nl80211.c 299.6 KB
Newer Older
1 2 3
/*
 * This is the new netlink-based wireless configuration interface.
 *
4
 * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5 6 7 8 9
 */

#include <linux/if.h>
#include <linux/module.h>
#include <linux/err.h>
10
#include <linux/slab.h>
11 12 13 14 15 16
#include <linux/list.h>
#include <linux/if_ether.h>
#include <linux/ieee80211.h>
#include <linux/nl80211.h>
#include <linux/rtnetlink.h>
#include <linux/netlink.h>
17
#include <linux/etherdevice.h>
18
#include <net/net_namespace.h>
19 20
#include <net/genetlink.h>
#include <net/cfg80211.h>
21
#include <net/sock.h>
22
#include <net/inet_connection_sock.h>
23 24
#include "core.h"
#include "nl80211.h"
25
#include "reg.h"
26
#include "rdev-ops.h"
27

28 29 30 31 32
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit);

33 34 35 36 37
static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
			    struct genl_info *info);
static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
			      struct genl_info *info);

38 39
/* the netlink family */
static struct genl_family nl80211_fam = {
40 41 42 43
	.id = GENL_ID_GENERATE,		/* don't bother with a hardcoded ID */
	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
	.hdrsize = 0,			/* no private header */
	.version = 1,			/* no particular meaning now */
44
	.maxattr = NL80211_ATTR_MAX,
45
	.netnsok = true,
46 47
	.pre_doit = nl80211_pre_doit,
	.post_doit = nl80211_post_doit,
48 49
};

50 51 52
/* returns ERR_PTR values */
static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
53
{
54 55 56 57 58 59 60
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *result = NULL;
	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
	u64 wdev_id;
	int wiphy_idx = -1;
	int ifidx = -1;
61

62
	ASSERT_RTNL();
63

64 65
	if (!have_ifidx && !have_wdev_id)
		return ERR_PTR(-EINVAL);
66

67 68 69 70 71
	if (have_ifidx)
		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
	if (have_wdev_id) {
		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		wiphy_idx = wdev_id >> 32;
72 73
	}

74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		struct wireless_dev *wdev;

		if (wiphy_net(&rdev->wiphy) != netns)
			continue;

		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
			continue;

		list_for_each_entry(wdev, &rdev->wdev_list, list) {
			if (have_ifidx && wdev->netdev &&
			    wdev->netdev->ifindex == ifidx) {
				result = wdev;
				break;
			}
			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
				result = wdev;
				break;
			}
		}

		if (result)
			break;
	}

	if (result)
		return result;
	return ERR_PTR(-ENODEV);
102 103
}

104
static struct cfg80211_registered_device *
105
__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
106
{
107 108
	struct cfg80211_registered_device *rdev = NULL, *tmp;
	struct net_device *netdev;
109

110
	ASSERT_RTNL();
111

112
	if (!attrs[NL80211_ATTR_WIPHY] &&
113 114
	    !attrs[NL80211_ATTR_IFINDEX] &&
	    !attrs[NL80211_ATTR_WDEV])
115 116
		return ERR_PTR(-EINVAL);

117
	if (attrs[NL80211_ATTR_WIPHY])
118
		rdev = cfg80211_rdev_by_wiphy_idx(
119
				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
120

121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144
	if (attrs[NL80211_ATTR_WDEV]) {
		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		struct wireless_dev *wdev;
		bool found = false;

		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
		if (tmp) {
			/* make sure wdev exists */
			list_for_each_entry(wdev, &tmp->wdev_list, list) {
				if (wdev->identifier != (u32)wdev_id)
					continue;
				found = true;
				break;
			}

			if (!found)
				tmp = NULL;

			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);
			rdev = tmp;
		}
	}

145 146
	if (attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
J
Johannes Berg 已提交
147
		netdev = dev_get_by_index(netns, ifindex);
148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165
		if (netdev) {
			if (netdev->ieee80211_ptr)
				tmp = wiphy_to_dev(
						netdev->ieee80211_ptr->wiphy);
			else
				tmp = NULL;

			dev_put(netdev);

			/* not wireless device -- return error */
			if (!tmp)
				return ERR_PTR(-EINVAL);

			/* mismatch -- return error */
			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);

			rdev = tmp;
166 167 168
		}
	}

J
Johannes Berg 已提交
169 170
	if (!rdev)
		return ERR_PTR(-ENODEV);
171

J
Johannes Berg 已提交
172 173 174 175
	if (netns != wiphy_net(&rdev->wiphy))
		return ERR_PTR(-ENODEV);

	return rdev;
176 177 178 179 180 181 182 183 184 185
}

/*
 * This function returns a pointer to the driver
 * that the genl_info item that is passed refers to.
 *
 * The result of this can be a PTR_ERR and hence must
 * be checked with IS_ERR() for errors.
 */
static struct cfg80211_registered_device *
J
Johannes Berg 已提交
186
cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
187
{
188
	return __cfg80211_rdev_from_attrs(netns, info->attrs);
189 190
}

191
/* policy for the attributes */
A
Alexey Dobriyan 已提交
192
static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
193 194
	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
195
				      .len = 20-1 },
196
	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
197

198
	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
S
Sujith 已提交
199
	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
200 201 202 203
	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },

204 205 206 207
	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
208
	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
209 210 211 212

	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
213

E
Eliad Peller 已提交
214 215
	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
216

217
	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
218 219 220 221 222
	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
				    .len = WLAN_MAX_KEY_LEN },
	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
223
	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
224
	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
225 226 227 228 229 230 231

	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
232 233 234 235 236
	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
					       .len = NL80211_MAX_SUPP_RATES },
237
	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
238
	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
J
Johannes Berg 已提交
239
	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
240
	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
241
				   .len = IEEE80211_MAX_MESH_ID_LEN },
242
	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
243

244 245 246
	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },

247 248 249
	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
250 251
	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
					   .len = NL80211_MAX_SUPP_RATES },
252
	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
253

254
	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
255
	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
256

257
	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
258 259 260 261

	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
			      .len = IEEE80211_MAX_DATA_LEN },
262 263
	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
264 265 266 267 268

	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
				.len = IEEE80211_MAX_SSID_LEN },
	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
J
Johannes Berg 已提交
269
	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
270
	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
271
	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
272 273 274
	[NL80211_ATTR_STA_FLAGS2] = {
		.len = sizeof(struct nl80211_sta_flag_update),
	},
275
	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
276 277
	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
S
Samuel Ortiz 已提交
278 279 280
	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
281
	[NL80211_ATTR_PID] = { .type = NLA_U32 },
282
	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
S
Samuel Ortiz 已提交
283 284
	[NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
				 .len = WLAN_PMKID_LEN },
285 286
	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
287
	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
288 289 290
	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
				 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
K
Kalle Valo 已提交
291
	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
292
	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
293
	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
294
	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
295 296
	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
297
	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
298 299
	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
300
	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
301
	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
302
	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
J
Johannes Berg 已提交
303
	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
304
	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
305
	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
306
	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
307
	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
308
	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
309 310 311 312
	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
313
	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
314
	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
315
	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
316 317 318 319 320
	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
321
	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
322 323
	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
				      .len = IEEE80211_MAX_DATA_LEN },
324
	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
325 326 327 328
	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
		.len = NL80211_HT_CAPABILITY_LEN
	},
329
	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
330
	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
331
	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
332
	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
333
	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
334
	[NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
M
Mahesh Palivela 已提交
335
	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
336
	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
337 338
	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
339 340
	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
341 342
	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
343
	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
344 345 346 347
	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
		.len = NL80211_VHT_CAPABILITY_LEN,
	},
348 349 350
	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
				  .len = IEEE80211_MAX_DATA_LEN },
351
	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
352 353 354 355 356
	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
357 358
	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
359
	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
360
	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
361 362
};

363
/* policy for the key attributes */
A
Alexey Dobriyan 已提交
364
static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
J
Johannes Berg 已提交
365
	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
366 367
	[NL80211_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
368
	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
369 370
	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
371
	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
372 373 374 375 376 377 378 379
	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
};

/* policy for the key default flags */
static const struct nla_policy
nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
380 381
};

J
Johannes Berg 已提交
382 383 384 385 386 387 388
/* policy for WoWLAN attributes */
static const struct nla_policy
nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
389 390 391 392
	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
};

static const struct nla_policy
nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
	},
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
	},
	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
J
Johannes Berg 已提交
413 414
};

415 416 417 418 419 420 421 422
/* policy for coalesce rule attributes */
static const struct nla_policy
nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
};

423 424 425 426 427 428 429 430
/* policy for GTK rekey offload attributes */
static const struct nla_policy
nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
	[NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
};

431 432
static const struct nla_policy
nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
433
	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
434
						 .len = IEEE80211_MAX_SSID_LEN },
435
	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
436 437
};

438 439 440 441
static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
				     struct netlink_callback *cb,
				     struct cfg80211_registered_device **rdev,
				     struct wireless_dev **wdev)
442
{
443
	int err;
444

445
	rtnl_lock();
446

447 448 449 450 451 452
	if (!cb->args[0]) {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
			goto out_unlock;
453

454 455 456 457 458 459 460
		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
						   nl80211_fam.attrbuf);
		if (IS_ERR(*wdev)) {
			err = PTR_ERR(*wdev);
			goto out_unlock;
		}
		*rdev = wiphy_to_dev((*wdev)->wiphy);
461 462
		/* 0 is the first index - add 1 to parse only once */
		cb->args[0] = (*rdev)->wiphy_idx + 1;
463 464
		cb->args[1] = (*wdev)->identifier;
	} else {
465 466
		/* subtract the 1 again here */
		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
467
		struct wireless_dev *tmp;
468

469 470 471 472 473 474
		if (!wiphy) {
			err = -ENODEV;
			goto out_unlock;
		}
		*rdev = wiphy_to_dev(wiphy);
		*wdev = NULL;
475

476 477 478 479 480 481
		list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
			if (tmp->identifier == cb->args[1]) {
				*wdev = tmp;
				break;
			}
		}
482

483 484 485 486
		if (!*wdev) {
			err = -ENODEV;
			goto out_unlock;
		}
487 488 489
	}

	return 0;
490
 out_unlock:
491 492 493 494
	rtnl_unlock();
	return err;
}

495
static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
496 497 498 499
{
	rtnl_unlock();
}

500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529
/* IE validation */
static bool is_valid_ie_attr(const struct nlattr *attr)
{
	const u8 *pos;
	int len;

	if (!attr)
		return true;

	pos = nla_data(attr);
	len = nla_len(attr);

	while (len) {
		u8 elemlen;

		if (len < 2)
			return false;
		len -= 2;

		elemlen = pos[1];
		if (elemlen > len)
			return false;

		len -= elemlen;
		pos += 2 + elemlen;
	}

	return true;
}

530
/* message building helper */
531
static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
532 533 534
				   int flags, u8 cmd)
{
	/* since there is no private header just add the generic one */
535
	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
536 537
}

538
static int nl80211_msg_put_channel(struct sk_buff *msg,
539 540
				   struct ieee80211_channel *chan,
				   bool large)
541
{
542 543 544
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
			chan->center_freq))
		goto nla_put_failure;
545

546 547 548
	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
		goto nla_put_failure;
549 550 551 552 553 554
	if (chan->flags & IEEE80211_CHAN_NO_IR) {
		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
			goto nla_put_failure;
		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
			goto nla_put_failure;
	}
555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570
	if (chan->flags & IEEE80211_CHAN_RADAR) {
		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
			goto nla_put_failure;
		if (large) {
			u32 time;

			time = elapsed_jiffies_msecs(chan->dfs_state_entered);

			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
					chan->dfs_state))
				goto nla_put_failure;
			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
					time))
				goto nla_put_failure;
		}
	}
571

572 573 574 575 576 577 578 579 580 581 582 583 584 585 586
	if (large) {
		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
			goto nla_put_failure;
	}

587 588 589
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
			DBM_TO_MBM(chan->max_power)))
		goto nla_put_failure;
590 591 592 593 594 595 596

	return 0;

 nla_put_failure:
	return -ENOBUFS;
}

597 598
/* netlink command implementations */

599 600 601
struct key_parse {
	struct key_params p;
	int idx;
602
	int type;
603
	bool def, defmgmt;
604
	bool def_uni, def_multi;
605 606 607 608 609 610 611 612 613 614 615 616 617
};

static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
{
	struct nlattr *tb[NL80211_KEY_MAX + 1];
	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
				   nl80211_key_policy);
	if (err)
		return err;

	k->def = !!tb[NL80211_KEY_DEFAULT];
	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];

618 619 620 621 622 623 624
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640
	if (tb[NL80211_KEY_IDX])
		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);

	if (tb[NL80211_KEY_DATA]) {
		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
	}

	if (tb[NL80211_KEY_SEQ]) {
		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
	}

	if (tb[NL80211_KEY_CIPHER])
		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);

641 642 643 644 645 646
	if (tb[NL80211_KEY_TYPE]) {
		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

647 648
	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
649 650 651
		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				       tb[NL80211_KEY_DEFAULT_TYPES],
				       nl80211_key_default_policy);
652 653 654 655 656 657 658
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682
	return 0;
}

static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
{
	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
	}

	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
	}

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);

	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];

683 684 685 686 687 688 689
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

690 691 692 693 694 695
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

696 697 698 699 700 701 702 703 704 705 706 707 708
	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
		int err = nla_parse_nested(
				kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
				nl80211_key_default_policy);
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

709 710 711 712 713 714 715 716 717
	return 0;
}

static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
{
	int err;

	memset(k, 0, sizeof(*k));
	k->idx = -1;
718
	k->type = -1;
719 720 721 722 723 724 725 726 727 728 729 730

	if (info->attrs[NL80211_ATTR_KEY])
		err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
	else
		err = nl80211_parse_key_old(info, k);

	if (err)
		return err;

	if (k->def && k->defmgmt)
		return -EINVAL;

731 732 733 734 735
	if (k->defmgmt) {
		if (k->def_uni || !k->def_multi)
			return -EINVAL;
	}

736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751
	if (k->idx != -1) {
		if (k->defmgmt) {
			if (k->idx < 4 || k->idx > 5)
				return -EINVAL;
		} else if (k->def) {
			if (k->idx < 0 || k->idx > 3)
				return -EINVAL;
		} else {
			if (k->idx < 0 || k->idx > 5)
				return -EINVAL;
		}
	}

	return 0;
}

J
Johannes Berg 已提交
752 753
static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
754
		       struct nlattr *keys, bool *no_ht)
J
Johannes Berg 已提交
755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784
{
	struct key_parse parse;
	struct nlattr *key;
	struct cfg80211_cached_keys *result;
	int rem, err, def = 0;

	result = kzalloc(sizeof(*result), GFP_KERNEL);
	if (!result)
		return ERR_PTR(-ENOMEM);

	result->def = -1;
	result->defmgmt = -1;

	nla_for_each_nested(key, keys, rem) {
		memset(&parse, 0, sizeof(parse));
		parse.idx = -1;

		err = nl80211_parse_key_new(key, &parse);
		if (err)
			goto error;
		err = -EINVAL;
		if (!parse.p.key)
			goto error;
		if (parse.idx < 0 || parse.idx > 4)
			goto error;
		if (parse.def) {
			if (def)
				goto error;
			def = 1;
			result->def = parse.idx;
785 786
			if (!parse.def_uni || !parse.def_multi)
				goto error;
J
Johannes Berg 已提交
787 788 789
		} else if (parse.defmgmt)
			goto error;
		err = cfg80211_validate_key_settings(rdev, &parse.p,
790
						     parse.idx, false, NULL);
J
Johannes Berg 已提交
791 792 793 794 795 796
		if (err)
			goto error;
		result->params[parse.idx].cipher = parse.p.cipher;
		result->params[parse.idx].key_len = parse.p.key_len;
		result->params[parse.idx].key = result->data[parse.idx];
		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
797 798 799 800 801 802

		if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
		    parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
			if (no_ht)
				*no_ht = true;
		}
J
Johannes Berg 已提交
803 804 805 806 807 808 809 810 811 812 813 814 815 816 817
	}

	return result;
 error:
	kfree(result);
	return ERR_PTR(err);
}

static int nl80211_key_allowed(struct wireless_dev *wdev)
{
	ASSERT_WDEV_LOCK(wdev);

	switch (wdev->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
818
	case NL80211_IFTYPE_P2P_GO:
819
	case NL80211_IFTYPE_MESH_POINT:
J
Johannes Berg 已提交
820 821 822
		break;
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_STATION:
823
	case NL80211_IFTYPE_P2P_CLIENT:
824
		if (!wdev->current_bss)
J
Johannes Berg 已提交
825 826 827 828 829 830 831 832 833
			return -ENOLINK;
		break;
	default:
		return -EINVAL;
	}

	return 0;
}

834 835 836 837 838 839 840 841 842 843
static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
{
	struct nlattr *nl_modes = nla_nest_start(msg, attr);
	int i;

	if (!nl_modes)
		goto nla_put_failure;

	i = 0;
	while (ifmodes) {
844 845
		if ((ifmodes & 1) && nla_put_flag(msg, i))
			goto nla_put_failure;
846 847 848 849 850 851 852 853 854 855 856 857
		ifmodes >>= 1;
		i++;
	}

	nla_nest_end(msg, nl_modes);
	return 0;

nla_put_failure:
	return -ENOBUFS;
}

static int nl80211_put_iface_combinations(struct wiphy *wiphy,
858 859
					  struct sk_buff *msg,
					  bool large)
860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888
{
	struct nlattr *nl_combis;
	int i, j;

	nl_combis = nla_nest_start(msg,
				NL80211_ATTR_INTERFACE_COMBINATIONS);
	if (!nl_combis)
		goto nla_put_failure;

	for (i = 0; i < wiphy->n_iface_combinations; i++) {
		const struct ieee80211_iface_combination *c;
		struct nlattr *nl_combi, *nl_limits;

		c = &wiphy->iface_combinations[i];

		nl_combi = nla_nest_start(msg, i + 1);
		if (!nl_combi)
			goto nla_put_failure;

		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
		if (!nl_limits)
			goto nla_put_failure;

		for (j = 0; j < c->n_limits; j++) {
			struct nlattr *nl_limit;

			nl_limit = nla_nest_start(msg, j + 1);
			if (!nl_limit)
				goto nla_put_failure;
889 890 891
			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
					c->limits[j].max))
				goto nla_put_failure;
892 893 894 895 896 897 898 899
			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
						c->limits[j].types))
				goto nla_put_failure;
			nla_nest_end(msg, nl_limit);
		}

		nla_nest_end(msg, nl_limits);

900 901 902 903 904 905 906 907
		if (c->beacon_int_infra_match &&
		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
			goto nla_put_failure;
		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
				c->num_different_channels) ||
		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
				c->max_interfaces))
			goto nla_put_failure;
908 909 910 911
		if (large &&
		    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
				c->radar_detect_widths))
			goto nla_put_failure;
912 913 914 915 916 917 918 919 920 921 922

		nla_nest_end(msg, nl_combi);
	}

	nla_nest_end(msg, nl_combis);

	return 0;
nla_put_failure:
	return -ENOBUFS;
}

923
#ifdef CONFIG_PM
924 925 926
static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
					struct sk_buff *msg)
{
927
	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
		return -ENOBUFS;

	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
				sizeof(*tcp->tok), tcp->tok))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
			tcp->wake_payload_max))
		return -ENOBUFS;

	nla_nest_end(msg, nl_tcp);
	return 0;
}

964
static int nl80211_send_wowlan(struct sk_buff *msg,
965 966
			       struct cfg80211_registered_device *dev,
			       bool large)
967
{
968
	struct nlattr *nl_wowlan;
969

970
	if (!dev->wiphy.wowlan)
971
		return 0;
972

973 974 975
	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
	if (!nl_wowlan)
		return -ENOBUFS;
976

977
	if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
978
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
979
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
980
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
981
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
982
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
983
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
984
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
985
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
986
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
987
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
988
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
989
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
990
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
991
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
992 993
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
		return -ENOBUFS;
994

995
	if (dev->wiphy.wowlan->n_patterns) {
996
		struct nl80211_pattern_support pat = {
997 998 999 1000
			.max_patterns = dev->wiphy.wowlan->n_patterns,
			.min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
			.max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
			.max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1001
		};
1002

1003 1004 1005 1006
		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
			    sizeof(pat), &pat))
			return -ENOBUFS;
	}
1007

1008 1009 1010
	if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
		return -ENOBUFS;

1011
	nla_nest_end(msg, nl_wowlan);
1012

1013 1014 1015
	return 0;
}
#endif
1016

1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037
static int nl80211_send_coalesce(struct sk_buff *msg,
				 struct cfg80211_registered_device *dev)
{
	struct nl80211_coalesce_rule_support rule;

	if (!dev->wiphy.coalesce)
		return 0;

	rule.max_rules = dev->wiphy.coalesce->n_rules;
	rule.max_delay = dev->wiphy.coalesce->max_delay;
	rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
	rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
	rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
	rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;

	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
		return -ENOBUFS;

	return 0;
}

1038 1039 1040 1041 1042 1043
static int nl80211_send_band_rateinfo(struct sk_buff *msg,
				      struct ieee80211_supported_band *sband)
{
	struct nlattr *nl_rates, *nl_rate;
	struct ieee80211_rate *rate;
	int i;
1044

1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056
	/* add HT info */
	if (sband->ht_cap.ht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
		     sizeof(sband->ht_cap.mcs),
		     &sband->ht_cap.mcs) ||
	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
			 sband->ht_cap.cap) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
			sband->ht_cap.ampdu_factor) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
			sband->ht_cap.ampdu_density)))
		return -ENOBUFS;
1057

1058 1059 1060 1061 1062 1063 1064 1065
	/* add VHT info */
	if (sband->vht_cap.vht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
		     sizeof(sband->vht_cap.vht_mcs),
		     &sband->vht_cap.vht_mcs) ||
	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
			 sband->vht_cap.cap)))
		return -ENOBUFS;
1066

1067 1068 1069 1070
	/* add bitrates */
	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
	if (!nl_rates)
		return -ENOBUFS;
1071

1072 1073 1074 1075
	for (i = 0; i < sband->n_bitrates; i++) {
		nl_rate = nla_nest_start(msg, i);
		if (!nl_rate)
			return -ENOBUFS;
1076

1077 1078 1079 1080 1081 1082 1083 1084
		rate = &sband->bitrates[i];
		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
				rate->bitrate))
			return -ENOBUFS;
		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
		    nla_put_flag(msg,
				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
			return -ENOBUFS;
1085

1086 1087
		nla_nest_end(msg, nl_rate);
	}
J
Johannes Berg 已提交
1088

1089
	nla_nest_end(msg, nl_rates);
1090

1091 1092
	return 0;
}
1093

1094 1095 1096 1097 1098 1099 1100 1101
static int
nl80211_send_mgmt_stypes(struct sk_buff *msg,
			 const struct ieee80211_txrx_stypes *mgmt_stypes)
{
	u16 stypes;
	struct nlattr *nl_ftypes, *nl_ifs;
	enum nl80211_iftype ift;
	int i;
1102

1103 1104
	if (!mgmt_stypes)
		return 0;
1105

1106 1107 1108
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1109

1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].tx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
1123
		}
1124 1125
		nla_nest_end(msg, nl_ftypes);
	}
1126

1127
	nla_nest_end(msg, nl_ifs);
1128

1129 1130 1131
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1132

1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].rx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
		}
		nla_nest_end(msg, nl_ftypes);
	}
	nla_nest_end(msg, nl_ifs);
1150

1151 1152
	return 0;
}
1153

1154 1155 1156 1157 1158 1159 1160
struct nl80211_dump_wiphy_state {
	s64 filter_wiphy;
	long start;
	long split_start, band_start, chan_start;
	bool split;
};

1161 1162
static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
			      struct sk_buff *msg, u32 portid, u32 seq,
1163
			      int flags, struct nl80211_dump_wiphy_state *state)
1164 1165 1166 1167 1168 1169 1170 1171 1172 1173
{
	void *hdr;
	struct nlattr *nl_bands, *nl_band;
	struct nlattr *nl_freqs, *nl_freq;
	struct nlattr *nl_cmds;
	enum ieee80211_band band;
	struct ieee80211_channel *chan;
	int i;
	const struct ieee80211_txrx_stypes *mgmt_stypes =
				dev->wiphy.mgmt_stypes;
1174
	u32 features;
1175

1176 1177 1178
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
	if (!hdr)
		return -ENOBUFS;
1179

1180 1181
	if (WARN_ON(!state))
		return -EINVAL;
1182

1183 1184 1185 1186 1187
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
			   wiphy_name(&dev->wiphy)) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			cfg80211_rdev_list_generation))
1188 1189
		goto nla_put_failure;

1190
	switch (state->split_start) {
1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211
	case 0:
		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
			       dev->wiphy.retry_short) ||
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
			       dev->wiphy.retry_long) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
				dev->wiphy.frag_threshold) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
				dev->wiphy.rts_threshold) ||
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
			       dev->wiphy.coverage_class) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
			       dev->wiphy.max_scan_ssids) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
			       dev->wiphy.max_sched_scan_ssids) ||
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
				dev->wiphy.max_scan_ie_len) ||
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
				dev->wiphy.max_sched_scan_ie_len) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
			       dev->wiphy.max_match_sets))
1212
			goto nla_put_failure;
1213 1214 1215

		if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1216
			goto nla_put_failure;
1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
		if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1231
			goto nla_put_failure;
1232 1233
		state->split_start++;
		if (state->split)
1234 1235 1236 1237 1238 1239
			break;
	case 1:
		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
			    sizeof(u32) * dev->wiphy.n_cipher_suites,
			    dev->wiphy.cipher_suites))
			goto nla_put_failure;
1240

1241 1242 1243
		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
			       dev->wiphy.max_num_pmkids))
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1244

1245 1246
		if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1247
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1248

1249 1250 1251 1252
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
				dev->wiphy.available_antennas_tx) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
				dev->wiphy.available_antennas_rx))
1253
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1254

1255 1256 1257 1258
		if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
				dev->wiphy.probe_resp_offload))
			goto nla_put_failure;
1259

1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275
		if ((dev->wiphy.available_antennas_tx ||
		     dev->wiphy.available_antennas_rx) &&
		    dev->ops->get_antenna) {
			u32 tx_ant = 0, rx_ant = 0;
			int res;
			res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
			if (!res) {
				if (nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_TX,
						tx_ant) ||
				    nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_RX,
						rx_ant))
					goto nla_put_failure;
			}
		}
1276

1277 1278
		state->split_start++;
		if (state->split)
1279 1280 1281 1282 1283
			break;
	case 2:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
					dev->wiphy.interface_modes))
				goto nla_put_failure;
1284 1285
		state->split_start++;
		if (state->split)
1286 1287 1288 1289 1290
			break;
	case 3:
		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
		if (!nl_bands)
			goto nla_put_failure;
1291

1292 1293
		for (band = state->band_start;
		     band < IEEE80211_NUM_BANDS; band++) {
1294
			struct ieee80211_supported_band *sband;
1295

1296
			sband = dev->wiphy.bands[band];
1297

1298 1299 1300 1301 1302
			if (!sband)
				continue;

			nl_band = nla_nest_start(msg, band);
			if (!nl_band)
1303
				goto nla_put_failure;
1304

1305
			switch (state->chan_start) {
1306 1307
			case 0:
				if (nl80211_send_band_rateinfo(msg, sband))
1308
					goto nla_put_failure;
1309 1310
				state->chan_start++;
				if (state->split)
1311 1312 1313 1314 1315 1316 1317 1318
					break;
			default:
				/* add frequencies */
				nl_freqs = nla_nest_start(
					msg, NL80211_BAND_ATTR_FREQS);
				if (!nl_freqs)
					goto nla_put_failure;

1319
				for (i = state->chan_start - 1;
1320 1321 1322 1323 1324 1325 1326 1327
				     i < sband->n_channels;
				     i++) {
					nl_freq = nla_nest_start(msg, i);
					if (!nl_freq)
						goto nla_put_failure;

					chan = &sband->channels[i];

1328 1329 1330
					if (nl80211_msg_put_channel(
							msg, chan,
							state->split))
1331 1332 1333
						goto nla_put_failure;

					nla_nest_end(msg, nl_freq);
1334
					if (state->split)
1335 1336 1337
						break;
				}
				if (i < sband->n_channels)
1338
					state->chan_start = i + 2;
1339
				else
1340
					state->chan_start = 0;
1341 1342 1343 1344 1345
				nla_nest_end(msg, nl_freqs);
			}

			nla_nest_end(msg, nl_band);

1346
			if (state->split) {
1347
				/* start again here */
1348
				if (state->chan_start)
1349 1350
					band--;
				break;
1351 1352
			}
		}
1353
		nla_nest_end(msg, nl_bands);
1354

1355
		if (band < IEEE80211_NUM_BANDS)
1356
			state->band_start = band + 1;
1357
		else
1358
			state->band_start = 0;
J
Johannes Berg 已提交
1359

1360
		/* if bands & channels are done, continue outside */
1361 1362 1363
		if (state->band_start == 0 && state->chan_start == 0)
			state->split_start++;
		if (state->split)
1364 1365 1366 1367
			break;
	case 4:
		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
		if (!nl_cmds)
1368 1369
			goto nla_put_failure;

1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
		i = 0;
#define CMD(op, n)							\
		 do {							\
			if (dev->ops->op) {				\
				i++;					\
				if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
					goto nla_put_failure;		\
			}						\
		} while (0)

		CMD(add_virtual_intf, NEW_INTERFACE);
		CMD(change_virtual_intf, SET_INTERFACE);
		CMD(add_key, NEW_KEY);
		CMD(start_ap, START_AP);
		CMD(add_station, NEW_STATION);
		CMD(add_mpath, NEW_MPATH);
		CMD(update_mesh_config, SET_MESH_CONFIG);
		CMD(change_bss, SET_BSS);
		CMD(auth, AUTHENTICATE);
		CMD(assoc, ASSOCIATE);
		CMD(deauth, DEAUTHENTICATE);
		CMD(disassoc, DISASSOCIATE);
		CMD(join_ibss, JOIN_IBSS);
		CMD(join_mesh, JOIN_MESH);
		CMD(set_pmksa, SET_PMKSA);
		CMD(del_pmksa, DEL_PMKSA);
		CMD(flush_pmksa, FLUSH_PMKSA);
		if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
			CMD(remain_on_channel, REMAIN_ON_CHANNEL);
		CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
		CMD(mgmt_tx, FRAME);
		CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
		if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1405 1406
				goto nla_put_failure;
		}
1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
		if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
		    dev->ops->join_mesh) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
				goto nla_put_failure;
		}
		CMD(set_wds_peer, SET_WDS_PEER);
		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
			CMD(tdls_mgmt, TDLS_MGMT);
			CMD(tdls_oper, TDLS_OPER);
		}
		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
			CMD(sched_scan_start, START_SCHED_SCAN);
		CMD(probe_client, PROBE_CLIENT);
		CMD(set_noack_map, SET_NOACK_MAP);
		if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
				goto nla_put_failure;
		}
		CMD(start_p2p_device, START_P2P_DEVICE);
		CMD(set_mcast_rate, SET_MCAST_RATE);
1429
		if (state->split) {
1430 1431
			CMD(crit_proto_start, CRIT_PROTOCOL_START);
			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1432 1433
			if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
				CMD(channel_switch, CHANNEL_SWITCH);
1434
		}
1435

1436 1437 1438
#ifdef CONFIG_NL80211_TESTMODE
		CMD(testmode_cmd, TESTMODE);
#endif
J
Johannes Berg 已提交
1439

1440
#undef CMD
J
Johannes Berg 已提交
1441

1442 1443 1444
		if (dev->ops->connect || dev->ops->auth) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1445
				goto nla_put_failure;
J
Johannes Berg 已提交
1446 1447
		}

1448 1449 1450 1451 1452 1453 1454
		if (dev->ops->disconnect || dev->ops->deauth) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
				goto nla_put_failure;
		}

		nla_nest_end(msg, nl_cmds);
1455 1456
		state->split_start++;
		if (state->split)
1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471
			break;
	case 5:
		if (dev->ops->remain_on_channel &&
		    (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
		    nla_put_u32(msg,
				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
				dev->wiphy.max_remain_on_channel_duration))
			goto nla_put_failure;

		if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
			goto nla_put_failure;

		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
			goto nla_put_failure;
1472 1473
		state->split_start++;
		if (state->split)
1474 1475 1476
			break;
	case 6:
#ifdef CONFIG_PM
1477
		if (nl80211_send_wowlan(msg, dev, state->split))
1478
			goto nla_put_failure;
1479 1480
		state->split_start++;
		if (state->split)
1481 1482
			break;
#else
1483
		state->split_start++;
1484
#endif
1485 1486 1487 1488
	case 7:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
					dev->wiphy.software_iftypes))
			goto nla_put_failure;
J
Johannes Berg 已提交
1489

1490 1491
		if (nl80211_put_iface_combinations(&dev->wiphy, msg,
						   state->split))
1492
			goto nla_put_failure;
1493

