11050 11051
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11052 11053
			  struct net_device *netdev, const u8 *buf,
			  size_t len, gfp_t gfp)
11054 11055
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
11056
				NL80211_CMD_AUTHENTICATE, gfp, -1);
11057 11058 11059 11060
}

void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
11061
			   size_t len, gfp_t gfp, int uapsd_queues)
11062
{
11063
	nl80211_send_mlme_event(rdev, netdev, buf, len,
11064
				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11065 11066
}

11067
void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11068 11069
			 struct net_device *netdev, const u8 *buf,
			 size_t len, gfp_t gfp)
11070 11071
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
11072
				NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11073 11074
}

11075 11076
void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
11077
			   size_t len, gfp_t gfp)
11078 11079
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
11080
				NL80211_CMD_DISASSOCIATE, gfp, -1);
11081 11082
}

11083 11084
void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
				  size_t len)
11085
{
11086 11087
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
11088
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11089 11090
	const struct ieee80211_mgmt *mgmt = (void *)buf;
	u32 cmd;
11091

11092 11093
	if (WARN_ON(len < 2))
		return;
11094

11095 11096 11097 11098
	if (ieee80211_is_deauth(mgmt->frame_control))
		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
	else
		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11099

11100
	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11101
	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11102
}
11103
EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11104

11105 11106
static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
				      struct net_device *netdev, int cmd,
11107
				      const u8 *addr, gfp_t gfp)
11108 11109 11110 11111
{
	struct sk_buff *msg;
	void *hdr;

11112
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11113 11114 11115 11116 11117 11118 11119 11120 11121
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11122 11123 11124 11125 11126
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
11127

11128
	genlmsg_end(msg, hdr);
11129

11130
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11131
				NL80211_MCGRP_MLME, gfp);
11132 11133 11134 11135 11136 11137 11138 11139
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11140 11141
			       struct net_device *netdev, const u8 *addr,
			       gfp_t gfp)
11142 11143
{
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11144
				  addr, gfp);
11145 11146 11147
}

void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11148 11149
				struct net_device *netdev, const u8 *addr,
				gfp_t gfp)
11150
{
11151 11152
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
				  addr, gfp);
11153 11154
}

11155 11156 11157 11158 11159 11160 11161 11162 11163
void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *bssid,
				 const u8 *req_ie, size_t req_ie_len,
				 const u8 *resp_ie, size_t resp_ie_len,
				 u16 status, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

11164
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11165 11166 11167 11168 11169 11170 11171 11172 11173
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11174 11175 11176 11177 11178 11179 11180 11181 11182
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
11183

11184
	genlmsg_end(msg, hdr);
11185

11186
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11187
				NL80211_MCGRP_MLME, gfp);
11188 11189 11190 11191 11192 11193 11194 11195 11196 11197 11198 11199 11200 11201 11202 11203
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
			 struct net_device *netdev, const u8 *bssid,
			 const u8 *req_ie, size_t req_ie_len,
			 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

11204
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11205 11206 11207 11208 11209 11210 11211 11212 11213
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11214 11215 11216 11217 11218 11219 11220 11221
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
11222

11223
	genlmsg_end(msg, hdr);
11224

11225
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11226
				NL80211_MCGRP_MLME, gfp);
11227 11228 11229 11230 11231 11232 11233 11234 11235 11236
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, u16 reason,
Johannes Berg's avatar
Johannes Berg committed
11237
			       const u8 *ie, size_t ie_len, bool from_ap)
11238 11239 11240 11241
{
	struct sk_buff *msg;
	void *hdr;

11242
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11243 11244 11245 11246 11247 11248 11249 11250 11251
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11252 11253 11254 11255 11256 11257 11258 11259
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (from_ap && reason &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
	    (from_ap &&
	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
		goto nla_put_failure;
11260

11261
	genlmsg_end(msg, hdr);
11262

11263
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11264
				NL80211_MCGRP_MLME, GFP_KERNEL);
11265 11266 11267 11268 11269 11270 11271 11272
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

11273 11274 11275 11276 11277 11278 11279
void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, const u8 *bssid,
			     gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

11280
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11281 11282 11283 11284 11285 11286 11287 11288 11289
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11290 11291 11292 11293
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
11294

