xref: /openbmc/linux/net/wireless/nl80211.c (revision ee89bd6b)
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5  */
6 
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include <net/inet_connection_sock.h>
23 #include "core.h"
24 #include "nl80211.h"
25 #include "reg.h"
26 #include "rdev-ops.h"
27 
28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
29 				   struct genl_info *info,
30 				   struct cfg80211_crypto_settings *settings,
31 				   int cipher_limit);
32 
33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
34 			    struct genl_info *info);
35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
36 			      struct genl_info *info);
37 
38 /* the netlink family */
39 static struct genl_family nl80211_fam = {
40 	.id = GENL_ID_GENERATE,	/* don't bother with a hardcoded ID */
41 	.name = "nl80211",	/* have users key off the name instead */
42 	.hdrsize = 0,		/* no private header */
43 	.version = 1,		/* no particular meaning now */
44 	.maxattr = NL80211_ATTR_MAX,
45 	.netnsok = true,
46 	.pre_doit = nl80211_pre_doit,
47 	.post_doit = nl80211_post_doit,
48 };
49 
50 /* returns ERR_PTR values */
51 static struct wireless_dev *
52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
53 {
54 	struct cfg80211_registered_device *rdev;
55 	struct wireless_dev *result = NULL;
56 	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
57 	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
58 	u64 wdev_id;
59 	int wiphy_idx = -1;
60 	int ifidx = -1;
61 
62 	assert_cfg80211_lock();
63 
64 	if (!have_ifidx && !have_wdev_id)
65 		return ERR_PTR(-EINVAL);
66 
67 	if (have_ifidx)
68 		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
69 	if (have_wdev_id) {
70 		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
71 		wiphy_idx = wdev_id >> 32;
72 	}
73 
74 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
75 		struct wireless_dev *wdev;
76 
77 		if (wiphy_net(&rdev->wiphy) != netns)
78 			continue;
79 
80 		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
81 			continue;
82 
83 		mutex_lock(&rdev->devlist_mtx);
84 		list_for_each_entry(wdev, &rdev->wdev_list, list) {
85 			if (have_ifidx && wdev->netdev &&
86 			    wdev->netdev->ifindex == ifidx) {
87 				result = wdev;
88 				break;
89 			}
90 			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
91 				result = wdev;
92 				break;
93 			}
94 		}
95 		mutex_unlock(&rdev->devlist_mtx);
96 
97 		if (result)
98 			break;
99 	}
100 
101 	if (result)
102 		return result;
103 	return ERR_PTR(-ENODEV);
104 }
105 
106 static struct cfg80211_registered_device *
107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
108 {
109 	struct cfg80211_registered_device *rdev = NULL, *tmp;
110 	struct net_device *netdev;
111 
112 	assert_cfg80211_lock();
113 
114 	if (!attrs[NL80211_ATTR_WIPHY] &&
115 	    !attrs[NL80211_ATTR_IFINDEX] &&
116 	    !attrs[NL80211_ATTR_WDEV])
117 		return ERR_PTR(-EINVAL);
118 
119 	if (attrs[NL80211_ATTR_WIPHY])
120 		rdev = cfg80211_rdev_by_wiphy_idx(
121 				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
122 
123 	if (attrs[NL80211_ATTR_WDEV]) {
124 		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
125 		struct wireless_dev *wdev;
126 		bool found = false;
127 
128 		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
129 		if (tmp) {
130 			/* make sure wdev exists */
131 			mutex_lock(&tmp->devlist_mtx);
132 			list_for_each_entry(wdev, &tmp->wdev_list, list) {
133 				if (wdev->identifier != (u32)wdev_id)
134 					continue;
135 				found = true;
136 				break;
137 			}
138 			mutex_unlock(&tmp->devlist_mtx);
139 
140 			if (!found)
141 				tmp = NULL;
142 
143 			if (rdev && tmp != rdev)
144 				return ERR_PTR(-EINVAL);
145 			rdev = tmp;
146 		}
147 	}
148 
149 	if (attrs[NL80211_ATTR_IFINDEX]) {
150 		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
151 		netdev = dev_get_by_index(netns, ifindex);
152 		if (netdev) {
153 			if (netdev->ieee80211_ptr)
154 				tmp = wiphy_to_dev(
155 						netdev->ieee80211_ptr->wiphy);
156 			else
157 				tmp = NULL;
158 
159 			dev_put(netdev);
160 
161 			/* not wireless device -- return error */
162 			if (!tmp)
163 				return ERR_PTR(-EINVAL);
164 
165 			/* mismatch -- return error */
166 			if (rdev && tmp != rdev)
167 				return ERR_PTR(-EINVAL);
168 
169 			rdev = tmp;
170 		}
171 	}
172 
173 	if (!rdev)
174 		return ERR_PTR(-ENODEV);
175 
176 	if (netns != wiphy_net(&rdev->wiphy))
177 		return ERR_PTR(-ENODEV);
178 
179 	return rdev;
180 }
181 
182 /*
183  * This function returns a pointer to the driver
184  * that the genl_info item that is passed refers to.
185  * If successful, it returns non-NULL and also locks
186  * the driver's mutex!
187  *
188  * This means that you need to call cfg80211_unlock_rdev()
189  * before being allowed to acquire &cfg80211_mutex!
190  *
191  * This is necessary because we need to lock the global
192  * mutex to get an item off the list safely, and then
193  * we lock the rdev mutex so it doesn't go away under us.
194  *
195  * We don't want to keep cfg80211_mutex locked
196  * for all the time in order to allow requests on
197  * other interfaces to go through at the same time.
198  *
199  * The result of this can be a PTR_ERR and hence must
200  * be checked with IS_ERR() for errors.
201  */
202 static struct cfg80211_registered_device *
203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
204 {
205 	struct cfg80211_registered_device *rdev;
206 
207 	mutex_lock(&cfg80211_mutex);
208 	rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
209 
210 	/* if it is not an error we grab the lock on
211 	 * it to assure it won't be going away while
212 	 * we operate on it */
213 	if (!IS_ERR(rdev))
214 		mutex_lock(&rdev->mtx);
215 
216 	mutex_unlock(&cfg80211_mutex);
217 
218 	return rdev;
219 }
220 
221 /* policy for the attributes */
222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
223 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
224 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
225 				      .len = 20-1 },
226 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
227 
228 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
229 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
230 	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
231 	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
232 	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
233 
234 	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
235 	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
236 	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
237 	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
238 	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
239 
240 	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
241 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
242 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
243 
244 	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
245 	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
246 
247 	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
248 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
249 				    .len = WLAN_MAX_KEY_LEN },
250 	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
251 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
252 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
253 	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
254 	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
255 
256 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
257 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
258 	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
259 				       .len = IEEE80211_MAX_DATA_LEN },
260 	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
261 				       .len = IEEE80211_MAX_DATA_LEN },
262 	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
263 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
264 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
265 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
266 					       .len = NL80211_MAX_SUPP_RATES },
267 	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
268 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
269 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
270 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
271 				   .len = IEEE80211_MAX_MESH_ID_LEN },
272 	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
273 
274 	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
275 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
276 
277 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
278 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
279 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
280 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
281 					   .len = NL80211_MAX_SUPP_RATES },
282 	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
283 
284 	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
285 	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
286 
287 	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
288 
289 	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
290 	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
291 			      .len = IEEE80211_MAX_DATA_LEN },
292 	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
293 	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
294 
295 	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
296 				.len = IEEE80211_MAX_SSID_LEN },
297 	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
298 	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
299 	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
300 	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
301 	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
302 	[NL80211_ATTR_STA_FLAGS2] = {
303 		.len = sizeof(struct nl80211_sta_flag_update),
304 	},
305 	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
306 	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
307 	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
308 	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
309 	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
310 	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
311 	[NL80211_ATTR_PID] = { .type = NLA_U32 },
312 	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
313 	[NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
314 				 .len = WLAN_PMKID_LEN },
315 	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
316 	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