1494 1495
		state->split_start++;
		if (state->split)
1496 1497 1498 1499 1500 1501
			break;
	case 8:
		if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
				dev->wiphy.ap_sme_capa))
			goto nla_put_failure;
1502

1503 1504 1505 1506 1507 1508
		features = dev->wiphy.features;
		/*
		 * We can only add the per-channel limit information if the
		 * dump is split, otherwise it makes it too big. Therefore
		 * only advertise it in that case.
		 */
1509
		if (state->split)
1510 1511
			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1512
			goto nla_put_failure;
J
Johannes Berg 已提交
1513

1514 1515 1516 1517 1518
		if (dev->wiphy.ht_capa_mod_mask &&
		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
			    sizeof(*dev->wiphy.ht_capa_mod_mask),
			    dev->wiphy.ht_capa_mod_mask))
			goto nla_put_failure;
1519

1520 1521 1522 1523 1524
		if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
		    dev->wiphy.max_acl_mac_addrs &&
		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
				dev->wiphy.max_acl_mac_addrs))
			goto nla_put_failure;
1525

1526 1527 1528 1529 1530 1531 1532 1533 1534 1535
		/*
		 * Any information below this point is only available to
		 * applications that can deal with it being split. This
		 * helps ensure that newly added capabilities don't break
		 * older tools by overrunning their buffers.
		 *
		 * We still increment split_start so that in the split
		 * case we'll continue with more data in the next round,
		 * but break unconditionally so unsplit data stops here.
		 */
1536
		state->split_start++;
1537 1538
		break;
	case 9:
1539 1540 1541 1542 1543 1544 1545 1546
		if (dev->wiphy.extended_capabilities &&
		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
			     dev->wiphy.extended_capabilities_len,
			     dev->wiphy.extended_capabilities) ||
		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
			     dev->wiphy.extended_capabilities_len,
			     dev->wiphy.extended_capabilities_mask)))
			goto nla_put_failure;
1547

1548 1549 1550 1551 1552 1553
		if (dev->wiphy.vht_capa_mod_mask &&
		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
			    sizeof(*dev->wiphy.vht_capa_mod_mask),
			    dev->wiphy.vht_capa_mod_mask))
			goto nla_put_failure;

1554 1555 1556 1557 1558 1559
		state->split_start++;
		break;
	case 10:
		if (nl80211_send_coalesce(msg, dev))
			goto nla_put_failure;

1560 1561 1562 1563 1564
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
			goto nla_put_failure;

1565
		/* done */
1566
		state->split_start = 0;
1567 1568
		break;
	}
1569 1570 1571
	return genlmsg_end(msg, hdr);

 nla_put_failure:
1572 1573
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
1574 1575
}

1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610
static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
				    struct netlink_callback *cb,
				    struct nl80211_dump_wiphy_state *state)
{
	struct nlattr **tb = nl80211_fam.attrbuf;
	int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
			      tb, nl80211_fam.maxattr, nl80211_policy);
	/* ignore parse errors for backward compatibility */
	if (ret)
		return 0;

	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
	if (tb[NL80211_ATTR_WIPHY])
		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
	if (tb[NL80211_ATTR_WDEV])
		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
	if (tb[NL80211_ATTR_IFINDEX]) {
		struct net_device *netdev;
		struct cfg80211_registered_device *rdev;
		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);

		netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
		if (!netdev)
			return -ENODEV;
		if (netdev->ieee80211_ptr) {
			rdev = wiphy_to_dev(
				netdev->ieee80211_ptr->wiphy);
			state->filter_wiphy = rdev->wiphy_idx;
		}
		dev_put(netdev);
	}

	return 0;
}

1611 1612
static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
{
1613
	int idx = 0, ret;
1614
	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1615
	struct cfg80211_registered_device *dev;
1616

1617
	rtnl_lock();
1618 1619
	if (!state) {
		state = kzalloc(sizeof(*state), GFP_KERNEL);
J
John W. Linville 已提交
1620 1621
		if (!state) {
			rtnl_unlock();
1622
			return -ENOMEM;
1623
		}
1624 1625 1626 1627 1628 1629
		state->filter_wiphy = -1;
		ret = nl80211_dump_wiphy_parse(skb, cb, state);
		if (ret) {
			kfree(state);
			rtnl_unlock();
			return ret;
1630
		}
1631
		cb->args[0] = (long)state;
1632 1633
	}

1634
	list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1635 1636
		if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
			continue;
1637
		if (++idx <= state->start)
1638
			continue;
1639 1640
		if (state->filter_wiphy != -1 &&
		    state->filter_wiphy != dev->wiphy_idx)
1641 1642 1643 1644 1645 1646
			continue;
		/* attempt to fit multiple wiphy data chunks into the skb */
		do {
			ret = nl80211_send_wiphy(dev, skb,
						 NETLINK_CB(cb->skb).portid,
						 cb->nlh->nlmsg_seq,
1647
						 NLM_F_MULTI, state);
1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665
			if (ret < 0) {
				/*
				 * If sending the wiphy data didn't fit (ENOBUFS
				 * or EMSGSIZE returned), this SKB is still
				 * empty (so it's not too big because another
				 * wiphy dataset is already in the skb) and
				 * we've not tried to adjust the dump allocation
				 * yet ... then adjust the alloc size to be
				 * bigger, and return 1 but with the empty skb.
				 * This results in an empty message being RX'ed
				 * in userspace, but that is ignored.
				 *
				 * We can then retry with the larger buffer.
				 */
				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
				    !skb->len &&
				    cb->min_dump_alloc < 4096) {
					cb->min_dump_alloc = 4096;
1666
					rtnl_unlock();
1667 1668 1669 1670
					return 1;
				}
				idx--;
				break;
1671
			}
1672
		} while (state->split_start > 0);
1673
		break;
1674
	}
1675
	rtnl_unlock();
1676

1677
	state->start = idx;
1678 1679 1680 1681

	return skb->len;
}

1682 1683 1684 1685 1686 1687
static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
{
	kfree((void *)cb->args[0]);
	return 0;
}

1688 1689 1690
static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
1691
	struct cfg80211_registered_device *dev = info->user_ptr[0];
1692
	struct nl80211_dump_wiphy_state state = {};
1693

1694
	msg = nlmsg_new(4096, GFP_KERNEL);
1695
	if (!msg)
1696
		return -ENOMEM;
1697

1698
	if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1699
			       &state) < 0) {
1700 1701 1702
		nlmsg_free(msg);
		return -ENOBUFS;
	}
1703

J
Johannes Berg 已提交
1704
	return genlmsg_reply(msg, info);
1705 1706
}

1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717
static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
};

static int parse_txq_params(struct nlattr *tb[],
			    struct ieee80211_txq_params *txq_params)
{
1718
	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1719 1720 1721 1722
	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
	    !tb[NL80211_TXQ_ATTR_AIFS])
		return -EINVAL;

1723
	txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1724 1725 1726 1727 1728
	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);

1729 1730 1731
	if (txq_params->ac >= NL80211_NUM_ACS)
		return -EINVAL;

1732 1733 1734
	return 0;
}

1735 1736 1737
static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
{
	/*
1738 1739 1740 1741 1742 1743 1744 1745 1746
	 * You can only set the channel explicitly for WDS interfaces,
	 * all others have their channel managed via their respective
	 * "establish a connection" command (connect, join, ...)
	 *
	 * For AP/GO and mesh mode, the channel can be set with the
	 * channel userspace API, but is only stored and passed to the
	 * low-level driver when the AP starts or the mesh is joined.
	 * This is for backward compatibility, userspace can also give
	 * the channel in the start-ap or join-mesh commands instead.
1747 1748
	 *
	 * Monitors are special as they are normally slaved to
1749 1750
	 * whatever else is going on, so they have their own special
	 * operation to set the monitor channel if possible.
1751 1752 1753 1754
	 */
	return !wdev ||
		wdev->iftype == NL80211_IFTYPE_AP ||
		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1755 1756
		wdev->iftype == NL80211_IFTYPE_MONITOR ||
		wdev->iftype == NL80211_IFTYPE_P2P_GO;
1757 1758
}

1759 1760 1761 1762
static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
				 struct genl_info *info,
				 struct cfg80211_chan_def *chandef)
{
1763
	u32 control_freq;
1764 1765 1766 1767 1768 1769 1770

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);

	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1771 1772 1773
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = control_freq;
	chandef->center_freq2 = 0;
1774 1775 1776 1777 1778

	/* Primary channel not allowed */
	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
		return -EINVAL;

1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808
	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
		enum nl80211_channel_type chantype;

		chantype = nla_get_u32(
				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);

		switch (chantype) {
		case NL80211_CHAN_NO_HT:
		case NL80211_CHAN_HT20:
		case NL80211_CHAN_HT40PLUS:
		case NL80211_CHAN_HT40MINUS:
			cfg80211_chandef_create(chandef, chandef->chan,
						chantype);
			break;
		default:
			return -EINVAL;
		}
	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
		chandef->width =
			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
			chandef->center_freq1 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
			chandef->center_freq2 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
	}

1809
	if (!cfg80211_chandef_valid(chandef))
1810 1811
		return -EINVAL;

1812 1813
	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
				     IEEE80211_CHAN_DISABLED))
1814 1815
		return -EINVAL;

1816 1817 1818 1819 1820
	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
	     chandef->width == NL80211_CHAN_WIDTH_10) &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
		return -EINVAL;

1821 1822 1823
	return 0;
}

1824 1825 1826 1827
static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
				 struct wireless_dev *wdev,
				 struct genl_info *info)
{
1828
	struct cfg80211_chan_def chandef;
1829
	int result;
1830 1831 1832 1833
	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;

	if (wdev)
		iftype = wdev->iftype;
1834 1835 1836 1837

	if (!nl80211_can_set_dev_channel(wdev))
		return -EOPNOTSUPP;

1838 1839 1840
	result = nl80211_parse_chandef(rdev, info, &chandef);
	if (result)
		return result;
1841

1842
	switch (iftype) {
1843 1844 1845 1846 1847 1848
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
		if (wdev->beacon_interval) {
			result = -EBUSY;
			break;
		}
1849
		if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1850 1851 1852
			result = -EINVAL;
			break;
		}
1853
		wdev->preset_chandef = chandef;
1854 1855
		result = 0;
		break;
1856
	case NL80211_IFTYPE_MESH_POINT:
1857
		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1858
		break;
1859
	case NL80211_IFTYPE_MONITOR:
1860
		result = cfg80211_set_monitor_channel(rdev, &chandef);
1861
		break;
1862
	default:
1863
		result = -EINVAL;
1864 1865 1866 1867 1868 1869 1870
	}

	return result;
}

static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
{
1871 1872
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *netdev = info->user_ptr[1];
1873

1874
	return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1875 1876
}

1877 1878
static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
{
1879 1880 1881
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
J
Johannes Berg 已提交
1882
	const u8 *bssid;
1883 1884 1885 1886

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

1887 1888
	if (netif_running(dev))
		return -EBUSY;
1889

1890 1891
	if (!rdev->ops->set_wds_peer)
		return -EOPNOTSUPP;
1892

1893 1894
	if (wdev->iftype != NL80211_IFTYPE_WDS)
		return -EOPNOTSUPP;
1895 1896

	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1897
	return rdev_set_wds_peer(rdev, dev, bssid);
1898 1899 1900
}


1901 1902 1903
static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
1904 1905
	struct net_device *netdev = NULL;
	struct wireless_dev *wdev;
B
Bill Jordan 已提交
1906
	int result = 0, rem_txq_params = 0;
1907
	struct nlattr *nl_txq_params;
1908 1909 1910
	u32 changed;
	u8 retry_short = 0, retry_long = 0;
	u32 frag_threshold = 0, rts_threshold = 0;
1911
	u8 coverage_class = 0;
1912

1913 1914
	ASSERT_RTNL();

1915 1916 1917 1918 1919 1920 1921 1922 1923
	/*
	 * Try to find the wiphy and netdev. Normally this
	 * function shouldn't need the netdev, but this is
	 * done for backward compatibility -- previously
	 * setting the channel was done per wiphy, but now
	 * it is per netdev. Previous userland like hostapd
	 * also passed a netdev to set_wiphy, so that it is
	 * possible to let that go to the right netdev!
	 */
1924

1925 1926 1927 1928
	if (info->attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);

		netdev = dev_get_by_index(genl_info_net(info), ifindex);
1929
		if (netdev && netdev->ieee80211_ptr)
1930
			rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1931
		else
1932
			netdev = NULL;
1933 1934
	}

1935
	if (!netdev) {
1936 1937
		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
						  info->attrs);
1938
		if (IS_ERR(rdev))
1939
			return PTR_ERR(rdev);
1940 1941 1942
		wdev = NULL;
		netdev = NULL;
		result = 0;
1943
	} else
1944 1945 1946 1947 1948 1949
		wdev = netdev->ieee80211_ptr;

	/*
	 * end workaround code, by now the rdev is available
	 * and locked, and wdev may or may not be NULL.
	 */
1950 1951

	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1952 1953
		result = cfg80211_dev_rename(
			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1954 1955 1956

	if (result)
		goto bad_res;
1957 1958 1959 1960 1961 1962 1963 1964 1965 1966

	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
		struct ieee80211_txq_params txq_params;
		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];

		if (!rdev->ops->set_txq_params) {
			result = -EOPNOTSUPP;
			goto bad_res;
		}

1967 1968 1969 1970 1971
		if (!netdev) {
			result = -EINVAL;
			goto bad_res;
		}

1972 1973 1974 1975 1976 1977
		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
			result = -EINVAL;
			goto bad_res;
		}

1978 1979 1980 1981 1982
		if (!netif_running(netdev)) {
			result = -ENETDOWN;
			goto bad_res;
		}

1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993
		nla_for_each_nested(nl_txq_params,
				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
				    rem_txq_params) {
			nla_parse(tb, NL80211_TXQ_ATTR_MAX,
				  nla_data(nl_txq_params),
				  nla_len(nl_txq_params),
				  txq_params_policy);
			result = parse_txq_params(tb, &txq_params);
			if (result)
				goto bad_res;

1994 1995
			result = rdev_set_txq_params(rdev, netdev,
						     &txq_params);
1996 1997 1998 1999
			if (result)
				goto bad_res;
		}
	}
2000

2001
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2002 2003 2004
		result = __nl80211_set_channel(rdev,
				nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
				info);
2005 2006 2007 2008
		if (result)
			goto bad_res;
	}

2009
	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2010
		struct wireless_dev *txp_wdev = wdev;
2011 2012 2013
		enum nl80211_tx_power_setting type;
		int idx, mbm = 0;

2014 2015 2016
		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
			txp_wdev = NULL;

2017
		if (!rdev->ops->set_tx_power) {
2018
			result = -EOPNOTSUPP;
2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035
			goto bad_res;
		}

		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
		type = nla_get_u32(info->attrs[idx]);

		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
		    (type != NL80211_TX_POWER_AUTOMATIC)) {
			result = -EINVAL;
			goto bad_res;
		}

		if (type != NL80211_TX_POWER_AUTOMATIC) {
			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
			mbm = nla_get_u32(info->attrs[idx]);
		}

2036
		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2037 2038 2039 2040
		if (result)
			goto bad_res;
	}

2041 2042 2043
	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
		u32 tx_ant, rx_ant;
2044 2045 2046
		if ((!rdev->wiphy.available_antennas_tx &&
		     !rdev->wiphy.available_antennas_rx) ||
		    !rdev->ops->set_antenna) {
2047 2048 2049 2050 2051 2052 2053
			result = -EOPNOTSUPP;
			goto bad_res;
		}

		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);

2054
		/* reject antenna configurations which don't match the
2055 2056 2057
		 * available antenna masks, except for the "all" mask */
		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2058 2059 2060 2061
			result = -EINVAL;
			goto bad_res;
		}

2062 2063
		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2064

2065
		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2066 2067 2068 2069
		if (result)
			goto bad_res;
	}

2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116
	changed = 0;

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
		retry_short = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
		if (retry_short == 0) {
			result = -EINVAL;
			goto bad_res;
		}
		changed |= WIPHY_PARAM_RETRY_SHORT;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
		retry_long = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
		if (retry_long == 0) {
			result = -EINVAL;
			goto bad_res;
		}
		changed |= WIPHY_PARAM_RETRY_LONG;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
		frag_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
		if (frag_threshold < 256) {
			result = -EINVAL;
			goto bad_res;
		}
		if (frag_threshold != (u32) -1) {
			/*
			 * Fragments (apart from the last one) are required to
			 * have even length. Make the fragmentation code
			 * simpler by stripping LSB should someone try to use
			 * odd threshold value.
			 */
			frag_threshold &= ~0x1;
		}
		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
		rts_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
		changed |= WIPHY_PARAM_RTS_THRESHOLD;
	}

2117 2118 2119 2120 2121 2122
	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
		coverage_class = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
		changed |= WIPHY_PARAM_COVERAGE_CLASS;
	}

2123 2124 2125
	if (changed) {
		u8 old_retry_short, old_retry_long;
		u32 old_frag_threshold, old_rts_threshold;
2126
		u8 old_coverage_class;
2127 2128 2129 2130 2131 2132 2133 2134 2135 2136

		if (!rdev->ops->set_wiphy_params) {
			result = -EOPNOTSUPP;
			goto bad_res;
		}

		old_retry_short = rdev->wiphy.retry_short;
		old_retry_long = rdev->wiphy.retry_long;
		old_frag_threshold = rdev->wiphy.frag_threshold;
		old_rts_threshold = rdev->wiphy.rts_threshold;
2137
		old_coverage_class = rdev->wiphy.coverage_class;
2138 2139 2140 2141 2142 2143 2144 2145 2146

		if (changed & WIPHY_PARAM_RETRY_SHORT)
			rdev->wiphy.retry_short = retry_short;
		if (changed & WIPHY_PARAM_RETRY_LONG)
			rdev->wiphy.retry_long = retry_long;
		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
			rdev->wiphy.frag_threshold = frag_threshold;
		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
			rdev->wiphy.rts_threshold = rts_threshold;
2147 2148
		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
			rdev->wiphy.coverage_class = coverage_class;
2149

2150
		result = rdev_set_wiphy_params(rdev, changed);
2151 2152 2153 2154 2155
		if (result) {
			rdev->wiphy.retry_short = old_retry_short;
			rdev->wiphy.retry_long = old_retry_long;
			rdev->wiphy.frag_threshold = old_frag_threshold;
			rdev->wiphy.rts_threshold = old_rts_threshold;
2156
			rdev->wiphy.coverage_class = old_coverage_class;
2157 2158
		}
	}
2159

2160
 bad_res:
2161 2162
	if (netdev)
		dev_put(netdev);
2163 2164 2165
	return result;
}

2166 2167 2168 2169 2170
static inline u64 wdev_id(struct wireless_dev *wdev)
{
	return (u64)wdev->identifier |
	       ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
}
2171

2172
static int nl80211_send_chandef(struct sk_buff *msg,
2173
				const struct cfg80211_chan_def *chandef)
2174
{
2175
	WARN_ON(!cfg80211_chandef_valid(chandef));
2176

2177 2178 2179
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
			chandef->chan->center_freq))
		return -ENOBUFS;
2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196
	switch (chandef->width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
				cfg80211_get_chandef_type(chandef)))
			return -ENOBUFS;
		break;
	default:
		break;
	}
	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
		return -ENOBUFS;
	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
		return -ENOBUFS;
	if (chandef->center_freq2 &&
	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2197 2198 2199 2200
		return -ENOBUFS;
	return 0;
}

2201
static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2202
			      struct cfg80211_registered_device *rdev,
2203
			      struct wireless_dev *wdev)
2204
{
2205
	struct net_device *dev = wdev->netdev;
2206 2207
	void *hdr;

2208
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2209 2210 2211
	if (!hdr)
		return -1;

2212 2213
	if (dev &&
	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2214
	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2215 2216 2217 2218
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2219
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2220
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2221 2222 2223 2224
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			rdev->devlist_generation ^
			(cfg80211_rdev_list_generation << 2)))
		goto nla_put_failure;
2225

2226
	if (rdev->ops->get_channel) {
2227 2228 2229 2230 2231 2232 2233 2234
		int ret;
		struct cfg80211_chan_def chandef;

		ret = rdev_get_channel(rdev, wdev, &chandef);
		if (ret == 0) {
			if (nl80211_send_chandef(msg, &chandef))
				goto nla_put_failure;
		}
2235 2236
	}

2237 2238 2239 2240 2241
	if (wdev->ssid_len) {
		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
			goto nla_put_failure;
	}

2242 2243 2244
	return genlmsg_end(msg, hdr);

 nla_put_failure:
2245 2246
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
2247 2248 2249 2250 2251 2252 2253 2254
}

static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
{
	int wp_idx = 0;
	int if_idx = 0;
	int wp_start = cb->args[0];
	int if_start = cb->args[1];
2255
	struct cfg80211_registered_device *rdev;
2256 2257
	struct wireless_dev *wdev;

2258
	rtnl_lock();
2259 2260
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2261
			continue;
J
Johannes Berg 已提交
2262 2263
		if (wp_idx < wp_start) {
			wp_idx++;
2264
			continue;
J
Johannes Berg 已提交
2265
		}
2266 2267
		if_idx = 0;

2268
		list_for_each_entry(wdev, &rdev->wdev_list, list) {
J
Johannes Berg 已提交
2269 2270
			if (if_idx < if_start) {
				if_idx++;
2271
				continue;
J
Johannes Berg 已提交
2272
			}
2273
			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2274
					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2275
					       rdev, wdev) < 0) {
J
Johannes Berg 已提交
2276 2277 2278
				goto out;
			}
			if_idx++;
2279
		}
J
Johannes Berg 已提交
2280 2281

		wp_idx++;
2282
	}
J
Johannes Berg 已提交
2283
 out:
2284
	rtnl_unlock();
2285 2286 2287 2288 2289 2290 2291 2292 2293 2294

	cb->args[0] = wp_idx;
	cb->args[1] = if_idx;

	return skb->len;
}

static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
2295
	struct cfg80211_registered_device *dev = info->user_ptr[0];
2296
	struct wireless_dev *wdev = info->user_ptr[1];
2297

2298
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2299
	if (!msg)
2300
		return -ENOMEM;
2301

2302
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2303
			       dev, wdev) < 0) {
2304 2305 2306
		nlmsg_free(msg);
		return -ENOBUFS;
	}
2307

J
Johannes Berg 已提交
2308
	return genlmsg_reply(msg, info);
2309 2310
}

2311 2312 2313 2314 2315 2316
static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2317
	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340
};

static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
{
	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
	int flag;

	*mntrflags = 0;

	if (!nla)
		return -EINVAL;

	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
			     nla, mntr_flags_policy))
		return -EINVAL;

	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
		if (flags[flag])
			*mntrflags |= (1<<flag);

	return 0;
}

2341
static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2342 2343
			       struct net_device *netdev, u8 use_4addr,
			       enum nl80211_iftype iftype)
2344
{
2345
	if (!use_4addr) {
2346
		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2347
			return -EBUSY;
2348
		return 0;
2349
	}
2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366

	switch (iftype) {
	case NL80211_IFTYPE_AP_VLAN:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
			return 0;
		break;
	case NL80211_IFTYPE_STATION:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
			return 0;
		break;
	default:
		break;
	}

	return -EOPNOTSUPP;
}

2367 2368
static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
{
2369
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2370
	struct vif_params params;
2371
	int err;
J
Johannes Berg 已提交
2372
	enum nl80211_iftype otype, ntype;
2373
	struct net_device *dev = info->user_ptr[1];
2374
	u32 _flags, *flags = NULL;
2375
	bool change = false;
2376

2377 2378
	memset(&params, 0, sizeof(params));

J
Johannes Berg 已提交
2379
	otype = ntype = dev->ieee80211_ptr->iftype;
2380

2381
	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2382
		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
J
Johannes Berg 已提交
2383
		if (otype != ntype)
2384
			change = true;
2385 2386
		if (ntype > NL80211_IFTYPE_MAX)
			return -EINVAL;
2387 2388
	}

2389
	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2390 2391
		struct wireless_dev *wdev = dev->ieee80211_ptr;

2392 2393
		if (ntype != NL80211_IFTYPE_MESH_POINT)
			return -EINVAL;
2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404
		if (netif_running(dev))
			return -EBUSY;

		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2405 2406
	}

2407 2408 2409
	if (info->attrs[NL80211_ATTR_4ADDR]) {
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
		change = true;
2410
		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2411
		if (err)
2412
			return err;
2413 2414 2415 2416
	} else {
		params.use_4addr = -1;
	}

2417
	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2418 2419
		if (ntype != NL80211_IFTYPE_MONITOR)
			return -EINVAL;
2420 2421
		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
					  &_flags);
2422
		if (err)
2423
			return err;
2424 2425 2426

		flags = &_flags;
		change = true;
2427
	}
J
Johannes Berg 已提交
2428

2429
	if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2430 2431 2432
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2433
	if (change)
2434
		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2435 2436
	else
		err = 0;
J
Johannes Berg 已提交
2437

2438 2439 2440
	if (!err && params.use_4addr != -1)
		dev->ieee80211_ptr->use_4addr = params.use_4addr;

2441 2442 2443 2444 2445
	return err;
}

static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
{
2446
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2447
	struct vif_params params;
2448
	struct wireless_dev *wdev;
2449
	struct sk_buff *msg;
2450 2451
	int err;
	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2452
	u32 flags;
2453

2454 2455
	memset(&params, 0, sizeof(params));

2456 2457 2458 2459 2460 2461 2462 2463 2464
	if (!info->attrs[NL80211_ATTR_IFNAME])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_IFTYPE]) {
		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
		if (type > NL80211_IFTYPE_MAX)
			return -EINVAL;
	}

2465
	if (!rdev->ops->add_virtual_intf ||
2466 2467
	    !(rdev->wiphy.interface_modes & (1 << type)))
		return -EOPNOTSUPP;
2468

2469 2470 2471 2472 2473 2474 2475
	if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
			   ETH_ALEN);
		if (!is_valid_ether_addr(params.macaddr))
			return -EADDRNOTAVAIL;
	}

2476
	if (info->attrs[NL80211_ATTR_4ADDR]) {
2477
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2478
		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2479
		if (err)
2480
			return err;
2481
	}
2482

2483 2484 2485 2486
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

2487 2488 2489
	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
				  &flags);
2490

2491
	if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2492 2493 2494
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2495 2496 2497
	wdev = rdev_add_virtual_intf(rdev,
				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
				type, err ? NULL : &flags, &params);
2498 2499
	if (IS_ERR(wdev)) {
		nlmsg_free(msg);
2500
		return PTR_ERR(wdev);
2501
	}
2502

2503 2504 2505 2506
	switch (type) {
	case NL80211_IFTYPE_MESH_POINT:
		if (!info->attrs[NL80211_ATTR_MESH_ID])
			break;
2507 2508 2509 2510 2511 2512 2513 2514
		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532
		break;
	case NL80211_IFTYPE_P2P_DEVICE:
		/*
		 * P2P Device doesn't have a netdev, so doesn't go
		 * through the netdev notifier and must be added here
		 */
		mutex_init(&wdev->mtx);
		INIT_LIST_HEAD(&wdev->event_list);
		spin_lock_init(&wdev->event_lock);
		INIT_LIST_HEAD(&wdev->mgmt_registrations);
		spin_lock_init(&wdev->mgmt_registrations_lock);

		wdev->identifier = ++rdev->wdev_id;
		list_add_rcu(&wdev->list, &rdev->wdev_list);
		rdev->devlist_generation++;
		break;
	default:
		break;
2533 2534
	}

2535
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2536 2537 2538 2539 2540 2541
			       rdev, wdev) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}

	return genlmsg_reply(msg, info);
2542 2543 2544 2545
}

static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
{
2546
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2547
	struct wireless_dev *wdev = info->user_ptr[1];
2548

2549 2550
	if (!rdev->ops->del_virtual_intf)
		return -EOPNOTSUPP;
2551

2552 2553 2554 2555 2556 2557 2558 2559 2560 2561
	/*
	 * If we remove a wireless device without a netdev then clear
	 * user_ptr[1] so that nl80211_post_doit won't dereference it
	 * to check if it needs to do dev_put(). Otherwise it crashes
	 * since the wdev has been freed, unlike with a netdev where
	 * we need the dev_put() for the netdev to really be freed.
	 */
	if (!wdev->netdev)
		info->user_ptr[1] = NULL;

2562
	return rdev_del_virtual_intf(rdev, wdev);
2563 2564
}

2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578
static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u16 noack_map;

	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
		return -EINVAL;

	if (!rdev->ops->set_noack_map)
		return -EOPNOTSUPP;

	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);

2579
	return rdev_set_noack_map(rdev, dev, noack_map);
2580 2581
}

2582 2583 2584
struct get_key_cookie {
	struct sk_buff *msg;
	int error;
2585
	int idx;
2586 2587 2588 2589
};

static void get_key_callback(void *c, struct key_params *params)
{
2590
	struct nlattr *key;
2591 2592
	struct get_key_cookie *cookie = c;

2593 2594 2595 2596 2597 2598 2599 2600 2601 2602
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2603

2604 2605 2606 2607
	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
	if (!key)
		goto nla_put_failure;

2608 2609 2610 2611 2612 2613 2614 2615 2616 2617
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2618

2619 2620
	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
		goto nla_put_failure;
2621 2622 2623

	nla_nest_end(cookie->msg, key);

2624 2625 2626 2627 2628 2629 2630
	return;
 nla_put_failure:
	cookie->error = 1;
}

static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
{
2631
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2632
	int err;
2633
	struct net_device *dev = info->user_ptr[1];
2634
	u8 key_idx = 0;
2635 2636
	const u8 *mac_addr = NULL;
	bool pairwise;
2637 2638 2639 2640 2641 2642 2643 2644 2645
	struct get_key_cookie cookie = {
		.error = 0,
	};
	void *hdr;
	struct sk_buff *msg;

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

2646
	if (key_idx > 5)
2647 2648 2649 2650 2651
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662
	pairwise = !!mac_addr;
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (kt >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
		if (kt != NL80211_KEYTYPE_GROUP &&
		    kt != NL80211_KEYTYPE_PAIRWISE)
			return -EINVAL;
		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
	}

2663 2664
	if (!rdev->ops->get_key)
		return -EOPNOTSUPP;
2665

2666
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2667 2668
	if (!msg)
		return -ENOMEM;
2669

2670
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2671
			     NL80211_CMD_NEW_KEY);
2672 2673
	if (!hdr)
		return -ENOBUFS;
2674 2675

	cookie.msg = msg;
2676
	cookie.idx = key_idx;
2677

2678 2679 2680 2681 2682 2683
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
		goto nla_put_failure;
	if (mac_addr &&
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
2684

2685 2686 2687 2688
	if (pairwise && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		return -ENOENT;

2689 2690
	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
			   get_key_callback);
2691 2692

	if (err)
N
Niko Jokinen 已提交
2693
		goto free_msg;
2694 2695 2696 2697 2698

	if (cookie.error)
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
2699
	return genlmsg_reply(msg, info);
2700 2701 2702

 nla_put_failure:
	err = -ENOBUFS;
N
Niko Jokinen 已提交
2703
 free_msg:
2704 2705 2706 2707 2708 2709
	nlmsg_free(msg);
	return err;
}

static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
{
2710
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2711
	struct key_parse key;
2712
	int err;
2713
	struct net_device *dev = info->user_ptr[1];
2714

2715 2716 2717
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2718

2719
	if (key.idx < 0)
2720 2721
		return -EINVAL;

2722 2723
	/* only support setting default key */
	if (!key.def && !key.defmgmt)
2724 2725
		return -EINVAL;

2726
	wdev_lock(dev->ieee80211_ptr);
2727

2728 2729 2730 2731 2732
	if (key.def) {
		if (!rdev->ops->set_default_key) {
			err = -EOPNOTSUPP;
			goto out;
		}
2733

2734 2735 2736 2737
		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2738
		err = rdev_set_default_key(rdev, dev, key.idx,
2739 2740 2741 2742
						 key.def_uni, key.def_multi);

		if (err)
			goto out;
J
Johannes Berg 已提交
2743

J
Johannes Berg 已提交
2744
#ifdef CONFIG_CFG80211_WEXT
2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761
		dev->ieee80211_ptr->wext.default_key = key.idx;
#endif
	} else {
		if (key.def_uni || !key.def_multi) {
			err = -EINVAL;
			goto out;
		}

		if (!rdev->ops->set_default_mgmt_key) {
			err = -EOPNOTSUPP;
			goto out;
		}

		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2762
		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2763 2764 2765 2766 2767
		if (err)
			goto out;

#ifdef CONFIG_CFG80211_WEXT
		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2768
#endif
2769 2770 2771
	}

 out:
J
Johannes Berg 已提交
2772
	wdev_unlock(dev->ieee80211_ptr);
2773 2774 2775 2776 2777 2778

	return err;
}

static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
{
2779
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
J
Johannes Berg 已提交
2780
	int err;
2781
	struct net_device *dev = info->user_ptr[1];
2782
	struct key_parse key;
2783
	const u8 *mac_addr = NULL;
2784

2785 2786 2787
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2788

2789
	if (!key.p.key)
2790 2791 2792 2793 2794
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