11295
	genlmsg_end(msg, hdr);
11296

11297
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11298
				NL80211_MCGRP_MLME, gfp);
11299 11300 11301 11302 11303 11304 11305
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11306 11307
void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
					const u8* ie, u8 ie_len, gfp_t gfp)
11308
{
11309
	struct wireless_dev *wdev = dev->ieee80211_ptr;
11310
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11311 11312 11313
	struct sk_buff *msg;
	void *hdr;

11314 11315 11316 11317 11318
	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
		return;

	trace_cfg80211_notify_new_peer_candidate(dev, addr);

11319 11320 11321 11322 11323 11324 11325 11326 11327 11328
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11329
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11330 11331
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11332 11333 11334
	    (ie_len && ie &&
	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
		goto nla_put_failure;
11335

11336
	genlmsg_end(msg, hdr);
11337

11338
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11339
				NL80211_MCGRP_MLME, gfp);
11340 11341 11342 11343 11344 11345
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
11346
EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11347

11348 11349 11350
void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *addr,
				 enum nl80211_key_type key_type, int key_id,
11351
				 const u8 *tsc, gfp_t gfp)
11352 11353 11354 11355
{
	struct sk_buff *msg;
	void *hdr;

11356
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11357 11358 11359 11360 11361 11362 11363 11364 11365
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11366 11367 11368 11369 11370 11371 11372 11373
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
	    (key_id != -1 &&
	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
		goto nla_put_failure;
11374

11375
	genlmsg_end(msg, hdr);
11376

11377
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11378
				NL80211_MCGRP_MLME, gfp);
11379 11380 11381 11382 11383 11384 11385
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11386 11387 11388 11389 11390 11391 11392 11393
void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
				    struct ieee80211_channel *channel_before,
				    struct ieee80211_channel *channel_after)
{
	struct sk_buff *msg;
	void *hdr;
	struct nlattr *nl_freq;

11394
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11395 11396 11397 11398 11399 11400 11401 11402 11403 11404 11405 11406 11407
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/*
	 * Since we are applying the beacon hint to a wiphy we know its
	 * wiphy_idx is valid
	 */
11408 11409
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
		goto nla_put_failure;
11410 11411 11412 11413 11414

	/* Before */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
	if (!nl_freq)
		goto nla_put_failure;
11415
	if (nl80211_msg_put_channel(msg, channel_before, false))
11416 11417 11418 11419 11420 11421 11422
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

	/* After */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
	if (!nl_freq)
		goto nla_put_failure;
11423
	if (nl80211_msg_put_channel(msg, channel_after, false))
11424 11425 11426
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

11427
	genlmsg_end(msg, hdr);
11428

11429
	rcu_read_lock();
11430
	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11431
				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11432
	rcu_read_unlock();
11433 11434 11435 11436 11437 11438 11439 11440

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11441 11442
static void nl80211_send_remain_on_chan_event(
	int cmd, struct cfg80211_registered_device *rdev,
11443
	struct wireless_dev *wdev, u64 cookie,
11444 11445 11446 11447 11448 11449 11450 11451 11452 11453 11454 11455 11456 11457 11458 11459
	struct ieee80211_channel *chan,
	unsigned int duration, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11460
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11461 11462
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
11463
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11464
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11465 11466
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
			NL80211_CHAN_NO_HT) ||
11467 11468
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
11469

11470 11471 11472
	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
		goto nla_put_failure;
11473

11474
	genlmsg_end(msg, hdr);
11475

11476
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11477
				NL80211_MCGRP_MLME, gfp);
11478 11479 11480 11481 11482 11483 11484
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11485 11486 11487
void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
			       struct ieee80211_channel *chan,
			       unsigned int duration, gfp_t gfp)
11488
{
11489
	struct wiphy *wiphy = wdev->wiphy;
11490
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11491 11492

	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11493
	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11494
					  rdev, wdev, cookie, chan,
11495
					  duration, gfp);
11496
}
11497
EXPORT_SYMBOL(cfg80211_ready_on_channel);
11498

11499 11500 11501
void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
					struct ieee80211_channel *chan,
					gfp_t gfp)
11502
{
11503
	struct wiphy *wiphy = wdev->wiphy;
11504
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11505 11506