317 	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
318 	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
319 				 .len = IEEE80211_MAX_DATA_LEN },
320 	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
321 	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
322 	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
323 	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
324 	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
325 	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
326 	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
327 	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
328 	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
329 	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
330 	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
331 	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
332 	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
333 	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
334 	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
335 	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
336 	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
337 	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
338 	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
339 	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
340 					 .len = IEEE80211_MAX_DATA_LEN },
341 	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
342 					 .len = IEEE80211_MAX_DATA_LEN },
343 	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
344 	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
345 	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
346 	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
347 	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
348 	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
349 	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
350 	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
351 	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
352 	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
353 				      .len = IEEE80211_MAX_DATA_LEN },
354 	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
355 	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
356 	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
357 		.len = NL80211_HT_CAPABILITY_LEN
358 	},
359 	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
360 	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
361 	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
362 	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
363 	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
364 	[NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
365 	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
366 	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
367 	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
368 	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
369 	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
370 	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
371 	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
372 	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
373 	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
374 	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
375 	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
376 		.len = NL80211_VHT_CAPABILITY_LEN,
377 	},
378 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
379 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
380 				  .len = IEEE80211_MAX_DATA_LEN },
381 };
382 
383 /* policy for the key attributes */
384 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
385 	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
386 	[NL80211_KEY_IDX] = { .type = NLA_U8 },
387 	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
388 	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
389 	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
390 	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
391 	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
392 	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
393 };
394 
395 /* policy for the key default flags */
396 static const struct nla_policy
397 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
398 	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
399 	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
400 };
401 
402 /* policy for WoWLAN attributes */
403 static const struct nla_policy
404 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
405 	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
406 	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
407 	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
408 	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
409 	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
410 	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
411 	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
412 	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
413 	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
414 };
415 
416 static const struct nla_policy
417 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
418 	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
419 	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
420 	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
421 	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
422 	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
423 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
424 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
425 		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
426 	},
427 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
428 		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
429 	},
430 	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
431 	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
432 	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
433 };
434 
435 /* policy for GTK rekey offload attributes */
436 static const struct nla_policy
437 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
438 	[NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
439 	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
440 	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
441 };
442 
443 static const struct nla_policy
444 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
445 	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
446 						 .len = IEEE80211_MAX_SSID_LEN },
447 	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
448 };
449 
450 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
451 				     struct netlink_callback *cb,
452 				     struct cfg80211_registered_device **rdev,
453 				     struct wireless_dev **wdev)
454 {
455 	int err;
456 
457 	rtnl_lock();
458 	mutex_lock(&cfg80211_mutex);
459 
460 	if (!cb->args[0]) {
461 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
462 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
463 				  nl80211_policy);
464 		if (err)
465 			goto out_unlock;
466 
467 		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
468 						   nl80211_fam.attrbuf);
469 		if (IS_ERR(*wdev)) {
470 			err = PTR_ERR(*wdev);
471 			goto out_unlock;
472 		}
473 		*rdev = wiphy_to_dev((*wdev)->wiphy);
474 		cb->args[0] = (*rdev)->wiphy_idx;
475 		cb->args[1] = (*wdev)->identifier;
476 	} else {
477 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
478 		struct wireless_dev *tmp;
479 
480 		if (!wiphy) {
481 			err = -ENODEV;
482 			goto out_unlock;
483 		}
484 		*rdev = wiphy_to_dev(wiphy);
485 		*wdev = NULL;
486 
487 		mutex_lock(&(*rdev)->devlist_mtx);
488 		list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
489 			if (tmp->identifier == cb->args[1]) {
490 				*wdev = tmp;
491 				break;
492 			}
493 		}
494 		mutex_unlock(&(*rdev)->devlist_mtx);
495 
496 		if (!*wdev) {
497 			err = -ENODEV;
498 			goto out_unlock;
499 		}
500 	}
501 
502 	cfg80211_lock_rdev(*rdev);
503 
504 	mutex_unlock(&cfg80211_mutex);
505 	return 0;
506  out_unlock:
507 	mutex_unlock(&cfg80211_mutex);
508 	rtnl_unlock();
509 	return err;
510 }
511 
512 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
513 {
514 	cfg80211_unlock_rdev(rdev);
515 	rtnl_unlock();
516 }
517 
518 /* IE validation */
519 static bool is_valid_ie_attr(const struct nlattr *attr)
520 {
521 	const u8 *pos;
522 	int len;
523 
524 	if (!attr)
525 		return true;
526 
527 	pos = nla_data(attr);
528 	len = nla_len(attr);
529 
530 	while (len) {
531 		u8 elemlen;
532 
533 		if (len < 2)
534 			return false;
535 		len -= 2;
536 
537 		elemlen = pos[1];
538 		if (elemlen > len)
539 			return false;
540 
541 		len -= elemlen;
542 		pos += 2 + elemlen;
543 	}
544 
545 	return true;
546 }
547 
548 /* message building helper */
549 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
550 				   int flags, u8 cmd)
551 {
552 	/* since there is no private header just add the generic one */
553 	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
554 }
555 
556 static int nl80211_msg_put_channel(struct sk_buff *msg,
557 				   struct ieee80211_channel *chan,
558 				   bool large)
559 {
560 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
561 			chan->center_freq))
562 		goto nla_put_failure;
563 
564 	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
565 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
566 		goto nla_put_failure;
567 	if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
568 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
569 		goto nla_put_failure;
570 	if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
571 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
572 		goto nla_put_failure;
573 	if (chan->flags & IEEE80211_CHAN_RADAR) {
574 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
575 			goto nla_put_failure;
576 		if (large) {
577 			u32 time;
578 
579 			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
580 
581 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
582 					chan->dfs_state))
583 				goto nla_put_failure;
584 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
585 					time))
586 				goto nla_put_failure;
587 		}
588 	}
589 
590 	if (large) {
591 		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
592 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
593 			goto nla_put_failure;
594 		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
595 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
596 			goto nla_put_failure;