2807 2808
	if (!rdev->ops->add_key)
		return -EOPNOTSUPP;
2809

2810 2811 2812
	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
					   key.type == NL80211_KEYTYPE_PAIRWISE,
					   mac_addr))
2813
		return -EINVAL;
2814

J
Johannes Berg 已提交
2815 2816 2817
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
	if (!err)
2818 2819 2820
		err = rdev_add_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				    mac_addr, &key.p);
J
Johannes Berg 已提交
2821
	wdev_unlock(dev->ieee80211_ptr);
2822 2823 2824 2825 2826 2827

	return err;
}

static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
{
2828
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2829
	int err;
2830
	struct net_device *dev = info->user_ptr[1];
2831
	u8 *mac_addr = NULL;
2832
	struct key_parse key;
2833

2834 2835 2836
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2837 2838 2839 2840

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

2853 2854
	if (!rdev->ops->del_key)
		return -EOPNOTSUPP;
2855

J
Johannes Berg 已提交
2856 2857
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
2858 2859 2860 2861 2862

	if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		err = -ENOENT;

J
Johannes Berg 已提交
2863
	if (!err)
2864 2865 2866
		err = rdev_del_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				   mac_addr);
2867

J
Johannes Berg 已提交
2868
#ifdef CONFIG_CFG80211_WEXT
2869
	if (!err) {
2870
		if (key.idx == dev->ieee80211_ptr->wext.default_key)
2871
			dev->ieee80211_ptr->wext.default_key = -1;
2872
		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2873 2874 2875
			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
	}
#endif
J
Johannes Berg 已提交
2876
	wdev_unlock(dev->ieee80211_ptr);
2877

2878 2879 2880
	return err;
}

2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971
/* This function returns an error or the number of nested attributes */
static int validate_acl_mac_addrs(struct nlattr *nl_attr)
{
	struct nlattr *attr;
	int n_entries = 0, tmp;

	nla_for_each_nested(attr, nl_attr, tmp) {
		if (nla_len(attr) != ETH_ALEN)
			return -EINVAL;

		n_entries++;
	}

	return n_entries;
}

/*
 * This function parses ACL information and allocates memory for ACL data.
 * On successful return, the calling function is responsible to free the
 * ACL buffer returned by this function.
 */
static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
						struct genl_info *info)
{
	enum nl80211_acl_policy acl_policy;
	struct nlattr *attr;
	struct cfg80211_acl_data *acl;
	int i = 0, n_entries, tmp;

	if (!wiphy->max_acl_mac_addrs)
		return ERR_PTR(-EOPNOTSUPP);

	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
		return ERR_PTR(-EINVAL);

	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
		return ERR_PTR(-EINVAL);

	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
		return ERR_PTR(-EINVAL);

	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
	if (n_entries < 0)
		return ERR_PTR(n_entries);

	if (n_entries > wiphy->max_acl_mac_addrs)
		return ERR_PTR(-ENOTSUPP);

	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
		      GFP_KERNEL);
	if (!acl)
		return ERR_PTR(-ENOMEM);

	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
		i++;
	}

	acl->n_acl_entries = n_entries;
	acl->acl_policy = acl_policy;

	return acl;
}

static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct cfg80211_acl_data *acl;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!dev->ieee80211_ptr->beacon_interval)
		return -EINVAL;

	acl = parse_acl_data(&rdev->wiphy, info);
	if (IS_ERR(acl))
		return PTR_ERR(acl);

	err = rdev_set_mac_acl(rdev, dev, acl);

	kfree(acl);

	return err;
}

2972
static int nl80211_parse_beacon(struct nlattr *attrs[],
2973
				struct cfg80211_beacon_data *bcn)
2974
{
2975
	bool haveinfo = false;
2976

2977 2978 2979 2980
	if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2981 2982
		return -EINVAL;

2983
	memset(bcn, 0, sizeof(*bcn));
2984

2985 2986 2987
	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
2988 2989 2990
		if (!bcn->head_len)
			return -EINVAL;
		haveinfo = true;
2991 2992
	}

2993 2994 2995
	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
2996
		haveinfo = true;
2997 2998
	}

2999 3000
	if (!haveinfo)
		return -EINVAL;
J
Johannes Berg 已提交
3001

3002 3003 3004
	if (attrs[NL80211_ATTR_IE]) {
		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3005 3006
	}

3007
	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3008
		bcn->proberesp_ies =
3009
			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3010
		bcn->proberesp_ies_len =
3011
			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3012 3013
	}

3014
	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3015
		bcn->assocresp_ies =
3016
			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3017
		bcn->assocresp_ies_len =
3018
			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3019 3020
	}

3021 3022 3023
	if (attrs[NL80211_ATTR_PROBE_RESP]) {
		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3024 3025
	}

3026 3027 3028
	return 0;
}

3029 3030 3031 3032 3033 3034
static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
				   struct cfg80211_ap_settings *params)
{
	struct wireless_dev *wdev;
	bool ret = false;

3035
	list_for_each_entry(wdev, &rdev->wdev_list, list) {
3036 3037 3038 3039
		if (wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
			continue;

3040
		if (!wdev->preset_chandef.chan)
3041 3042
			continue;

3043
		params->chandef = wdev->preset_chandef;
3044 3045 3046 3047 3048 3049 3050
		ret = true;
		break;
	}

	return ret;
}

3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074
static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
				    enum nl80211_auth_type auth_type,
				    enum nl80211_commands cmd)
{
	if (auth_type > NL80211_AUTHTYPE_MAX)
		return false;

	switch (cmd) {
	case NL80211_CMD_AUTHENTICATE:
		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
		    auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	case NL80211_CMD_CONNECT:
	case NL80211_CMD_START_AP:
		/* SAE not supported yet */
		if (auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	default:
		return false;
	}
}

3075 3076 3077 3078 3079 3080 3081
static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_ap_settings params;
	int err;
3082
	u8 radar_detect_width = 0;
3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->start_ap)
		return -EOPNOTSUPP;

	if (wdev->beacon_interval)
		return -EALREADY;

	memset(&params, 0, sizeof(params));

	/* these are required for START_AP */
	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
		return -EINVAL;

3102
	err = nl80211_parse_beacon(info->attrs, &params.beacon);
3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144
	if (err)
		return err;

	params.beacon_interval =
		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
	params.dtim_period =
		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);

	err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
	if (err)
		return err;

	/*
	 * In theory, some of these attributes should be required here
	 * but since they were not used when the command was originally
	 * added, keep them optional for old user space programs to let
	 * them continue to work with drivers that do not need the
	 * additional information -- drivers must check!
	 */
	if (info->attrs[NL80211_ATTR_SSID]) {
		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
		params.ssid_len =
			nla_len(info->attrs[NL80211_ATTR_SSID]);
		if (params.ssid_len == 0 ||
		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
		params.hidden_ssid = nla_get_u32(
			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
			return -EINVAL;
	}

	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		params.auth_type = nla_get_u32(
			info->attrs[NL80211_ATTR_AUTH_TYPE]);
3145 3146
		if (!nl80211_valid_auth_type(rdev, params.auth_type,
					     NL80211_CMD_START_AP))
3147 3148 3149 3150 3151 3152 3153 3154 3155
			return -EINVAL;
	} else
		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	err = nl80211_crypto_settings(rdev, info, &params.crypto,
				      NL80211_MAX_NR_CIPHER_SUITES);
	if (err)
		return err;

3156 3157 3158 3159 3160 3161 3162
	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
			return -EOPNOTSUPP;
		params.inactivity_timeout = nla_get_u16(
			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
	}

3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow > 127)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

3189
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3190 3191 3192 3193 3194
		err = nl80211_parse_chandef(rdev, info, &params.chandef);
		if (err)
			return err;
	} else if (wdev->preset_chandef.chan) {
		params.chandef = wdev->preset_chandef;
3195
	} else if (!nl80211_get_ap_channel(rdev, &params))
3196 3197
		return -EINVAL;

3198
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3199 3200
		return -EINVAL;

3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212
	err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
	if (err < 0)
		return err;
	if (err) {
		radar_detect_width = BIT(params.chandef.width);
		params.radar_required = true;
	}

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   params.chandef.chan,
					   CHAN_MODE_SHARED,
					   radar_detect_width);
3213 3214 3215
	if (err)
		return err;

3216 3217 3218 3219 3220 3221
	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
		params.acl = parse_acl_data(&rdev->wiphy, info);
		if (IS_ERR(params.acl))
			return PTR_ERR(params.acl);
	}

3222
	wdev_lock(wdev);
3223
	err = rdev_start_ap(rdev, dev, &params);
3224
	if (!err) {
3225
		wdev->preset_chandef = params.chandef;
3226
		wdev->beacon_interval = params.beacon_interval;
3227
		wdev->channel = params.chandef.chan;
3228 3229
		wdev->ssid_len = params.ssid_len;
		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3230
	}
3231
	wdev_unlock(wdev);
3232 3233 3234

	kfree(params.acl);

3235
	return err;
3236 3237
}

3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255
static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_beacon_data params;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->change_beacon)
		return -EOPNOTSUPP;

	if (!wdev->beacon_interval)
		return -EINVAL;

3256
	err = nl80211_parse_beacon(info->attrs, &params);
3257 3258 3259
	if (err)
		return err;

3260 3261 3262 3263 3264
	wdev_lock(wdev);
	err = rdev_change_beacon(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
3265 3266 3267
}

static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3268
{
3269 3270
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3271

3272
	return cfg80211_stop_ap(rdev, dev);
3273 3274
}

3275 3276 3277 3278
static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3279
	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3280
	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3281
	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3282 3283
};

3284
static int parse_station_flags(struct genl_info *info,
3285
			       enum nl80211_iftype iftype,
3286
			       struct station_parameters *params)
3287 3288
{
	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3289
	struct nlattr *nla;
3290 3291
	int flag;

3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302
	/*
	 * Try parsing the new attribute first so userspace
	 * can specify both for older kernels.
	 */
	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
	if (nla) {
		struct nl80211_sta_flag_update *sta_flags;

		sta_flags = nla_data(nla);
		params->sta_flags_mask = sta_flags->mask;
		params->sta_flags_set = sta_flags->set;
3303
		params->sta_flags_set &= params->sta_flags_mask;
3304 3305 3306 3307 3308 3309 3310
		if ((params->sta_flags_mask |
		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
			return -EINVAL;
		return 0;
	}

	/* if present, parse the old attribute */
3311

3312
	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3313 3314 3315 3316 3317 3318 3319
	if (!nla)
		return 0;

	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
			     nla, sta_flags_policy))
		return -EINVAL;

3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346
	/*
	 * Only allow certain flags for interface types so that
	 * other attributes are silently ignored. Remember that
	 * this is backward compatibility code with old userspace
	 * and shouldn't be hit in other cases anyway.
	 */
	switch (iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
					 BIT(NL80211_STA_FLAG_WME) |
					 BIT(NL80211_STA_FLAG_MFP);
		break;
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_STATION:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	case NL80211_IFTYPE_MESH_POINT:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
					 BIT(NL80211_STA_FLAG_MFP) |
					 BIT(NL80211_STA_FLAG_AUTHORIZED);
	default:
		return -EINVAL;
	}
3347

3348 3349
	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
		if (flags[flag]) {
3350
			params->sta_flags_set |= (1<<flag);
3351

3352 3353 3354 3355 3356 3357
			/* no longer support new API additions in old API */
			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
				return -EINVAL;
		}
	}

3358 3359 3360
	return 0;
}

3361 3362 3363 3364
static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
				 int attr)
{
	struct nlattr *rate;
3365 3366
	u32 bitrate;
	u16 bitrate_compat;
3367 3368 3369

	rate = nla_nest_start(msg, attr);
	if (!rate)
3370
		return false;
3371 3372 3373

	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
	bitrate = cfg80211_calculate_bitrate(info);
3374 3375
	/* report 16-bit bitrate only if we can */
	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412
	if (bitrate > 0 &&
	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
		return false;
	if (bitrate_compat > 0 &&
	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
		return false;

	if (info->flags & RATE_INFO_FLAGS_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
			return false;
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	}
3413 3414 3415 3416 3417

	nla_nest_end(msg, rate);
	return true;
}

3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443
static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
			       int id)
{
	void *attr;
	int i = 0;

	if (!mask)
		return true;

	attr = nla_nest_start(msg, id);
	if (!attr)
		return false;

	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
		if (!(mask & BIT(i)))
			continue;

		if (nla_put_u8(msg, i, signal[i]))
			return false;
	}

	nla_nest_end(msg, attr);

	return true;
}

3444
static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3445 3446 3447
				int flags,
				struct cfg80211_registered_device *rdev,
				struct net_device *dev,
3448
				const u8 *mac_addr, struct station_info *sinfo)
3449 3450
{
	void *hdr;
3451
	struct nlattr *sinfoattr, *bss_param;
3452

3453
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3454 3455 3456
	if (!hdr)
		return -1;

3457 3458 3459 3460
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
		goto nla_put_failure;
3461

3462 3463
	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
	if (!sinfoattr)
3464
		goto nla_put_failure;
3465 3466 3467 3468 3469 3470 3471 3472
	if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
			sinfo->connected_time))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
			sinfo->inactive_time))
		goto nla_put_failure;
3473 3474
	if ((sinfo->filled & (STATION_INFO_RX_BYTES |
			      STATION_INFO_RX_BYTES64)) &&
3475
	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3476
			(u32)sinfo->rx_bytes))
3477
		goto nla_put_failure;
3478
	if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3479
			      STATION_INFO_TX_BYTES64)) &&
3480
	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3481 3482 3483 3484 3485 3486 3487 3488
			(u32)sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
			sinfo->rx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3489 3490 3491 3492 3493 3494 3495 3496 3497 3498 3499 3500
			sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_LLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
	    nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
		       sinfo->plink_state))
		goto nla_put_failure;
3501 3502
	switch (rdev->wiphy.signal_type) {
	case CFG80211_SIGNAL_TYPE_MBM:
3503 3504 3505 3506 3507 3508 3509 3510
		if ((sinfo->filled & STATION_INFO_SIGNAL) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
			       sinfo->signal))
			goto nla_put_failure;
		if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
			       sinfo->signal_avg))
			goto nla_put_failure;
3511 3512 3513 3514
		break;
	default:
		break;
	}
3515 3516 3517 3518 3519 3520 3521 3522 3523 3524 3525 3526
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal,
					NL80211_STA_INFO_CHAIN_SIGNAL))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal_avg,
					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
			goto nla_put_failure;
	}
3527
	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3528 3529 3530 3531 3532 3533 3534
		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
					  NL80211_STA_INFO_TX_BITRATE))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_RX_BITRATE) {
		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
					  NL80211_STA_INFO_RX_BITRATE))
3535 3536
			goto nla_put_failure;
	}
3537 3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556
	if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
			sinfo->rx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
			sinfo->tx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
			sinfo->tx_retries))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
			sinfo->tx_failed))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
	    nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
			sinfo->beacon_loss_count))
		goto nla_put_failure;
3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568
	if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
			sinfo->local_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
			sinfo->peer_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
			sinfo->nonpeer_pm))
		goto nla_put_failure;
3569 3570 3571 3572 3573
	if (sinfo->filled & STATION_INFO_BSS_PARAM) {
		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
		if (!bss_param)
			goto nla_put_failure;

3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584
		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
			       sinfo->bss_param.dtim_period) ||
		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
				sinfo->bss_param.beacon_interval))
			goto nla_put_failure;
3585 3586 3587

		nla_nest_end(msg, bss_param);
	}
3588 3589 3590 3591 3592
	if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
		    sizeof(struct nl80211_sta_flag_update),
		    &sinfo->sta_flags))
		goto nla_put_failure;
3593 3594 3595 3596
	if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
		nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
			    sinfo->t_offset))
		goto nla_put_failure;
3597
	nla_nest_end(msg, sinfoattr);
3598

3599 3600 3601 3602
	if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
		    sinfo->assoc_req_ies))
		goto nla_put_failure;
3603

3604 3605 3606
	return genlmsg_end(msg, hdr);

 nla_put_failure:
3607 3608
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
3609 3610
}

3611
static int nl80211_dump_station(struct sk_buff *skb,
J
Johannes Berg 已提交
3612
				struct netlink_callback *cb)
3613 3614 3615
{
	struct station_info sinfo;
	struct cfg80211_registered_device *dev;
3616
	struct wireless_dev *wdev;
3617
	u8 mac_addr[ETH_ALEN];
3618
	int sta_idx = cb->args[2];
3619 3620
	int err;

3621
	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3622 3623
	if (err)
		return err;
J
Johannes Berg 已提交
3624

3625 3626 3627 3628 3629
	if (!wdev->netdev) {
		err = -EINVAL;
		goto out_err;
	}

J
Johannes Berg 已提交
3630
	if (!dev->ops->dump_station) {
3631
		err = -EOPNOTSUPP;
J
Johannes Berg 已提交
3632 3633 3634 3635
		goto out_err;
	}

	while (1) {
3636
		memset(&sinfo, 0, sizeof(sinfo));
3637
		err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3638
					mac_addr, &sinfo);
J
Johannes Berg 已提交
3639 3640 3641
		if (err == -ENOENT)
			break;
		if (err)
J
Johannes Berg 已提交
3642
			goto out_err;
J
Johannes Berg 已提交
3643 3644

		if (nl80211_send_station(skb,
3645
				NETLINK_CB(cb->skb).portid,
J
Johannes Berg 已提交
3646
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
3647
				dev, wdev->netdev, mac_addr,
J
Johannes Berg 已提交
3648 3649 3650 3651 3652 3653 3654 3655
				&sinfo) < 0)
			goto out;

		sta_idx++;
	}


 out:
3656
	cb->args[2] = sta_idx;
J
Johannes Berg 已提交
3657 3658
	err = skb->len;
 out_err:
3659
	nl80211_finish_wdev_dump(dev);
J
Johannes Berg 已提交
3660 3661

	return err;
3662
}
3663

3664 3665
static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
{
3666 3667
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3668
	struct station_info sinfo;
3669 3670
	struct sk_buff *msg;
	u8 *mac_addr = NULL;
3671
	int err;
3672

3673
	memset(&sinfo, 0, sizeof(sinfo));
3674 3675 3676 3677 3678 3679

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

3680 3681
	if (!rdev->ops->get_station)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
3682

3683
	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3684
	if (err)
3685
		return err;
3686

3687
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3688
	if (!msg)
3689
		return -ENOMEM;
3690

3691
	if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3692
				 rdev, dev, mac_addr, &sinfo) < 0) {
3693 3694 3695
		nlmsg_free(msg);
		return -ENOBUFS;
	}
J
Johannes Berg 已提交
3696

3697
	return genlmsg_reply(msg, info);
3698 3699
}

3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712
int cfg80211_check_station_change(struct wiphy *wiphy,
				  struct station_parameters *params,
				  enum cfg80211_station_type statype)
{
	if (params->listen_interval != -1)
		return -EINVAL;
	if (params->aid)
		return -EINVAL;

	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

	switch (statype) {
3713 3714
	case CFG80211_STA_MESH_PEER_KERNEL:
	case CFG80211_STA_MESH_PEER_USER:
3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815
		/*
		 * No ignoring the TDLS flag here -- the userspace mesh
		 * code doesn't have the bug of including TDLS in the
		 * mask everywhere.
		 */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_MFP) |
				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* ignore since it can't change */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	default:
		/* disallow mesh-specific things */
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		if (params->local_pm)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
		/* TDLS can't be set, ... */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
			return -EINVAL;
		/*
		 * ... but don't bother the driver with it. This works around
		 * a hostapd/wpa_supplicant issue -- it always includes the
		 * TLDS_PEER flag in the mask even for AP mode.
		 */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
		/* reject other things that can't change */
		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
			return -EINVAL;
		if (params->supported_rates)
			return -EINVAL;
		if (params->ext_capab || params->ht_capa || params->vht_capa)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_AP_CLIENT) {
		if (params->vlan)
			return -EINVAL;
	}

	switch (statype) {
	case CFG80211_STA_AP_MLME_CLIENT:
		/* Use this only for authorizing/unauthorizing a station */
		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EOPNOTSUPP;
		break;
	case CFG80211_STA_AP_CLIENT:
		/* accept only the listed bits */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
				  BIT(NL80211_STA_FLAG_WME) |
				  BIT(NL80211_STA_FLAG_MFP)))
			return -EINVAL;

		/* but authenticated/associated only if driver handles it */
		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params->sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;
		break;
	case CFG80211_STA_IBSS:
	case CFG80211_STA_AP_STA:
		/* reject any changes other than AUTHORIZED */
		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
		/* reject any changes other than AUTHORIZED or WME */
		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
					       BIT(NL80211_STA_FLAG_WME)))
			return -EINVAL;
		/* force (at least) rates when authorizing */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
		    !params->supported_rates)
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		/* reject any changes */
		return -EINVAL;
3816
	case CFG80211_STA_MESH_PEER_KERNEL:
3817 3818 3819
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
		break;
3820
	case CFG80211_STA_MESH_PEER_USER:
3821 3822 3823 3824 3825 3826 3827 3828 3829
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		break;
	}

	return 0;
}
EXPORT_SYMBOL(cfg80211_check_station_change);

3830
/*
3831
 * Get vlan interface making sure it is running and on the right wiphy.
3832
 */
3833 3834
static struct net_device *get_vlan(struct genl_info *info,
				   struct cfg80211_registered_device *rdev)
3835
{
3836
	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849
	struct net_device *v;
	int ret;

	if (!vlanattr)
		return NULL;

	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
	if (!v)
		return ERR_PTR(-ENODEV);

	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
		ret = -EINVAL;
		goto error;
3850
	}
3851

3852 3853 3854 3855 3856 3857 3858
	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
		ret = -EINVAL;
		goto error;
	}

3859 3860 3861 3862 3863 3864 3865 3866 3867
	if (!netif_running(v)) {
		ret = -ENETDOWN;
		goto error;
	}

	return v;
 error:
	dev_put(v);
	return ERR_PTR(ret);
3868 3869
}

3870 3871 3872 3873 3874 3875
static struct nla_policy
nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
};

3876 3877
static int nl80211_parse_sta_wme(struct genl_info *info,
				 struct station_parameters *params)
3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909
{
	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
	struct nlattr *nla;
	int err;

	/* parse WME attributes if present */
	if (!info->attrs[NL80211_ATTR_STA_WME])
		return 0;

	nla = info->attrs[NL80211_ATTR_STA_WME];
	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
			       nl80211_sta_wme_policy);
	if (err)
		return err;

	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
		params->uapsd_queues = nla_get_u8(
			tb[NL80211_STA_WME_UAPSD_QUEUES]);
	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
		return -EINVAL;

	if (tb[NL80211_STA_WME_MAX_SP])
		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);

	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
		return -EINVAL;

	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;

	return 0;
}

3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944
static int nl80211_parse_sta_channel_info(struct genl_info *info,
				      struct station_parameters *params)
{
	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
		params->supported_channels =
		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
		params->supported_channels_len =
		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
		/*
		 * Need to include at least one (first channel, number of
		 * channels) tuple for each subband, and must have proper
		 * tuples for the rest of the data as well.
		 */
		if (params->supported_channels_len < 2)
			return -EINVAL;
		if (params->supported_channels_len % 2)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
		params->supported_oper_classes =
		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
		params->supported_oper_classes_len =
		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
		/*
		 * The value of the Length field of the Supported Operating
		 * Classes element is between 2 and 253.
		 */
		if (params->supported_oper_classes_len < 2 ||
		    params->supported_oper_classes_len > 253)
			return -EINVAL;
	}
	return 0;
}

3945 3946 3947
static int nl80211_set_station_tdls(struct genl_info *info,
				    struct station_parameters *params)
{
3948
	int err;
3949
	/* Dummy STA entry gets updated once the peer capabilities are known */
3950 3951
	if (info->attrs[NL80211_ATTR_PEER_AID])
		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3952 3953 3954 3955 3956 3957 3958
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params->ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params->vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

3959 3960 3961 3962
	err = nl80211_parse_sta_channel_info(info, params);
	if (err)
		return err;

3963 3964 3965
	return nl80211_parse_sta_wme(info, params);
}

3966 3967
static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
{
3968 3969
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3970
	struct station_parameters params;
3971 3972
	u8 *mac_addr;
	int err;
3973 3974 3975 3976 3977

	memset(&params, 0, sizeof(params));

	params.listen_interval = -1;

3978 3979 3980
	if (!rdev->ops->change_station)
		return -EOPNOTSUPP;

3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995
	if (info->attrs[NL80211_ATTR_STA_AID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
		params.supported_rates =
			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
		params.supported_rates_len =
			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	}

3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

4009
	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4010
		return -EINVAL;
4011

4012
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4013 4014
		return -EINVAL;

4015
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4016
		params.plink_action =
4017 4018 4019 4020
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
4021

4022
	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4023
		params.plink_state =
4024 4025 4026 4027 4028
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
			return -EINVAL;
		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
	}
4029

4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040
	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
		enum nl80211_mesh_power_mode pm = nla_get_u32(
			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);

		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
		    pm > NL80211_MESH_POWER_MAX)
			return -EINVAL;

		params.local_pm = pm;
	}

4041 4042 4043 4044 4045 4046 4047 4048 4049
	/* Include parameters for TDLS peer (will check later) */
	err = nl80211_set_station_tdls(info, &params);
	if (err)
		return err;

	params.vlan = get_vlan(info, rdev);
	if (IS_ERR(params.vlan))
		return PTR_ERR(params.vlan);

4050 4051 4052
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
4053 4054
	case NL80211_IFTYPE_P2P_GO:
	case NL80211_IFTYPE_P2P_CLIENT:
4055
	case NL80211_IFTYPE_STATION:
4056
	case NL80211_IFTYPE_ADHOC:
4057 4058 4059
	case NL80211_IFTYPE_MESH_POINT:
		break;
	default:
4060 4061
		err = -EOPNOTSUPP;
		goto out_put_vlan;
4062 4063
	}

4064
	/* driver will call cfg80211_check_station_change() */
4065
	err = rdev_change_station(rdev, dev, mac_addr, &params);
4066

4067
 out_put_vlan:
4068 4069
	if (params.vlan)
		dev_put(params.vlan);
J
Johannes Berg 已提交
4070

4071 4072 4073 4074 4075
	return err;
}

static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
{
4076
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4077
	int err;
4078
	struct net_device *dev = info->user_ptr[1];
4079 4080 4081 4082 4083
	struct station_parameters params;
	u8 *mac_addr = NULL;

	memset(&params, 0, sizeof(params));

4084 4085 4086
	if (!rdev->ops->add_station)
		return -EOPNOTSUPP;

4087 4088 4089 4090 4091 4092 4093 4094 4095
	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
		return -EINVAL;

4096 4097
	if (!info->attrs[NL80211_ATTR_STA_AID] &&
	    !info->attrs[NL80211_ATTR_PEER_AID])
4098 4099
		return -EINVAL;

4100 4101 4102 4103 4104 4105 4106
	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
	params.supported_rates =
		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.supported_rates_len =
		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.listen_interval =
		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4107

4108
	if (info->attrs[NL80211_ATTR_PEER_AID])
4109
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4110 4111
	else
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4112 4113
	if (!params.aid || params.aid > IEEE80211_MAX_AID)
		return -EINVAL;
4114

4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

4128 4129 4130
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params.ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4131

M
Mahesh Palivela 已提交
4132 4133 4134 4135
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params.vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

4136 4137 4138 4139 4140 4141
	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
		params.opmode_notif_used = true;
		params.opmode_notif =
			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
	}

4142
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4143
		params.plink_action =
4144 4145 4146 4147
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
4148

4149 4150 4151 4152
	err = nl80211_parse_sta_channel_info(info, &params);
	if (err)
		return err;

4153 4154 4155
	err = nl80211_parse_sta_wme(info, &params);
	if (err)
		return err;
4156

4157
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4158 4159
		return -EINVAL;

4160 4161 4162
	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

4163 4164 4165 4166
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
4167 4168 4169 4170
		/* ignore WME attributes if iface/sta is not capable */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4171

4172
		/* TDLS peers cannot be added */
4173 4174
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4175
			return -EINVAL;
4176 4177
		/* but don't bother the driver with it */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4178

4179 4180 4181 4182 4183 4184 4185 4186
		/* allow authenticated/associated only if driver handles it */
		if (!(rdev->wiphy.features &
				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;

4187 4188 4189 4190 4191 4192
		/* must be last in here for error handling */
		params.vlan = get_vlan(info, rdev);
		if (IS_ERR(params.vlan))
			return PTR_ERR(params.vlan);
		break;
	case NL80211_IFTYPE_MESH_POINT:
4193 4194 4195
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4196 4197 4198
		/* associated is disallowed */
		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
			return -EINVAL;
4199
		/* TDLS peers cannot be added */
4200 4201
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4202 4203 4204
			return -EINVAL;
		break;
	case NL80211_IFTYPE_STATION:
4205
	case NL80211_IFTYPE_P2P_CLIENT:
4206 4207 4208
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4209 4210 4211 4212
		/* these are disallowed */
		if (params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4213
			return -EINVAL;
4214 4215 4216 4217 4218 4219 4220 4221 4222
		/* Only TDLS peers can be added */
		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* Can only add if TDLS ... */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
			return -EOPNOTSUPP;
		/* ... with external setup is supported */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
			return -EOPNOTSUPP;
4223 4224 4225 4226 4227
		/*
		 * Older wpa_supplicant versions always mark the TDLS peer
		 * as authorized, but it shouldn't yet be.
		 */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4228 4229 4230
		break;
	default:
		return -EOPNOTSUPP;
4231 4232
	}

4233
	/* be aware of params.vlan when changing code here */
4234

4235
	err = rdev_add_station(rdev, dev, mac_addr, &params);
4236 4237 4238 4239 4240 4241 4242 4243

	if (params.vlan)
		dev_put(params.vlan);
	return err;
}

static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
{
4244 4245
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4246 4247 4248 4249 4250
	u8 *mac_addr = NULL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

4251
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4252
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4253
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4254 4255
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;
4256

4257 4258
	if (!rdev->ops->del_station)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4259

4260
	return rdev_del_station(rdev, dev, mac_addr);
4261 4262
}

4263
static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4264 4265 4266 4267 4268 4269 4270
				int flags, struct net_device *dev,
				u8 *dst, u8 *next_hop,
				struct mpath_info *pinfo)
{
	void *hdr;
	struct nlattr *pinfoattr;

4271
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4272 4273 4274
	if (!hdr)
		return -1;

4275 4276 4277 4278 4279
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
		goto nla_put_failure;
4280

4281 4282 4283
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
	if (!pinfoattr)
		goto nla_put_failure;
4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301 4302 4303 4304 4305
	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
			pinfo->frame_qlen))
		goto nla_put_failure;
	if (((pinfo->filled & MPATH_INFO_SN) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
	    ((pinfo->filled & MPATH_INFO_METRIC) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
			 pinfo->metric)) ||
	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
			 pinfo->exptime)) ||
	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
			pinfo->flags)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
			 pinfo->discovery_timeout)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
			pinfo->discovery_retries)))
		goto nla_put_failure;
4306 4307 4308 4309 4310 4311

	nla_nest_end(msg, pinfoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
4312 4313
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
4314 4315 4316
}

static int nl80211_dump_mpath(struct sk_buff *skb,
J
Johannes Berg 已提交
4317
			      struct netlink_callback *cb)
4318 4319 4320
{
	struct mpath_info pinfo;
	struct cfg80211_registered_device *dev;
4321
	struct wireless_dev *wdev;
4322 4323
	u8 dst[ETH_ALEN];
	u8 next_hop[ETH_ALEN];
4324
	int path_idx = cb->args[2];
4325 4326
	int err;

4327
	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4328 4329
	if (err)
		return err;
J
Johannes Berg 已提交
4330 4331

	if (!dev->ops->dump_mpath) {
4332
		err = -EOPNOTSUPP;
J
Johannes Berg 已提交
4333 4334 4335
		goto out_err;
	}

4336
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4337
		err = -EOPNOTSUPP;
4338
		goto out_err;
4339 4340
	}

J
Johannes Berg 已提交
4341
	while (1) {
4342 4343
		err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
				      next_hop, &pinfo);
J
Johannes Berg 已提交
4344
		if (err == -ENOENT)
4345
			break;
J
Johannes Berg 已提交
4346
		if (err)
J
Johannes Berg 已提交
4347
			goto out_err;
4348

4349
		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
J
Johannes Berg 已提交
4350
				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
4351
				       wdev->netdev, dst, next_hop,
J
Johannes Berg 已提交
4352 4353
				       &pinfo) < 0)
			goto out;
4354

J
Johannes Berg 已提交
4355
		path_idx++;
4356 4357 4358
	}


J
Johannes Berg 已提交
4359
 out:
4360
	cb->args[2] = path_idx;
J
Johannes Berg 已提交
4361 4362
	err = skb->len;
 out_err:
4363
	nl80211_finish_wdev_dump(dev);
J
Johannes Berg 已提交
4364
	return err;
4365 4366 4367 4368
}

static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
{
4369
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4370
	int err;
4371
	struct net_device *dev = info->user_ptr[1];
4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383
	struct mpath_info pinfo;
	struct sk_buff *msg;
	u8 *dst = NULL;
	u8 next_hop[ETH_ALEN];

	memset(&pinfo, 0, sizeof(pinfo));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4384 4385
	if (!rdev->ops->get_mpath)
		return -EOPNOTSUPP;
4386