	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11507
	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11508
					  rdev, wdev, cookie, chan, 0, gfp);
11509
}
11510
EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11511

11512 11513
void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
		      struct station_info *sinfo, gfp_t gfp)
11514
{
11515
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11516
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11517 11518
	struct sk_buff *msg;

11519 11520
	trace_cfg80211_new_sta(dev, mac_addr, sinfo);

11521
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11522 11523 11524
	if (!msg)
		return;

11525 11526
	if (nl80211_send_station(msg, 0, 0, 0,
				 rdev, dev, mac_addr, sinfo) < 0) {
11527 11528 11529 11530
		nlmsg_free(msg);
		return;
	}

11531
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11532
				NL80211_MCGRP_MLME, gfp);
11533
}
11534
EXPORT_SYMBOL(cfg80211_new_sta);
11535

11536
void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
11537
{
11538
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11539
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11540 11541 11542
	struct sk_buff *msg;
	void *hdr;

11543 11544
	trace_cfg80211_del_sta(dev, mac_addr);

11545
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11546 11547 11548 11549 11550 11551 11552 11553 11554
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11555 11556 11557
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
11558

11559
	genlmsg_end(msg, hdr);
11560

11561
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11562
				NL80211_MCGRP_MLME, gfp);
11563 11564 11565 11566 11567 11568
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
11569
EXPORT_SYMBOL(cfg80211_del_sta);
11570

11571 11572 11573
void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
			  enum nl80211_connect_failed_reason reason,
			  gfp_t gfp)
11574
{
11575
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11576
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11577 11578 11579 11580 11581 11582 11583 11584 11585 11586 11587 11588 11589 11590 11591 11592 11593 11594 11595 11596
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

11597
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11598
				NL80211_MCGRP_MLME, gfp);
11599 11600 11601 11602 11603 11604
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
11605
EXPORT_SYMBOL(cfg80211_conn_failed);
11606

11607 11608
static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
				       const u8 *addr, gfp_t gfp)
11609 11610
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
11611
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11612 11613
	struct sk_buff *msg;
	void *hdr;
11614
	u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11615

11616
	if (!nlportid)
11617 11618 11619 11620 11621 11622
		return false;

	msg = nlmsg_new(100, gfp);
	if (!msg)
		return true;

11623
	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11624 11625 11626 11627 11628
	if (!hdr) {
		nlmsg_free(msg);
		return true;
	}

11629 11630 11631 11632
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
11633

11634
	genlmsg_end(msg, hdr);
11635
	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11636 11637 11638 11639 11640 11641 11642 11643
	return true;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return true;
}

11644 11645
bool cfg80211_rx_spurious_frame(struct net_device *dev,
				const u8 *addr, gfp_t gfp)
11646
{
11647 11648 11649 11650 11651 11652 11653 11654 11655 11656 11657 11658 11659 11660
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_spurious_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
11661
}
11662
EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11663

11664 11665
bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
					const u8 *addr, gfp_t gfp)
11666
{
11667 11668 11669 11670 11671 11672 11673 11674 11675 11676 11677 11678 11679 11680 11681 11682
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev,
					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
11683
}
11684
EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11685

11686
int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11687
		      struct wireless_dev *wdev, u32 nlportid,
11688
		      int freq, int sig_dbm,
11689
		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11690
{
11691
	struct net_device *netdev = wdev->netdev;
11692 11693 11694 11695 11696 11697 11698
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return -ENOMEM;

11699
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11700 11701 11702 11703 11704
	if (!hdr) {
		nlmsg_free(msg);
		return -ENOMEM;
	}

11705
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11706 11707
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					netdev->ifindex)) ||
11708
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11709 11710 11711
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
	    (sig_dbm &&
	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11712 11713 11714
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    (flags &&
	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11715
		goto nla_put_failure;
11716

11717
	genlmsg_end(msg, hdr);
11718

11719
	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11720 11721 11722 11723 11724 11725 11726

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return -ENOBUFS;
}

11727 11728
void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
11729
{
11730
	struct wiphy *wiphy = wdev->wiphy;
11731
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11732
	struct net_device *netdev = wdev->netdev;
11733 11734 11735
	struct sk_buff *msg;
	void *hdr;