597 		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
598 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
599 			goto nla_put_failure;
600 		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
601 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
602 			goto nla_put_failure;
603 	}
604 
605 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
606 			DBM_TO_MBM(chan->max_power)))
607 		goto nla_put_failure;
608 
609 	return 0;
610 
611  nla_put_failure:
612 	return -ENOBUFS;
613 }
614 
615 /* netlink command implementations */
616 
617 struct key_parse {
618 	struct key_params p;
619 	int idx;
620 	int type;
621 	bool def, defmgmt;
622 	bool def_uni, def_multi;
623 };
624 
625 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
626 {
627 	struct nlattr *tb[NL80211_KEY_MAX + 1];
628 	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
629 				   nl80211_key_policy);
630 	if (err)
631 		return err;
632 
633 	k->def = !!tb[NL80211_KEY_DEFAULT];
634 	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
635 
636 	if (k->def) {
637 		k->def_uni = true;
638 		k->def_multi = true;
639 	}
640 	if (k->defmgmt)
641 		k->def_multi = true;
642 
643 	if (tb[NL80211_KEY_IDX])
644 		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
645 
646 	if (tb[NL80211_KEY_DATA]) {
647 		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
648 		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
649 	}
650 
651 	if (tb[NL80211_KEY_SEQ]) {
652 		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
653 		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
654 	}
655 
656 	if (tb[NL80211_KEY_CIPHER])
657 		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
658 
659 	if (tb[NL80211_KEY_TYPE]) {
660 		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
661 		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
662 			return -EINVAL;
663 	}
664 
665 	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
666 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
667 		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
668 				       tb[NL80211_KEY_DEFAULT_TYPES],
669 				       nl80211_key_default_policy);
670 		if (err)
671 			return err;
672 
673 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
674 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
675 	}
676 
677 	return 0;
678 }
679 
680 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
681 {
682 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
683 		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
684 		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
685 	}
686 
687 	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
688 		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
689 		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
690 	}
691 
692 	if (info->attrs[NL80211_ATTR_KEY_IDX])
693 		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
694 
695 	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
696 		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
697 
698 	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
699 	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
700 
701 	if (k->def) {
702 		k->def_uni = true;
703 		k->def_multi = true;
704 	}
705 	if (k->defmgmt)
706 		k->def_multi = true;
707 
708 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
709 		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
710 		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
711 			return -EINVAL;
712 	}
713 
714 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
715 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
716 		int err = nla_parse_nested(
717 				kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
718 				info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
719 				nl80211_key_default_policy);
720 		if (err)
721 			return err;
722 
723 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
724 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
725 	}
726 
727 	return 0;
728 }
729 
730 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
731 {
732 	int err;
733 
734 	memset(k, 0, sizeof(*k));
735 	k->idx = -1;
736 	k->type = -1;
737 
738 	if (info->attrs[NL80211_ATTR_KEY])
739 		err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
740 	else
741 		err = nl80211_parse_key_old(info, k);
742 
743 	if (err)
744 		return err;
745 
746 	if (k->def && k->defmgmt)
747 		return -EINVAL;
748 
749 	if (k->defmgmt) {
750 		if (k->def_uni || !k->def_multi)
751 			return -EINVAL;
752 	}
753 
754 	if (k->idx != -1) {
755 		if (k->defmgmt) {
756 			if (k->idx < 4 || k->idx > 5)
757 				return -EINVAL;
758 		} else if (k->def) {
759 			if (k->idx < 0 || k->idx > 3)
760 				return -EINVAL;
761 		} else {
762 			if (k->idx < 0 || k->idx > 5)
763 				return -EINVAL;
764 		}
765 	}
766 
767 	return 0;
768 }
769 
770 static struct cfg80211_cached_keys *
771 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
772 		       struct nlattr *keys, bool *no_ht)
773 {
774 	struct key_parse parse;
775 	struct nlattr *key;
776 	struct cfg80211_cached_keys *result;
777 	int rem, err, def = 0;
778 
779 	result = kzalloc(sizeof(*result), GFP_KERNEL);
780 	if (!result)
781 		return ERR_PTR(-ENOMEM);
782 
783 	result->def = -1;
784 	result->defmgmt = -1;
785 
786 	nla_for_each_nested(key, keys, rem) {
787 		memset(&parse, 0, sizeof(parse));
788 		parse.idx = -1;
789 
790 		err = nl80211_parse_key_new(key, &parse);
791 		if (err)
792 			goto error;
793 		err = -EINVAL;
794 		if (!parse.p.key)
795 			goto error;
796 		if (parse.idx < 0 || parse.idx > 4)
797 			goto error;
798 		if (parse.def) {
799 			if (def)
800 				goto error;
801 			def = 1;
802 			result->def = parse.idx;
803 			if (!parse.def_uni || !parse.def_multi)
804 				goto error;
805 		} else if (parse.defmgmt)
806 			goto error;
807 		err = cfg80211_validate_key_settings(rdev, &parse.p,
808 						     parse.idx, false, NULL);
809 		if (err)
810 			goto error;
811 		result->params[parse.idx].cipher = parse.p.cipher;
812 		result->params[parse.idx].key_len = parse.p.key_len;
813 		result->params[parse.idx].key = result->data[parse.idx];
814 		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
815 
816 		if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
817 		    parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
818 			if (no_ht)
819 				*no_ht = true;
820 		}
821 	}
822 
823 	return result;
824  error:
825 	kfree(result);
826 	return ERR_PTR(err);
827 }
828 
829 static int nl80211_key_allowed(struct wireless_dev *wdev)
830 {
831 	ASSERT_WDEV_LOCK(wdev);
832 
833 	switch (wdev->iftype) {
834 	case NL80211_IFTYPE_AP:
835 	case NL80211_IFTYPE_AP_VLAN:
836 	case NL80211_IFTYPE_P2P_GO:
837 	case NL80211_IFTYPE_MESH_POINT:
838 		break;
839 	case NL80211_IFTYPE_ADHOC:
840 		if (!wdev->current_bss)
841 			return -ENOLINK;
842 		break;
843 	case NL80211_IFTYPE_STATION:
844 	case NL80211_IFTYPE_P2P_CLIENT:
845 		if (wdev->sme_state != CFG80211_SME_CONNECTED)
846 			return -ENOLINK;
847 		break;
848 	default:
849 		return -EINVAL;
850 	}
851 
852 	return 0;
853 }
854 
855 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
856 {
857 	struct nlattr *nl_modes = nla_nest_start(msg, attr);
858 	int i;
859 
860 	if (!nl_modes)
861 		goto nla_put_failure;
862 
863 	i = 0;
864 	while (ifmodes) {
865 		if ((ifmodes & 1) && nla_put_flag(msg, i))
866 			goto nla_put_failure;
867 		ifmodes >>= 1;
868 		i++;
869 	}
870 
871 	nla_nest_end(msg, nl_modes);
872 	return 0;
873 
874 nla_put_failure:
875 	return -ENOBUFS;
876 }
877 
878 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
879 					  struct sk_buff *msg,
880 					  bool large)
881 {
882 	struct nlattr *nl_combis;
883 	int i, j;
884 
885 	nl_combis = nla_nest_start(msg,
886 				NL80211_ATTR_INTERFACE_COMBINATIONS);
887 	if (!nl_combis)
888 		goto nla_put_failure;
889 
890 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
891 		const struct ieee80211_iface_combination *c;
892 		struct nlattr *nl_combi, *nl_limits;
893 
894 		c = &wiphy->iface_combinations[i];
895 
896 		nl_combi = nla_nest_start(msg, i + 1);
897 		if (!nl_combi)
898 			goto nla_put_failure;
899 
900 		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
901 		if (!nl_limits)
902 			goto nla_put_failure;
903 
904 		for (j = 0; j < c->n_limits; j++) {
905 			struct nlattr *nl_limit;
906 
907 			nl_limit = nla_nest_start(msg, j + 1);
908 			if (!nl_limit)
909 				goto nla_put_failure;
910 			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
911 					c->limits[j].max))
912 				goto nla_put_failure;
913 			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
914 						c->limits[j].types))
915 				goto nla_put_failure;
916 			nla_nest_end(msg, nl_limit);
917 		}
918 
919 		nla_nest_end(msg, nl_limits);
920 
921 		if (c->beacon_int_infra_match &&
922 		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
923 			goto nla_put_failure;
924 		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
925 				c->num_different_channels) ||
926 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
927 				c->max_interfaces))
928 			goto nla_put_failure;
929 		if (large &&
930 		    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
931 				c->radar_detect_widths))
932 			goto nla_put_failure;
933 
934 		nla_nest_end(msg, nl_combi);
935 	}
936 
937 	nla_nest_end(msg, nl_combis);
938 
939 	return 0;
940 nla_put_failure:
941 	return -ENOBUFS;
942 }
943 
944 #ifdef CONFIG_PM
945 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
946 					struct sk_buff *msg)
947 {
948 	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
949 	struct nlattr *nl_tcp;
950 
951 	if (!tcp)
952 		return 0;
953 
954 	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
955 	if (!nl_tcp)
956 		return -ENOBUFS;
957 
958 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
959 			tcp->data_payload_max))
960 		return -ENOBUFS;
961 
962 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
963 			tcp->data_payload_max))
964 		return -ENOBUFS;
965 
966 	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
967 		return -ENOBUFS;
968 
969 	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
970 				sizeof(*tcp->tok), tcp->tok))
971 		return -ENOBUFS;
972 
973 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
974 			tcp->data_interval_max))
975 		return -ENOBUFS;
976 
977 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
978 			tcp->wake_payload_max))
979 		return -ENOBUFS;
980 
981 	nla_nest_end(msg, nl_tcp);
982 	return 0;
983 }
984 