4387 4388
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4389

4390
	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4391
	if (err)
4392
		return err;
4393

4394
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4395
	if (!msg)
4396
		return -ENOMEM;
4397

4398
	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4399 4400 4401 4402
				 dev, dst, next_hop, &pinfo) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}
J
Johannes Berg 已提交
4403

4404
	return genlmsg_reply(msg, info);
4405 4406 4407 4408
}

static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
{
4409 4410
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4411 4412 4413 4414 4415 4416 4417 4418 4419 4420 4421 4422
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4423 4424
	if (!rdev->ops->change_mpath)
		return -EOPNOTSUPP;
4425

4426 4427
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4428

4429
	return rdev_change_mpath(rdev, dev, dst, next_hop);
4430
}
4431

4432 4433
static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
{
4434 4435
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4448 4449
	if (!rdev->ops->add_mpath)
		return -EOPNOTSUPP;
4450

4451 4452
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4453

4454
	return rdev_add_mpath(rdev, dev, dst, next_hop);
4455 4456 4457 4458
}

static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
{
4459 4460
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4461 4462 4463 4464 4465
	u8 *dst = NULL;

	if (info->attrs[NL80211_ATTR_MAC])
		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4466 4467
	if (!rdev->ops->del_mpath)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4468

4469
	return rdev_del_mpath(rdev, dev, dst);
4470 4471
}

4472 4473
static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
{
4474 4475
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4476
	struct wireless_dev *wdev = dev->ieee80211_ptr;
4477
	struct bss_parameters params;
4478
	int err;
4479 4480 4481 4482 4483 4484

	memset(&params, 0, sizeof(params));
	/* default to not changing parameters */
	params.use_cts_prot = -1;
	params.use_short_preamble = -1;
	params.use_short_slot_time = -1;
4485
	params.ap_isolate = -1;
4486
	params.ht_opmode = -1;
4487 4488
	params.p2p_ctwindow = -1;
	params.p2p_opp_ps = -1;
4489 4490 4491 4492 4493 4494 4495 4496 4497 4498

	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
		params.use_cts_prot =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
		params.use_short_preamble =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
		params.use_short_slot_time =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4499 4500 4501 4502 4503 4504
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		params.basic_rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		params.basic_rates_len =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
	}
4505 4506
	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4507 4508 4509
	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
		params.ht_opmode =
			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4510

4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow < 0)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

4537 4538
	if (!rdev->ops->change_bss)
		return -EOPNOTSUPP;
4539

4540
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4541 4542
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4543

4544 4545 4546 4547 4548
	wdev_lock(wdev);
	err = rdev_change_bss(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
4549 4550
}

A
Alexey Dobriyan 已提交
4551
static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599
	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
};

static int parse_reg_rule(struct nlattr *tb[],
	struct ieee80211_reg_rule *reg_rule)
{
	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;

	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
		return -EINVAL;
	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
		return -EINVAL;

	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);

	freq_range->start_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
	freq_range->end_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
	freq_range->max_bandwidth_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);

	power_rule->max_eirp =
		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);

	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
		power_rule->max_antenna_gain =
			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);

	return 0;
}

static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	int r;
	char *data = NULL;
4600
	enum nl80211_user_reg_hint_type user_reg_hint_type;
4601

4602 4603 4604 4605 4606 4607
	/*
	 * You should only get this when cfg80211 hasn't yet initialized
	 * completely when built-in to the kernel right between the time
	 * window between nl80211_init() and regulatory_init(), if that is
	 * even possible.
	 */
4608
	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4609
		return -EINPROGRESS;
4610

4611 4612
	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
		return -EINVAL;
4613 4614 4615

	data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);

4616 4617 4618 4619 4620 4621 4622 4623 4624 4625 4626 4627 4628 4629 4630
	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
		user_reg_hint_type =
		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
	else
		user_reg_hint_type = NL80211_USER_REG_HINT_USER;

	switch (user_reg_hint_type) {
	case NL80211_USER_REG_HINT_USER:
	case NL80211_USER_REG_HINT_CELL_BASE:
		break;
	default:
		return -EINVAL;
	}

	r = regulatory_hint_user(data, user_reg_hint_type);
4631

4632 4633 4634
	return r;
}

4635
static int nl80211_get_mesh_config(struct sk_buff *skb,
4636
				   struct genl_info *info)
4637
{
4638 4639
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4640 4641 4642
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct mesh_config cur_params;
	int err = 0;
4643 4644 4645 4646
	void *hdr;
	struct nlattr *pinfoattr;
	struct sk_buff *msg;

4647 4648 4649
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

4650
	if (!rdev->ops->get_mesh_config)
4651
		return -EOPNOTSUPP;
4652

4653 4654 4655 4656 4657
	wdev_lock(wdev);
	/* If not connected, get default parameters */
	if (!wdev->mesh_id_len)
		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
	else
4658
		err = rdev_get_mesh_config(rdev, dev, &cur_params);
4659 4660
	wdev_unlock(wdev);

4661
	if (err)
4662
		return err;
4663 4664

	/* Draw up a netlink message to send back */
4665
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4666 4667
	if (!msg)
		return -ENOMEM;
4668
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4669
			     NL80211_CMD_GET_MESH_CONFIG);
4670
	if (!hdr)
4671
		goto out;
4672
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4673 4674
	if (!pinfoattr)
		goto nla_put_failure;
4675 4676 4677 4678 4679 4680 4681 4682 4683 4684 4685 4686 4687 4688 4689 4690 4691
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
			cur_params.dot11MeshRetryTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
			cur_params.dot11MeshConfirmTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
			cur_params.dot11MeshHoldingTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
			cur_params.dot11MeshMaxPeerLinks) ||
	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
		       cur_params.dot11MeshMaxRetries) ||
	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
		       cur_params.dot11MeshTTL) ||
	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
		       cur_params.element_ttl) ||
	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
		       cur_params.auto_open_plinks) ||
4692 4693
	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4694 4695 4696 4697 4698 4699 4700 4701 4702 4703 4704 4705 4706 4707 4708 4709 4710 4711 4712 4713 4714 4715 4716
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
		       cur_params.dot11MeshHWMPmaxPREQretries) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
			cur_params.path_refresh_time) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
			cur_params.min_discovery_timeout) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
			cur_params.dot11MeshHWMPpreqMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
			cur_params.dot11MeshHWMPperrMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
		       cur_params.dot11MeshHWMPRootMode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
			cur_params.dot11MeshHWMPRannInterval) ||
	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
		       cur_params.dot11MeshGateAnnouncementProtocol) ||
	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
		       cur_params.dot11MeshForwarding) ||
	    nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4717 4718
			cur_params.rssi_threshold) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4719 4720 4721 4722
			cur_params.ht_opmode) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4723 4724
			cur_params.dot11MeshHWMProotInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4725 4726 4727 4728
			cur_params.dot11MeshHWMPconfirmationInterval) ||
	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
			cur_params.power_mode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4729 4730 4731
			cur_params.dot11MeshAwakeWindowDuration) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
			cur_params.plink_timeout))
4732
		goto nla_put_failure;
4733 4734
	nla_nest_end(msg, pinfoattr);
	genlmsg_end(msg, hdr);
4735
	return genlmsg_reply(msg, info);
4736

J
Johannes Berg 已提交
4737
 nla_put_failure:
4738
	genlmsg_cancel(msg, hdr);
4739
 out:
Y
Yuri Ershov 已提交
4740
	nlmsg_free(msg);
4741
	return -ENOBUFS;
4742 4743
}

A
Alexey Dobriyan 已提交
4744
static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4745 4746 4747 4748 4749 4750
	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4751
	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4752
	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4753
	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4754 4755 4756 4757 4758
	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4759
	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4760
	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4761
	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4762
	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4763
	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4764
	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4765 4766
	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4767 4768
	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4769
	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4770 4771
	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4772
	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4773 4774
};

4775 4776
static const struct nla_policy
	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4777
	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4778 4779
	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4780
	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4781
	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4782
	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4783
	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4784
				    .len = IEEE80211_MAX_DATA_LEN },
4785
	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4786 4787
};

4788
static int nl80211_parse_mesh_config(struct genl_info *info,
4789 4790
				     struct mesh_config *cfg,
				     u32 *mask_out)
4791 4792
{
	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4793
	u32 mask = 0;
4794

4795 4796 4797 4798 4799 4800 4801 4802 4803
#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
do {									    \
	if (tb[attr]) {							    \
		if (fn(tb[attr]) < min || fn(tb[attr]) > max)		    \
			return -EINVAL;					    \
		cfg->param = fn(tb[attr]);				    \
		mask |= (1 << (attr - 1));				    \
	}								    \
} while (0)
4804 4805


4806
	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4807 4808
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4809
			     info->attrs[NL80211_ATTR_MESH_CONFIG],
4810
			     nl80211_meshconf_params_policy))
4811 4812 4813 4814 4815 4816 4817
		return -EINVAL;

	/* This makes sure that there aren't more than 32 mesh config
	 * parameters (otherwise our bitfield scheme would not work.) */
	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);

	/* Fill in the params struct */
4818
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4819 4820
				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
				  nla_get_u16);
4821
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4822 4823
				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
				  nla_get_u16);
4824
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4825 4826
				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
				  nla_get_u16);
4827
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4828 4829
				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
				  nla_get_u16);
4830
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4831 4832
				  mask, NL80211_MESHCONF_MAX_RETRIES,
				  nla_get_u8);
4833
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4834
				  mask, NL80211_MESHCONF_TTL, nla_get_u8);
4835
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4836 4837
				  mask, NL80211_MESHCONF_ELEMENT_TTL,
				  nla_get_u8);
4838
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4839 4840
				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
				  nla_get_u8);
4841 4842
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
				  1, 255, mask,
4843 4844
				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
				  nla_get_u32);
4845
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4846 4847
				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
				  nla_get_u8);
4848
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4849 4850
				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
				  nla_get_u32);
4851
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4852 4853
				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
				  nla_get_u16);
4854 4855
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
				  1, 65535, mask,
4856 4857
				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
				  nla_get_u32);
4858
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4859 4860
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4861
				  nla_get_u16);
4862
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4863 4864
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4865
				  nla_get_u16);
4866
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4867 4868
				  dot11MeshHWMPnetDiameterTraversalTime,
				  1, 65535, mask,
4869 4870
				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
				  nla_get_u16);
4871 4872 4873 4874 4875
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
				  nla_get_u8);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4876
				  nla_get_u16);
4877
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4878 4879
				  dot11MeshGateAnnouncementProtocol, 0, 1,
				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4880
				  nla_get_u8);
4881
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4882 4883
				  mask, NL80211_MESHCONF_FORWARDING,
				  nla_get_u8);
4884
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4885
				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4886
				  nla_get_s32);
4887
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4888
				  mask, NL80211_MESHCONF_HT_OPMODE,
4889 4890
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4891
				  1, 65535, mask,
4892 4893
				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
				  nla_get_u32);
4894
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4895
				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4896 4897
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4898 4899
				  dot11MeshHWMPconfirmationInterval,
				  1, 65535, mask,
4900
				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4901
				  nla_get_u16);
4902 4903 4904 4905 4906 4907 4908 4909
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
				  NL80211_MESH_POWER_ACTIVE,
				  NL80211_MESH_POWER_MAX,
				  mask, NL80211_MESHCONF_POWER_MODE,
				  nla_get_u32);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
				  0, 65535, mask,
				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4910 4911 4912
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
				  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
				  nla_get_u32);
4913 4914
	if (mask_out)
		*mask_out = mask;
4915

4916 4917 4918 4919 4920
	return 0;

#undef FILL_IN_MESH_PARAM_IF_SET
}

4921 4922 4923
static int nl80211_parse_mesh_setup(struct genl_info *info,
				     struct mesh_setup *setup)
{
4924
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4925 4926 4927 4928 4929 4930 4931 4932 4933
	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];

	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
			     info->attrs[NL80211_ATTR_MESH_SETUP],
			     nl80211_mesh_setup_params_policy))
		return -EINVAL;

4934 4935 4936 4937 4938 4939
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
		setup->sync_method =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
		 IEEE80211_SYNC_METHOD_VENDOR :
		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;

4940 4941 4942 4943 4944 4945 4946 4947 4948 4949 4950 4951
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
		setup->path_sel_proto =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
		 IEEE80211_PATH_PROTOCOL_VENDOR :
		 IEEE80211_PATH_PROTOCOL_HWMP;

	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
		setup->path_metric =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
		 IEEE80211_PATH_METRIC_VENDOR :
		 IEEE80211_PATH_METRIC_AIRTIME;

4952 4953

	if (tb[NL80211_MESH_SETUP_IE]) {
4954
		struct nlattr *ieattr =
4955
			tb[NL80211_MESH_SETUP_IE];
4956 4957
		if (!is_valid_ie_attr(ieattr))
			return -EINVAL;
4958 4959
		setup->ie = nla_data(ieattr);
		setup->ie_len = nla_len(ieattr);
4960
	}
4961 4962 4963 4964
	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
		return -EINVAL;
	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4965 4966
	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4967 4968
	if (setup->is_secure)
		setup->user_mpm = true;
4969

4970 4971 4972 4973 4974 4975 4976
	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
		if (!setup->user_mpm)
			return -EINVAL;
		setup->auth_id =
			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
	}

4977 4978 4979
	return 0;
}

4980
static int nl80211_update_mesh_config(struct sk_buff *skb,
4981
				      struct genl_info *info)
4982 4983 4984
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4985
	struct wireless_dev *wdev = dev->ieee80211_ptr;
4986 4987 4988 4989
	struct mesh_config cfg;
	u32 mask;
	int err;

4990 4991 4992
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

4993
	if (!rdev->ops->update_mesh_config)
4994 4995
		return -EOPNOTSUPP;

4996
	err = nl80211_parse_mesh_config(info, &cfg, &mask);
4997 4998 4999
	if (err)
		return err;

5000 5001 5002 5003 5004
	wdev_lock(wdev);
	if (!wdev->mesh_id_len)
		err = -ENOLINK;

	if (!err)
5005
		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5006 5007 5008 5009

	wdev_unlock(wdev);

	return err;
5010 5011
}

5012 5013
static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
{
5014
	const struct ieee80211_regdomain *regdom;
5015 5016 5017 5018 5019 5020
	struct sk_buff *msg;
	void *hdr = NULL;
	struct nlattr *nl_reg_rules;
	unsigned int i;

	if (!cfg80211_regdomain)
5021
		return -EINVAL;
5022

5023
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5024 5025
	if (!msg)
		return -ENOBUFS;
5026

5027
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5028 5029
			     NL80211_CMD_GET_REG);
	if (!hdr)
5030
		goto put_failure;
5031

5032 5033 5034 5035 5036
	if (reg_last_request_cell_base() &&
	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
			NL80211_USER_REG_HINT_CELL_BASE))
		goto nla_put_failure;

5037 5038 5039 5040 5041 5042 5043 5044
	rcu_read_lock();
	regdom = rcu_dereference(cfg80211_regdomain);

	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
	    (regdom->dfs_region &&
	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
		goto nla_put_failure_rcu;

5045 5046
	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
	if (!nl_reg_rules)
5047
		goto nla_put_failure_rcu;
5048

5049
	for (i = 0; i < regdom->n_reg_rules; i++) {
5050 5051 5052 5053 5054
		struct nlattr *nl_reg_rule;
		const struct ieee80211_reg_rule *reg_rule;
		const struct ieee80211_freq_range *freq_range;
		const struct ieee80211_power_rule *power_rule;

5055
		reg_rule = &regdom->reg_rules[i];
5056 5057 5058 5059 5060
		freq_range = &reg_rule->freq_range;
		power_rule = &reg_rule->power_rule;

		nl_reg_rule = nla_nest_start(msg, i);
		if (!nl_reg_rule)
5061
			goto nla_put_failure_rcu;
5062

5063 5064 5065 5066 5067 5068 5069 5070 5071 5072 5073 5074
		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
				reg_rule->flags) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
				freq_range->start_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
				freq_range->end_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
				freq_range->max_bandwidth_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
				power_rule->max_antenna_gain) ||
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
				power_rule->max_eirp))
5075
			goto nla_put_failure_rcu;
5076 5077 5078

		nla_nest_end(msg, nl_reg_rule);
	}
5079
	rcu_read_unlock();
5080 5081 5082 5083

	nla_nest_end(msg, nl_reg_rules);

	genlmsg_end(msg, hdr);
5084
	return genlmsg_reply(msg, info);
5085

5086 5087
nla_put_failure_rcu:
	rcu_read_unlock();
5088 5089
nla_put_failure:
	genlmsg_cancel(msg, hdr);
5090
put_failure:
Y
Yuri Ershov 已提交
5091
	nlmsg_free(msg);
5092
	return -EMSGSIZE;
5093 5094
}

5095 5096 5097 5098 5099 5100 5101
static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
	struct nlattr *nl_reg_rule;
	char *alpha2 = NULL;
	int rem_reg_rules = 0, r = 0;
	u32 num_rules = 0, rule_idx = 0, size_of_regd;
5102
	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5103 5104 5105 5106 5107 5108 5109 5110 5111 5112
	struct ieee80211_regdomain *rd = NULL;

	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REG_RULES])
		return -EINVAL;

	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);

5113 5114 5115
	if (info->attrs[NL80211_ATTR_DFS_REGION])
		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);

5116
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
J
Johannes Berg 已提交
5117
			    rem_reg_rules) {
5118 5119
		num_rules++;
		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5120
			return -EINVAL;
5121 5122
	}

5123 5124 5125
	if (!reg_is_valid_request(alpha2))
		return -EINVAL;

5126
	size_of_regd = sizeof(struct ieee80211_regdomain) +
J
Johannes Berg 已提交
5127
		       num_rules * sizeof(struct ieee80211_reg_rule);
5128 5129

	rd = kzalloc(size_of_regd, GFP_KERNEL);
5130 5131
	if (!rd)
		return -ENOMEM;
5132 5133 5134 5135 5136

	rd->n_reg_rules = num_rules;
	rd->alpha2[0] = alpha2[0];
	rd->alpha2[1] = alpha2[1];

5137 5138 5139 5140 5141 5142 5143
	/*
	 * Disable DFS master mode if the DFS region was
	 * not supported or known on this kernel.
	 */
	if (reg_supported_dfs_region(dfs_region))
		rd->dfs_region = dfs_region;

5144
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
J
Johannes Berg 已提交
5145
			    rem_reg_rules) {
5146
		nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
J
Johannes Berg 已提交
5147 5148
			  nla_data(nl_reg_rule), nla_len(nl_reg_rule),
			  reg_rule_policy);
5149 5150 5151 5152 5153 5154
		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
		if (r)
			goto bad_reg;

		rule_idx++;

5155 5156
		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
			r = -EINVAL;
5157
			goto bad_reg;
5158
		}
5159 5160 5161
	}

	r = set_regdom(rd);
5162
	/* set_regdom took ownership */
J
Johannes Berg 已提交
5163
	rd = NULL;
5164

5165
 bad_reg:
5166
	kfree(rd);
5167
	return r;
5168 5169
}

5170 5171 5172 5173 5174 5175 5176 5177 5178 5179 5180 5181 5182 5183 5184 5185 5186 5187 5188 5189 5190 5191 5192 5193 5194
static int validate_scan_freqs(struct nlattr *freqs)
{
	struct nlattr *attr1, *attr2;
	int n_channels = 0, tmp1, tmp2;

	nla_for_each_nested(attr1, freqs, tmp1) {
		n_channels++;
		/*
		 * Some hardware has a limited channel list for
		 * scanning, and it is pretty much nonsensical
		 * to scan for a channel twice, so disallow that
		 * and don't require drivers to check that the
		 * channel list they get isn't longer than what
		 * they can scan, as long as they can scan all
		 * the channels they registered at once.
		 */
		nla_for_each_nested(attr2, freqs, tmp2)
			if (attr1 != attr2 &&
			    nla_get_u32(attr1) == nla_get_u32(attr2))
				return 0;
	}

	return n_channels;
}

5195 5196
static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
{
5197
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
J
Johannes Berg 已提交
5198
	struct wireless_dev *wdev = info->user_ptr[1];
5199 5200 5201
	struct cfg80211_scan_request *request;
	struct nlattr *attr;
	struct wiphy *wiphy;
5202
	int err, tmp, n_ssids = 0, n_channels, i;
5203
	size_t ie_len;
5204

5205 5206 5207
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

5208
	wiphy = &rdev->wiphy;
5209

5210 5211
	if (!rdev->ops->scan)
		return -EOPNOTSUPP;
5212

5213 5214 5215 5216
	if (rdev->scan_req) {
		err = -EBUSY;
		goto unlock;
	}
5217 5218

	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5219 5220
		n_channels = validate_scan_freqs(
				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5221 5222 5223 5224
		if (!n_channels) {
			err = -EINVAL;
			goto unlock;
		}
5225
	} else {
5226
		enum ieee80211_band band;
5227 5228
		n_channels = 0;

5229 5230 5231 5232 5233 5234 5235 5236 5237
		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
			if (wiphy->bands[band])
				n_channels += wiphy->bands[band]->n_channels;
	}

	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
			n_ssids++;

5238 5239 5240 5241
	if (n_ssids > wiphy->max_scan_ssids) {
		err = -EINVAL;
		goto unlock;
	}
5242

5243 5244 5245 5246 5247
	if (info->attrs[NL80211_ATTR_IE])
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	else
		ie_len = 0;

5248 5249 5250 5251
	if (ie_len > wiphy->max_scan_ie_len) {
		err = -EINVAL;
		goto unlock;
	}
5252

5253
	request = kzalloc(sizeof(*request)
5254 5255
			+ sizeof(*request->ssids) * n_ssids
			+ sizeof(*request->channels) * n_channels
5256
			+ ie_len, GFP_KERNEL);
5257 5258 5259 5260
	if (!request) {
		err = -ENOMEM;
		goto unlock;
	}
5261 5262

	if (n_ssids)
5263
		request->ssids = (void *)&request->channels[n_channels];
5264
	request->n_ssids = n_ssids;
5265 5266 5267 5268 5269 5270
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}
5271

J
Johannes Berg 已提交
5272
	i = 0;
5273 5274 5275
	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
J
Johannes Berg 已提交
5276 5277 5278 5279 5280
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
5281 5282 5283
				err = -EINVAL;
				goto out_free;
			}
J
Johannes Berg 已提交
5284 5285 5286 5287 5288 5289

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
5290 5291 5292
			i++;
		}
	} else {
5293 5294
		enum ieee80211_band band;

5295 5296 5297 5298 5299 5300
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
J
Johannes Berg 已提交
5301 5302 5303 5304 5305 5306 5307 5308
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
5309 5310 5311 5312 5313
				i++;
			}
		}
	}

J
Johannes Berg 已提交
5314 5315 5316 5317 5318 5319 5320
	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

5321 5322 5323
	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5324
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5325 5326 5327
				err = -EINVAL;
				goto out_free;
			}
5328
			request->ssids[i].ssid_len = nla_len(attr);
5329 5330 5331 5332 5333
			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
			i++;
		}
	}

5334 5335
	if (info->attrs[NL80211_ATTR_IE]) {
		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5336 5337
		memcpy((void *)request->ie,
		       nla_data(info->attrs[NL80211_ATTR_IE]),
5338 5339 5340
		       request->ie_len);
	}

5341
	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5342 5343 5344
		if (wiphy->bands[i])
			request->rates[i] =
				(1 << wiphy->bands[i]->n_bitrates) - 1;
5345 5346 5347 5348 5349 5350 5351

	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
				    tmp) {
			enum ieee80211_band band = nla_type(attr);

5352
			if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5353 5354 5355 5356 5357 5358 5359 5360 5361 5362 5363 5364
				err = -EINVAL;
				goto out_free;
			}
			err = ieee80211_get_ratemask(wiphy->bands[band],
						     nla_data(attr),
						     nla_len(attr),
						     &request->rates[band]);
			if (err)
				goto out_free;
		}
	}

5365
	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5366 5367
		request->flags = nla_get_u32(
			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5368 5369
		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5370 5371 5372 5373
			err = -EOPNOTSUPP;
			goto out_free;
		}
	}
5374

5375 5376 5377
	request->no_cck =
		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);

J
Johannes Berg 已提交
5378
	request->wdev = wdev;
5379
	request->wiphy = &rdev->wiphy;
5380
	request->scan_start = jiffies;
5381

5382
	rdev->scan_req = request;
5383
	err = rdev_scan(rdev, request);
5384

5385
	if (!err) {
J
Johannes Berg 已提交
5386 5387 5388
		nl80211_send_scan_start(rdev, wdev);
		if (wdev->netdev)
			dev_hold(wdev->netdev);
5389
	} else {
5390
 out_free:
5391
		rdev->scan_req = NULL;
5392 5393
		kfree(request);
	}
J
Johannes Berg 已提交
5394

5395
 unlock:
5396 5397 5398
	return err;
}

5399 5400 5401 5402 5403 5404 5405 5406
static int nl80211_start_sched_scan(struct sk_buff *skb,
				    struct genl_info *info)
{
	struct cfg80211_sched_scan_request *request;
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct nlattr *attr;
	struct wiphy *wiphy;
5407
	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5408
	u32 interval;
5409 5410
	enum ieee80211_band band;
	size_t ie_len;
5411
	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5412 5413 5414 5415 5416 5417 5418 5419

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_start)
		return -EOPNOTSUPP;

	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

5420 5421 5422 5423 5424 5425 5426
	if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
		return -EINVAL;

	interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
	if (interval == 0)
		return -EINVAL;

5427 5428 5429 5430 5431 5432 5433 5434 5435 5436 5437 5438 5439 5440 5441 5442 5443 5444 5445 5446
	wiphy = &rdev->wiphy;

	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		n_channels = validate_scan_freqs(
				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
		if (!n_channels)
			return -EINVAL;
	} else {
		n_channels = 0;

		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
			if (wiphy->bands[band])
				n_channels += wiphy->bands[band]->n_channels;
	}

	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
				    tmp)
			n_ssids++;

5447
	if (n_ssids > wiphy->max_sched_scan_ssids)
5448 5449
		return -EINVAL;

5450 5451 5452 5453 5454 5455 5456 5457 5458
	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
				    tmp)
			n_match_sets++;

	if (n_match_sets > wiphy->max_match_sets)
		return -EINVAL;

5459 5460 5461 5462 5463
	if (info->attrs[NL80211_ATTR_IE])
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	else
		ie_len = 0;

5464
	if (ie_len > wiphy->max_sched_scan_ie_len)
5465 5466
		return -EINVAL;

5467 5468 5469 5470 5471
	if (rdev->sched_scan_req) {
		err = -EINPROGRESS;
		goto out;
	}

5472
	request = kzalloc(sizeof(*request)
5473
			+ sizeof(*request->ssids) * n_ssids
5474
			+ sizeof(*request->match_sets) * n_match_sets
5475
			+ sizeof(*request->channels) * n_channels
5476
			+ ie_len, GFP_KERNEL);
5477 5478 5479 5480
	if (!request) {
		err = -ENOMEM;
		goto out;
	}
5481 5482 5483 5484 5485 5486 5487 5488 5489 5490 5491

	if (n_ssids)
		request->ssids = (void *)&request->channels[n_channels];
	request->n_ssids = n_ssids;
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}

5492 5493 5494 5495 5496 5497 5498 5499 5500 5501 5502 5503
	if (n_match_sets) {
		if (request->ie)
			request->match_sets = (void *)(request->ie + ie_len);
		else if (request->ssids)
			request->match_sets =
				(void *)(request->ssids + n_ssids);
		else
			request->match_sets =
				(void *)(request->channels + n_channels);
	}
	request->n_match_sets = n_match_sets;

5504 5505 5506 5507 5508 5509 5510 5511 5512 5513 5514 5515 5516 5517 5518 5519 5520 5521 5522 5523 5524 5525 5526 5527 5528 5529 5530 5531 5532 5533 5534 5535 5536 5537 5538 5539 5540 5541 5542 5543 5544 5545 5546 5547 5548 5549 5550 5551 5552 5553 5554 5555 5556
	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
				    tmp) {
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
				err = -EINVAL;
				goto out_free;
			}

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
			i++;
		}
	} else {
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
				i++;
			}
		}
	}

	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
				    tmp) {
5557
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5558 5559 5560
				err = -EINVAL;
				goto out_free;
			}
5561
			request->ssids[i].ssid_len = nla_len(attr);
5562 5563 5564 5565 5566 5567
			memcpy(request->ssids[i].ssid, nla_data(attr),
			       nla_len(attr));
			i++;
		}
	}

5568 5569 5570 5571 5572
	i = 0;
	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
				    tmp) {
5573
			struct nlattr *ssid, *rssi;
5574 5575 5576 5577

			nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
				  nla_data(attr), nla_len(attr),
				  nl80211_match_policy);
5578
			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5579 5580 5581 5582 5583 5584 5585 5586 5587 5588
			if (ssid) {
				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
					err = -EINVAL;
					goto out_free;
				}
				memcpy(request->match_sets[i].ssid.ssid,
				       nla_data(ssid), nla_len(ssid));
				request->match_sets[i].ssid.ssid_len =
					nla_len(ssid);
			}
5589 5590 5591 5592 5593 5594
			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
			if (rssi)
				request->rssi_thold = nla_get_u32(rssi);
			else
				request->rssi_thold =
						   NL80211_SCAN_RSSI_THOLD_OFF;
5595 5596 5597 5598
			i++;
		}
	}

5599 5600 5601 5602 5603 5604 5605
	if (info->attrs[NL80211_ATTR_IE]) {
		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
		memcpy((void *)request->ie,
		       nla_data(info->attrs[NL80211_ATTR_IE]),
		       request->ie_len);
	}

5606
	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5607 5608
		request->flags = nla_get_u32(
			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5609 5610
		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5611 5612 5613 5614
			err = -EOPNOTSUPP;
			goto out_free;
		}
	}
5615

5616 5617
	request->dev = dev;
	request->wiphy = &rdev->wiphy;
5618
	request->interval = interval;
5619
	request->scan_start = jiffies;
5620

5621
	err = rdev_sched_scan_start(rdev, dev, request);
5622 5623 5624 5625 5626 5627 5628 5629 5630 5631 5632 5633 5634 5635 5636 5637 5638 5639 5640 5641 5642 5643
	if (!err) {
		rdev->sched_scan_req = request;
		nl80211_send_sched_scan(rdev, dev,
					NL80211_CMD_START_SCHED_SCAN);
		goto out;
	}

out_free:
	kfree(request);
out:
	return err;
}

static int nl80211_stop_sched_scan(struct sk_buff *skb,
				   struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_stop)
		return -EOPNOTSUPP;

5644
	return __cfg80211_stop_sched_scan(rdev, false);
5645 5646
}

5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657 5658 5659
static int nl80211_start_radar_detection(struct sk_buff *skb,
					 struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_chan_def chandef;
	int err;

	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;

5660 5661 5662
	if (netif_carrier_ok(dev))
		return -EBUSY;

5663 5664 5665 5666 5667 5668 5669 5670 5671 5672
	if (wdev->cac_started)
		return -EBUSY;

	err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
	if (err < 0)
		return err;

	if (err == 0)
		return -EINVAL;

5673
	if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5674 5675 5676 5677 5678 5679 5680 5681 5682
		return -EINVAL;

	if (!rdev->ops->start_radar_detection)
		return -EOPNOTSUPP;

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   chandef.chan, CHAN_MODE_SHARED,
					   BIT(chandef.width));
	if (err)
5683
		return err;
5684 5685 5686 5687 5688 5689 5690 5691 5692 5693

	err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
	if (!err) {
		wdev->channel = chandef.chan;
		wdev->cac_started = true;
		wdev->cac_start_time = jiffies;
	}
	return err;
}

5694 5695 5696 5697 5698 5699 5700 5701 5702 5703 5704 5705
static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_csa_settings params;
	/* csa_attrs is defined static to avoid waste of stack size - this
	 * function is called under RTNL lock, so this should not be a problem.
	 */
	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
	u8 radar_detect_width = 0;
	int err;
5706
	bool need_new_beacon = false;
5707 5708 5709 5710 5711

	if (!rdev->ops->channel_switch ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
		return -EOPNOTSUPP;

5712 5713 5714 5715 5716 5717 5718 5719 5720 5721
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
		need_new_beacon = true;

		/* useless if AP is not running */
		if (!wdev->beacon_interval)
			return -EINVAL;
		break;
	case NL80211_IFTYPE_ADHOC:
5722
	case NL80211_IFTYPE_MESH_POINT:
5723 5724
		break;
	default:
5725
		return -EOPNOTSUPP;
5726
	}
5727 5728 5729 5730 5731 5732 5733 5734

	memset(&params, 0, sizeof(params));

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
		return -EINVAL;

	/* only important for AP, IBSS and mesh create IEs internally */
5735
	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5736 5737 5738 5739
		return -EINVAL;

	params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);