11736 11737
	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);

11738 11739 11740 11741
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

11742
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11743 11744 11745 11746 11747
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11748
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11749 11750
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
				   netdev->ifindex)) ||
11751
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11752 11753 11754 11755
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
11756

11757
	genlmsg_end(msg, hdr);
11758

11759
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11760
				NL80211_MCGRP_MLME, gfp);
11761 11762 11763 11764 11765 11766
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
11767
EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11768

11769 11770
static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
					    const char *mac, gfp_t gfp)
11771
{
11772
	struct wireless_dev *wdev = dev->ieee80211_ptr;
11773 11774 11775
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	void **cb;
11776

11777
	if (!msg)
11778
		return NULL;
11779

11780 11781 11782 11783
	cb = (void **)msg->cb;

	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!cb[0]) {
11784
		nlmsg_free(msg);
11785
		return NULL;
11786 11787
	}

11788
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11789
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11790
		goto nla_put_failure;
11791

11792
	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
11793 11794
		goto nla_put_failure;

11795 11796
	cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!cb[1])
11797
		goto nla_put_failure;
11798

11799
	cb[2] = rdev;
11800

11801 11802 11803 11804 11805 11806 11807 11808 11809 11810 11811 11812 11813 11814 11815
	return msg;
 nla_put_failure:
	nlmsg_free(msg);
	return NULL;
}

static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
{
	void **cb = (void **)msg->cb;
	struct cfg80211_registered_device *rdev = cb[2];

	nla_nest_end(msg, cb[1]);
	genlmsg_end(msg, cb[0]);

	memset(msg->cb, 0, sizeof(msg->cb));
11816

11817
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11818
				NL80211_MCGRP_MLME, gfp);
11819 11820 11821 11822 11823 11824 11825 11826 11827 11828
}

void cfg80211_cqm_rssi_notify(struct net_device *dev,
			      enum nl80211_cqm_rssi_threshold_event rssi_event,
			      gfp_t gfp)
{
	struct sk_buff *msg;

	trace_cfg80211_cqm_rssi_notify(dev, rssi_event);

11829 11830 11831 11832
	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
		return;

11833 11834 11835 11836 11837 11838 11839 11840 11841 11842
	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
	if (!msg)
		return;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
			rssi_event))
		goto nla_put_failure;

	cfg80211_send_cqm(msg, gfp);

11843 11844 11845 11846 11847
	return;

 nla_put_failure:
	nlmsg_free(msg);
}
11848
EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11849

11850 11851 11852 11853 11854 11855 11856 11857 11858 11859 11860 11861 11862 11863 11864 11865 11866 11867 11868 11869 11870 11871 11872 11873 11874 11875 11876 11877 11878 11879 11880 11881 11882 11883 11884 11885 11886 11887 11888 11889 11890 11891 11892 11893 11894 11895 11896 11897 11898
void cfg80211_cqm_txe_notify(struct net_device *dev,
			     const u8 *peer, u32 num_packets,
			     u32 rate, u32 intvl, gfp_t gfp)
{
	struct sk_buff *msg;

	msg = cfg80211_prepare_cqm(dev, peer, gfp);
	if (!msg)
		return;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
		goto nla_put_failure;

	cfg80211_send_cqm(msg, gfp);
	return;

 nla_put_failure:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_cqm_txe_notify);

void cfg80211_cqm_pktloss_notify(struct net_device *dev,
				 const u8 *peer, u32 num_packets, gfp_t gfp)
{
	struct sk_buff *msg;

	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);

	msg = cfg80211_prepare_cqm(dev, peer, gfp);
	if (!msg)
		return;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
		goto nla_put_failure;

	cfg80211_send_cqm(msg, gfp);
	return;

 nla_put_failure:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);

11899 11900 11901 11902 11903 11904 11905 11906 11907 11908 11909 11910 11911 11912 11913 11914 11915 11916 11917
void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
{
	struct sk_buff *msg;

	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
	if (!msg)
		return;

	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
		goto nla_put_failure;

	cfg80211_send_cqm(msg, gfp);
	return;

 nla_put_failure:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);

11918 11919 11920
static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev, const u8 *bssid,
				     const u8 *replay_ctr, gfp_t gfp)
11921 11922 11923 11924 11925
{
	struct sk_buff *msg;
	struct nlattr *rekey_attr;
	void *hdr;