985 static int nl80211_send_wowlan(struct sk_buff *msg,
986 			       struct cfg80211_registered_device *dev,
987 			       bool large)
988 {
989 	struct nlattr *nl_wowlan;
990 
991 	if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
992 		return 0;
993 
994 	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
995 	if (!nl_wowlan)
996 		return -ENOBUFS;
997 
998 	if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
999 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1000 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1001 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1002 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1003 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1004 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1005 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1006 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1007 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1008 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1009 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1010 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1011 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1012 	    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1013 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1014 		return -ENOBUFS;
1015 
1016 	if (dev->wiphy.wowlan.n_patterns) {
1017 		struct nl80211_wowlan_pattern_support pat = {
1018 			.max_patterns = dev->wiphy.wowlan.n_patterns,
1019 			.min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
1020 			.max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
1021 			.max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
1022 		};
1023 
1024 		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1025 			    sizeof(pat), &pat))
1026 			return -ENOBUFS;
1027 	}
1028 
1029 	if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1030 		return -ENOBUFS;
1031 
1032 	nla_nest_end(msg, nl_wowlan);
1033 
1034 	return 0;
1035 }
1036 #endif
1037 
1038 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1039 				      struct ieee80211_supported_band *sband)
1040 {
1041 	struct nlattr *nl_rates, *nl_rate;
1042 	struct ieee80211_rate *rate;
1043 	int i;
1044 
1045 	/* add HT info */
1046 	if (sband->ht_cap.ht_supported &&
1047 	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1048 		     sizeof(sband->ht_cap.mcs),
1049 		     &sband->ht_cap.mcs) ||
1050 	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1051 			 sband->ht_cap.cap) ||
1052 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1053 			sband->ht_cap.ampdu_factor) ||
1054 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1055 			sband->ht_cap.ampdu_density)))
1056 		return -ENOBUFS;
1057 
1058 	/* add VHT info */
1059 	if (sband->vht_cap.vht_supported &&
1060 	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1061 		     sizeof(sband->vht_cap.vht_mcs),
1062 		     &sband->vht_cap.vht_mcs) ||
1063 	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1064 			 sband->vht_cap.cap)))
1065 		return -ENOBUFS;
1066 
1067 	/* add bitrates */
1068 	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1069 	if (!nl_rates)
1070 		return -ENOBUFS;
1071 
1072 	for (i = 0; i < sband->n_bitrates; i++) {
1073 		nl_rate = nla_nest_start(msg, i);
1074 		if (!nl_rate)
1075 			return -ENOBUFS;
1076 
1077 		rate = &sband->bitrates[i];
1078 		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1079 				rate->bitrate))
1080 			return -ENOBUFS;
1081 		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1082 		    nla_put_flag(msg,
1083 				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1084 			return -ENOBUFS;
1085 
1086 		nla_nest_end(msg, nl_rate);
1087 	}
1088 
1089 	nla_nest_end(msg, nl_rates);
1090 
1091 	return 0;
1092 }
1093 
1094 static int
1095 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1096 			 const struct ieee80211_txrx_stypes *mgmt_stypes)
1097 {
1098 	u16 stypes;
1099 	struct nlattr *nl_ftypes, *nl_ifs;
1100 	enum nl80211_iftype ift;
1101 	int i;
1102 
1103 	if (!mgmt_stypes)
1104 		return 0;
1105 
1106 	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1107 	if (!nl_ifs)
1108 		return -ENOBUFS;
1109 
1110 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1111 		nl_ftypes = nla_nest_start(msg, ift);
1112 		if (!nl_ftypes)
1113 			return -ENOBUFS;
1114 		i = 0;
1115 		stypes = mgmt_stypes[ift].tx;
1116 		while (stypes) {
1117 			if ((stypes & 1) &&
1118 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1119 					(i << 4) | IEEE80211_FTYPE_MGMT))
1120 				return -ENOBUFS;
1121 			stypes >>= 1;
1122 			i++;
1123 		}
1124 		nla_nest_end(msg, nl_ftypes);
1125 	}
1126 
1127 	nla_nest_end(msg, nl_ifs);
1128 
1129 	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1130 	if (!nl_ifs)
1131 		return -ENOBUFS;
1132 
1133 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1134 		nl_ftypes = nla_nest_start(msg, ift);
1135 		if (!nl_ftypes)
1136 			return -ENOBUFS;
1137 		i = 0;
1138 		stypes = mgmt_stypes[ift].rx;
1139 		while (stypes) {
1140 			if ((stypes & 1) &&
1141 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1142 					(i << 4) | IEEE80211_FTYPE_MGMT))
1143 				return -ENOBUFS;
1144 			stypes >>= 1;
1145 			i++;
1146 		}
1147 		nla_nest_end(msg, nl_ftypes);
1148 	}
1149 	nla_nest_end(msg, nl_ifs);
1150 
1151 	return 0;
1152 }
1153 
1154 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1155 			      struct sk_buff *msg, u32 portid, u32 seq,
1156 			      int flags, bool split, long *split_start,
1157 			      long *band_start, long *chan_start)
1158 {
1159 	void *hdr;
1160 	struct nlattr *nl_bands, *nl_band;
1161 	struct nlattr *nl_freqs, *nl_freq;
1162 	struct nlattr *nl_cmds;
1163 	enum ieee80211_band band;
1164 	struct ieee80211_channel *chan;
1165 	int i;
1166 	const struct ieee80211_txrx_stypes *mgmt_stypes =
1167 				dev->wiphy.mgmt_stypes;
1168 	long start = 0, start_chan = 0, start_band = 0;
1169 	u32 features;
1170 
1171 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1172 	if (!hdr)
1173 		return -ENOBUFS;
1174 
1175 	/* allow always using the variables */
1176 	if (!split) {
1177 		split_start = &start;
1178 		band_start = &start_band;
1179 		chan_start = &start_chan;
1180 	}
1181 
1182 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1183 	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1184 			   wiphy_name(&dev->wiphy)) ||
1185 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
1186 			cfg80211_rdev_list_generation))
1187 		goto nla_put_failure;
1188 
1189 	switch (*split_start) {
1190 	case 0:
1191 		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1192 			       dev->wiphy.retry_short) ||
1193 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1194 			       dev->wiphy.retry_long) ||
1195 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1196 				dev->wiphy.frag_threshold) ||
1197 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1198 				dev->wiphy.rts_threshold) ||
1199 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1200 			       dev->wiphy.coverage_class) ||
1201 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1202 			       dev->wiphy.max_scan_ssids) ||
1203 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1204 			       dev->wiphy.max_sched_scan_ssids) ||
1205 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1206 				dev->wiphy.max_scan_ie_len) ||
1207 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1208 				dev->wiphy.max_sched_scan_ie_len) ||
1209 		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1210 			       dev->wiphy.max_match_sets))
1211 			goto nla_put_failure;
1212 
1213 		if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1214 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1215 			goto nla_put_failure;
1216 		if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1217 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1218 			goto nla_put_failure;
1219 		if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1220 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1221 			goto nla_put_failure;
1222 		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1223 		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1224 			goto nla_put_failure;
1225 		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1226 		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1227 			goto nla_put_failure;
1228 		if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1229 		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1230 			goto nla_put_failure;
1231 
1232 		(*split_start)++;
1233 		if (split)
1234 			break;
1235 	case 1:
1236 		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1237 			    sizeof(u32) * dev->wiphy.n_cipher_suites,
1238 			    dev->wiphy.cipher_suites))
1239 			goto nla_put_failure;
1240 
1241 		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1242 			       dev->wiphy.max_num_pmkids))
1243 			goto nla_put_failure;
1244 
1245 		if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1246 		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1247 			goto nla_put_failure;
1248 
1249 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1250 				dev->wiphy.available_antennas_tx) ||
1251 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1252 				dev->wiphy.available_antennas_rx))
1253 			goto nla_put_failure;
1254 
1255 		if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1256 		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1257 				dev->wiphy.probe_resp_offload))
1258 			goto nla_put_failure;
1259 
1260 		if ((dev->wiphy.available_antennas_tx ||
1261 		     dev->wiphy.available_antennas_rx) &&
1262 		    dev->ops->get_antenna) {
1263 			u32 tx_ant = 0, rx_ant = 0;
1264 			int res;
1265 			res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1266 			if (!res) {
1267 				if (nla_put_u32(msg,
1268 						NL80211_ATTR_WIPHY_ANTENNA_TX,
1269 						tx_ant) ||
1270 				    nla_put_u32(msg,
1271 						NL80211_ATTR_WIPHY_ANTENNA_RX,
1272 						rx_ant))
1273 					goto nla_put_failure;
1274 			}
1275 		}
1276 
1277 		(*split_start)++;
1278 		if (split)
1279 			break;
1280 	case 2:
1281 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1282 					dev->wiphy.interface_modes))
1283 				goto nla_put_failure;
1284 		(*split_start)++;
1285 		if (split)
1286 			break;
1287 	case 3:
1288 		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1289 		if (!nl_bands)
1290 			goto nla_put_failure;
1291 
1292 		for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1293 			struct ieee80211_supported_band *sband;