5740 5741 5742
	if (!need_new_beacon)
		goto skip_beacons;

5743 5744 5745 5746 5747 5748 5749 5750 5751 5752 5753 5754 5755 5756 5757 5758 5759 5760 5761 5762 5763 5764 5765 5766 5767 5768 5769 5770 5771 5772 5773 5774 5775 5776 5777 5778 5779 5780 5781
	err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
	if (err)
		return err;

	err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
			       info->attrs[NL80211_ATTR_CSA_IES],
			       nl80211_policy);
	if (err)
		return err;

	err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
	if (err)
		return err;

	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
		return -EINVAL;

	params.counter_offset_beacon =
		nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
	if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
		return -EINVAL;

	/* sanity check - counters should be the same */
	if (params.beacon_csa.tail[params.counter_offset_beacon] !=
	    params.count)
		return -EINVAL;

	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
		params.counter_offset_presp =
			nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
		if (params.counter_offset_presp >=
		    params.beacon_csa.probe_resp_len)
			return -EINVAL;

		if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
		    params.count)
			return -EINVAL;
	}

5782
skip_beacons:
5783 5784 5785 5786 5787 5788 5789
	err = nl80211_parse_chandef(rdev, info, &params.chandef);
	if (err)
		return err;

	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
		return -EINVAL;

5790
	if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5791 5792
	    dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
	    dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5793 5794 5795 5796 5797 5798 5799 5800
		err = cfg80211_chandef_dfs_required(wdev->wiphy,
						    &params.chandef);
		if (err < 0) {
			return err;
		} else if (err) {
			radar_detect_width = BIT(params.chandef.width);
			params.radar_required = true;
		}
5801 5802 5803 5804 5805 5806 5807 5808 5809 5810 5811 5812
	}

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   params.chandef.chan,
					   CHAN_MODE_SHARED,
					   radar_detect_width);
	if (err)
		return err;

	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
		params.block_tx = true;

5813 5814 5815 5816 5817
	wdev_lock(wdev);
	err = rdev_channel_switch(rdev, dev, &params);
	wdev_unlock(wdev);

	return err;
5818 5819
}

5820 5821
static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
			    u32 seq, int flags,
5822
			    struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
5823 5824
			    struct wireless_dev *wdev,
			    struct cfg80211_internal_bss *intbss)
5825
{
J
Johannes Berg 已提交
5826
	struct cfg80211_bss *res = &intbss->pub;
5827
	const struct cfg80211_bss_ies *ies;
5828 5829
	void *hdr;
	struct nlattr *bss;
J
Johannes Berg 已提交
5830
	bool tsf = false;
J
Johannes Berg 已提交
5831 5832

	ASSERT_WDEV_LOCK(wdev);
5833

5834
	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5835 5836 5837 5838
			     NL80211_CMD_NEW_SCAN_RESULTS);
	if (!hdr)
		return -1;

5839 5840
	genl_dump_check_consistent(cb, hdr, &nl80211_fam);

5841 5842 5843
	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
		goto nla_put_failure;
	if (wdev->netdev &&
5844 5845
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
		goto nla_put_failure;
5846 5847
	if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;
5848 5849 5850 5851

	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
	if (!bss)
		goto nla_put_failure;
5852
	if ((!is_zero_ether_addr(res->bssid) &&
5853
	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5854
		goto nla_put_failure;
5855 5856 5857

	rcu_read_lock();
	ies = rcu_dereference(res->ies);
J
Johannes Berg 已提交
5858 5859 5860 5861 5862 5863 5864
	if (ies) {
		if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
			goto fail_unlock_rcu;
		tsf = true;
		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
					ies->len, ies->data))
			goto fail_unlock_rcu;
5865 5866
	}
	ies = rcu_dereference(res->beacon_ies);
J
Johannes Berg 已提交
5867 5868 5869 5870 5871 5872
	if (ies) {
		if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
			goto fail_unlock_rcu;
		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
					ies->len, ies->data))
			goto fail_unlock_rcu;
5873 5874 5875
	}
	rcu_read_unlock();

5876 5877 5878 5879 5880
	if (res->beacon_interval &&
	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
		goto nla_put_failure;
	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5881
	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5882 5883 5884
	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
			jiffies_to_msecs(jiffies - intbss->ts)))
		goto nla_put_failure;
5885

J
Johannes Berg 已提交
5886
	switch (rdev->wiphy.signal_type) {
5887
	case CFG80211_SIGNAL_TYPE_MBM:
5888 5889
		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
			goto nla_put_failure;
5890 5891
		break;
	case CFG80211_SIGNAL_TYPE_UNSPEC:
5892 5893
		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
			goto nla_put_failure;
5894 5895 5896 5897 5898
		break;
	default:
		break;
	}

J
Johannes Berg 已提交
5899
	switch (wdev->iftype) {
5900
	case NL80211_IFTYPE_P2P_CLIENT:
J
Johannes Berg 已提交
5901
	case NL80211_IFTYPE_STATION:
5902 5903 5904 5905
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_ASSOCIATED))
			goto nla_put_failure;
J
Johannes Berg 已提交
5906 5907
		break;
	case NL80211_IFTYPE_ADHOC:
5908 5909 5910 5911
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_IBSS_JOINED))
			goto nla_put_failure;
J
Johannes Berg 已提交
5912 5913 5914 5915 5916
		break;
	default:
		break;
	}

5917 5918 5919 5920
	nla_nest_end(msg, bss);

	return genlmsg_end(msg, hdr);

J
Johannes Berg 已提交
5921 5922
 fail_unlock_rcu:
	rcu_read_unlock();
5923 5924 5925 5926 5927
 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

5928
static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5929
{
J
Johannes Berg 已提交
5930
	struct cfg80211_registered_device *rdev;
5931
	struct cfg80211_internal_bss *scan;
J
Johannes Berg 已提交
5932
	struct wireless_dev *wdev;
5933
	int start = cb->args[2], idx = 0;
5934 5935
	int err;

5936
	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5937 5938
	if (err)
		return err;
5939

J
Johannes Berg 已提交
5940 5941 5942 5943
	wdev_lock(wdev);
	spin_lock_bh(&rdev->bss_lock);
	cfg80211_bss_expire(rdev);

5944 5945
	cb->seq = rdev->bss_generation;

J
Johannes Berg 已提交
5946
	list_for_each_entry(scan, &rdev->bss_list, list) {
5947 5948
		if (++idx <= start)
			continue;
5949
		if (nl80211_send_bss(skb, cb,
5950
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
J
Johannes Berg 已提交
5951
				rdev, wdev, scan) < 0) {
5952
			idx--;
5953
			break;
5954 5955 5956
		}
	}

J
Johannes Berg 已提交
5957 5958
	spin_unlock_bh(&rdev->bss_lock);
	wdev_unlock(wdev);
5959

5960 5961
	cb->args[2] = idx;
	nl80211_finish_wdev_dump(rdev);
5962

5963
	return skb->len;
5964 5965
}

5966
static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5967 5968 5969 5970 5971 5972
				int flags, struct net_device *dev,
				struct survey_info *survey)
{
	void *hdr;
	struct nlattr *infoattr;

5973
	hdr = nl80211hdr_put(msg, portid, seq, flags,
5974 5975 5976 5977
			     NL80211_CMD_NEW_SURVEY_RESULTS);
	if (!hdr)
		return -ENOMEM;

5978 5979
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
		goto nla_put_failure;
5980 5981 5982 5983 5984

	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
	if (!infoattr)
		goto nla_put_failure;

5985 5986 5987 5988 5989 5990 5991 5992 5993 5994 5995 5996 5997 5998 5999 6000 6001 6002 6003 6004 6005 6006 6007 6008 6009 6010 6011 6012 6013 6014
	if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
			survey->channel->center_freq))
		goto nla_put_failure;

	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_IN_USE) &&
	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
			survey->channel_time))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
			survey->channel_time_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
			survey->channel_time_ext_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
			survey->channel_time_rx))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
			survey->channel_time_tx))
		goto nla_put_failure;
6015 6016 6017 6018 6019 6020 6021 6022 6023 6024 6025 6026 6027 6028 6029

	nla_nest_end(msg, infoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

static int nl80211_dump_survey(struct sk_buff *skb,
			struct netlink_callback *cb)
{
	struct survey_info survey;
	struct cfg80211_registered_device *dev;
6030 6031
	struct wireless_dev *wdev;
	int survey_idx = cb->args[2];
6032 6033
	int res;

6034
	res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6035 6036
	if (res)
		return res;
6037

6038 6039 6040 6041 6042
	if (!wdev->netdev) {
		res = -EINVAL;
		goto out_err;
	}

6043 6044 6045 6046 6047 6048
	if (!dev->ops->dump_survey) {
		res = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
6049 6050
		struct ieee80211_channel *chan;

6051
		res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6052 6053 6054 6055 6056
		if (res == -ENOENT)
			break;
		if (res)
			goto out_err;

6057 6058 6059 6060 6061 6062 6063 6064 6065 6066 6067 6068 6069
		/* Survey without a channel doesn't make sense */
		if (!survey.channel) {
			res = -EINVAL;
			goto out;
		}

		chan = ieee80211_get_channel(&dev->wiphy,
					     survey.channel->center_freq);
		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
			survey_idx++;
			continue;
		}

6070
		if (nl80211_send_survey(skb,
6071
				NETLINK_CB(cb->skb).portid,
6072
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
6073
				wdev->netdev, &survey) < 0)
6074 6075 6076 6077 6078
			goto out;
		survey_idx++;
	}

 out:
6079
	cb->args[2] = survey_idx;
6080 6081
	res = skb->len;
 out_err:
6082
	nl80211_finish_wdev_dump(dev);
6083 6084 6085
	return res;
}

S
Samuel Ortiz 已提交
6086 6087 6088 6089 6090 6091
static bool nl80211_valid_wpa_versions(u32 wpa_versions)
{
	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
				  NL80211_WPA_VERSION_2));
}

6092 6093
static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
{
6094 6095
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6096
	struct ieee80211_channel *chan;
6097 6098
	const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
	int err, ssid_len, ie_len = 0, sae_data_len = 0;
J
Johannes Berg 已提交
6099
	enum nl80211_auth_type auth_type;
J
Johannes Berg 已提交
6100
	struct key_parse key;
6101
	bool local_state_change;
6102

6103 6104 6105 6106 6107 6108
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

6109 6110 6111
	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
		return -EINVAL;

J
Johannes Berg 已提交
6112 6113 6114 6115 6116 6117
	if (!info->attrs[NL80211_ATTR_SSID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

J
Johannes Berg 已提交
6118 6119 6120 6121 6122
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;

	if (key.idx >= 0) {
6123 6124
		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
			return -EINVAL;
J
Johannes Berg 已提交
6125 6126 6127 6128 6129 6130 6131 6132 6133 6134 6135 6136 6137 6138
		if (!key.p.key || !key.p.key_len)
			return -EINVAL;
		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP104))
			return -EINVAL;
		if (key.idx > 4)
			return -EINVAL;
	} else {
		key.p.key_len = 0;
		key.p.key = NULL;
	}

6139 6140 6141 6142 6143 6144 6145 6146 6147
	if (key.idx >= 0) {
		int i;
		bool ok = false;
		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
				ok = true;
				break;
			}
		}
6148 6149
		if (!ok)
			return -EINVAL;
6150 6151
	}

6152 6153
	if (!rdev->ops->auth)
		return -EOPNOTSUPP;
6154

6155
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6156 6157
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6158

J
Johannes Berg 已提交
6159
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6160
	chan = ieee80211_get_channel(&rdev->wiphy,
J
Johannes Berg 已提交
6161
		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6162 6163
	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
		return -EINVAL;
6164

J
Johannes Berg 已提交
6165 6166
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6167 6168

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6169 6170
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6171 6172
	}

J
Johannes Berg 已提交
6173
	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6174
	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6175
		return -EINVAL;
6176

6177 6178 6179 6180 6181 6182 6183 6184 6185 6186 6187 6188 6189 6190
	if (auth_type == NL80211_AUTHTYPE_SAE &&
	    !info->attrs[NL80211_ATTR_SAE_DATA])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_SAE_DATA]) {
		if (auth_type != NL80211_AUTHTYPE_SAE)
			return -EINVAL;
		sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
		sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
		/* need to include at least Auth Transaction and Status Code */
		if (sae_data_len < 4)
			return -EINVAL;
	}

6191 6192
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6193 6194 6195 6196 6197 6198 6199
	/*
	 * Since we no longer track auth state, ignore
	 * requests to only change local state.
	 */
	if (local_state_change)
		return 0;

6200 6201 6202 6203 6204 6205 6206
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
				 ssid, ssid_len, ie, ie_len,
				 key.p.key, key.p.key_len, key.idx,
				 sae_data, sae_data_len);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6207 6208
}

6209 6210
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
6211 6212
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit)
S
Samuel Ortiz 已提交
6213
{
6214 6215
	memset(settings, 0, sizeof(*settings));

S
Samuel Ortiz 已提交
6216 6217
	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];

6218 6219 6220 6221 6222 6223 6224 6225 6226 6227 6228 6229 6230
	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
		u16 proto;
		proto = nla_get_u16(
			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
		settings->control_port_ethertype = cpu_to_be16(proto);
		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
		    proto != ETH_P_PAE)
			return -EINVAL;
		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
			settings->control_port_no_encrypt = true;
	} else
		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);

S
Samuel Ortiz 已提交
6231 6232 6233 6234 6235 6236 6237 6238 6239 6240 6241
	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
		void *data;
		int len, i;

		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		settings->n_ciphers_pairwise = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6242
		if (settings->n_ciphers_pairwise > cipher_limit)
S
Samuel Ortiz 已提交
6243 6244 6245 6246 6247
			return -EINVAL;

		memcpy(settings->ciphers_pairwise, data, len);

		for (i = 0; i < settings->n_ciphers_pairwise; i++)
6248 6249
			if (!cfg80211_supported_cipher_suite(
					&rdev->wiphy,
S
Samuel Ortiz 已提交
6250 6251 6252 6253 6254 6255 6256
					settings->ciphers_pairwise[i]))
				return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
		settings->cipher_group =
			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6257 6258
		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
						     settings->cipher_group))
S
Samuel Ortiz 已提交
6259 6260 6261 6262 6263 6264 6265 6266 6267 6268 6269 6270
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
		settings->wpa_versions =
			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
		void *data;
6271
		int len;
S
Samuel Ortiz 已提交
6272 6273 6274 6275 6276 6277 6278 6279

		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
		settings->n_akm_suites = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6280 6281 6282
		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
			return -EINVAL;

S
Samuel Ortiz 已提交
6283 6284 6285 6286 6287 6288
		memcpy(settings->akm_suites, data, len);
	}

	return 0;
}

6289 6290
static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
{
6291 6292
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6293
	struct ieee80211_channel *chan;
6294 6295 6296
	struct cfg80211_assoc_request req = {};
	const u8 *bssid, *ssid;
	int err, ssid_len = 0;
6297

6298 6299 6300 6301
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC] ||
J
Johannes Berg 已提交
6302 6303
	    !info->attrs[NL80211_ATTR_SSID] ||
	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6304 6305
		return -EINVAL;

6306 6307
	if (!rdev->ops->assoc)
		return -EOPNOTSUPP;
6308

6309
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6310 6311
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6312

J
Johannes Berg 已提交
6313
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6314

J
Johannes Berg 已提交
6315 6316
	chan = ieee80211_get_channel(&rdev->wiphy,
		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6317 6318
	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
		return -EINVAL;
6319

J
Johannes Berg 已提交
6320 6321
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6322 6323

	if (info->attrs[NL80211_ATTR_IE]) {
6324 6325
		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6326 6327
	}

6328
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
6329
		enum nl80211_mfp mfp =
6330
			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6331
		if (mfp == NL80211_MFP_REQUIRED)
6332
			req.use_mfp = true;
6333 6334
		else if (mfp != NL80211_MFP_NO)
			return -EINVAL;
6335 6336
	}

6337
	if (info->attrs[NL80211_ATTR_PREV_BSSID])
6338
		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6339

6340
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6341
		req.flags |= ASSOC_REQ_DISABLE_HT;
6342 6343

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6344 6345 6346
		memcpy(&req.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(req.ht_capa_mask));
6347 6348

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6349
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6350
			return -EINVAL;
6351 6352 6353
		memcpy(&req.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(req.ht_capa));
6354 6355
	}

6356
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6357
		req.flags |= ASSOC_REQ_DISABLE_VHT;
6358 6359

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6360 6361 6362
		memcpy(&req.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(req.vht_capa_mask));
6363 6364

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6365
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6366
			return -EINVAL;
6367 6368 6369
		memcpy(&req.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(req.vht_capa));
6370 6371
	}

6372
	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6373 6374
	if (!err) {
		wdev_lock(dev->ieee80211_ptr);
6375 6376
		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
					  ssid, ssid_len, &req);
6377 6378
		wdev_unlock(dev->ieee80211_ptr);
	}
6379 6380 6381 6382 6383 6384

	return err;
}

static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
{
6385 6386
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6387
	const u8 *ie = NULL, *bssid;
6388
	int ie_len = 0, err;
J
Johannes Berg 已提交
6389
	u16 reason_code;
6390
	bool local_state_change;
6391

6392 6393 6394 6395 6396 6397 6398 6399 6400
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6401 6402
	if (!rdev->ops->deauth)
		return -EOPNOTSUPP;
6403

6404
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6405 6406
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6407

J
Johannes Berg 已提交
6408
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6409

J
Johannes Berg 已提交
6410 6411
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6412
		/* Reason Code 0 is reserved */
6413
		return -EINVAL;
6414
	}
6415 6416

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6417 6418
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6419 6420
	}

6421 6422
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6423 6424 6425 6426 6427
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
				   local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6428 6429 6430 6431
}

static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
{
6432 6433
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6434
	const u8 *ie = NULL, *bssid;
6435
	int ie_len = 0, err;
J
Johannes Berg 已提交
6436
	u16 reason_code;
6437
	bool local_state_change;
6438

6439 6440 6441 6442 6443 6444 6445 6446 6447
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6448 6449
	if (!rdev->ops->disassoc)
		return -EOPNOTSUPP;
6450

6451
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6452 6453
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6454

J
Johannes Berg 已提交
6455
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6456

J
Johannes Berg 已提交
6457 6458
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6459
		/* Reason Code 0 is reserved */
6460
		return -EINVAL;
6461
	}
6462 6463

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6464 6465
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6466 6467
	}

6468 6469
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6470 6471 6472 6473 6474
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
				     local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6475 6476
}

6477 6478 6479 6480 6481 6482 6483 6484 6485 6486 6487 6488 6489 6490 6491 6492 6493 6494 6495 6496 6497 6498 6499 6500 6501 6502 6503 6504
static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
			 int mcast_rate[IEEE80211_NUM_BANDS],
			 int rateval)
{
	struct wiphy *wiphy = &rdev->wiphy;
	bool found = false;
	int band, i;

	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
		struct ieee80211_supported_band *sband;

		sband = wiphy->bands[band];
		if (!sband)
			continue;

		for (i = 0; i < sband->n_bitrates; i++) {
			if (sband->bitrates[i].bitrate == rateval) {
				mcast_rate[band] = i + 1;
				found = true;
				break;
			}
		}
	}

	return found;
}

J
Johannes Berg 已提交
6505 6506
static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
{
6507 6508
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6509 6510
	struct cfg80211_ibss_params ibss;
	struct wiphy *wiphy;
J
Johannes Berg 已提交
6511
	struct cfg80211_cached_keys *connkeys = NULL;
J
Johannes Berg 已提交
6512 6513
	int err;

6514 6515
	memset(&ibss, 0, sizeof(ibss));

J
Johannes Berg 已提交
6516 6517 6518
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

6519
	if (!info->attrs[NL80211_ATTR_SSID] ||
J
Johannes Berg 已提交
6520 6521 6522
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

6523 6524 6525 6526 6527 6528 6529 6530 6531
	ibss.beacon_interval = 100;

	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		ibss.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
			return -EINVAL;
	}

6532 6533
	if (!rdev->ops->join_ibss)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6534

6535 6536
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6537

6538
	wiphy = &rdev->wiphy;
J
Johannes Berg 已提交
6539

J
Johannes Berg 已提交
6540
	if (info->attrs[NL80211_ATTR_MAC]) {
J
Johannes Berg 已提交
6541
		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
J
Johannes Berg 已提交
6542 6543 6544 6545

		if (!is_valid_ether_addr(ibss.bssid))
			return -EINVAL;
	}
J
Johannes Berg 已提交
6546 6547 6548 6549 6550 6551 6552 6553
	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

6554 6555 6556
	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
	if (err)
		return err;
J
Johannes Berg 已提交
6557

6558
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6559 6560
		return -EINVAL;

6561
	switch (ibss.chandef.width) {
6562 6563
	case NL80211_CHAN_WIDTH_5:
	case NL80211_CHAN_WIDTH_10:
6564 6565 6566 6567 6568 6569 6570
	case NL80211_CHAN_WIDTH_20_NOHT:
		break;
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
			break;
	default:
6571
		return -EINVAL;
6572
	}
6573

J
Johannes Berg 已提交
6574
	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
J
Johannes Berg 已提交
6575 6576
	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

6577 6578 6579 6580 6581 6582
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband =
6583
			wiphy->bands[ibss.chandef.chan->band];
6584

6585 6586 6587 6588
		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &ibss.basic_rates);
		if (err)
			return err;
6589
	}
6590

6591 6592 6593 6594 6595 6596 6597 6598 6599 6600 6601 6602 6603
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&ibss.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(ibss.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
			return -EINVAL;
		memcpy(&ibss.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(ibss.ht_capa));
	}

6604 6605 6606 6607
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
		return -EINVAL;
6608

6609
	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6610 6611
		bool no_ht = false;

6612
		connkeys = nl80211_parse_connkeys(rdev,
6613 6614
					  info->attrs[NL80211_ATTR_KEYS],
					  &no_ht);
6615 6616
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
6617

6618 6619
		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
		    no_ht) {
6620 6621 6622
			kfree(connkeys);
			return -EINVAL;
		}
6623
	}
J
Johannes Berg 已提交
6624

6625 6626 6627
	ibss.control_port =
		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);

6628 6629 6630
	ibss.userspace_handles_dfs =
		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);

6631
	err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
J
Johannes Berg 已提交
6632 6633
	if (err)
		kfree(connkeys);
J
Johannes Berg 已提交
6634 6635 6636 6637 6638
	return err;
}

static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
{
6639 6640
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6641

6642 6643
	if (!rdev->ops->leave_ibss)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6644

6645 6646
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6647

6648
	return cfg80211_leave_ibss(rdev, dev, false);
J
Johannes Berg 已提交
6649 6650
}

6651 6652 6653 6654 6655 6656 6657 6658 6659 6660 6661 6662 6663 6664 6665 6666 6667 6668 6669 6670 6671 6672 6673 6674 6675 6676 6677 6678 6679 6680
static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	int mcast_rate[IEEE80211_NUM_BANDS];
	u32 nla_rate;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

	if (!rdev->ops->set_mcast_rate)
		return -EOPNOTSUPP;

	memset(mcast_rate, 0, sizeof(mcast_rate));

	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
		return -EINVAL;

	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
		return -EINVAL;

	err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);

	return err;
}


6681 6682 6683 6684 6685 6686 6687
#ifdef CONFIG_NL80211_TESTMODE
static struct genl_multicast_group nl80211_testmode_mcgrp = {
	.name = "testmode",
};

static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
{
6688
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6689 6690
	struct wireless_dev *wdev =
		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6691 6692
	int err;

6693 6694 6695 6696 6697 6698 6699 6700 6701 6702 6703 6704
	if (!rdev->ops->testmode_cmd)
		return -EOPNOTSUPP;

	if (IS_ERR(wdev)) {
		err = PTR_ERR(wdev);
		if (err != -EINVAL)
			return err;
		wdev = NULL;
	} else if (wdev->wiphy != &rdev->wiphy) {
		return -EINVAL;
	}

6705 6706 6707
	if (!info->attrs[NL80211_ATTR_TESTDATA])
		return -EINVAL;

6708 6709
	rdev->testmode_info = info;
	err = rdev_testmode_cmd(rdev, wdev,
6710 6711
				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6712
	rdev->testmode_info = NULL;
6713 6714 6715 6716

	return err;
}

W
Wey-Yi Guy 已提交
6717 6718 6719
static int nl80211_testmode_dump(struct sk_buff *skb,
				 struct netlink_callback *cb)
{
6720
	struct cfg80211_registered_device *rdev;
W
Wey-Yi Guy 已提交
6721 6722 6723 6724 6725
	int err;
	long phy_idx;
	void *data = NULL;
	int data_len = 0;

6726 6727
	rtnl_lock();

W
Wey-Yi Guy 已提交
6728 6729 6730 6731 6732 6733 6734 6735 6736 6737 6738
	if (cb->args[0]) {
		/*
		 * 0 is a valid index, but not valid for args[0],
		 * so we need to offset by 1.
		 */
		phy_idx = cb->args[0] - 1;
	} else {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
6739
			goto out_err;
6740

6741 6742 6743
		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
						  nl80211_fam.attrbuf);
		if (IS_ERR(rdev)) {
6744 6745
			err = PTR_ERR(rdev);
			goto out_err;
6746
		}
6747 6748 6749
		phy_idx = rdev->wiphy_idx;
		rdev = NULL;

W
Wey-Yi Guy 已提交
6750 6751 6752 6753 6754 6755 6756 6757 6758 6759
		if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
			cb->args[1] =
				(long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
	}

	if (cb->args[1]) {
		data = nla_data((void *)cb->args[1]);
		data_len = nla_len((void *)cb->args[1]);
	}

6760 6761
	rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
	if (!rdev) {
6762 6763
		err = -ENOENT;
		goto out_err;
W
Wey-Yi Guy 已提交
6764 6765
	}

6766
	if (!rdev->ops->testmode_dump) {
W
Wey-Yi Guy 已提交
6767 6768 6769 6770 6771
		err = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
6772
		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
W
Wey-Yi Guy 已提交
6773 6774 6775 6776
					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
					   NL80211_CMD_TESTMODE);
		struct nlattr *tmdata;

6777 6778 6779
		if (!hdr)
			break;

6780
		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
W
Wey-Yi Guy 已提交
6781 6782 6783 6784 6785 6786 6787 6788 6789
			genlmsg_cancel(skb, hdr);
			break;
		}

		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
		if (!tmdata) {
			genlmsg_cancel(skb, hdr);
			break;
		}
6790
		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
W
Wey-Yi Guy 已提交
6791 6792 6793 6794 6795 6796 6797 6798 6799 6800 6801 6802 6803 6804 6805 6806 6807
		nla_nest_end(skb, tmdata);

		if (err == -ENOBUFS || err == -ENOENT) {
			genlmsg_cancel(skb, hdr);
			break;
		} else if (err) {
			genlmsg_cancel(skb, hdr);
			goto out_err;
		}

		genlmsg_end(skb, hdr);
	}

	err = skb->len;
	/* see above */
	cb->args[0] = phy_idx + 1;
 out_err:
6808
	rtnl_unlock();
W
Wey-Yi Guy 已提交
6809 6810 6811
	return err;
}

6812 6813
static struct sk_buff *
__cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6814
			      int approxlen, u32 portid, u32 seq, gfp_t gfp)
6815 6816 6817 6818 6819 6820 6821 6822 6823
{
	struct sk_buff *skb;
	void *hdr;
	struct nlattr *data;

	skb = nlmsg_new(approxlen + 100, gfp);
	if (!skb)
		return NULL;

6824
	hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6825 6826 6827 6828 6829
	if (!hdr) {
		kfree_skb(skb);
		return NULL;
	}

6830 6831
	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;
6832 6833 6834 6835 6836 6837 6838 6839 6840 6841 6842 6843 6844 6845 6846 6847 6848 6849 6850 6851 6852 6853
	data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);

	((void **)skb->cb)[0] = rdev;
	((void **)skb->cb)[1] = hdr;
	((void **)skb->cb)[2] = data;

	return skb;

 nla_put_failure:
	kfree_skb(skb);
	return NULL;
}

struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
						  int approxlen)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	if (WARN_ON(!rdev->testmode_info))
		return NULL;

	return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6854
				rdev->testmode_info->snd_portid,
6855 6856 6857 6858 6859 6860 6861 6862 6863 6864 6865 6866 6867 6868 6869 6870 6871 6872 6873 6874 6875 6876 6877 6878 6879 6880 6881 6882 6883 6884 6885 6886 6887
				rdev->testmode_info->snd_seq,
				GFP_KERNEL);
}
EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);

int cfg80211_testmode_reply(struct sk_buff *skb)
{
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];

	if (WARN_ON(!rdev->testmode_info)) {
		kfree_skb(skb);
		return -EINVAL;
	}

	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);
	return genlmsg_reply(skb, rdev->testmode_info);
}
EXPORT_SYMBOL(cfg80211_testmode_reply);

struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
						  int approxlen, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
}
EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);

void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
{
6888
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6889 6890 6891 6892 6893
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];

	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);
6894 6895
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
				nl80211_testmode_mcgrp.id, gfp);
6896 6897 6898 6899
}
EXPORT_SYMBOL(cfg80211_testmode_event);
#endif

S
Samuel Ortiz 已提交
6900 6901
static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
{
6902 6903
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
6904 6905
	struct cfg80211_connect_params connect;
	struct wiphy *wiphy;
J
Johannes Berg 已提交
6906
	struct cfg80211_cached_keys *connkeys = NULL;
S
Samuel Ortiz 已提交
6907 6908 6909 6910 6911 6912 6913 6914 6915 6916 6917 6918 6919 6920
	int err;

	memset(&connect, 0, sizeof(connect));

	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_SSID] ||
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		connect.auth_type =
			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6921 6922
		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
					     NL80211_CMD_CONNECT))
S
Samuel Ortiz 已提交
6923 6924 6925 6926 6927 6928
			return -EINVAL;
	} else
		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];

6929
	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6930
				      NL80211_MAX_NR_CIPHER_SUITES);
S
Samuel Ortiz 已提交
6931 6932 6933
	if (err)
		return err;

6934
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6935 6936
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
6937

6938
	wiphy = &rdev->wiphy;
S
Samuel Ortiz 已提交
6939

6940 6941 6942 6943 6944 6945 6946
	connect.bg_scan_period = -1;
	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
		connect.bg_scan_period =
			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
	}

S
Samuel Ortiz 已提交
6947 6948 6949 6950 6951 6952 6953 6954 6955 6956
	if (info->attrs[NL80211_ATTR_MAC])
		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

6957 6958 6959 6960 6961 6962 6963 6964 6965
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
		if (connect.mfp != NL80211_MFP_REQUIRED &&
		    connect.mfp != NL80211_MFP_NO)
			return -EINVAL;
	} else {
		connect.mfp = NL80211_MFP_NO;
	}

S
Samuel Ortiz 已提交
6966 6967 6968 6969 6970
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
		connect.channel =
			ieee80211_get_channel(wiphy,
			    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
		if (!connect.channel ||
6971 6972
		    connect.channel->flags & IEEE80211_CHAN_DISABLED)
			return -EINVAL;
S
Samuel Ortiz 已提交
6973 6974
	}

J
Johannes Berg 已提交
6975 6976
	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
		connkeys = nl80211_parse_connkeys(rdev,
6977
					  info->attrs[NL80211_ATTR_KEYS], NULL);
6978 6979
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
J
Johannes Berg 已提交
6980 6981
	}

6982 6983 6984 6985 6986 6987 6988 6989 6990
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
		connect.flags |= ASSOC_REQ_DISABLE_HT;

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&connect.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(connect.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6991 6992
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
			kfree(connkeys);
6993
			return -EINVAL;
6994
		}
6995 6996 6997 6998 6999
		memcpy(&connect.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(connect.ht_capa));
	}

7000 7001 7002 7003 7004 7005 7006 7007 7008 7009 7010 7011 7012 7013 7014 7015 7016 7017
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
		connect.flags |= ASSOC_REQ_DISABLE_VHT;

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
		memcpy(&connect.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(connect.vht_capa_mask));

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
			kfree(connkeys);
			return -EINVAL;
		}
		memcpy(&connect.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(connect.vht_capa));
	}

7018 7019 7020
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
	wdev_unlock(dev->ieee80211_ptr);
J
Johannes Berg 已提交
7021 7022
	if (err)
		kfree(connkeys);
S
Samuel Ortiz 已提交
7023 7024 7025 7026 7027
	return err;
}

static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
{
7028 7029
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
7030
	u16 reason;
7031
	int ret;
S
Samuel Ortiz 已提交
7032 7033 7034 7035 7036 7037 7038 7039 7040

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		reason = WLAN_REASON_DEAUTH_LEAVING;
	else
		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);

	if (reason == 0)
		return -EINVAL;

7041
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7042 7043
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7044

7045 7046 7047 7048
	wdev_lock(dev->ieee80211_ptr);
	ret = cfg80211_disconnect(rdev, dev, reason, true);
	wdev_unlock(dev->ieee80211_ptr);
	return ret;
S
Samuel Ortiz 已提交
7049 7050
}