11926
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11927 11928 11929 11930 11931 11932 11933 11934 11935
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11936 11937 11938 11939
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
11940 11941 11942 11943 11944

	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
	if (!rekey_attr)
		goto nla_put_failure;

11945 11946 11947
	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
		    NL80211_REPLAY_CTR_LEN, replay_ctr))
		goto nla_put_failure;
11948 11949 11950

	nla_nest_end(msg, rekey_attr);

11951
	genlmsg_end(msg, hdr);
11952

11953
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11954
				NL80211_MCGRP_MLME, gfp);
11955 11956 11957 11958 11959 11960 11961
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

11962 11963 11964 11965 11966
void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
			       const u8 *replay_ctr, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
11967
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11968 11969 11970 11971 11972 11973 11974 11975 11976 11977

	trace_cfg80211_gtk_rekey_notify(dev, bssid);
	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
}
EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);

static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, int index,
			       const u8 *bssid, bool preauth, gfp_t gfp)
11978 11979 11980 11981 11982
{
	struct sk_buff *msg;
	struct nlattr *attr;
	void *hdr;

11983
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11984 11985 11986 11987 11988 11989 11990 11991 11992
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11993 11994 11995
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
11996 11997 11998 11999 12000

	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
	if (!attr)
		goto nla_put_failure;

12001 12002 12003 12004 12005
	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
	    (preauth &&
	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
		goto nla_put_failure;
12006 12007 12008

	nla_nest_end(msg, attr);

12009
	genlmsg_end(msg, hdr);
12010

12011
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12012
				NL80211_MCGRP_MLME, gfp);
12013 12014 12015 12016 12017 12018 12019
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

12020 12021 12022 12023 12024
void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
				     const u8 *bssid, bool preauth, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
12025
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12026 12027 12028 12029 12030 12031 12032 12033 12034

	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
}
EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);

static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev,
				     struct cfg80211_chan_def *chandef,
12035 12036 12037
				     gfp_t gfp,
				     enum nl80211_commands notif,
				     u8 count)
12038 12039 12040 12041
{
	struct sk_buff *msg;
	void *hdr;

12042
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12043 12044 12045
	if (!msg)
		return;

12046
	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12047 12048 12049 12050 12051
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

12052 12053 12054 12055
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
12056
		goto nla_put_failure;
12057

12058 12059 12060 12061
	if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
	    (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
			goto nla_put_failure;

12062 12063
	genlmsg_end(msg, hdr);

12064
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12065
				NL80211_MCGRP_MLME, gfp);
12066 12067 12068 12069 12070 12071 12072
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

12073 12074
void cfg80211_ch_switch_notify(struct net_device *dev,
			       struct cfg80211_chan_def *chandef)
12075
{
12076 12077
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
12078
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12079

12080
	ASSERT_WDEV_LOCK(wdev);
12081

12082
	trace_cfg80211_ch_switch_notify(dev, chandef);
12083

12084
	wdev->chandef = *chandef;
12085
	wdev->preset_chandef = *chandef;
12086 12087
	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
				 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12088 12089 12090
}
EXPORT_SYMBOL(cfg80211_ch_switch_notify);

12091 12092 12093 12094 12095 12096 12097 12098 12099 12100 12101 12102 12103 12104 12105
void cfg80211_ch_switch_started_notify(struct net_device *dev,
				       struct cfg80211_chan_def *chandef,
				       u8 count)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);

	trace_cfg80211_ch_switch_started_notify(dev, chandef);

	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
}
EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);

12106 12107
void
nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12108
		     const struct cfg80211_chan_def *chandef,
12109 12110 12111 12112 12113 12114 12115 12116 12117 12118 12119 12120 12121 12122 12123 12124 12125 12126 12127 12128 12129 12130 12131 12132 12133 12134 12135 12136 12137 12138 12139 12140 12141 12142
		     enum nl80211_radar_event event,
		     struct net_device *netdev, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;

	/* NOP and radar events don't need a netdev parameter */
	if (netdev) {
		struct wireless_dev *wdev = netdev->ieee80211_ptr;

		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
		    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
			goto nla_put_failure;
	}