1294 
1295 			sband = dev->wiphy.bands[band];
1296 
1297 			if (!sband)
1298 				continue;
1299 
1300 			nl_band = nla_nest_start(msg, band);
1301 			if (!nl_band)
1302 				goto nla_put_failure;
1303 
1304 			switch (*chan_start) {
1305 			case 0:
1306 				if (nl80211_send_band_rateinfo(msg, sband))
1307 					goto nla_put_failure;
1308 				(*chan_start)++;
1309 				if (split)
1310 					break;
1311 			default:
1312 				/* add frequencies */
1313 				nl_freqs = nla_nest_start(
1314 					msg, NL80211_BAND_ATTR_FREQS);
1315 				if (!nl_freqs)
1316 					goto nla_put_failure;
1317 
1318 				for (i = *chan_start - 1;
1319 				     i < sband->n_channels;
1320 				     i++) {
1321 					nl_freq = nla_nest_start(msg, i);
1322 					if (!nl_freq)
1323 						goto nla_put_failure;
1324 
1325 					chan = &sband->channels[i];
1326 
1327 					if (nl80211_msg_put_channel(msg, chan,
1328 								    split))
1329 						goto nla_put_failure;
1330 
1331 					nla_nest_end(msg, nl_freq);
1332 					if (split)
1333 						break;
1334 				}
1335 				if (i < sband->n_channels)
1336 					*chan_start = i + 2;
1337 				else
1338 					*chan_start = 0;
1339 				nla_nest_end(msg, nl_freqs);
1340 			}
1341 
1342 			nla_nest_end(msg, nl_band);
1343 
1344 			if (split) {
1345 				/* start again here */
1346 				if (*chan_start)
1347 					band--;
1348 				break;
1349 			}
1350 		}
1351 		nla_nest_end(msg, nl_bands);
1352 
1353 		if (band < IEEE80211_NUM_BANDS)
1354 			*band_start = band + 1;
1355 		else
1356 			*band_start = 0;
1357 
1358 		/* if bands & channels are done, continue outside */
1359 		if (*band_start == 0 && *chan_start == 0)
1360 			(*split_start)++;
1361 		if (split)
1362 			break;
1363 	case 4:
1364 		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1365 		if (!nl_cmds)
1366 			goto nla_put_failure;
1367 
1368 		i = 0;
1369 #define CMD(op, n)							\
1370 		 do {							\
1371 			if (dev->ops->op) {				\
1372 				i++;					\
1373 				if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1374 					goto nla_put_failure;		\
1375 			}						\
1376 		} while (0)
1377 
1378 		CMD(add_virtual_intf, NEW_INTERFACE);
1379 		CMD(change_virtual_intf, SET_INTERFACE);
1380 		CMD(add_key, NEW_KEY);
1381 		CMD(start_ap, START_AP);
1382 		CMD(add_station, NEW_STATION);
1383 		CMD(add_mpath, NEW_MPATH);
1384 		CMD(update_mesh_config, SET_MESH_CONFIG);
1385 		CMD(change_bss, SET_BSS);
1386 		CMD(auth, AUTHENTICATE);
1387 		CMD(assoc, ASSOCIATE);
1388 		CMD(deauth, DEAUTHENTICATE);
1389 		CMD(disassoc, DISASSOCIATE);
1390 		CMD(join_ibss, JOIN_IBSS);
1391 		CMD(join_mesh, JOIN_MESH);
1392 		CMD(set_pmksa, SET_PMKSA);
1393 		CMD(del_pmksa, DEL_PMKSA);
1394 		CMD(flush_pmksa, FLUSH_PMKSA);
1395 		if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1396 			CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1397 		CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1398 		CMD(mgmt_tx, FRAME);
1399 		CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1400 		if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1401 			i++;
1402 			if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1403 				goto nla_put_failure;
1404 		}
1405 		if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1406 		    dev->ops->join_mesh) {
1407 			i++;
1408 			if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1409 				goto nla_put_failure;
1410 		}
1411 		CMD(set_wds_peer, SET_WDS_PEER);
1412 		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1413 			CMD(tdls_mgmt, TDLS_MGMT);
1414 			CMD(tdls_oper, TDLS_OPER);
1415 		}
1416 		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1417 			CMD(sched_scan_start, START_SCHED_SCAN);
1418 		CMD(probe_client, PROBE_CLIENT);
1419 		CMD(set_noack_map, SET_NOACK_MAP);
1420 		if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1421 			i++;
1422 			if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1423 				goto nla_put_failure;
1424 		}
1425 		CMD(start_p2p_device, START_P2P_DEVICE);
1426 		CMD(set_mcast_rate, SET_MCAST_RATE);
1427 		if (split) {
1428 			CMD(crit_proto_start, CRIT_PROTOCOL_START);
1429 			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1430 		}
1431 
1432 #ifdef CONFIG_NL80211_TESTMODE
1433 		CMD(testmode_cmd, TESTMODE);
1434 #endif
1435 
1436 #undef CMD
1437 
1438 		if (dev->ops->connect || dev->ops->auth) {
1439 			i++;
1440 			if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1441 				goto nla_put_failure;
1442 		}
1443 
1444 		if (dev->ops->disconnect || dev->ops->deauth) {
1445 			i++;
1446 			if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1447 				goto nla_put_failure;
1448 		}
1449 
1450 		nla_nest_end(msg, nl_cmds);
1451 		(*split_start)++;
1452 		if (split)
1453 			break;
1454 	case 5:
1455 		if (dev->ops->remain_on_channel &&
1456 		    (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1457 		    nla_put_u32(msg,
1458 				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1459 				dev->wiphy.max_remain_on_channel_duration))
1460 			goto nla_put_failure;
1461 
1462 		if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1463 		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1464 			goto nla_put_failure;
1465 
1466 		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1467 			goto nla_put_failure;
1468 		(*split_start)++;
1469 		if (split)
1470 			break;
1471 	case 6:
1472 #ifdef CONFIG_PM
1473 		if (nl80211_send_wowlan(msg, dev, split))
1474 			goto nla_put_failure;
1475 		(*split_start)++;
1476 		if (split)
1477 			break;
1478 #else
1479 		(*split_start)++;
1480 #endif
1481 	case 7:
1482 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1483 					dev->wiphy.software_iftypes))
1484 			goto nla_put_failure;
1485 
1486 		if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1487 			goto nla_put_failure;
1488 
1489 		(*split_start)++;
1490 		if (split)
1491 			break;
1492 	case 8:
1493 		if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1494 		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1495 				dev->wiphy.ap_sme_capa))
1496 			goto nla_put_failure;
1497 
1498 		features = dev->wiphy.features;
1499 		/*
1500 		 * We can only add the per-channel limit information if the
1501 		 * dump is split, otherwise it makes it too big. Therefore
1502 		 * only advertise it in that case.
1503 		 */
1504 		if (split)
1505 			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1506 		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1507 			goto nla_put_failure;
1508 
1509 		if (dev->wiphy.ht_capa_mod_mask &&
1510 		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1511 			    sizeof(*dev->wiphy.ht_capa_mod_mask),
1512 			    dev->wiphy.ht_capa_mod_mask))
1513 			goto nla_put_failure;
1514 
1515 		if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1516 		    dev->wiphy.max_acl_mac_addrs &&
1517 		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1518 				dev->wiphy.max_acl_mac_addrs))
1519 			goto nla_put_failure;
1520 
1521 		/*
1522 		 * Any information below this point is only available to
1523 		 * applications that can deal with it being split. This
1524 		 * helps ensure that newly added capabilities don't break
1525 		 * older tools by overrunning their buffers.
1526 		 *
1527 		 * We still increment split_start so that in the split
1528 		 * case we'll continue with more data in the next round,
1529 		 * but break unconditionally so unsplit data stops here.
1530 		 */
1531 		(*split_start)++;
1532 		break;
1533 	case 9:
1534 		if (dev->wiphy.extended_capabilities &&
1535 		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1536 			     dev->wiphy.extended_capabilities_len,
1537 			     dev->wiphy.extended_capabilities) ||
1538 		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1539 			     dev->wiphy.extended_capabilities_len,
1540 			     dev->wiphy.extended_capabilities_mask)))
1541 			goto nla_put_failure;
1542 
1543 		if (dev->wiphy.vht_capa_mod_mask &&
1544 		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1545 			    sizeof(*dev->wiphy.vht_capa_mod_mask),
1546 			    dev->wiphy.vht_capa_mod_mask))
1547 			goto nla_put_failure;
1548 
1549 		/* done */
1550 		*split_start = 0;
1551 		break;
1552 	}
1553 	return genlmsg_end(msg, hdr);
1554 
1555  nla_put_failure:
1556 	genlmsg_cancel(msg, hdr);
1557 	return -EMSGSIZE;
1558 }
1559 
1560 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1561 {
1562 	int idx = 0, ret;
1563 	int start = cb->args[0];
1564 	struct cfg80211_registered_device *dev;
1565 	s64 filter_wiphy = -1;
1566 	bool split = false;
1567 	struct nlattr **tb = nl80211_fam.attrbuf;
1568 	int res;
1569 
1570 	mutex_lock(&cfg80211_mutex);
1571 	res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1572 			  tb, nl80211_fam.maxattr, nl80211_policy);
1573 	if (res == 0) {
1574 		split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1575 		if (tb[NL80211_ATTR_WIPHY])
1576 			filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1577 		if (tb[NL80211_ATTR_WDEV])
1578 			filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1579 		if (tb[NL80211_ATTR_IFINDEX]) {
1580 			struct net_device *netdev;
1581 			int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1582 
1583 			netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1584 			if (!netdev) {
1585 				mutex_unlock(&cfg80211_mutex);
1586 				return -ENODEV;
1587 			}
1588 			if (netdev->ieee80211_ptr) {
1589 				dev = wiphy_to_dev(
1590 					netdev->ieee80211_ptr->wiphy);
1591 				filter_wiphy = dev->wiphy_idx;
1592 			}
1593 			dev_put(netdev);
1594 		}
1595 	}
1596 
1597 	list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1598 		if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1599 			continue;
1600 		if (++idx <= start)
1601 			continue;
1602 		if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1603 			continue;
1604 		/* attempt to fit multiple wiphy data chunks into the skb */
1605 		do {
1606 			ret = nl80211_send_wiphy(dev, skb,
1607 						 NETLINK_CB(cb->skb).portid,
1608 						 cb->nlh->nlmsg_seq,
1609 						 NLM_F_MULTI,
1610 						 split, &cb->args[1],
1611 						 &cb->args[2],
1612 						 &cb->args[3]);
1613 			if (ret < 0) {
1614 				/*
1615 				 * If sending the wiphy data didn't fit (ENOBUFS
1616 				 * or EMSGSIZE returned), this SKB is still
1617 				 * empty (so it's not too big because another
1618 				 * wiphy dataset is already in the skb) and
1619 				 * we've not tried to adjust the dump allocation
1620 				 * yet ... then adjust the alloc size to be
1621 				 * bigger, and return 1 but with the empty skb.