7051 7052
static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
{
7053
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7054 7055 7056 7057 7058 7059 7060 7061 7062 7063
	struct net *net;
	int err;
	u32 pid;

	if (!info->attrs[NL80211_ATTR_PID])
		return -EINVAL;

	pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);

	net = get_net_ns_by_pid(pid);
7064 7065
	if (IS_ERR(net))
		return PTR_ERR(net);
7066 7067 7068 7069

	err = 0;

	/* check if anything to do */
7070 7071
	if (!net_eq(wiphy_net(&rdev->wiphy), net))
		err = cfg80211_switch_netns(rdev, net);
7072 7073 7074 7075 7076

	put_net(net);
	return err;
}

S
Samuel Ortiz 已提交
7077 7078
static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7079
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
S
Samuel Ortiz 已提交
7080 7081
	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
			struct cfg80211_pmksa *pmksa) = NULL;
7082
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
7083 7084 7085 7086 7087 7088 7089 7090 7091 7092 7093 7094 7095
	struct cfg80211_pmksa pmksa;

	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_PMKID])
		return -EINVAL;

	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
	pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);

7096
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7097 7098
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7099 7100 7101 7102 7103 7104 7105 7106 7107 7108 7109 7110 7111

	switch (info->genlhdr->cmd) {
	case NL80211_CMD_SET_PMKSA:
		rdev_ops = rdev->ops->set_pmksa;
		break;
	case NL80211_CMD_DEL_PMKSA:
		rdev_ops = rdev->ops->del_pmksa;
		break;
	default:
		WARN_ON(1);
		break;
	}

7112 7113
	if (!rdev_ops)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7114

7115
	return rdev_ops(&rdev->wiphy, dev, &pmksa);
S
Samuel Ortiz 已提交
7116 7117 7118 7119
}

static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7120 7121
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
7122

7123
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7124 7125
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7126

7127 7128
	if (!rdev->ops->flush_pmksa)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7129

7130
	return rdev_flush_pmksa(rdev, dev);
S
Samuel Ortiz 已提交
7131 7132
}

7133 7134 7135 7136 7137 7138 7139 7140 7141 7142 7143 7144 7145 7146 7147 7148 7149 7150 7151 7152 7153 7154 7155 7156
static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u8 action_code, dialog_token;
	u16 status_code;
	u8 *peer;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_mgmt)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
	    !info->attrs[NL80211_ATTR_IE] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);

7157 7158 7159 7160
	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
			      dialog_token, status_code,
			      nla_data(info->attrs[NL80211_ATTR_IE]),
			      nla_len(info->attrs[NL80211_ATTR_IE]));
7161 7162 7163 7164 7165 7166 7167 7168 7169 7170 7171 7172 7173 7174 7175 7176 7177 7178 7179 7180
}

static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	enum nl80211_tdls_operation operation;
	u8 *peer;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_oper)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);

7181
	return rdev_tdls_oper(rdev, dev, peer, operation);
7182 7183
}

7184 7185 7186
static int nl80211_remain_on_channel(struct sk_buff *skb,
				     struct genl_info *info)
{
7187
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7188
	struct wireless_dev *wdev = info->user_ptr[1];
7189
	struct cfg80211_chan_def chandef;
7190 7191 7192
	struct sk_buff *msg;
	void *hdr;
	u64 cookie;
7193
	u32 duration;
7194 7195 7196 7197 7198 7199 7200 7201
	int err;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_DURATION])
		return -EINVAL;

	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);

7202 7203 7204 7205
	if (!rdev->ops->remain_on_channel ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
		return -EOPNOTSUPP;

7206
	/*
7207 7208
	 * We should be on that channel for at least a minimum amount of
	 * time (10ms) but no longer than the driver supports.
7209
	 */
7210
	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7211
	    duration > rdev->wiphy.max_remain_on_channel_duration)
7212 7213
		return -EINVAL;

7214 7215 7216
	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;
7217 7218

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7219 7220
	if (!msg)
		return -ENOMEM;
7221

7222
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7223
			     NL80211_CMD_REMAIN_ON_CHANNEL);
7224 7225
	if (!hdr) {
		err = -ENOBUFS;
7226 7227 7228
		goto free_msg;
	}

7229 7230
	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
				     duration, &cookie);
7231 7232 7233 7234

	if (err)
		goto free_msg;

7235 7236
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
7237 7238

	genlmsg_end(msg, hdr);
7239 7240

	return genlmsg_reply(msg, info);
7241 7242 7243 7244 7245 7246 7247 7248 7249 7250 7251

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
					    struct genl_info *info)
{
7252
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7253
	struct wireless_dev *wdev = info->user_ptr[1];
7254 7255 7256 7257 7258
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

7259 7260
	if (!rdev->ops->cancel_remain_on_channel)
		return -EOPNOTSUPP;
7261 7262 7263

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

7264
	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7265 7266
}

7267 7268 7269 7270 7271 7272 7273 7274 7275 7276 7277 7278 7279 7280 7281 7282 7283 7284 7285 7286 7287 7288 7289 7290
static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
			   u8 *rates, u8 rates_len)
{
	u8 i;
	u32 mask = 0;

	for (i = 0; i < rates_len; i++) {
		int rate = (rates[i] & 0x7f) * 5;
		int ridx;
		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
			struct ieee80211_rate *srate =
				&sband->bitrates[ridx];
			if (rate == srate->bitrate) {
				mask |= 1 << ridx;
				break;
			}
		}
		if (ridx == sband->n_bitrates)
			return 0; /* rate not found */
	}

	return mask;
}

7291 7292 7293 7294 7295 7296 7297 7298 7299 7300 7301 7302 7303 7304 7305
static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
			       u8 *rates, u8 rates_len,
			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
{
	u8 i;

	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);

	for (i = 0; i < rates_len; i++) {
		int ridx, rbit;

		ridx = rates[i] / 8;
		rbit = BIT(rates[i] % 8);

		/* check validity */
7306
		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7307 7308 7309 7310 7311 7312 7313 7314 7315 7316 7317 7318
			return false;

		/* check availability */
		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
			mcs[ridx] |= rbit;
		else
			return false;
	}

	return true;
}

A
Alexey Dobriyan 已提交
7319
static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7320 7321
	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
				    .len = NL80211_MAX_SUPP_RATES },
7322 7323
	[NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
				 .len = NL80211_MAX_SUPP_HT_RATES },
7324 7325 7326 7327 7328 7329
};

static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7330
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7331
	struct cfg80211_bitrate_mask mask;
7332 7333
	int rem, i;
	struct net_device *dev = info->user_ptr[1];
7334 7335 7336 7337 7338 7339
	struct nlattr *tx_rates;
	struct ieee80211_supported_band *sband;

	if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
		return -EINVAL;

7340 7341
	if (!rdev->ops->set_bitrate_mask)
		return -EOPNOTSUPP;
7342 7343 7344 7345 7346 7347 7348

	memset(&mask, 0, sizeof(mask));
	/* Default to all rates enabled */
	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
		sband = rdev->wiphy.bands[i];
		mask.control[i].legacy =
			sband ? (1 << sband->n_bitrates) - 1 : 0;
7349 7350 7351 7352 7353 7354 7355
		if (sband)
			memcpy(mask.control[i].mcs,
			       sband->ht_cap.mcs.rx_mask,
			       sizeof(mask.control[i].mcs));
		else
			memset(mask.control[i].mcs, 0,
			       sizeof(mask.control[i].mcs));
7356 7357 7358 7359 7360 7361
	}

	/*
	 * The nested attribute uses enum nl80211_band as the index. This maps
	 * directly to the enum ieee80211_band values used in cfg80211.
	 */
7362
	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7363 7364 7365
	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
	{
		enum ieee80211_band band = nla_type(tx_rates);
7366 7367
		if (band < 0 || band >= IEEE80211_NUM_BANDS)
			return -EINVAL;
7368
		sband = rdev->wiphy.bands[band];
7369 7370
		if (sband == NULL)
			return -EINVAL;
7371 7372 7373 7374 7375 7376 7377
		nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
			  nla_len(tx_rates), nl80211_txattr_policy);
		if (tb[NL80211_TXRATE_LEGACY]) {
			mask.control[band].legacy = rateset_to_mask(
				sband,
				nla_data(tb[NL80211_TXRATE_LEGACY]),
				nla_len(tb[NL80211_TXRATE_LEGACY]));
7378 7379 7380
			if ((mask.control[band].legacy == 0) &&
			    nla_len(tb[NL80211_TXRATE_LEGACY]))
				return -EINVAL;
7381 7382 7383 7384 7385 7386 7387 7388 7389 7390 7391 7392 7393 7394 7395 7396 7397 7398 7399 7400 7401 7402
		}
		if (tb[NL80211_TXRATE_MCS]) {
			if (!ht_rateset_to_mask(
					sband,
					nla_data(tb[NL80211_TXRATE_MCS]),
					nla_len(tb[NL80211_TXRATE_MCS]),
					mask.control[band].mcs))
				return -EINVAL;
		}

		if (mask.control[band].legacy == 0) {
			/* don't allow empty legacy rates if HT
			 * is not even supported. */
			if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
				return -EINVAL;

			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
				if (mask.control[band].mcs[i])
					break;

			/* legacy and mcs rates may not be both empty */
			if (i == IEEE80211_HT_MCS_MASK_LEN)
7403
				return -EINVAL;
7404 7405 7406
		}
	}

7407
	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7408 7409
}

7410
static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7411
{
7412
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7413
	struct wireless_dev *wdev = info->user_ptr[1];
7414
	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7415 7416 7417 7418

	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
		return -EINVAL;

7419 7420
	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7421

7422 7423 7424 7425 7426 7427 7428 7429
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
7430
	case NL80211_IFTYPE_P2P_DEVICE:
7431 7432
		break;
	default:
7433
		return -EOPNOTSUPP;
7434
	}
7435 7436

	/* not much point in registering if we can't reply */
7437 7438
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
7439

7440
	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7441 7442 7443 7444
			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
}

7445
static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7446
{
7447
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7448
	struct wireless_dev *wdev = info->user_ptr[1];
7449
	struct cfg80211_chan_def chandef;
7450
	int err;
J
Johannes Berg 已提交
7451
	void *hdr = NULL;
7452
	u64 cookie;
7453
	struct sk_buff *msg = NULL;
7454 7455 7456 7457
	struct cfg80211_mgmt_tx_params params = {
		.dont_wait_for_ack =
			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
	};
7458

7459
	if (!info->attrs[NL80211_ATTR_FRAME])
7460 7461
		return -EINVAL;

7462 7463
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
7464

7465
	switch (wdev->iftype) {
7466 7467 7468
	case NL80211_IFTYPE_P2P_DEVICE:
		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
			return -EINVAL;
7469 7470 7471 7472 7473 7474 7475 7476 7477
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
		break;
	default:
7478
		return -EOPNOTSUPP;
7479
	}
7480

7481
	if (info->attrs[NL80211_ATTR_DURATION]) {
7482
		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7483
			return -EINVAL;
7484
		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7485 7486 7487 7488 7489

		/*
		 * We should wait on the channel for at least a minimum amount
		 * of time (10ms) but no longer than the driver supports.
		 */
7490 7491
		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
7492 7493
			return -EINVAL;

7494 7495
	}

7496
	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7497

7498
	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7499 7500
		return -EINVAL;

7501
	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7502

7503 7504 7505 7506 7507 7508 7509 7510 7511 7512
	/* get the channel if any has been specified, otherwise pass NULL to
	 * the driver. The latter will use the current one
	 */
	chandef.chan = NULL;
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
		err = nl80211_parse_chandef(rdev, info, &chandef);
		if (err)
			return err;
	}

7513
	if (!chandef.chan && params.offchan)
7514
		return -EINVAL;
7515

7516
	if (!params.dont_wait_for_ack) {
7517 7518 7519
		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (!msg)
			return -ENOMEM;
7520

7521
		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7522
				     NL80211_CMD_FRAME);
7523 7524
		if (!hdr) {
			err = -ENOBUFS;
7525 7526
			goto free_msg;
		}
7527
	}
7528

7529 7530 7531 7532
	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
	params.chan = chandef.chan;
	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7533 7534 7535
	if (err)
		goto free_msg;

7536
	if (msg) {
7537 7538
		if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
			goto nla_put_failure;
7539

7540 7541 7542 7543 7544
		genlmsg_end(msg, hdr);
		return genlmsg_reply(msg, info);
	}

	return 0;
7545 7546 7547 7548 7549 7550 7551 7552

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

7553 7554 7555
static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7556
	struct wireless_dev *wdev = info->user_ptr[1];
7557 7558 7559 7560 7561 7562 7563 7564
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

	if (!rdev->ops->mgmt_tx_cancel_wait)
		return -EOPNOTSUPP;

7565 7566 7567 7568 7569 7570 7571
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
7572
	case NL80211_IFTYPE_P2P_DEVICE:
7573 7574
		break;
	default:
7575
		return -EOPNOTSUPP;
7576
	}
7577 7578 7579

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

7580
	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7581 7582
}

K
Kalle Valo 已提交
7583 7584
static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
{
7585
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
K
Kalle Valo 已提交
7586
	struct wireless_dev *wdev;
7587
	struct net_device *dev = info->user_ptr[1];
K
Kalle Valo 已提交
7588 7589 7590 7591
	u8 ps_state;
	bool state;
	int err;

7592 7593
	if (!info->attrs[NL80211_ATTR_PS_STATE])
		return -EINVAL;
K
Kalle Valo 已提交
7594 7595 7596

	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);

7597 7598
	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
		return -EINVAL;
K
Kalle Valo 已提交
7599 7600 7601

	wdev = dev->ieee80211_ptr;

7602 7603
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
K
Kalle Valo 已提交
7604 7605 7606 7607

	state = (ps_state == NL80211_PS_ENABLED) ? true : false;

	if (state == wdev->ps)
7608
		return 0;
K
Kalle Valo 已提交
7609

7610
	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7611 7612
	if (!err)
		wdev->ps = state;
K
Kalle Valo 已提交
7613 7614 7615 7616 7617
	return err;
}

static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
{
7618
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
K
Kalle Valo 已提交
7619 7620
	enum nl80211_ps_state ps_state;
	struct wireless_dev *wdev;
7621
	struct net_device *dev = info->user_ptr[1];
K
Kalle Valo 已提交
7622 7623 7624 7625 7626 7627
	struct sk_buff *msg;
	void *hdr;
	int err;

	wdev = dev->ieee80211_ptr;

7628 7629
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
K
Kalle Valo 已提交
7630 7631

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7632 7633
	if (!msg)
		return -ENOMEM;
K
Kalle Valo 已提交
7634

7635
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
K
Kalle Valo 已提交
7636 7637
			     NL80211_CMD_GET_POWER_SAVE);
	if (!hdr) {
7638
		err = -ENOBUFS;
K
Kalle Valo 已提交
7639 7640 7641 7642 7643 7644 7645 7646
		goto free_msg;
	}

	if (wdev->ps)
		ps_state = NL80211_PS_ENABLED;
	else
		ps_state = NL80211_PS_DISABLED;

7647 7648
	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
		goto nla_put_failure;
K
Kalle Valo 已提交
7649 7650

	genlmsg_end(msg, hdr);
7651
	return genlmsg_reply(msg, info);
K
Kalle Valo 已提交
7652

7653
 nla_put_failure:
K
Kalle Valo 已提交
7654
	err = -ENOBUFS;
7655
 free_msg:
K
Kalle Valo 已提交
7656 7657 7658 7659
	nlmsg_free(msg);
	return err;
}

7660 7661 7662 7663 7664
static struct nla_policy
nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7665 7666 7667
	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7668 7669
};

7670
static int nl80211_set_cqm_txe(struct genl_info *info,
J
Johannes Berg 已提交
7671
			       u32 rate, u32 pkts, u32 intvl)
7672 7673 7674
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7675
	struct wireless_dev *wdev = dev->ieee80211_ptr;
7676

J
Johannes Berg 已提交
7677
	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7678 7679 7680 7681 7682 7683 7684 7685 7686
		return -EINVAL;

	if (!rdev->ops->set_cqm_txe_config)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_STATION &&
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;

7687
	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7688 7689
}

7690 7691 7692
static int nl80211_set_cqm_rssi(struct genl_info *info,
				s32 threshold, u32 hysteresis)
{
7693 7694
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7695
	struct wireless_dev *wdev = dev->ieee80211_ptr;
7696 7697 7698 7699

	if (threshold > 0)
		return -EINVAL;

7700 7701 7702
	/* disabling - hysteresis should also be zero then */
	if (threshold == 0)
		hysteresis = 0;
7703

7704 7705
	if (!rdev->ops->set_cqm_rssi_config)
		return -EOPNOTSUPP;
7706

7707
	if (wdev->iftype != NL80211_IFTYPE_STATION &&
7708 7709
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7710

7711
	return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7712 7713 7714 7715 7716 7717 7718 7719 7720
}

static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
	struct nlattr *cqm;
	int err;

	cqm = info->attrs[NL80211_ATTR_CQM];
7721 7722
	if (!cqm)
		return -EINVAL;
7723 7724 7725 7726

	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
			       nl80211_attr_cqm_policy);
	if (err)
7727
		return err;
7728 7729 7730

	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7731 7732
		s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7733

7734 7735 7736 7737 7738 7739 7740 7741 7742 7743 7744 7745 7746 7747
		return nl80211_set_cqm_rssi(info, threshold, hysteresis);
	}

	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);

		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
	}

	return -EINVAL;
7748 7749
}

7750 7751 7752 7753 7754
static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct mesh_config cfg;
7755
	struct mesh_setup setup;
7756 7757 7758 7759
	int err;

	/* start with default */
	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7760
	memcpy(&setup, &default_mesh_setup, sizeof(setup));
7761

7762
	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7763
		/* and parse parameters if given */
7764
		err = nl80211_parse_mesh_config(info, &cfg, NULL);
7765 7766 7767 7768 7769 7770 7771 7772
		if (err)
			return err;
	}

	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
		return -EINVAL;

7773 7774 7775
	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);

7776 7777 7778 7779 7780
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
			return -EINVAL;

7781 7782 7783 7784 7785 7786 7787 7788 7789 7790 7791 7792 7793 7794 7795
	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		setup.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (setup.beacon_interval < 10 ||
		    setup.beacon_interval > 10000)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
		setup.dtim_period =
			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
		if (setup.dtim_period < 1 || setup.dtim_period > 100)
			return -EINVAL;
	}

7796 7797 7798 7799 7800 7801 7802
	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
		/* parse additional setup parameters if given */
		err = nl80211_parse_mesh_setup(info, &setup);
		if (err)
			return err;
	}

7803 7804 7805
	if (setup.user_mpm)
		cfg.auto_open_plinks = false;

7806
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7807 7808 7809
		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
		if (err)
			return err;
7810 7811
	} else {
		/* cfg80211_join_mesh() will sort it out */
7812
		setup.chandef.chan = NULL;
7813 7814
	}

7815 7816 7817 7818 7819 7820 7821 7822 7823 7824 7825 7826 7827 7828 7829 7830 7831
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband;

		if (!setup.chandef.chan)
			return -EINVAL;

		sband = rdev->wiphy.bands[setup.chandef.chan->band];

		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &setup.basic_rates);
		if (err)
			return err;
	}

7832
	return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7833 7834 7835 7836 7837 7838 7839 7840 7841 7842
}

static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];

	return cfg80211_leave_mesh(rdev, dev);
}

7843
#ifdef CONFIG_PM
7844 7845 7846
static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
					struct cfg80211_registered_device *rdev)
{
7847
	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7848 7849 7850
	struct nlattr *nl_pats, *nl_pat;
	int i, pat_len;

7851
	if (!wowlan->n_patterns)
7852 7853 7854 7855 7856 7857
		return 0;

	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
	if (!nl_pats)
		return -ENOBUFS;

7858
	for (i = 0; i < wowlan->n_patterns; i++) {
7859 7860 7861
		nl_pat = nla_nest_start(msg, i + 1);
		if (!nl_pat)
			return -ENOBUFS;
7862
		pat_len = wowlan->patterns[i].pattern_len;
7863
		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7864
			    wowlan->patterns[i].mask) ||
7865 7866 7867
		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
			    wowlan->patterns[i].pattern) ||
		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7868
				wowlan->patterns[i].pkt_offset))
7869 7870 7871 7872 7873 7874 7875 7876
			return -ENOBUFS;
		nla_nest_end(msg, nl_pat);
	}
	nla_nest_end(msg, nl_pats);

	return 0;
}

7877 7878 7879 7880 7881 7882 7883 7884 7885 7886 7887 7888 7889 7890 7891 7892 7893 7894 7895 7896 7897 7898 7899 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914
static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
				   struct cfg80211_wowlan_tcp *tcp)
{
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
	    nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
		    tcp->payload_len, tcp->payload) ||
	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
		    tcp->wake_len, tcp->wake_data) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
		return -ENOBUFS;

	if (tcp->payload_seq.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
		    sizeof(tcp->payload_seq), &tcp->payload_seq))
		return -ENOBUFS;

	if (tcp->payload_tok.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
		    sizeof(tcp->payload_tok) + tcp->tokens_size,
		    &tcp->payload_tok))
		return -ENOBUFS;

7915 7916
	nla_nest_end(msg, nl_tcp);

7917 7918 7919
	return 0;
}

J
Johannes Berg 已提交
7920 7921 7922 7923 7924
static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;
7925
	u32 size = NLMSG_DEFAULT_SIZE;
J
Johannes Berg 已提交
7926

7927
	if (!rdev->wiphy.wowlan)
J
Johannes Berg 已提交
7928 7929
		return -EOPNOTSUPP;

7930
	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7931
		/* adjust size to have room for all the data */
7932 7933 7934 7935
		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
			rdev->wiphy.wowlan_config->tcp->payload_len +
			rdev->wiphy.wowlan_config->tcp->wake_len +
			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7936 7937 7938
	}

	msg = nlmsg_new(size, GFP_KERNEL);
J
Johannes Berg 已提交
7939 7940 7941
	if (!msg)
		return -ENOMEM;

7942
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
J
Johannes Berg 已提交
7943 7944 7945 7946
			     NL80211_CMD_GET_WOWLAN);
	if (!hdr)
		goto nla_put_failure;

7947
	if (rdev->wiphy.wowlan_config) {
J
Johannes Berg 已提交
7948 7949 7950 7951 7952 7953
		struct nlattr *nl_wowlan;

		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
		if (!nl_wowlan)
			goto nla_put_failure;

7954
		if ((rdev->wiphy.wowlan_config->any &&
7955
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7956
		    (rdev->wiphy.wowlan_config->disconnect &&
7957
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7958
		    (rdev->wiphy.wowlan_config->magic_pkt &&
7959
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7960
		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7961
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7962
		    (rdev->wiphy.wowlan_config->eap_identity_req &&
7963
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7964
		    (rdev->wiphy.wowlan_config->four_way_handshake &&
7965
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7966
		    (rdev->wiphy.wowlan_config->rfkill_release &&
7967 7968
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
			goto nla_put_failure;
7969

7970 7971
		if (nl80211_send_wowlan_patterns(msg, rdev))
			goto nla_put_failure;
7972

7973 7974
		if (nl80211_send_wowlan_tcp(msg,
					    rdev->wiphy.wowlan_config->tcp))
7975 7976
			goto nla_put_failure;

J
Johannes Berg 已提交
7977 7978 7979 7980 7981 7982 7983 7984 7985 7986 7987
		nla_nest_end(msg, nl_wowlan);
	}

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

7988 7989 7990 7991 7992 7993 7994 7995 7996 7997 7998 7999
static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
				    struct nlattr *attr,
				    struct cfg80211_wowlan *trig)
{
	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
	struct cfg80211_wowlan_tcp *cfg;
	struct nl80211_wowlan_tcp_data_token *tok = NULL;
	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
	u32 size;
	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
	int err, port;

8000
	if (!rdev->wiphy.wowlan->tcp)
8001 8002 8003 8004 8005 8006 8007 8008 8009 8010 8011 8012 8013 8014 8015 8016 8017 8018 8019
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
			nla_data(attr), nla_len(attr),
			nl80211_wowlan_tcp_policy);
	if (err)
		return err;

	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
		return -EINVAL;

	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8020
	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8021 8022 8023
		return -EINVAL;

	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8024
			rdev->wiphy.wowlan->tcp->data_interval_max ||
8025
	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8026 8027 8028
		return -EINVAL;

	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8029
	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8030 8031 8032 8033 8034 8035 8036 8037 8038 8039 8040 8041 8042 8043
		return -EINVAL;

	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);

		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
		tokens_size = tokln - sizeof(*tok);

		if (!tok->len || tokens_size % tok->len)
			return -EINVAL;
8044
		if (!rdev->wiphy.wowlan->tcp->tok)
8045
			return -EINVAL;
8046
		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8047
			return -EINVAL;
8048
		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8049
			return -EINVAL;
8050
		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8051 8052 8053 8054 8055 8056 8057
			return -EINVAL;
		if (tok->offset + tok->len > data_size)
			return -EINVAL;
	}

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8058
		if (!rdev->wiphy.wowlan->tcp->seq)
8059 8060 8061 8062 8063 8064 8065 8066 8067 8068 8069 8070 8071 8072 8073 8074 8075 8076 8077 8078 8079 8080 8081 8082 8083 8084 8085 8086 8087 8088 8089 8090 8091 8092 8093 8094 8095 8096 8097 8098 8099 8100 8101 8102 8103 8104 8105 8106 8107 8108 8109 8110 8111 8112 8113 8114 8115 8116 8117 8118 8119 8120 8121 8122 8123 8124 8125 8126 8127 8128 8129 8130 8131 8132
			return -EINVAL;
		if (seq->len == 0 || seq->len > 4)
			return -EINVAL;
		if (seq->len + seq->offset > data_size)
			return -EINVAL;
	}

	size = sizeof(*cfg);
	size += data_size;
	size += wake_size + wake_mask_size;
	size += tokens_size;

	cfg = kzalloc(size, GFP_KERNEL);
	if (!cfg)
		return -ENOMEM;
	cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
	cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
	       ETH_ALEN);
	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
	else
		port = 0;
#ifdef CONFIG_INET
	/* allocate a socket and port for it and use it */
	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
			    IPPROTO_TCP, &cfg->sock, 1);
	if (err) {
		kfree(cfg);
		return err;
	}
	if (inet_csk_get_port(cfg->sock->sk, port)) {
		sock_release(cfg->sock);
		kfree(cfg);
		return -EADDRINUSE;
	}
	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
#else
	if (!port) {
		kfree(cfg);
		return -EINVAL;
	}
	cfg->src_port = port;
#endif

	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
	cfg->payload_len = data_size;
	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
	memcpy((void *)cfg->payload,
	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
	       data_size);
	if (seq)
		cfg->payload_seq = *seq;
	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
	cfg->wake_len = wake_size;
	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
	memcpy((void *)cfg->wake_data,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
	       wake_size);
	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
			 data_size + wake_size;
	memcpy((void *)cfg->wake_mask,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
	       wake_mask_size);
	if (tok) {
		cfg->tokens_size = tokens_size;
		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
	}

	trig->tcp = cfg;

	return 0;
}

J
Johannes Berg 已提交
8133 8134 8135 8136 8137
static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
	struct cfg80211_wowlan new_triggers = {};
8138
	struct cfg80211_wowlan *ntrig;
8139
	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
J
Johannes Berg 已提交
8140
	int err, i;
8141
	bool prev_enabled = rdev->wiphy.wowlan_config;
J
Johannes Berg 已提交
8142

8143
	if (!wowlan)
J
Johannes Berg 已提交
8144 8145
		return -EOPNOTSUPP;

8146 8147
	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
		cfg80211_rdev_free_wowlan(rdev);
8148
		rdev->wiphy.wowlan_config = NULL;
8149 8150
		goto set_wakeup;
	}
J
Johannes Berg 已提交
8151 8152 8153 8154 8155 8156 8157 8158 8159 8160 8161 8162 8163 8164 8165 8166 8167 8168 8169 8170 8171 8172 8173 8174 8175 8176

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
			nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nl80211_wowlan_policy);
	if (err)
		return err;

	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
			return -EINVAL;
		new_triggers.any = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
			return -EINVAL;
		new_triggers.disconnect = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
			return -EINVAL;
		new_triggers.magic_pkt = true;
	}

8177 8178 8179 8180 8181 8182 8183 8184 8185 8186 8187 8188 8189 8190 8191 8192 8193 8194 8195 8196 8197 8198 8199 8200 8201 8202 8203
	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
			return -EINVAL;
		new_triggers.gtk_rekey_failure = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
			return -EINVAL;
		new_triggers.eap_identity_req = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
			return -EINVAL;
		new_triggers.four_way_handshake = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
			return -EINVAL;
		new_triggers.rfkill_release = true;
	}

J
Johannes Berg 已提交
8204 8205 8206
	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
		struct nlattr *pat;
		int n_patterns = 0;
8207
		int rem, pat_len, mask_len, pkt_offset;
8208
		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
J
Johannes Berg 已提交
8209 8210 8211 8212 8213 8214 8215 8216 8217 8218 8219 8220 8221 8222 8223 8224 8225 8226

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem)
			n_patterns++;
		if (n_patterns > wowlan->n_patterns)
			return -EINVAL;

		new_triggers.patterns = kcalloc(n_patterns,
						sizeof(new_triggers.patterns[0]),
						GFP_KERNEL);
		if (!new_triggers.patterns)
			return -ENOMEM;

		new_triggers.n_patterns = n_patterns;
		i = 0;

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem) {
8227 8228
			nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
				  nla_len(pat), NULL);
J
Johannes Berg 已提交
8229
			err = -EINVAL;
8230 8231
			if (!pat_tb[NL80211_PKTPAT_MASK] ||
			    !pat_tb[NL80211_PKTPAT_PATTERN])
J
Johannes Berg 已提交
8232
				goto error;
8233
			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
J
Johannes Berg 已提交
8234
			mask_len = DIV_ROUND_UP(pat_len, 8);
8235
			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
J
Johannes Berg 已提交
8236 8237 8238 8239 8240
				goto error;
			if (pat_len > wowlan->pattern_max_len ||
			    pat_len < wowlan->pattern_min_len)
				goto error;

8241
			if (!pat_tb[NL80211_PKTPAT_OFFSET])
8242 8243 8244
				pkt_offset = 0;
			else
				pkt_offset = nla_get_u32(
8245
					pat_tb[NL80211_PKTPAT_OFFSET]);
8246 8247 8248 8249
			if (pkt_offset > wowlan->max_pkt_offset)
				goto error;
			new_triggers.patterns[i].pkt_offset = pkt_offset;

J
Johannes Berg 已提交
8250 8251 8252 8253 8254 8255 8256 8257 8258
			new_triggers.patterns[i].mask =
				kmalloc(mask_len + pat_len, GFP_KERNEL);
			if (!new_triggers.patterns[i].mask) {
				err = -ENOMEM;
				goto error;
			}
			new_triggers.patterns[i].pattern =
				new_triggers.patterns[i].mask + mask_len;
			memcpy(new_triggers.patterns[i].mask,
8259
			       nla_data(pat_tb[NL80211_PKTPAT_MASK]),
J
Johannes Berg 已提交
8260 8261 8262
			       mask_len);
			new_triggers.patterns[i].pattern_len = pat_len;
			memcpy(new_triggers.patterns[i].pattern,
8263
			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
J
Johannes Berg 已提交
8264 8265 8266 8267 8268
			       pat_len);
			i++;
		}
	}

8269 8270 8271 8272 8273 8274 8275 8276
	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
		err = nl80211_parse_wowlan_tcp(
			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
			&new_triggers);
		if (err)
			goto error;
	}

8277 8278 8279 8280
	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
	if (!ntrig) {
		err = -ENOMEM;
		goto error;
J
Johannes Berg 已提交
8281
	}
8282
	cfg80211_rdev_free_wowlan(rdev);
8283
	rdev->wiphy.wowlan_config = ntrig;
J
Johannes Berg 已提交
8284

8285
 set_wakeup:
8286 8287 8288
	if (rdev->ops->set_wakeup &&
	    prev_enabled != !!rdev->wiphy.wowlan_config)
		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8289

J
Johannes Berg 已提交
8290 8291 8292 8293 8294
	return 0;
 error:
	for (i = 0; i < new_triggers.n_patterns; i++)
		kfree(new_triggers.patterns[i].mask);
	kfree(new_triggers.patterns);
8295 8296 8297
	if (new_triggers.tcp && new_triggers.tcp->sock)
		sock_release(new_triggers.tcp->sock);
	kfree(new_triggers.tcp);
J
Johannes Berg 已提交
8298 8299
	return err;
}
8300
#endif
J
Johannes Berg 已提交
8301