	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
		goto nla_put_failure;

12143
	genlmsg_end(msg, hdr);
12144

12145
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12146
				NL80211_MCGRP_MLME, gfp);
12147 12148 12149 12150 12151 12152 12153
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

12154 12155 12156 12157
void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
			   u64 cookie, bool acked, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
12158
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12159 12160 12161
	struct sk_buff *msg;
	void *hdr;

12162 12163
	trace_cfg80211_probe_status(dev, addr, cookie, acked);

12164
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12165

12166 12167 12168 12169 12170 12171 12172 12173 12174
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

12175 12176 12177 12178 12179 12180
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
12181

12182
	genlmsg_end(msg, hdr);
12183

12184
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12185
				NL80211_MCGRP_MLME, gfp);
12186 12187 12188 12189 12190 12191 12192 12193
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_probe_status);

12194 12195
void cfg80211_report_obss_beacon(struct wiphy *wiphy,
				 const u8 *frame, size_t len,
12196
				 int freq, int sig_dbm)
12197
{
12198
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12199 12200
	struct sk_buff *msg;
	void *hdr;
12201
	struct cfg80211_beacon_registration *reg;
12202

12203 12204
	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);

12205 12206 12207 12208 12209 12210 12211
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		msg = nlmsg_new(len + 100, GFP_ATOMIC);
		if (!msg) {
			spin_unlock_bh(&rdev->beacon_registrations_lock);
			return;
		}
12212

12213 12214 12215
		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
		if (!hdr)
			goto nla_put_failure;
12216

12217 12218 12219 12220 12221 12222 12223
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
		    (freq &&
		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
		    (sig_dbm &&
		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
			goto nla_put_failure;
12224

12225
		genlmsg_end(msg, hdr);
12226

12227 12228 12229
		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
	}
	spin_unlock_bh(&rdev->beacon_registrations_lock);
12230 12231 12232
	return;

 nla_put_failure:
12233 12234 12235
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	if (hdr)
		genlmsg_cancel(msg, hdr);
12236 12237 12238 12239
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_obss_beacon);

12240
#ifdef CONFIG_PM
12241 12242 12243 12244 12245 12246 12247 12248 12249 12250 12251 12252 12253 12254 12255 12256 12257 12258 12259 12260 12261 12262 12263 12264 12265 12266 12267 12268 12269 12270 12271 12272 12273 12274 12275 12276 12277 12278 12279 12280 12281 12282 12283 12284 12285 12286 12287 12288 12289 12290 12291 12292 12293 12294 12295 12296 12297 12298 12299 12300 12301
static int cfg80211_net_detect_results(struct sk_buff *msg,
				       struct cfg80211_wowlan_wakeup *wakeup)
{
	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
	struct nlattr *nl_results, *nl_match, *nl_freqs;
	int i, j;

	nl_results = nla_nest_start(
		msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
	if (!nl_results)
		return -EMSGSIZE;

	for (i = 0; i < nd->n_matches; i++) {
		struct cfg80211_wowlan_nd_match *match = nd->matches[i];

		nl_match = nla_nest_start(msg, i);
		if (!nl_match)
			break;

		/* The SSID attribute is optional in nl80211, but for
		 * simplicity reasons it's always present in the
		 * cfg80211 structure.  If a driver can't pass the
		 * SSID, that needs to be changed.  A zero length SSID
		 * is still a valid SSID (wildcard), so it cannot be
		 * used for this purpose.
		 */
		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
			    match->ssid.ssid)) {
			nla_nest_cancel(msg, nl_match);
			goto out;
		}

		if (match->n_channels) {
			nl_freqs = nla_nest_start(
				msg, NL80211_ATTR_SCAN_FREQUENCIES);
			if (!nl_freqs) {
				nla_nest_cancel(msg, nl_match);
				goto out;
			}

			for (j = 0; j < match->n_channels; j++) {
				if (nla_put_u32(msg,
						NL80211_ATTR_WIPHY_FREQ,
						match->channels[j])) {
					nla_nest_cancel(msg, nl_freqs);
					nla_nest_cancel(msg, nl_match);
					goto out;
				}
			}

			nla_nest_end(msg, nl_freqs);
		}

		nla_nest_end(msg, nl_match);
	}

out:
	nla_nest_end(msg, nl_results);
	return 0;
}

12302 12303 12304 12305
void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
				   struct cfg80211_wowlan_wakeup *wakeup,
				   gfp_t gfp)
{
12306
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12307 12308
	struct sk_buff *msg;
	void *hdr;
12309
	int size = 200;
12310 12311 12312 12313 12314 12315 12316 12317 12318 12319 12320 12321 12322 12323 12324 12325 12326 12327 12328 12329 12330 12331 12332 12333 12334 12335