1622 				 * This results in an empty message being RX'ed
1623 				 * in userspace, but that is ignored.
1624 				 *
1625 				 * We can then retry with the larger buffer.
1626 				 */
1627 				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1628 				    !skb->len &&
1629 				    cb->min_dump_alloc < 4096) {
1630 					cb->min_dump_alloc = 4096;
1631 					mutex_unlock(&cfg80211_mutex);
1632 					return 1;
1633 				}
1634 				idx--;
1635 				break;
1636 			}
1637 		} while (cb->args[1] > 0);
1638 		break;
1639 	}
1640 	mutex_unlock(&cfg80211_mutex);
1641 
1642 	cb->args[0] = idx;
1643 
1644 	return skb->len;
1645 }
1646 
1647 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1648 {
1649 	struct sk_buff *msg;
1650 	struct cfg80211_registered_device *dev = info->user_ptr[0];
1651 
1652 	msg = nlmsg_new(4096, GFP_KERNEL);
1653 	if (!msg)
1654 		return -ENOMEM;
1655 
1656 	if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1657 			       false, NULL, NULL, NULL) < 0) {
1658 		nlmsg_free(msg);
1659 		return -ENOBUFS;
1660 	}
1661 
1662 	return genlmsg_reply(msg, info);
1663 }
1664 
1665 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1666 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
1667 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
1668 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
1669 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
1670 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
1671 };
1672 
1673 static int parse_txq_params(struct nlattr *tb[],
1674 			    struct ieee80211_txq_params *txq_params)
1675 {
1676 	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1677 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1678 	    !tb[NL80211_TXQ_ATTR_AIFS])
1679 		return -EINVAL;
1680 
1681 	txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1682 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1683 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1684 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1685 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1686 
1687 	if (txq_params->ac >= NL80211_NUM_ACS)
1688 		return -EINVAL;
1689 
1690 	return 0;
1691 }
1692 
1693 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1694 {
1695 	/*
1696 	 * You can only set the channel explicitly for WDS interfaces,
1697 	 * all others have their channel managed via their respective
1698 	 * "establish a connection" command (connect, join, ...)
1699 	 *
1700 	 * For AP/GO and mesh mode, the channel can be set with the
1701 	 * channel userspace API, but is only stored and passed to the
1702 	 * low-level driver when the AP starts or the mesh is joined.
1703 	 * This is for backward compatibility, userspace can also give
1704 	 * the channel in the start-ap or join-mesh commands instead.
1705 	 *
1706 	 * Monitors are special as they are normally slaved to
1707 	 * whatever else is going on, so they have their own special
1708 	 * operation to set the monitor channel if possible.
1709 	 */
1710 	return !wdev ||
1711 		wdev->iftype == NL80211_IFTYPE_AP ||
1712 		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1713 		wdev->iftype == NL80211_IFTYPE_MONITOR ||
1714 		wdev->iftype == NL80211_IFTYPE_P2P_GO;
1715 }
1716 
1717 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1718 				 struct genl_info *info,
1719 				 struct cfg80211_chan_def *chandef)
1720 {
1721 	u32 control_freq;
1722 
1723 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1724 		return -EINVAL;
1725 
1726 	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1727 
1728 	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1729 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1730 	chandef->center_freq1 = control_freq;
1731 	chandef->center_freq2 = 0;
1732 
1733 	/* Primary channel not allowed */
1734 	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1735 		return -EINVAL;
1736 
1737 	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1738 		enum nl80211_channel_type chantype;
1739 
1740 		chantype = nla_get_u32(
1741 				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1742 
1743 		switch (chantype) {
1744 		case NL80211_CHAN_NO_HT:
1745 		case NL80211_CHAN_HT20:
1746 		case NL80211_CHAN_HT40PLUS:
1747 		case NL80211_CHAN_HT40MINUS:
1748 			cfg80211_chandef_create(chandef, chandef->chan,
1749 						chantype);
1750 			break;
1751 		default:
1752 			return -EINVAL;
1753 		}
1754 	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1755 		chandef->width =
1756 			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1757 		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1758 			chandef->center_freq1 =
1759 				nla_get_u32(
1760 					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1761 		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1762 			chandef->center_freq2 =
1763 				nla_get_u32(
1764 					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1765 	}
1766 
1767 	if (!cfg80211_chandef_valid(chandef))
1768 		return -EINVAL;
1769 
1770 	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1771 				     IEEE80211_CHAN_DISABLED))
1772 		return -EINVAL;
1773 
1774 	return 0;
1775 }
1776 
1777 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1778 				 struct wireless_dev *wdev,
1779 				 struct genl_info *info)
1780 {
1781 	struct cfg80211_chan_def chandef;
1782 	int result;
1783 	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1784 
1785 	if (wdev)
1786 		iftype = wdev->iftype;
1787 
1788 	if (!nl80211_can_set_dev_channel(wdev))
1789 		return -EOPNOTSUPP;
1790 
1791 	result = nl80211_parse_chandef(rdev, info, &chandef);
1792 	if (result)
1793 		return result;
1794 
1795 	mutex_lock(&rdev->devlist_mtx);
1796 	switch (iftype) {
1797 	case NL80211_IFTYPE_AP:
1798 	case NL80211_IFTYPE_P2P_GO:
1799 		if (wdev->beacon_interval) {
1800 			result = -EBUSY;
1801 			break;
1802 		}
1803 		if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1804 			result = -EINVAL;
1805 			break;
1806 		}
1807 		wdev->preset_chandef = chandef;
1808 		result = 0;
1809 		break;
1810 	case NL80211_IFTYPE_MESH_POINT:
1811 		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1812 		break;
1813 	case NL80211_IFTYPE_MONITOR:
1814 		result = cfg80211_set_monitor_channel(rdev, &chandef);
1815 		break;
1816 	default:
1817 		result = -EINVAL;
1818 	}
1819 	mutex_unlock(&rdev->devlist_mtx);
1820 
1821 	return result;
1822 }
1823 
1824 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1825 {
1826 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
1827 	struct net_device *netdev = info->user_ptr[1];
1828 
1829 	return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1830 }
1831 
1832 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1833 {
1834 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
1835 	struct net_device *dev = info->user_ptr[1];
1836 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1837 	const u8 *bssid;
1838 
1839 	if (!info->attrs[NL80211_ATTR_MAC])
1840 		return -EINVAL;
1841 
1842 	if (netif_running(dev))
1843 		return -EBUSY;
1844 
1845 	if (!rdev->ops->set_wds_peer)
1846 		return -EOPNOTSUPP;
1847 
1848 	if (wdev->iftype != NL80211_IFTYPE_WDS)
1849 		return -EOPNOTSUPP;
1850 
1851 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1852 	return rdev_set_wds_peer(rdev, dev, bssid);
1853 }
1854 
1855 
1856 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1857 {
1858 	struct cfg80211_registered_device *rdev;
1859 	struct net_device *netdev = NULL;
1860 	struct wireless_dev *wdev;
1861 	int result = 0, rem_txq_params = 0;
1862 	struct nlattr *nl_txq_params;
1863 	u32 changed;
1864 	u8 retry_short = 0, retry_long = 0;
1865 	u32 frag_threshold = 0, rts_threshold = 0;
1866 	u8 coverage_class = 0;
1867 
1868 	/*
1869 	 * Try to find the wiphy and netdev. Normally this
1870 	 * function shouldn't need the netdev, but this is
1871 	 * done for backward compatibility -- previously
1872 	 * setting the channel was done per wiphy, but now
1873 	 * it is per netdev. Previous userland like hostapd
1874 	 * also passed a netdev to set_wiphy, so that it is
1875 	 * possible to let that go to the right netdev!