8302 8303 8304 8305 8306 8307 8308 8309 8310 8311 8312 8313 8314 8315 8316 8317 8318 8319 8320 8321 8322 8323 8324 8325 8326 8327 8328 8329 8330 8331 8332 8333 8334 8335 8336 8337 8338 8339 8340 8341 8342 8343 8344 8345 8346 8347 8348 8349 8350 8351 8352 8353 8354 8355 8356 8357 8358 8359 8360 8361 8362 8363 8364 8365 8366 8367 8368 8369 8370 8371 8372 8373 8374 8375 8376 8377 8378 8379 8380 8381 8382 8383 8384 8385 8386 8387 8388 8389 8390 8391 8392 8393 8394 8395 8396 8397 8398 8399 8400 8401 8402 8403 8404 8405 8406 8407 8408 8409 8410 8411 8412 8413 8414 8415 8416 8417 8418 8419 8420 8421 8422 8423 8424 8425 8426 8427 8428 8429 8430 8431 8432 8433 8434 8435 8436 8437 8438 8439 8440 8441 8442 8443 8444 8445 8446 8447 8448 8449 8450 8451 8452 8453 8454 8455 8456 8457 8458 8459 8460 8461 8462 8463 8464 8465 8466 8467 8468 8469 8470 8471 8472 8473 8474 8475 8476 8477 8478 8479 8480 8481 8482 8483 8484 8485 8486 8487 8488 8489 8490 8491 8492 8493 8494 8495 8496 8497 8498 8499 8500 8501 8502 8503 8504 8505 8506 8507 8508 8509 8510 8511 8512 8513 8514 8515 8516 8517 8518 8519 8520 8521 8522 8523 8524 8525 8526 8527 8528 8529 8530 8531 8532 8533 8534 8535 8536 8537 8538 8539 8540 8541 8542 8543 8544 8545 8546 8547 8548 8549 8550 8551 8552 8553 8554 8555 8556 8557 8558 8559
static int nl80211_send_coalesce_rules(struct sk_buff *msg,
				       struct cfg80211_registered_device *rdev)
{
	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
	int i, j, pat_len;
	struct cfg80211_coalesce_rules *rule;

	if (!rdev->coalesce->n_rules)
		return 0;

	nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
	if (!nl_rules)
		return -ENOBUFS;

	for (i = 0; i < rdev->coalesce->n_rules; i++) {
		nl_rule = nla_nest_start(msg, i + 1);
		if (!nl_rule)
			return -ENOBUFS;

		rule = &rdev->coalesce->rules[i];
		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
				rule->delay))
			return -ENOBUFS;

		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
				rule->condition))
			return -ENOBUFS;

		nl_pats = nla_nest_start(msg,
				NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
		if (!nl_pats)
			return -ENOBUFS;

		for (j = 0; j < rule->n_patterns; j++) {
			nl_pat = nla_nest_start(msg, j + 1);
			if (!nl_pat)
				return -ENOBUFS;
			pat_len = rule->patterns[j].pattern_len;
			if (nla_put(msg, NL80211_PKTPAT_MASK,
				    DIV_ROUND_UP(pat_len, 8),
				    rule->patterns[j].mask) ||
			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
				    rule->patterns[j].pattern) ||
			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
					rule->patterns[j].pkt_offset))
				return -ENOBUFS;
			nla_nest_end(msg, nl_pat);
		}
		nla_nest_end(msg, nl_pats);
		nla_nest_end(msg, nl_rule);
	}
	nla_nest_end(msg, nl_rules);

	return 0;
}

static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;

	if (!rdev->wiphy.coalesce)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_COALESCE);
	if (!hdr)
		goto nla_put_failure;

	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
{
	struct cfg80211_coalesce *coalesce = rdev->coalesce;
	int i, j;
	struct cfg80211_coalesce_rules *rule;

	if (!coalesce)
		return;

	for (i = 0; i < coalesce->n_rules; i++) {
		rule = &coalesce->rules[i];
		for (j = 0; j < rule->n_patterns; j++)
			kfree(rule->patterns[j].mask);
		kfree(rule->patterns);
	}
	kfree(coalesce->rules);
	kfree(coalesce);
	rdev->coalesce = NULL;
}

static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
				       struct nlattr *rule,
				       struct cfg80211_coalesce_rules *new_rule)
{
	int err, i;
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];

	err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
			nla_len(rule), nl80211_coalesce_policy);
	if (err)
		return err;

	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
		new_rule->delay =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
	if (new_rule->delay > coalesce->max_delay)
		return -EINVAL;

	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
		new_rule->condition =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
	if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
	    new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
		return -EINVAL;

	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
		return -EINVAL;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem)
		n_patterns++;
	if (n_patterns > coalesce->n_patterns)
		return -EINVAL;

	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
				     GFP_KERNEL);
	if (!new_rule->patterns)
		return -ENOMEM;

	new_rule->n_patterns = n_patterns;
	i = 0;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem) {
		nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
			  nla_len(pat), NULL);
		if (!pat_tb[NL80211_PKTPAT_MASK] ||
		    !pat_tb[NL80211_PKTPAT_PATTERN])
			return -EINVAL;
		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
		mask_len = DIV_ROUND_UP(pat_len, 8);
		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
			return -EINVAL;
		if (pat_len > coalesce->pattern_max_len ||
		    pat_len < coalesce->pattern_min_len)
			return -EINVAL;

		if (!pat_tb[NL80211_PKTPAT_OFFSET])
			pkt_offset = 0;
		else
			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
		if (pkt_offset > coalesce->max_pkt_offset)
			return -EINVAL;
		new_rule->patterns[i].pkt_offset = pkt_offset;

		new_rule->patterns[i].mask =
			kmalloc(mask_len + pat_len, GFP_KERNEL);
		if (!new_rule->patterns[i].mask)
			return -ENOMEM;
		new_rule->patterns[i].pattern =
			new_rule->patterns[i].mask + mask_len;
		memcpy(new_rule->patterns[i].mask,
		       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
		new_rule->patterns[i].pattern_len = pat_len;
		memcpy(new_rule->patterns[i].pattern,
		       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
		i++;
	}

	return 0;
}

static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct cfg80211_coalesce new_coalesce = {};
	struct cfg80211_coalesce *n_coalesce;
	int err, rem_rule, n_rules = 0, i, j;
	struct nlattr *rule;
	struct cfg80211_coalesce_rules *tmp_rule;

	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
		cfg80211_rdev_free_coalesce(rdev);
		rdev->ops->set_coalesce(&rdev->wiphy, NULL);
		return 0;
	}

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule)
		n_rules++;
	if (n_rules > coalesce->n_rules)
		return -EINVAL;

	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
				     GFP_KERNEL);
	if (!new_coalesce.rules)
		return -ENOMEM;

	new_coalesce.n_rules = n_rules;
	i = 0;

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule) {
		err = nl80211_parse_coalesce_rule(rdev, rule,
						  &new_coalesce.rules[i]);
		if (err)
			goto error;

		i++;
	}

	err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
	if (err)
		goto error;

	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
	if (!n_coalesce) {
		err = -ENOMEM;
		goto error;
	}
	cfg80211_rdev_free_coalesce(rdev);
	rdev->coalesce = n_coalesce;

	return 0;
error:
	for (i = 0; i < new_coalesce.n_rules; i++) {
		tmp_rule = &new_coalesce.rules[i];
		for (j = 0; j < tmp_rule->n_patterns; j++)
			kfree(tmp_rule->patterns[j].mask);
		kfree(tmp_rule->patterns);
	}
	kfree(new_coalesce.rules);

	return err;
}

8560 8561 8562 8563 8564 8565 8566 8567 8568 8569 8570 8571 8572 8573 8574 8575 8576 8577 8578 8579 8580 8581 8582 8583 8584 8585 8586 8587 8588 8589 8590 8591 8592 8593 8594 8595 8596 8597 8598 8599 8600 8601 8602 8603 8604
static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
	struct cfg80211_gtk_rekey_data rekey_data;
	int err;

	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
			nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nl80211_rekey_policy);
	if (err)
		return err;

	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
		return -ERANGE;

	memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
	       NL80211_KEK_LEN);
	memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
	       NL80211_KCK_LEN);
	memcpy(rekey_data.replay_ctr,
	       nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
	       NL80211_REPLAY_CTR_LEN);

	wdev_lock(wdev);
	if (!wdev->current_bss) {
		err = -ENOTCONN;
		goto out;
	}

	if (!rdev->ops->set_rekey_data) {
		err = -EOPNOTSUPP;
		goto out;
	}

8605
	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8606 8607 8608 8609 8610
 out:
	wdev_unlock(wdev);
	return err;
}

8611 8612 8613 8614 8615 8616 8617 8618 8619 8620
static int nl80211_register_unexpected_frame(struct sk_buff *skb,
					     struct genl_info *info)
{
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;

8621
	if (wdev->ap_unexpected_nlportid)
8622 8623
		return -EBUSY;

8624
	wdev->ap_unexpected_nlportid = info->snd_portid;
8625 8626 8627
	return 0;
}

J
Johannes Berg 已提交
8628 8629 8630 8631 8632 8633 8634 8635 8636 8637 8638 8639 8640 8641 8642 8643 8644 8645 8646 8647 8648 8649 8650 8651 8652 8653
static int nl80211_probe_client(struct sk_buff *skb,
				struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct sk_buff *msg;
	void *hdr;
	const u8 *addr;
	u64 cookie;
	int err;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!rdev->ops->probe_client)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

8654
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
J
Johannes Berg 已提交
8655
			     NL80211_CMD_PROBE_CLIENT);
8656 8657
	if (!hdr) {
		err = -ENOBUFS;
J
Johannes Berg 已提交
8658 8659 8660 8661 8662
		goto free_msg;
	}

	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

8663
	err = rdev_probe_client(rdev, dev, addr, &cookie);
J
Johannes Berg 已提交
8664 8665 8666
	if (err)
		goto free_msg;

8667 8668
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
J
Johannes Berg 已提交
8669 8670 8671 8672 8673 8674 8675 8676 8677 8678 8679 8680

	genlmsg_end(msg, hdr);

	return genlmsg_reply(msg, info);

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

8681 8682 8683
static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8684 8685
	struct cfg80211_beacon_registration *reg, *nreg;
	int rv;
8686 8687 8688 8689

	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
		return -EOPNOTSUPP;

8690 8691 8692 8693 8694 8695 8696 8697 8698 8699 8700 8701 8702 8703 8704
	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
	if (!nreg)
		return -ENOMEM;

	/* First, check if already registered. */
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		if (reg->nlportid == info->snd_portid) {
			rv = -EALREADY;
			goto out_err;
		}
	}
	/* Add it to the list */
	nreg->nlportid = info->snd_portid;
	list_add(&nreg->list, &rdev->beacon_registrations);
8705

8706
	spin_unlock_bh(&rdev->beacon_registrations_lock);
8707 8708

	return 0;
8709 8710 8711 8712
out_err:
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	kfree(nreg);
	return rv;
8713 8714
}

8715 8716 8717 8718 8719 8720 8721 8722 8723 8724 8725 8726 8727 8728 8729 8730 8731 8732 8733
static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	int err;

	if (!rdev->ops->start_p2p_device)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (wdev->p2p_started)
		return 0;

	err = cfg80211_can_add_interface(rdev, wdev->iftype);
	if (err)
		return err;

8734
	err = rdev_start_p2p_device(rdev, wdev);
8735 8736 8737 8738 8739 8740 8741 8742 8743 8744 8745 8746 8747 8748 8749 8750 8751 8752 8753 8754
	if (err)
		return err;

	wdev->p2p_started = true;
	rdev->opencount++;

	return 0;
}

static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (!rdev->ops->stop_p2p_device)
		return -EOPNOTSUPP;

8755
	cfg80211_stop_p2p_device(rdev, wdev);
8756 8757 8758 8759

	return 0;
}

8760 8761 8762 8763 8764 8765 8766 8767 8768 8769 8770 8771 8772 8773 8774 8775 8776 8777 8778 8779 8780 8781 8782 8783 8784 8785 8786
static int nl80211_get_protocol_features(struct sk_buff *skb,
					 struct genl_info *info)
{
	void *hdr;
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_PROTOCOL_FEATURES);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

 nla_put_failure:
	kfree_skb(msg);
	return -ENOBUFS;
}

8787 8788 8789 8790 8791 8792 8793 8794 8795 8796 8797 8798 8799 8800 8801 8802 8803 8804 8805 8806 8807
static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct cfg80211_update_ft_ies_params ft_params;
	struct net_device *dev = info->user_ptr[1];

	if (!rdev->ops->update_ft_ies)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MDID] ||
	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	memset(&ft_params, 0, sizeof(ft_params));
	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);

	return rdev_update_ft_ies(rdev, dev, &ft_params);
}

8808 8809 8810 8811 8812 8813 8814 8815 8816 8817 8818 8819 8820 8821 8822 8823 8824 8825 8826 8827 8828 8829 8830 8831 8832 8833 8834 8835 8836 8837 8838 8839 8840 8841 8842 8843 8844 8845 8846 8847 8848 8849 8850 8851 8852 8853 8854 8855 8856 8857 8858 8859 8860 8861 8862 8863 8864 8865
static int nl80211_crit_protocol_start(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
	u16 duration;
	int ret;

	if (!rdev->ops->crit_proto_start)
		return -EOPNOTSUPP;

	if (WARN_ON(!rdev->ops->crit_proto_stop))
		return -EINVAL;

	if (rdev->crit_proto_nlportid)
		return -EBUSY;

	/* determine protocol if provided */
	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);

	if (proto >= NUM_NL80211_CRIT_PROTO)
		return -EINVAL;

	/* timeout must be provided */
	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
		return -EINVAL;

	duration =
		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);

	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
		return -ERANGE;

	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
	if (!ret)
		rdev->crit_proto_nlportid = info->snd_portid;

	return ret;
}

static int nl80211_crit_protocol_stop(struct sk_buff *skb,
				      struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (!rdev->ops->crit_proto_stop)
		return -EOPNOTSUPP;

	if (rdev->crit_proto_nlportid) {
		rdev->crit_proto_nlportid = 0;
		rdev_crit_proto_stop(rdev, wdev);
	}
	return 0;
}

8866 8867 8868
#define NL80211_FLAG_NEED_WIPHY		0x01
#define NL80211_FLAG_NEED_NETDEV	0x02
#define NL80211_FLAG_NEED_RTNL		0x04
8869 8870 8871
#define NL80211_FLAG_CHECK_NETDEV_UP	0x08
#define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
8872
#define NL80211_FLAG_NEED_WDEV		0x10
8873
/* If a netdev is associated, it must be UP, P2P must be started */
8874 8875
#define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
8876 8877 8878 8879 8880

static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
			    struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
8881
	struct wireless_dev *wdev;
8882 8883 8884 8885 8886 8887 8888
	struct net_device *dev;
	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;

	if (rtnl)
		rtnl_lock();

	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
J
Johannes Berg 已提交
8889
		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8890 8891 8892 8893 8894 8895
		if (IS_ERR(rdev)) {
			if (rtnl)
				rtnl_unlock();
			return PTR_ERR(rdev);
		}
		info->user_ptr[0] = rdev;
8896 8897
	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8898 8899
		ASSERT_RTNL();

8900 8901 8902
		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
						  info->attrs);
		if (IS_ERR(wdev)) {
8903 8904
			if (rtnl)
				rtnl_unlock();
8905
			return PTR_ERR(wdev);
8906
		}
8907 8908 8909 8910

		dev = wdev->netdev;
		rdev = wiphy_to_dev(wdev->wiphy);

8911 8912 8913 8914 8915 8916 8917 8918 8919 8920
		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
			if (!dev) {
				if (rtnl)
					rtnl_unlock();
				return -EINVAL;
			}

			info->user_ptr[1] = dev;
		} else {
			info->user_ptr[1] = wdev;
8921
		}
8922 8923 8924 8925 8926 8927 8928 8929 8930 8931

		if (dev) {
			if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
			    !netif_running(dev)) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}

			dev_hold(dev);
8932 8933 8934 8935 8936 8937
		} else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
			if (!wdev->p2p_started) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}
8938
		}
8939

8940 8941 8942 8943 8944 8945 8946 8947 8948
		info->user_ptr[0] = rdev;
	}

	return 0;
}

static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
			      struct genl_info *info)
{
8949 8950 8951 8952 8953 8954 8955 8956 8957 8958
	if (info->user_ptr[1]) {
		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
			struct wireless_dev *wdev = info->user_ptr[1];

			if (wdev->netdev)
				dev_put(wdev->netdev);
		} else {
			dev_put(info->user_ptr[1]);
		}
	}
8959 8960 8961 8962
	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
		rtnl_unlock();
}

8963 8964 8965 8966 8967
static struct genl_ops nl80211_ops[] = {
	{
		.cmd = NL80211_CMD_GET_WIPHY,
		.doit = nl80211_get_wiphy,
		.dumpit = nl80211_dump_wiphy,
8968
		.done = nl80211_dump_wiphy_done,
8969 8970
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
8971 8972
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
8973 8974 8975 8976 8977 8978
	},
	{
		.cmd = NL80211_CMD_SET_WIPHY,
		.doit = nl80211_set_wiphy,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8979
		.internal_flags = NL80211_FLAG_NEED_RTNL,
8980 8981 8982 8983 8984 8985 8986
	},
	{
		.cmd = NL80211_CMD_GET_INTERFACE,
		.doit = nl80211_get_interface,
		.dumpit = nl80211_dump_interface,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
8987 8988
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
8989 8990 8991 8992 8993 8994
	},
	{
		.cmd = NL80211_CMD_SET_INTERFACE,
		.doit = nl80211_set_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8995 8996
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
8997 8998 8999 9000 9001 9002
	},
	{
		.cmd = NL80211_CMD_NEW_INTERFACE,
		.doit = nl80211_new_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9003 9004
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9005 9006 9007 9008 9009
	},
	{
		.cmd = NL80211_CMD_DEL_INTERFACE,
		.doit = nl80211_del_interface,
		.policy = nl80211_policy,
9010
		.flags = GENL_ADMIN_PERM,
9011
		.internal_flags = NL80211_FLAG_NEED_WDEV |
9012
				  NL80211_FLAG_NEED_RTNL,
9013 9014 9015 9016 9017 9018
	},
	{
		.cmd = NL80211_CMD_GET_KEY,
		.doit = nl80211_get_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9019
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9020
				  NL80211_FLAG_NEED_RTNL,
9021 9022 9023 9024 9025 9026
	},
	{
		.cmd = NL80211_CMD_SET_KEY,
		.doit = nl80211_set_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9027
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9028
				  NL80211_FLAG_NEED_RTNL,
9029 9030 9031 9032 9033 9034
	},
	{
		.cmd = NL80211_CMD_NEW_KEY,
		.doit = nl80211_new_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9035
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9036
				  NL80211_FLAG_NEED_RTNL,
9037 9038 9039 9040 9041
	},
	{
		.cmd = NL80211_CMD_DEL_KEY,
		.doit = nl80211_del_key,
		.policy = nl80211_policy,
9042
		.flags = GENL_ADMIN_PERM,
9043
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9044
				  NL80211_FLAG_NEED_RTNL,
9045
	},
9046 9047 9048 9049
	{
		.cmd = NL80211_CMD_SET_BEACON,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9050
		.doit = nl80211_set_beacon,
9051
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9052
				  NL80211_FLAG_NEED_RTNL,
9053 9054
	},
	{
9055
		.cmd = NL80211_CMD_START_AP,
9056 9057
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9058
		.doit = nl80211_start_ap,
9059
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9060
				  NL80211_FLAG_NEED_RTNL,
9061 9062
	},
	{
9063
		.cmd = NL80211_CMD_STOP_AP,
9064 9065
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9066
		.doit = nl80211_stop_ap,
9067
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9068
				  NL80211_FLAG_NEED_RTNL,
9069
	},
9070 9071 9072
	{
		.cmd = NL80211_CMD_GET_STATION,
		.doit = nl80211_get_station,
9073
		.dumpit = nl80211_dump_station,
9074
		.policy = nl80211_policy,
9075 9076
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9077 9078 9079 9080 9081 9082
	},
	{
		.cmd = NL80211_CMD_SET_STATION,
		.doit = nl80211_set_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9083
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9084
				  NL80211_FLAG_NEED_RTNL,
9085 9086 9087 9088 9089 9090
	},
	{
		.cmd = NL80211_CMD_NEW_STATION,
		.doit = nl80211_new_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9091
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9092
				  NL80211_FLAG_NEED_RTNL,
9093 9094 9095 9096 9097
	},
	{
		.cmd = NL80211_CMD_DEL_STATION,
		.doit = nl80211_del_station,
		.policy = nl80211_policy,
9098
		.flags = GENL_ADMIN_PERM,
9099
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9100
				  NL80211_FLAG_NEED_RTNL,
9101 9102 9103 9104 9105 9106 9107
	},
	{
		.cmd = NL80211_CMD_GET_MPATH,
		.doit = nl80211_get_mpath,
		.dumpit = nl80211_dump_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9108
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9109
				  NL80211_FLAG_NEED_RTNL,
9110 9111 9112 9113 9114 9115
	},
	{
		.cmd = NL80211_CMD_SET_MPATH,
		.doit = nl80211_set_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9116
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9117
				  NL80211_FLAG_NEED_RTNL,
9118 9119 9120 9121 9122 9123
	},
	{
		.cmd = NL80211_CMD_NEW_MPATH,
		.doit = nl80211_new_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9124
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9125
				  NL80211_FLAG_NEED_RTNL,
9126 9127 9128 9129 9130
	},
	{
		.cmd = NL80211_CMD_DEL_MPATH,
		.doit = nl80211_del_mpath,
		.policy = nl80211_policy,
9131
		.flags = GENL_ADMIN_PERM,
9132
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9133
				  NL80211_FLAG_NEED_RTNL,
9134 9135 9136 9137 9138
	},
	{
		.cmd = NL80211_CMD_SET_BSS,
		.doit = nl80211_set_bss,
		.policy = nl80211_policy,
9139
		.flags = GENL_ADMIN_PERM,
9140
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9141
				  NL80211_FLAG_NEED_RTNL,
9142
	},
9143 9144 9145 9146
	{
		.cmd = NL80211_CMD_GET_REG,
		.doit = nl80211_get_reg,
		.policy = nl80211_policy,
9147
		.internal_flags = NL80211_FLAG_NEED_RTNL,
9148 9149
		/* can be retrieved by unprivileged users */
	},
9150 9151 9152 9153 9154
	{
		.cmd = NL80211_CMD_SET_REG,
		.doit = nl80211_set_reg,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9155
		.internal_flags = NL80211_FLAG_NEED_RTNL,
9156 9157 9158 9159 9160
	},
	{
		.cmd = NL80211_CMD_REQ_SET_REG,
		.doit = nl80211_req_set_reg,
		.policy = nl80211_policy,
9161 9162 9163
		.flags = GENL_ADMIN_PERM,
	},
	{
9164 9165
		.cmd = NL80211_CMD_GET_MESH_CONFIG,
		.doit = nl80211_get_mesh_config,
9166 9167
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
9168
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9169
				  NL80211_FLAG_NEED_RTNL,
9170 9171
	},
	{
9172 9173
		.cmd = NL80211_CMD_SET_MESH_CONFIG,
		.doit = nl80211_update_mesh_config,
9174
		.policy = nl80211_policy,
9175
		.flags = GENL_ADMIN_PERM,
9176
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9177
				  NL80211_FLAG_NEED_RTNL,
9178
	},
9179 9180 9181 9182 9183
	{
		.cmd = NL80211_CMD_TRIGGER_SCAN,
		.doit = nl80211_trigger_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
J
Johannes Berg 已提交
9184
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9185
				  NL80211_FLAG_NEED_RTNL,
9186 9187 9188 9189 9190 9191
	},
	{
		.cmd = NL80211_CMD_GET_SCAN,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_scan,
	},
9192 9193 9194 9195 9196 9197 9198 9199 9200 9201 9202 9203 9204 9205 9206 9207
	{
		.cmd = NL80211_CMD_START_SCHED_SCAN,
		.doit = nl80211_start_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
		.doit = nl80211_stop_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9208 9209 9210 9211 9212
	{
		.cmd = NL80211_CMD_AUTHENTICATE,
		.doit = nl80211_authenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9213
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9214
				  NL80211_FLAG_NEED_RTNL,
9215 9216 9217 9218 9219 9220
	},
	{
		.cmd = NL80211_CMD_ASSOCIATE,
		.doit = nl80211_associate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9221
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9222
				  NL80211_FLAG_NEED_RTNL,
9223 9224 9225 9226 9227 9228
	},
	{
		.cmd = NL80211_CMD_DEAUTHENTICATE,
		.doit = nl80211_deauthenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9229
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9230
				  NL80211_FLAG_NEED_RTNL,
9231 9232 9233 9234 9235 9236
	},
	{
		.cmd = NL80211_CMD_DISASSOCIATE,
		.doit = nl80211_disassociate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9237
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9238
				  NL80211_FLAG_NEED_RTNL,
9239
	},
J
Johannes Berg 已提交
9240 9241 9242 9243 9244
	{
		.cmd = NL80211_CMD_JOIN_IBSS,
		.doit = nl80211_join_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9245
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9246
				  NL80211_FLAG_NEED_RTNL,
J
Johannes Berg 已提交
9247 9248 9249 9250 9251 9252
	},
	{
		.cmd = NL80211_CMD_LEAVE_IBSS,
		.doit = nl80211_leave_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9253
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9254
				  NL80211_FLAG_NEED_RTNL,
J
Johannes Berg 已提交
9255
	},
9256 9257 9258 9259
#ifdef CONFIG_NL80211_TESTMODE
	{
		.cmd = NL80211_CMD_TESTMODE,
		.doit = nl80211_testmode_do,
W
Wey-Yi Guy 已提交
9260
		.dumpit = nl80211_testmode_dump,
9261 9262
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9263 9264
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9265 9266
	},
#endif
S
Samuel Ortiz 已提交
9267 9268 9269 9270 9271
	{
		.cmd = NL80211_CMD_CONNECT,
		.doit = nl80211_connect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9272
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9273
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9274 9275 9276 9277 9278 9279
	},
	{
		.cmd = NL80211_CMD_DISCONNECT,
		.doit = nl80211_disconnect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9280
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9281
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9282
	},
9283 9284 9285 9286 9287
	{
		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
		.doit = nl80211_wiphy_netns,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9288 9289
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9290
	},
9291 9292 9293 9294 9295
	{
		.cmd = NL80211_CMD_GET_SURVEY,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_survey,
	},
S
Samuel Ortiz 已提交
9296 9297 9298 9299 9300
	{
		.cmd = NL80211_CMD_SET_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9301
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9302
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9303 9304 9305 9306 9307 9308
	},
	{
		.cmd = NL80211_CMD_DEL_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9309
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9310
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9311 9312 9313 9314 9315 9316
	},
	{
		.cmd = NL80211_CMD_FLUSH_PMKSA,
		.doit = nl80211_flush_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9317
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9318
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9319
	},
9320 9321 9322 9323 9324
	{
		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
		.doit = nl80211_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9325
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9326
				  NL80211_FLAG_NEED_RTNL,
9327 9328 9329 9330 9331 9332
	},
	{
		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
		.doit = nl80211_cancel_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9333
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9334
				  NL80211_FLAG_NEED_RTNL,
9335
	},
9336 9337 9338 9339 9340
	{
		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
		.doit = nl80211_set_tx_bitrate_mask,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9341 9342
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9343
	},
9344
	{
9345 9346
		.cmd = NL80211_CMD_REGISTER_FRAME,
		.doit = nl80211_register_mgmt,
9347 9348
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9349
		.internal_flags = NL80211_FLAG_NEED_WDEV |
9350
				  NL80211_FLAG_NEED_RTNL,
9351 9352
	},
	{
9353 9354
		.cmd = NL80211_CMD_FRAME,
		.doit = nl80211_tx_mgmt,
9355
		.policy = nl80211_policy,
9356
		.flags = GENL_ADMIN_PERM,
9357
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9358 9359 9360 9361 9362 9363
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
		.doit = nl80211_tx_mgmt_cancel_wait,
		.policy = nl80211_policy,
9364
		.flags = GENL_ADMIN_PERM,
9365
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9366
				  NL80211_FLAG_NEED_RTNL,
9367
	},
K
Kalle Valo 已提交
9368 9369 9370 9371 9372
	{
		.cmd = NL80211_CMD_SET_POWER_SAVE,
		.doit = nl80211_set_power_save,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9373 9374
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
K
Kalle Valo 已提交
9375 9376 9377 9378 9379 9380
	},
	{
		.cmd = NL80211_CMD_GET_POWER_SAVE,
		.doit = nl80211_get_power_save,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
9381 9382
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
K
Kalle Valo 已提交
9383
	},
9384 9385 9386 9387 9388
	{
		.cmd = NL80211_CMD_SET_CQM,
		.doit = nl80211_set_cqm,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9389 9390
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9391
	},
9392 9393 9394 9395 9396
	{
		.cmd = NL80211_CMD_SET_CHANNEL,
		.doit = nl80211_set_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9397 9398
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9399
	},
9400 9401 9402 9403 9404
	{
		.cmd = NL80211_CMD_SET_WDS_PEER,
		.doit = nl80211_set_wds_peer,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9405 9406
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9407
	},
9408 9409 9410 9411 9412 9413 9414 9415 9416 9417 9418 9419 9420 9421 9422 9423
	{
		.cmd = NL80211_CMD_JOIN_MESH,
		.doit = nl80211_join_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_LEAVE_MESH,
		.doit = nl80211_leave_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9424
#ifdef CONFIG_PM
J
Johannes Berg 已提交
9425 9426 9427 9428 9429 9430 9431 9432 9433 9434 9435 9436 9437 9438 9439 9440
	{
		.cmd = NL80211_CMD_GET_WOWLAN,
		.doit = nl80211_get_wowlan,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_WOWLAN,
		.doit = nl80211_set_wowlan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
9441
#endif
9442 9443 9444 9445 9446 9447 9448 9449
	{
		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
		.doit = nl80211_set_rekey_data,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9450 9451 9452 9453 9454 9455 9456 9457 9458 9459 9460 9461 9462 9463 9464 9465
	{
		.cmd = NL80211_CMD_TDLS_MGMT,
		.doit = nl80211_tdls_mgmt,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_TDLS_OPER,
		.doit = nl80211_tdls_oper,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9466 9467 9468 9469 9470 9471 9472 9473
	{
		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
		.doit = nl80211_register_unexpected_frame,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
J
Johannes Berg 已提交
9474 9475 9476 9477 9478
	{
		.cmd = NL80211_CMD_PROBE_CLIENT,
		.doit = nl80211_probe_client,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9479
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
J
Johannes Berg 已提交
9480 9481
				  NL80211_FLAG_NEED_RTNL,
	},
9482 9483 9484 9485 9486 9487 9488 9489
	{
		.cmd = NL80211_CMD_REGISTER_BEACONS,
		.doit = nl80211_register_beacons,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
9490 9491 9492 9493 9494 9495 9496 9497
	{
		.cmd = NL80211_CMD_SET_NOACK_MAP,
		.doit = nl80211_set_noack_map,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
9498 9499 9500 9501 9502 9503 9504 9505 9506 9507 9508 9509 9510 9511 9512 9513
	{
		.cmd = NL80211_CMD_START_P2P_DEVICE,
		.doit = nl80211_start_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
		.doit = nl80211_stop_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9514 9515 9516
	{
		.cmd = NL80211_CMD_SET_MCAST_RATE,
		.doit = nl80211_set_mcast_rate,
9517 9518 9519 9520 9521 9522 9523 9524
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_MAC_ACL,
		.doit = nl80211_set_mac_acl,
9525 9526 9527 9528 9529
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
9530 9531 9532 9533 9534 9535 9536 9537
	{
		.cmd = NL80211_CMD_RADAR_DETECT,
		.doit = nl80211_start_radar_detection,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9538 9539 9540 9541 9542
	{
		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
		.doit = nl80211_get_protocol_features,
		.policy = nl80211_policy,
	},
9543 9544 9545 9546 9547 9548 9549 9550
	{
		.cmd = NL80211_CMD_UPDATE_FT_IES,
		.doit = nl80211_update_ft_ies,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9551 9552 9553 9554 9555 9556 9557 9558 9559 9560 9561 9562 9563 9564 9565
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
		.doit = nl80211_crit_protocol_start,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
		.doit = nl80211_crit_protocol_stop,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
9566 9567 9568 9569 9570 9571 9572 9573 9574 9575 9576 9577 9578 9579 9580
	},
	{
		.cmd = NL80211_CMD_GET_COALESCE,
		.doit = nl80211_get_coalesce,
		.policy = nl80211_policy,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_COALESCE,
		.doit = nl80211_set_coalesce,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9581 9582 9583 9584 9585 9586 9587 9588 9589
	},
	{
		.cmd = NL80211_CMD_CHANNEL_SWITCH,
		.doit = nl80211_channel_switch,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9590
};
9591

9592 9593 9594
static struct genl_multicast_group nl80211_mlme_mcgrp = {
	.name = "mlme",
};
9595 9596 9597 9598 9599

/* multicast groups */
static struct genl_multicast_group nl80211_config_mcgrp = {
	.name = "config",
};
9600 9601 9602
static struct genl_multicast_group nl80211_scan_mcgrp = {
	.name = "scan",
};
9603 9604 9605
static struct genl_multicast_group nl80211_regulatory_mcgrp = {
	.name = "regulatory",
};
9606 9607 9608 9609 9610 9611