	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);

	if (wakeup)
		size += wakeup->packet_present_len;

	msg = nlmsg_new(size, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
	if (!hdr)
		goto free_msg;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto free_msg;

	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					wdev->netdev->ifindex))
		goto free_msg;

	if (wakeup) {
		struct nlattr *reasons;

		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12336 12337
		if (!reasons)
			goto free_msg;
12338 12339 12340 12341 12342 12343 12344 12345 12346 12347 12348 12349 12350 12351 12352 12353 12354 12355 12356 12357 12358 12359 12360 12361 12362

		if (wakeup->disconnect &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
			goto free_msg;
		if (wakeup->magic_pkt &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
			goto free_msg;
		if (wakeup->gtk_rekey_failure &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
			goto free_msg;
		if (wakeup->eap_identity_req &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
			goto free_msg;
		if (wakeup->four_way_handshake &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
			goto free_msg;
		if (wakeup->rfkill_release &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
			goto free_msg;

		if (wakeup->pattern_idx >= 0 &&
		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
				wakeup->pattern_idx))
			goto free_msg;

12363 12364 12365
		if (wakeup->tcp_match &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
			goto free_msg;
12366

12367 12368 12369
		if (wakeup->tcp_connlost &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
			goto free_msg;
12370

12371 12372 12373 12374
		if (wakeup->tcp_nomoretokens &&
		    nla_put_flag(msg,
				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
			goto free_msg;
12375

12376 12377 12378 12379 12380 12381 12382 12383 12384 12385 12386 12387 12388 12389 12390 12391 12392 12393 12394 12395
		if (wakeup->packet) {
			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;

			if (!wakeup->packet_80211) {
				pkt_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
				len_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
			}

			if (wakeup->packet_len &&
			    nla_put_u32(msg, len_attr, wakeup->packet_len))
				goto free_msg;

			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
				    wakeup->packet))
				goto free_msg;
		}

12396 12397 12398 12399
		if (wakeup->net_detect &&
		    cfg80211_net_detect_results(msg, wakeup))
				goto free_msg;

12400 12401 12402
		nla_nest_end(msg, reasons);
	}

12403
	genlmsg_end(msg, hdr);
12404

12405
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12406
				NL80211_MCGRP_MLME, gfp);
12407 12408 12409 12410 12411 12412 12413 12414
	return;

 free_msg:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
#endif

12415 12416 12417 12418 12419
void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
				enum nl80211_tdls_operation oper,
				u16 reason_code, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
12420
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12421 12422 12423 12424 12425 12426 12427 12428 12429 12430 12431 12432 12433 12434 12435 12436 12437 12438 12439 12440 12441 12442 12443 12444
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
					 reason_code);

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
	    (reason_code > 0 &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
		goto nla_put_failure;

12445
	genlmsg_end(msg, hdr);
12446

12447
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12448
				NL80211_MCGRP_MLME, gfp);
12449 12450 12451 12452 12453 12454 12455 12456
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_tdls_oper_request);

12457 12458 12459 12460 12461 12462 12463
static int nl80211_netlink_notify(struct notifier_block * nb,
				  unsigned long state,
				  void *_notify)
{
	struct netlink_notify *notify = _notify;
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *wdev;
12464
	struct cfg80211_beacon_registration *reg, *tmp;
12465 12466 12467 12468 12469 12470

	if (state != NETLINK_URELEASE)
		return NOTIFY_DONE;

	rcu_read_lock();

12471
	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12472 12473 12474
		bool schedule_destroy_work = false;

		list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12475
			cfg80211_mlme_unregister_socket(wdev, notify->portid);
12476

12477 12478 12479 12480
			if (wdev->owner_nlportid == notify->portid)
				schedule_destroy_work = true;
		}