1876 	 */
1877 	mutex_lock(&cfg80211_mutex);
1878 
1879 	if (info->attrs[NL80211_ATTR_IFINDEX]) {
1880 		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1881 
1882 		netdev = dev_get_by_index(genl_info_net(info), ifindex);
1883 		if (netdev && netdev->ieee80211_ptr) {
1884 			rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1885 			mutex_lock(&rdev->mtx);
1886 		} else
1887 			netdev = NULL;
1888 	}
1889 
1890 	if (!netdev) {
1891 		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1892 						  info->attrs);
1893 		if (IS_ERR(rdev)) {
1894 			mutex_unlock(&cfg80211_mutex);
1895 			return PTR_ERR(rdev);
1896 		}
1897 		wdev = NULL;
1898 		netdev = NULL;
1899 		result = 0;
1900 
1901 		mutex_lock(&rdev->mtx);
1902 	} else
1903 		wdev = netdev->ieee80211_ptr;
1904 
1905 	/*
1906 	 * end workaround code, by now the rdev is available
1907 	 * and locked, and wdev may or may not be NULL.
1908 	 */
1909 
1910 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1911 		result = cfg80211_dev_rename(
1912 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1913 
1914 	mutex_unlock(&cfg80211_mutex);
1915 
1916 	if (result)
1917 		goto bad_res;
1918 
1919 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1920 		struct ieee80211_txq_params txq_params;
1921 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1922 
1923 		if (!rdev->ops->set_txq_params) {
1924 			result = -EOPNOTSUPP;
1925 			goto bad_res;
1926 		}
1927 
1928 		if (!netdev) {
1929 			result = -EINVAL;
1930 			goto bad_res;
1931 		}
1932 
1933 		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1934 		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1935 			result = -EINVAL;
1936 			goto bad_res;
1937 		}
1938 
1939 		if (!netif_running(netdev)) {
1940 			result = -ENETDOWN;
1941 			goto bad_res;
1942 		}
1943 
1944 		nla_for_each_nested(nl_txq_params,
1945 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1946 				    rem_txq_params) {
1947 			nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1948 				  nla_data(nl_txq_params),
1949 				  nla_len(nl_txq_params),
1950 				  txq_params_policy);
1951 			result = parse_txq_params(tb, &txq_params);
1952 			if (result)
1953 				goto bad_res;
1954 
1955 			result = rdev_set_txq_params(rdev, netdev,
1956 						     &txq_params);
1957 			if (result)
1958 				goto bad_res;
1959 		}
1960 	}
1961 
1962 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1963 		result = __nl80211_set_channel(rdev,
1964 				nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1965 				info);
1966 		if (result)
1967 			goto bad_res;
1968 	}
1969 
1970 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1971 		struct wireless_dev *txp_wdev = wdev;
1972 		enum nl80211_tx_power_setting type;
1973 		int idx, mbm = 0;
1974 
1975 		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1976 			txp_wdev = NULL;
1977 
1978 		if (!rdev->ops->set_tx_power) {
1979 			result = -EOPNOTSUPP;
1980 			goto bad_res;
1981 		}
1982 
1983 		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1984 		type = nla_get_u32(info->attrs[idx]);
1985 
1986 		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1987 		    (type != NL80211_TX_POWER_AUTOMATIC)) {
1988 			result = -EINVAL;
1989 			goto bad_res;
1990 		}
1991 
1992 		if (type != NL80211_TX_POWER_AUTOMATIC) {
1993 			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1994 			mbm = nla_get_u32(info->attrs[idx]);
1995 		}
1996 
1997 		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1998 		if (result)
1999 			goto bad_res;
2000 	}
2001 
2002 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2003 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2004 		u32 tx_ant, rx_ant;
2005 		if ((!rdev->wiphy.available_antennas_tx &&
2006 		     !rdev->wiphy.available_antennas_rx) ||
2007 		    !rdev->ops->set_antenna) {
2008 			result = -EOPNOTSUPP;
2009 			goto bad_res;
2010 		}
2011 
2012 		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2013 		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2014 
2015 		/* reject antenna configurations which don't match the
2016 		 * available antenna masks, except for the "all" mask */
2017 		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2018 		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2019 			result = -EINVAL;
2020 			goto bad_res;
2021 		}
2022 
2023 		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2024 		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2025 
2026 		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2027 		if (result)
2028 			goto bad_res;
2029 	}
2030 
2031 	changed = 0;
2032 
2033 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2034 		retry_short = nla_get_u8(
2035 			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2036 		if (retry_short == 0) {
2037 			result = -EINVAL;
2038 			goto bad_res;
2039 		}
2040 		changed |= WIPHY_PARAM_RETRY_SHORT;
2041 	}
2042 
2043 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2044 		retry_long = nla_get_u8(
2045 			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2046 		if (retry_long == 0) {
2047 			result = -EINVAL;
2048 			goto bad_res;
2049 		}
2050 		changed |= WIPHY_PARAM_RETRY_LONG;
2051 	}
2052 
2053 	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2054 		frag_threshold = nla_get_u32(
2055 			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2056 		if (frag_threshold < 256) {
2057 			result = -EINVAL;
2058 			goto bad_res;
2059 		}
2060 		if (frag_threshold != (u32) -1) {
2061 			/*
2062 			 * Fragments (apart from the last one) are required to
2063 			 * have even length. Make the fragmentation code
2064 			 * simpler by stripping LSB should someone try to use
2065 			 * odd threshold value.
2066 			 */
2067 			frag_threshold &= ~0x1;
2068 		}
2069 		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2070 	}
2071 
2072 	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2073 		rts_threshold = nla_get_u32(
2074 			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2075 		changed |= WIPHY_PARAM_RTS_THRESHOLD;
2076 	}
2077 
2078 	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2079 		coverage_class = nla_get_u8(
2080 			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2081 		changed |= WIPHY_PARAM_COVERAGE_CLASS;
2082 	}
2083 
2084 	if (changed) {
2085 		u8 old_retry_short, old_retry_long;
2086 		u32 old_frag_threshold, old_rts_threshold;
2087 		u8 old_coverage_class;
2088 
2089 		if (!rdev->ops->set_wiphy_params) {
2090 			result = -EOPNOTSUPP;
2091 			goto bad_res;
2092 		}
2093 
2094 		old_retry_short = rdev->wiphy.retry_short;
2095 		old_retry_long = rdev->wiphy.retry_long;
2096 		old_frag_threshold = rdev->wiphy.frag_threshold;
2097 		old_rts_threshold = rdev->wiphy.rts_threshold;
2098 		old_coverage_class = rdev->wiphy.coverage_class;
2099 
2100 		if (changed & WIPHY_PARAM_RETRY_SHORT)
2101 			rdev->wiphy.retry_short = retry_short;
2102 		if (changed & WIPHY_PARAM_RETRY_LONG)
2103 			rdev->wiphy.retry_long = retry_long;
2104 		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2105 			rdev->wiphy.frag_threshold = frag_threshold;
2106 		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2107 			rdev->wiphy.rts_threshold = rts_threshold;
2108 		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2109 			rdev->wiphy.coverage_class = coverage_class;
2110 
2111 		result = rdev_set_wiphy_params(rdev, changed);
2112 		if (result) {
2113 			rdev->wiphy.retry_short = old_retry_short;
2114 			rdev->wiphy.retry_long = old_retry_long;
2115 			rdev->wiphy.frag_threshold = old_frag_threshold;
2116 			rdev->wiphy.rts_threshold = old_rts_threshold;
2117 			rdev->wiphy.coverage_class = old_coverage_class;
2118 		}
2119 	}
2120 
2121  bad_res:
2122 	mutex_unlock(&rdev->mtx);
2123 	if (netdev)
2124 		dev_put(netdev);
2125 	return result;
2126 }
2127 
2128 static inline u64 wdev_id(struct wireless_dev *wdev)
2129 {
2130 	return (u64)wdev->identifier |
2131 	       ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2132 }
2133 
2134 static int nl80211_send_chandef(struct sk_buff *msg,
2135 				 struct cfg80211_chan_def *chandef)
2136 {
2137 	WARN_ON(!cfg80211_chandef_valid(chandef));
2138 
2139 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2140 			chandef->chan->center_freq))
2141 		return -ENOBUFS;
2142 	switch (chandef->width) {
2143 	case NL80211_CHAN_WIDTH_20_NOHT:
2144 	case NL80211_CHAN_WIDTH_20:
2145 	case NL80211_CHAN_WIDTH_40:
2146 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2147 				cfg80211_get_chandef_type(chandef)))
2148 			return -ENOBUFS;
2149 		break;
2150 	default:
2151 		break;
2152 	}
2153 	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2154 		return -ENOBUFS;
2155 	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2156 		return -ENOBUFS;
2157 	if (chandef->center_freq2 &&
2158 	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2159 		return -ENOBUFS;
2160 	return 0;