/* notification functions */

void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
{
	struct sk_buff *msg;
9612
	struct nl80211_dump_wiphy_state state = {};
9613

9614
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9615 9616 9617
	if (!msg)
		return;

9618
	if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9619 9620 9621 9622
		nlmsg_free(msg);
		return;
	}

9623 9624
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_config_mcgrp.id, GFP_KERNEL);
9625 9626
}

9627 9628 9629 9630 9631 9632 9633 9634 9635 9636 9637 9638 9639
static int nl80211_add_scan_req(struct sk_buff *msg,
				struct cfg80211_registered_device *rdev)
{
	struct cfg80211_scan_request *req = rdev->scan_req;
	struct nlattr *nest;
	int i;

	if (WARN_ON(!req))
		return 0;

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
	if (!nest)
		goto nla_put_failure;
9640 9641 9642 9643
	for (i = 0; i < req->n_ssids; i++) {
		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
			goto nla_put_failure;
	}
9644 9645 9646 9647 9648
	nla_nest_end(msg, nest);

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
	if (!nest)
		goto nla_put_failure;
9649 9650 9651 9652
	for (i = 0; i < req->n_channels; i++) {
		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
			goto nla_put_failure;
	}
9653 9654
	nla_nest_end(msg, nest);

9655 9656 9657
	if (req->ie &&
	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
		goto nla_put_failure;
9658

9659 9660 9661
	if (req->flags)
		nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);

9662 9663 9664 9665 9666
	return 0;
 nla_put_failure:
	return -ENOBUFS;
}

9667 9668
static int nl80211_send_scan_msg(struct sk_buff *msg,
				 struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9669
				 struct wireless_dev *wdev,
9670
				 u32 portid, u32 seq, int flags,
9671
				 u32 cmd)
9672 9673 9674
{
	void *hdr;

9675
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9676 9677 9678
	if (!hdr)
		return -1;

9679
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
J
Johannes Berg 已提交
9680 9681 9682
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9683
		goto nla_put_failure;
9684

9685 9686
	/* ignore errors and send incomplete event anyway */
	nl80211_add_scan_req(msg, rdev);
9687 9688 9689 9690 9691 9692 9693 9694

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

9695 9696 9697 9698
static int
nl80211_send_sched_scan_msg(struct sk_buff *msg,
			    struct cfg80211_registered_device *rdev,
			    struct net_device *netdev,
9699
			    u32 portid, u32 seq, int flags, u32 cmd)
9700 9701 9702
{
	void *hdr;

9703
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9704 9705 9706
	if (!hdr)
		return -1;

9707 9708 9709
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
9710 9711 9712 9713 9714 9715 9716 9717

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

9718
void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9719
			     struct wireless_dev *wdev)
9720 9721 9722
{
	struct sk_buff *msg;

9723
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9724 9725 9726
	if (!msg)
		return;

J
Johannes Berg 已提交
9727
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9728 9729 9730 9731 9732
				  NL80211_CMD_TRIGGER_SCAN) < 0) {
		nlmsg_free(msg);
		return;
	}

9733 9734
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9735 9736
}

9737
void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9738
			    struct wireless_dev *wdev)
9739 9740 9741
{
	struct sk_buff *msg;

9742
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9743 9744 9745
	if (!msg)
		return;

J
Johannes Berg 已提交
9746
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9747
				  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9748 9749 9750 9751
		nlmsg_free(msg);
		return;
	}

9752 9753
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9754 9755 9756
}

void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9757
			       struct wireless_dev *wdev)
9758 9759 9760
{
	struct sk_buff *msg;

9761
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9762 9763 9764
	if (!msg)
		return;

J
Johannes Berg 已提交
9765
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9766
				  NL80211_CMD_SCAN_ABORTED) < 0) {
9767 9768 9769 9770
		nlmsg_free(msg);
		return;
	}

9771 9772
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9773 9774
}

9775 9776 9777 9778 9779 9780 9781 9782 9783 9784 9785 9786 9787 9788 9789 9790 9791 9792 9793 9794 9795 9796 9797 9798
void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev)
{
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
					NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
}

void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, u32 cmd)
{
	struct sk_buff *msg;

9799
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9800 9801 9802 9803 9804 9805 9806 9807 9808 9809 9810 9811
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
}

9812 9813 9814 9815 9816 9817 9818 9819 9820
/*
 * This can happen on global regulatory changes or device specific settings
 * based on custom world regulatory domains.
 */
void nl80211_send_reg_change_event(struct regulatory_request *request)
{
	struct sk_buff *msg;
	void *hdr;

9821
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9822 9823 9824 9825 9826 9827 9828 9829 9830 9831
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/* Userspace can always count this one always being set */
9832 9833 9834 9835 9836 9837 9838 9839 9840 9841 9842 9843 9844 9845 9846 9847 9848 9849 9850 9851 9852 9853 9854 9855
	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
		goto nla_put_failure;

	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_WORLD))
			goto nla_put_failure;
	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
			goto nla_put_failure;
	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
		   request->intersect) {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_INTERSECTION))
			goto nla_put_failure;
	} else {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_COUNTRY) ||
		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
				   request->alpha2))
			goto nla_put_failure;
	}

J
Johannes Berg 已提交
9856
	if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9857 9858
	    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
		goto nla_put_failure;
9859

J
Johannes Berg 已提交
9860
	genlmsg_end(msg, hdr);
9861

9862
	rcu_read_lock();
9863
	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9864 9865
				GFP_ATOMIC);
	rcu_read_unlock();
9866 9867 9868 9869 9870 9871 9872 9873

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

9874 9875 9876
static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
				    struct net_device *netdev,
				    const u8 *buf, size_t len,
9877
				    enum nl80211_commands cmd, gfp_t gfp)
9878 9879 9880 9881
{
	struct sk_buff *msg;
	void *hdr;

9882
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9883 9884 9885 9886 9887 9888 9889 9890 9891
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9892 9893 9894 9895
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
		goto nla_put_failure;
9896

J
Johannes Berg 已提交
9897
	genlmsg_end(msg, hdr);
9898

9899 9900
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
9901 9902 9903 9904 9905 9906 9907 9908
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9909 9910
			  struct net_device *netdev, const u8 *buf,
			  size_t len, gfp_t gfp)
9911 9912
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9913
				NL80211_CMD_AUTHENTICATE, gfp);
9914 9915 9916 9917
}

void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
9918
			   size_t len, gfp_t gfp)
9919
{
9920 9921
	nl80211_send_mlme_event(rdev, netdev, buf, len,
				NL80211_CMD_ASSOCIATE, gfp);
9922 9923
}

9924
void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9925 9926
			 struct net_device *netdev, const u8 *buf,
			 size_t len, gfp_t gfp)
9927 9928
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9929
				NL80211_CMD_DEAUTHENTICATE, gfp);
9930 9931
}

9932 9933
void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
9934
			   size_t len, gfp_t gfp)
9935 9936
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9937
				NL80211_CMD_DISASSOCIATE, gfp);
9938 9939
}

9940 9941
void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
				  size_t len)
9942
{
9943 9944 9945
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9946 9947
	const struct ieee80211_mgmt *mgmt = (void *)buf;
	u32 cmd;
9948

9949 9950
	if (WARN_ON(len < 2))
		return;
9951

9952 9953 9954 9955
	if (ieee80211_is_deauth(mgmt->frame_control))
		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
	else
		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9956

9957 9958
	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9959
}
9960
EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9961

9962 9963
static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
				      struct net_device *netdev, int cmd,
9964
				      const u8 *addr, gfp_t gfp)
9965 9966 9967 9968
{
	struct sk_buff *msg;
	void *hdr;

9969
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9970 9971 9972 9973 9974 9975 9976 9977 9978
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9979 9980 9981 9982 9983
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
9984

J
Johannes Berg 已提交
9985
	genlmsg_end(msg, hdr);
9986

9987 9988
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
9989 9990 9991 9992 9993 9994 9995 9996
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9997 9998
			       struct net_device *netdev, const u8 *addr,
			       gfp_t gfp)
9999 10000
{
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10001
				  addr, gfp);
10002 10003 10004
}

void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10005 10006
				struct net_device *netdev, const u8 *addr,
				gfp_t gfp)
10007
{
10008 10009
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
				  addr, gfp);
10010 10011
}

S
Samuel Ortiz 已提交
10012 10013 10014 10015 10016 10017 10018 10019 10020
void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *bssid,
				 const u8 *req_ie, size_t req_ie_len,
				 const u8 *resp_ie, size_t resp_ie_len,
				 u16 status, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

10021
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
S
Samuel Ortiz 已提交
10022 10023 10024 10025 10026 10027 10028 10029 10030
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10031 10032 10033 10034 10035 10036 10037 10038 10039
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
10040

J
Johannes Berg 已提交
10041
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
10042

10043 10044
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
S
Samuel Ortiz 已提交
10045 10046 10047 10048 10049 10050 10051 10052 10053 10054 10055 10056 10057 10058 10059 10060
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
			 struct net_device *netdev, const u8 *bssid,
			 const u8 *req_ie, size_t req_ie_len,
			 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

10061
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
S
Samuel Ortiz 已提交
10062 10063 10064 10065 10066 10067 10068 10069 10070
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10071 10072 10073 10074 10075 10076 10077 10078
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
10079

J
Johannes Berg 已提交
10080
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
10081

10082 10083
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
S
Samuel Ortiz 已提交
10084 10085 10086 10087 10088 10089 10090 10091 10092 10093
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, u16 reason,
J
Johannes Berg 已提交
10094
			       const u8 *ie, size_t ie_len, bool from_ap)
S
Samuel Ortiz 已提交
10095 10096 10097 10098
{
	struct sk_buff *msg;
	void *hdr;

10099
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
S
Samuel Ortiz 已提交
10100 10101 10102 10103 10104 10105 10106 10107 10108
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10109 10110 10111 10112 10113 10114 10115 10116
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (from_ap && reason &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
	    (from_ap &&
	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
10117

J
Johannes Berg 已提交
10118
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
10119

10120 10121
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, GFP_KERNEL);
S
Samuel Ortiz 已提交
10122 10123 10124 10125 10126 10127 10128 10129
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

J
Johannes Berg 已提交
10130 10131 10132 10133 10134 10135 10136
void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, const u8 *bssid,
			     gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

10137
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
J
Johannes Berg 已提交
10138 10139 10140 10141 10142 10143 10144 10145 10146
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10147 10148 10149 10150
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
J
Johannes Berg 已提交
10151

J
Johannes Berg 已提交
10152
	genlmsg_end(msg, hdr);
J
Johannes Berg 已提交
10153

10154 10155
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
J
Johannes Berg 已提交
10156 10157 10158 10159 10160 10161 10162
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10163 10164
void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
					const u8* ie, u8 ie_len, gfp_t gfp)
10165
{
10166 10167
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10168 10169 10170
	struct sk_buff *msg;
	void *hdr;

10171 10172 10173 10174 10175
	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
		return;

	trace_cfg80211_notify_new_peer_candidate(dev, addr);

10176 10177 10178 10179 10180 10181 10182 10183 10184 10185
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10186
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10187 10188
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10189 10190 10191
	    (ie_len && ie &&
	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
		goto nla_put_failure;
10192

J
Johannes Berg 已提交
10193
	genlmsg_end(msg, hdr);
10194 10195 10196 10197 10198 10199 10200 10201 10202

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10203
EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10204

10205 10206 10207
void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *addr,
				 enum nl80211_key_type key_type, int key_id,
10208
				 const u8 *tsc, gfp_t gfp)
10209 10210 10211 10212
{
	struct sk_buff *msg;
	void *hdr;

10213
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10214 10215 10216 10217 10218 10219 10220 10221 10222
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10223 10224 10225 10226 10227 10228 10229 10230
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
	    (key_id != -1 &&
	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
		goto nla_put_failure;
10231

J
Johannes Berg 已提交
10232
	genlmsg_end(msg, hdr);
10233

10234 10235
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
10236 10237 10238 10239 10240 10241 10242
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10243 10244 10245 10246 10247 10248 10249 10250
void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
				    struct ieee80211_channel *channel_before,
				    struct ieee80211_channel *channel_after)
{
	struct sk_buff *msg;
	void *hdr;
	struct nlattr *nl_freq;

10251
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10252 10253 10254 10255 10256 10257 10258 10259 10260 10261 10262 10263 10264
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/*
	 * Since we are applying the beacon hint to a wiphy we know its
	 * wiphy_idx is valid
	 */
10265 10266
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
		goto nla_put_failure;
10267 10268 10269 10270 10271

	/* Before */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
	if (!nl_freq)
		goto nla_put_failure;
10272
	if (nl80211_msg_put_channel(msg, channel_before, false))
10273 10274 10275 10276 10277 10278 10279
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

	/* After */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
	if (!nl_freq)
		goto nla_put_failure;
10280
	if (nl80211_msg_put_channel(msg, channel_after, false))
10281 10282 10283
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

J
Johannes Berg 已提交
10284
	genlmsg_end(msg, hdr);
10285

10286 10287 10288 10289
	rcu_read_lock();
	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
				GFP_ATOMIC);
	rcu_read_unlock();
10290 10291 10292 10293 10294 10295 10296 10297

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10298 10299
static void nl80211_send_remain_on_chan_event(
	int cmd, struct cfg80211_registered_device *rdev,
10300
	struct wireless_dev *wdev, u64 cookie,
10301 10302 10303 10304 10305 10306 10307 10308 10309 10310 10311 10312 10313 10314 10315 10316
	struct ieee80211_channel *chan,
	unsigned int duration, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10317
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10318 10319
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
10320
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10321
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10322 10323
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
			NL80211_CHAN_NO_HT) ||
10324 10325
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
10326

10327 10328 10329
	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
		goto nla_put_failure;
10330

J
Johannes Berg 已提交
10331
	genlmsg_end(msg, hdr);
10332 10333 10334 10335 10336 10337 10338 10339 10340 10341

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10342 10343 10344
void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
			       struct ieee80211_channel *chan,
			       unsigned int duration, gfp_t gfp)
10345
{
10346 10347 10348 10349
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10350
	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10351
					  rdev, wdev, cookie, chan,
10352
					  duration, gfp);
10353
}
10354
EXPORT_SYMBOL(cfg80211_ready_on_channel);
10355

10356 10357 10358
void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
					struct ieee80211_channel *chan,
					gfp_t gfp)
10359
{
10360 10361 10362 10363
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10364
	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10365
					  rdev, wdev, cookie, chan, 0, gfp);
10366
}
10367
EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10368

10369 10370
void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
		      struct station_info *sinfo, gfp_t gfp)
10371
{
10372 10373
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10374 10375
	struct sk_buff *msg;

10376 10377
	trace_cfg80211_new_sta(dev, mac_addr, sinfo);

10378
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10379 10380 10381
	if (!msg)
		return;

10382 10383
	if (nl80211_send_station(msg, 0, 0, 0,
				 rdev, dev, mac_addr, sinfo) < 0) {
10384 10385 10386 10387 10388 10389 10390
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
}
10391
EXPORT_SYMBOL(cfg80211_new_sta);
10392

10393
void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10394
{
10395 10396
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10397 10398 10399
	struct sk_buff *msg;
	void *hdr;

10400 10401
	trace_cfg80211_del_sta(dev, mac_addr);

10402
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10403 10404 10405 10406 10407 10408 10409 10410 10411
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10412 10413 10414
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
10415

J
Johannes Berg 已提交
10416
	genlmsg_end(msg, hdr);
10417 10418 10419 10420 10421 10422 10423 10424 10425

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10426
EXPORT_SYMBOL(cfg80211_del_sta);
10427

10428 10429 10430
void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
			  enum nl80211_connect_failed_reason reason,
			  gfp_t gfp)
10431
{
10432 10433
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10434 10435 10436 10437 10438 10439 10440 10441 10442 10443 10444 10445 10446 10447 10448 10449 10450 10451 10452 10453 10454 10455 10456 10457 10458 10459 10460 10461
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10462
EXPORT_SYMBOL(cfg80211_conn_failed);
10463

10464 10465
static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
				       const u8 *addr, gfp_t gfp)
10466 10467 10468 10469 10470
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;
10471
	u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10472

10473
	if (!nlportid)
10474 10475 10476 10477 10478 10479
		return false;

	msg = nlmsg_new(100, gfp);
	if (!msg)
		return true;

10480
	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10481 10482 10483 10484 10485
	if (!hdr) {
		nlmsg_free(msg);
		return true;
	}

10486 10487 10488 10489
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
10490

10491
	genlmsg_end(msg, hdr);
10492
	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10493 10494 10495 10496 10497 10498 10499 10500
	return true;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return true;
}

10501 10502
bool cfg80211_rx_spurious_frame(struct net_device *dev,
				const u8 *addr, gfp_t gfp)
10503
{
10504 10505 10506 10507 10508 10509 10510 10511 10512 10513 10514 10515 10516 10517
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_spurious_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
10518
}
10519
EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10520

10521 10522
bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
					const u8 *addr, gfp_t gfp)
10523
{
10524 10525 10526 10527 10528 10529 10530 10531 10532 10533 10534 10535 10536 10537 10538 10539
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev,
					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
10540
}
10541
EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10542

10543
int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10544
		      struct wireless_dev *wdev, u32 nlportid,
10545
		      int freq, int sig_dbm,
10546
		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10547
{
10548
	struct net_device *netdev = wdev->netdev;
10549 10550 10551 10552 10553 10554 10555
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return -ENOMEM;

10556
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10557 10558 10559 10560 10561
	if (!hdr) {
		nlmsg_free(msg);
		return -ENOMEM;
	}

10562
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10563 10564
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					netdev->ifindex)) ||
10565
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10566 10567 10568
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
	    (sig_dbm &&
	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10569 10570 10571
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    (flags &&
	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10572
		goto nla_put_failure;
10573

J
Johannes Berg 已提交
10574
	genlmsg_end(msg, hdr);
10575

10576
	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10577 10578 10579 10580 10581 10582 10583

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return -ENOBUFS;
}

10584 10585
void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
10586
{
10587 10588
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10589
	struct net_device *netdev = wdev->netdev;
10590 10591 10592
	struct sk_buff *msg;
	void *hdr;

10593 10594
	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);

10595 10596 10597 10598
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

10599
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10600 10601 10602 10603 10604
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10605
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10606 10607
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
				   netdev->ifindex)) ||
10608
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10609 10610 10611 10612
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
10613

J
Johannes Berg 已提交
10614
	genlmsg_end(msg, hdr);
10615

10616 10617
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
10618 10619 10620 10621 10622 10623
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10624
EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10625

10626 10627 10628
void cfg80211_cqm_rssi_notify(struct net_device *dev,
			      enum nl80211_cqm_rssi_threshold_event rssi_event,
			      gfp_t gfp)
10629
{
10630 10631 10632
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10633 10634 10635 10636
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

10637 10638
	trace_cfg80211_cqm_rssi_notify(dev, rssi_event);

10639
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10640 10641 10642 10643 10644 10645 10646 10647 10648
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10649
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10650
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10651
		goto nla_put_failure;
10652 10653 10654 10655 10656

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

10657 10658 10659
	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
			rssi_event))
		goto nla_put_failure;
10660 10661 10662

	nla_nest_end(msg, pinfoattr);

J
Johannes Berg 已提交
10663
	genlmsg_end(msg, hdr);
10664 10665 10666 10667 10668 10669 10670 10671 10672

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10673
EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10674

10675 10676 10677
static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev, const u8 *bssid,
				     const u8 *replay_ctr, gfp_t gfp)
10678 10679 10680 10681 10682
{
	struct sk_buff *msg;
	struct nlattr *rekey_attr;
	void *hdr;

10683
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10684 10685 10686 10687 10688 10689 10690 10691 10692
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10693 10694 10695 10696
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
10697 10698 10699 10700 10701

	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
	if (!rekey_attr)
		goto nla_put_failure;

10702 10703 10704
	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
		    NL80211_REPLAY_CTR_LEN, replay_ctr))
		goto nla_put_failure;
10705 10706 10707

	nla_nest_end(msg, rekey_attr);

J
Johannes Berg 已提交
10708
	genlmsg_end(msg, hdr);
10709 10710 10711 10712 10713 10714 10715 10716 10717 10718

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10719 10720 10721 10722 10723 10724 10725 10726 10727 10728 10729 10730 10731 10732 10733 10734
void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
			       const u8 *replay_ctr, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_gtk_rekey_notify(dev, bssid);
	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
}
EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);

static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, int index,
			       const u8 *bssid, bool preauth, gfp_t gfp)
10735 10736 10737 10738 10739
{
	struct sk_buff *msg;
	struct nlattr *attr;
	void *hdr;

10740
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10741 10742 10743 10744 10745 10746 10747 10748 10749
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10750 10751 10752
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
10753 10754 10755 10756 10757

	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
	if (!attr)
		goto nla_put_failure;

10758 10759 10760 10761 10762
	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
	    (preauth &&
	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
		goto nla_put_failure;
10763 10764 10765

	nla_nest_end(msg, attr);

J
Johannes Berg 已提交
10766
	genlmsg_end(msg, hdr);
10767 10768 10769 10770 10771 10772 10773 10774 10775 10776

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10777 10778 10779 10780 10781 10782 10783 10784 10785 10786 10787 10788 10789 10790 10791 10792
void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
				     const u8 *bssid, bool preauth, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
}
EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);

static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev,
				     struct cfg80211_chan_def *chandef,
				     gfp_t gfp)
10793 10794 10795 10796
{
	struct sk_buff *msg;
	void *hdr;

10797
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10798 10799 10800 10801 10802 10803 10804 10805 10806
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10807 10808 10809 10810
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
10811
		goto nla_put_failure;
10812 10813 10814 10815 10816 10817 10818 10819 10820 10821 10822 10823

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10824 10825
void cfg80211_ch_switch_notify(struct net_device *dev,
			       struct cfg80211_chan_def *chandef)
10826
{
10827 10828 10829 10830
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

10831
	ASSERT_WDEV_LOCK(wdev);
10832

10833
	trace_cfg80211_ch_switch_notify(dev, chandef);
10834 10835

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10836
		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10837 10838
		    wdev->iftype != NL80211_IFTYPE_ADHOC &&
		    wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10839
		return;
10840 10841 10842 10843 10844 10845 10846 10847 10848 10849 10850 10851 10852

	wdev->channel = chandef->chan;
	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
}
EXPORT_SYMBOL(cfg80211_ch_switch_notify);

void cfg80211_cqm_txe_notify(struct net_device *dev,
			     const u8 *peer, u32 num_packets,
			     u32 rate, u32 intvl, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10853 10854 10855 10856 10857 10858 10859 10860 10861 10862 10863 10864 10865 10866 10867
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10868
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10869 10870 10871 10872 10873 10874 10875 10876 10877 10878 10879 10880 10881 10882 10883 10884 10885 10886 10887 10888 10889 10890 10891 10892 10893 10894 10895 10896
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
		goto nla_put_failure;

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
		goto nla_put_failure;

	nla_nest_end(msg, pinfoattr);

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10897
EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10898

10899 10900
void
nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10901
		     const struct cfg80211_chan_def *chandef,
10902 10903 10904 10905 10906 10907 10908 10909 10910 10911 10912 10913 10914 10915 10916 10917 10918 10919 10920 10921 10922 10923 10924 10925 10926 10927 10928 10929 10930 10931 10932 10933 10934 10935
		     enum nl80211_radar_event event,
		     struct net_device *netdev, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;

	/* NOP and radar events don't need a netdev parameter */
	if (netdev) {
		struct wireless_dev *wdev = netdev->ieee80211_ptr;

		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
		    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
			goto nla_put_failure;
	}

	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
		goto nla_put_failure;

10936
	genlmsg_end(msg, hdr);
10937 10938 10939 10940 10941 10942 10943 10944 10945 10946

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10947 10948
void cfg80211_cqm_pktloss_notify(struct net_device *dev,
				 const u8 *peer, u32 num_packets, gfp_t gfp)
10949
{
10950 10951 10952
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10953 10954 10955 10956
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

10957 10958
	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);

10959
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10960 10961 10962 10963 10964 10965 10966 10967 10968
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10969
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10970
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10971 10972
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
		goto nla_put_failure;
10973 10974 10975 10976 10977

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

10978 10979
	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
		goto nla_put_failure;
10980 10981 10982

	nla_nest_end(msg, pinfoattr);

J
Johannes Berg 已提交
10983
	genlmsg_end(msg, hdr);
10984 10985 10986 10987 10988 10989 10990 10991 10992

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10993
EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10994

J
Johannes Berg 已提交
10995 10996 10997 10998 10999 11000 11001 11002
void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
			   u64 cookie, bool acked, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;

11003 11004
	trace_cfg80211_probe_status(dev, addr, cookie, acked);

11005
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11006

J
Johannes Berg 已提交
11007 11008 11009 11010 11011 11012 11013 11014 11015
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

11016 11017 11018 11019 11020 11021
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
J
Johannes Berg 已提交
11022

11023
	genlmsg_end(msg, hdr);
J
Johannes Berg 已提交
11024 11025 11026 11027 11028 11029 11030 11031 11032 11033 11034

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_probe_status);

11035 11036
void cfg80211_report_obss_beacon(struct wiphy *wiphy,
				 const u8 *frame, size_t len,
11037
				 int freq, int sig_dbm)
11038 11039 11040 11041
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	struct sk_buff *msg;
	void *hdr;
11042
	struct cfg80211_beacon_registration *reg;
11043

11044 11045
	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);

11046 11047 11048 11049 11050 11051 11052
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		msg = nlmsg_new(len + 100, GFP_ATOMIC);
		if (!msg) {
			spin_unlock_bh(&rdev->beacon_registrations_lock);
			return;
		}
11053

11054 11055 11056
		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
		if (!hdr)
			goto nla_put_failure;
11057

11058 11059 11060 11061 11062 11063 11064
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
		    (freq &&
		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
		    (sig_dbm &&
		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
			goto nla_put_failure;
11065

11066
		genlmsg_end(msg, hdr);
11067

11068 11069 11070
		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
	}
	spin_unlock_bh(&rdev->beacon_registrations_lock);
11071 11072 11073
	return;

 nla_put_failure:
11074 11075 11076
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	if (hdr)
		genlmsg_cancel(msg, hdr);
11077 11078 11079 11080
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_obss_beacon);

11081 11082 11083 11084 11085 11086 11087 11088
#ifdef CONFIG_PM
void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
				   struct cfg80211_wowlan_wakeup *wakeup,
				   gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;
11089
	int size = 200;
11090 11091 11092 11093 11094 11095 11096 11097 11098 11099 11100 11101 11102 11103 11104 11105 11106 11107 11108 11109 11110 11111 11112 11113 11114 11115 11116 11117 11118 11119 11120 11121 11122 11123 11124 11125 11126 11127 11128 11129 11130 11131 11132 11133 11134 11135 11136 11137 11138 11139 11140

	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);

	if (wakeup)
		size += wakeup->packet_present_len;

	msg = nlmsg_new(size, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
	if (!hdr)
		goto free_msg;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto free_msg;

	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					wdev->netdev->ifindex))
		goto free_msg;

	if (wakeup) {
		struct nlattr *reasons;

		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);

		if (wakeup->disconnect &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
			goto free_msg;
		if (wakeup->magic_pkt &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
			goto free_msg;
		if (wakeup->gtk_rekey_failure &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
			goto free_msg;
		if (wakeup->eap_identity_req &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
			goto free_msg;
		if (wakeup->four_way_handshake &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
			goto free_msg;
		if (wakeup->rfkill_release &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
			goto free_msg;

		if (wakeup->pattern_idx >= 0 &&
		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
				wakeup->pattern_idx))
			goto free_msg;

11141 11142 11143 11144 11145 11146 11147 11148 11149 11150 11151
		if (wakeup->tcp_match)
			nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);

		if (wakeup->tcp_connlost)
			nla_put_flag(msg,
				     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);

		if (wakeup->tcp_nomoretokens)
			nla_put_flag(msg,
				NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);

11152 11153 11154 11155 11156 11157 11158 11159 11160 11161 11162 11163 11164 11165 11166 11167 11168 11169 11170 11171 11172 11173 11174
		if (wakeup->packet) {
			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;

			if (!wakeup->packet_80211) {
				pkt_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
				len_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
			}

			if (wakeup->packet_len &&
			    nla_put_u32(msg, len_attr, wakeup->packet_len))
				goto free_msg;

			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
				    wakeup->packet))
				goto free_msg;
		}

		nla_nest_end(msg, reasons);
	}

11175
	genlmsg_end(msg, hdr);
11176 11177 11178 11179 11180 11181 11182 11183 11184 11185 11186

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 free_msg:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
#endif

11187 11188 11189 11190 11191 11192 11193 11194 11195 11196 11197 11198 11199 11200 11201 11202 11203 11204 11205 11206 11207 11208 11209 11210 11211 11212 11213 11214 11215 11216
void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
				enum nl80211_tdls_operation oper,
				u16 reason_code, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
					 reason_code);

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
	    (reason_code > 0 &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
		goto nla_put_failure;

11217
	genlmsg_end(msg, hdr);
11218 11219 11220 11221 11222 11223 11224 11225 11226 11227 11228

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_tdls_oper_request);

11229 11230 11231 11232 11233 11234 11235
static int nl80211_netlink_notify(struct notifier_block * nb,
				  unsigned long state,
				  void *_notify)
{
	struct netlink_notify *notify = _notify;
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *wdev;
11236
	struct cfg80211_beacon_registration *reg, *tmp;
11237 11238 11239 11240 11241 11242

	if (state != NETLINK_URELEASE)
		return NOTIFY_DONE;

	rcu_read_lock();

11243
	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11244
		list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11245
			cfg80211_mlme_unregister_socket(wdev, notify->portid);
11246 11247 11248 11249 11250 11251 11252 11253 11254 11255 11256

		spin_lock_bh(&rdev->beacon_registrations_lock);
		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
					 list) {
			if (reg->nlportid == notify->portid) {
				list_del(&reg->list);
				kfree(reg);
				break;
			}
		}
		spin_unlock_bh(&rdev->beacon_registrations_lock);
11257
	}
11258 11259 11260 11261 11262 11263 11264 11265 11266 11267

	rcu_read_unlock();

	return NOTIFY_DONE;
}

static struct notifier_block nl80211_netlink_notifier = {
	.notifier_call = nl80211_netlink_notify,
};

11268 11269 11270 11271 11272 11273 11274 11275 11276 11277 11278 11279 11280 11281 11282 11283 11284 11285 11286 11287 11288 11289 11290 11291 11292 11293 11294 11295 11296 11297 11298 11299
void cfg80211_ft_event(struct net_device *netdev,
		       struct cfg80211_ft_event_params *ft_event)
{
	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_ft_event(wiphy, netdev, ft_event);

	if (!ft_event->target_ap)
		return;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
	nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
	nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
	if (ft_event->ies)
		nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
	if (ft_event->ric_ies)
		nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
			ft_event->ric_ies);

11300
	genlmsg_end(msg, hdr);
11301 11302 11303 11304 11305 11306

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, GFP_KERNEL);
}
EXPORT_SYMBOL(cfg80211_ft_event);

11307 11308 11309 11310 11311 11312 11313 11314 11315 11316 11317 11318 11319 11320 11321 11322 11323 11324 11325 11326 11327 11328 11329 11330 11331 11332 11333 11334 11335 11336 11337 11338 11339 11340 11341 11342 11343 11344 11345
void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev;
	struct sk_buff *msg;
	void *hdr;
	u32 nlportid;

	rdev = wiphy_to_dev(wdev->wiphy);
	if (!rdev->crit_proto_nlportid)
		return;

	nlportid = rdev->crit_proto_nlportid;
	rdev->crit_proto_nlportid = 0;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
	return;

 nla_put_failure:
	if (hdr)
		genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}
EXPORT_SYMBOL(cfg80211_crit_proto_stopped);

11346 11347 11348 11349
/* initialisation/exit functions */

int nl80211_init(void)
{
11350
	int err;
11351

11352 11353
	err = genl_register_family_with_ops(&nl80211_fam,
		nl80211_ops, ARRAY_SIZE(nl80211_ops));
11354 11355 11356 11357 11358 11359 11360
	if (err)
		return err;

	err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
	if (err)
		goto err_out;

11361 11362 11363 11364
	err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
	if (err)
		goto err_out;

11365 11366 11367 11368
	err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
	if (err)
		goto err_out;

11369 11370 11371 11372
	err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
	if (err)
		goto err_out;

11373 11374 11375 11376 11377 11378
#ifdef CONFIG_NL80211_TESTMODE
	err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
	if (err)
		goto err_out;
#endif

11379 11380 11381 11382
	err = netlink_register_notifier(&nl80211_netlink_notifier);
	if (err)
		goto err_out;

11383 11384 11385 11386 11387 11388 11389 11390
	return 0;
 err_out:
	genl_unregister_family(&nl80211_fam);
	return err;
}

void nl80211_exit(void)
{
11391
	netlink_unregister_notifier(&nl80211_netlink_notifier);
11392 11393
	genl_unregister_family(&nl80211_fam);
}