12481 12482 12483 12484 12485 12486 12487 12488 12489 12490
		spin_lock_bh(&rdev->beacon_registrations_lock);
		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
					 list) {
			if (reg->nlportid == notify->portid) {
				list_del(&reg->list);
				kfree(reg);
				break;
			}
		}
		spin_unlock_bh(&rdev->beacon_registrations_lock);
12491 12492 12493 12494 12495 12496 12497 12498 12499 12500 12501 12502 12503

		if (schedule_destroy_work) {
			struct cfg80211_iface_destroy *destroy;

			destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
			if (destroy) {
				destroy->nlportid = notify->portid;
				spin_lock(&rdev->destroy_list_lock);
				list_add(&destroy->list, &rdev->destroy_list);
				spin_unlock(&rdev->destroy_list_lock);
				schedule_work(&rdev->destroy_work);
			}
		}
12504
	}
12505 12506 12507

	rcu_read_unlock();

12508
	return NOTIFY_OK;
12509 12510 12511 12512 12513 12514
}

static struct notifier_block nl80211_netlink_notifier = {
	.notifier_call = nl80211_netlink_notify,
};

12515 12516 12517 12518
void cfg80211_ft_event(struct net_device *netdev,
		       struct cfg80211_ft_event_params *ft_event)
{
	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12519
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12520 12521 12522 12523 12524 12525 12526 12527 12528 12529 12530 12531 12532
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_ft_event(wiphy, netdev, ft_event);

	if (!ft_event->target_ap)
		return;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12533 12534
	if (!hdr)
		goto out;
12535

12536 12537 12538 12539
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
		goto out;
12540

12541 12542 12543 12544 12545 12546 12547
	if (ft_event->ies &&
	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
		goto out;
	if (ft_event->ric_ies &&
	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
		    ft_event->ric_ies))
		goto out;
12548

12549
	genlmsg_end(msg, hdr);
12550

12551
	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12552
				NL80211_MCGRP_MLME, GFP_KERNEL);
12553 12554 12555
	return;
 out:
	nlmsg_free(msg);
12556 12557 12558
}
EXPORT_SYMBOL(cfg80211_ft_event);

12559 12560 12561 12562 12563 12564 12565
void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev;
	struct sk_buff *msg;
	void *hdr;
	u32 nlportid;

12566
	rdev = wiphy_to_rdev(wdev->wiphy);
12567 12568 12569 12570 12571 12572 12573 12574 12575 12576 12577 12578 12579 12580 12581 12582 12583 12584 12585 12586 12587 12588 12589 12590 12591 12592 12593 12594 12595 12596 12597
	if (!rdev->crit_proto_nlportid)
		return;

	nlportid = rdev->crit_proto_nlportid;
	rdev->crit_proto_nlportid = 0;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
	return;

 nla_put_failure:
	if (hdr)
		genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}
EXPORT_SYMBOL(cfg80211_crit_proto_stopped);

12598 12599 12600
void nl80211_send_ap_stopped(struct wireless_dev *wdev)
{
	struct wiphy *wiphy = wdev->wiphy;
12601
	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12602 12603 12604 12605 12606 12607 12608 12609 12610 12611 12612 12613 12614 12615 12616 12617 12618 12619 12620 12621 12622 12623 12624 12625 12626
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
	if (!hdr)
		goto out;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto out;

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
				NL80211_MCGRP_MLME, GFP_KERNEL);
	return;
 out:
	nlmsg_free(msg);
}

12627 12628 12629 12630
/* initialisation/exit functions */

int nl80211_init(void)
{
12631
	int err;
12632

12633 12634
	err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
						   nl80211_mcgrps);
12635 12636 12637
	if (err)
		return err;

12638 12639 12640 12641
	err = netlink_register_notifier(&nl80211_netlink_notifier);
	if (err)
		goto err_out;

12642 12643 12644 12645 12646 12647 12648 12649
	return 0;
 err_out:
	genl_unregister_family(&nl80211_fam);
	return err;
}

void nl80211_exit(void)
{
12650
	netlink_unregister_notifier(&nl80211_netlink_notifier);
12651 12652
	genl_unregister_family(&nl80211_fam);
}