2161 }
2162 
2163 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2164 			      struct cfg80211_registered_device *rdev,
2165 			      struct wireless_dev *wdev)
2166 {
2167 	struct net_device *dev = wdev->netdev;
2168 	void *hdr;
2169 
2170 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2171 	if (!hdr)
2172 		return -1;
2173 
2174 	if (dev &&
2175 	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2176 	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2177 		goto nla_put_failure;
2178 
2179 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2180 	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2181 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2182 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2183 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
2184 			rdev->devlist_generation ^
2185 			(cfg80211_rdev_list_generation << 2)))
2186 		goto nla_put_failure;
2187 
2188 	if (rdev->ops->get_channel) {
2189 		int ret;
2190 		struct cfg80211_chan_def chandef;
2191 
2192 		ret = rdev_get_channel(rdev, wdev, &chandef);
2193 		if (ret == 0) {
2194 			if (nl80211_send_chandef(msg, &chandef))
2195 				goto nla_put_failure;
2196 		}
2197 	}
2198 
2199 	if (wdev->ssid_len) {
2200 		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2201 			goto nla_put_failure;
2202 	}
2203 
2204 	return genlmsg_end(msg, hdr);
2205 
2206  nla_put_failure:
2207 	genlmsg_cancel(msg, hdr);
2208 	return -EMSGSIZE;
2209 }
2210 
2211 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2212 {
2213 	int wp_idx = 0;
2214 	int if_idx = 0;
2215 	int wp_start = cb->args[0];
2216 	int if_start = cb->args[1];
2217 	struct cfg80211_registered_device *rdev;
2218 	struct wireless_dev *wdev;
2219 
2220 	mutex_lock(&cfg80211_mutex);
2221 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2222 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2223 			continue;
2224 		if (wp_idx < wp_start) {
2225 			wp_idx++;
2226 			continue;
2227 		}
2228 		if_idx = 0;
2229 
2230 		mutex_lock(&rdev->devlist_mtx);
2231 		list_for_each_entry(wdev, &rdev->wdev_list, list) {
2232 			if (if_idx < if_start) {
2233 				if_idx++;
2234 				continue;
2235 			}
2236 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2237 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2238 					       rdev, wdev) < 0) {
2239 				mutex_unlock(&rdev->devlist_mtx);
2240 				goto out;
2241 			}
2242 			if_idx++;
2243 		}
2244 		mutex_unlock(&rdev->devlist_mtx);
2245 
2246 		wp_idx++;
2247 	}
2248  out:
2249 	mutex_unlock(&cfg80211_mutex);
2250 
2251 	cb->args[0] = wp_idx;
2252 	cb->args[1] = if_idx;
2253 
2254 	return skb->len;
2255 }
2256 
2257 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2258 {
2259 	struct sk_buff *msg;
2260 	struct cfg80211_registered_device *dev = info->user_ptr[0];
2261 	struct wireless_dev *wdev = info->user_ptr[1];
2262 
2263 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2264 	if (!msg)
2265 		return -ENOMEM;
2266 
2267 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2268 			       dev, wdev) < 0) {
2269 		nlmsg_free(msg);
2270 		return -ENOBUFS;
2271 	}
2272 
2273 	return genlmsg_reply(msg, info);
2274 }
2275 
2276 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2277 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2278 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2279 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2280 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2281 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2282 };
2283 
2284 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2285 {
2286 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2287 	int flag;
2288 
2289 	*mntrflags = 0;
2290 
2291 	if (!nla)
2292 		return -EINVAL;
2293 
2294 	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2295 			     nla, mntr_flags_policy))
2296 		return -EINVAL;
2297 
2298 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2299 		if (flags[flag])
2300 			*mntrflags |= (1<<flag);
2301 
2302 	return 0;
2303 }
2304 
2305 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2306 			       struct net_device *netdev, u8 use_4addr,
2307 			       enum nl80211_iftype iftype)
2308 {
2309 	if (!use_4addr) {
2310 		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2311 			return -EBUSY;
2312 		return 0;
2313 	}
2314 
2315 	switch (iftype) {
2316 	case NL80211_IFTYPE_AP_VLAN:
2317 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2318 			return 0;
2319 		break;
2320 	case NL80211_IFTYPE_STATION:
2321 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2322 			return 0;
2323 		break;
2324 	default:
2325 		break;
2326 	}
2327 
2328 	return -EOPNOTSUPP;
2329 }
2330 
2331 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2332 {
2333 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2334 	struct vif_params params;
2335 	int err;
2336 	enum nl80211_iftype otype, ntype;
2337 	struct net_device *dev = info->user_ptr[1];
2338 	u32 _flags, *flags = NULL;
2339 	bool change = false;
2340 
2341 	memset(&params, 0, sizeof(params));
2342 
2343 	otype = ntype = dev->ieee80211_ptr->iftype;
2344 
2345 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2346 		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2347 		if (otype != ntype)
2348 			change = true;
2349 		if (ntype > NL80211_IFTYPE_MAX)
2350 			return -EINVAL;
2351 	}
2352 
2353 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2354 		struct wireless_dev *wdev = dev->ieee80211_ptr;
2355 
2356 		if (ntype != NL80211_IFTYPE_MESH_POINT)
2357 			return -EINVAL;
2358 		if (netif_running(dev))
2359 			return -EBUSY;
2360 
2361 		wdev_lock(wdev);
2362 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2363 			     IEEE80211_MAX_MESH_ID_LEN);
2364 		wdev->mesh_id_up_len =
2365 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2366 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2367 		       wdev->mesh_id_up_len);
2368 		wdev_unlock(wdev);
2369 	}
2370 
2371 	if (info->attrs[NL80211_ATTR_4ADDR]) {
2372 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2373 		change = true;
2374 		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2375 		if (err)
2376 			return err;
2377 	} else {
2378 		params.use_4addr = -1;
2379 	}
2380 
2381 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2382 		if (ntype != NL80211_IFTYPE_MONITOR)
2383 			return -EINVAL;
2384 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2385 					  &_flags);
2386 		if (err)
2387 			return err;
2388 
2389 		flags = &_flags;
2390 		change = true;
2391 	}
2392 
2393 	if (change)
2394 		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2395 	else
2396 		err = 0;
2397 
2398 	if (!err && params.use_4addr != -1)
2399 		dev->ieee80211_ptr->use_4addr = params.use_4addr;
2400 
2401 	return err;
2402 }
2403 
2404 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2405 {
2406 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2407 	struct vif_params params;
2408 	struct wireless_dev *wdev;
2409 	struct sk_buff *msg;
2410 	int err;
2411 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2412 	u32 flags;
2413 
2414 	memset(&params, 0, sizeof(params));
2415 
2416 	if (!info->attrs[NL80211_ATTR_IFNAME])
2417 		return -EINVAL;
2418 
2419 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2420 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2421 		if (type > NL80211_IFTYPE_MAX)
2422 			return -EINVAL;
2423 	}
2424 
2425 	if (!rdev->ops->add_virtual_intf ||
2426 	    !(rdev->wiphy.interface_modes & (1 << type)))
2427 		return -EOPNOTSUPP;
2428 
2429 	if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2430 		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2431 			   ETH_ALEN);
2432 		if (!is_valid_ether_addr(params.macaddr))
2433 			return -EADDRNOTAVAIL;
2434 	}
2435 
2436 	if (info->attrs[NL80211_ATTR_4ADDR]) {
2437 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2438 		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2439 		if (err)
2440 			return err;
2441 	}
2442 
2443 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2444 	if (!msg)
2445 		return -ENOMEM;
2446 
2447 	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2448 				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2449 				  &flags);
2450 	wdev = rdev_add_virtual_intf(rdev,
2451 				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2452 				type, err ? NULL : &flags, &params);
2453 	if (IS_ERR(wdev)) {
2454 		nlmsg_free(msg);
2455 		return PTR_ERR(wdev);
2456 	}
2457 
2458 	switch (type) {
2459 	case NL80211_IFTYPE_MESH_POINT:
2460 		if (!info->attrs[NL80211_ATTR_MESH_ID])
2461 			break;
2462 		wdev_lock(wdev);
2463 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2464 			     IEEE80211_MAX_MESH_ID_LEN);
2465 		wdev->mesh_id_up_len =
2466 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2467 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2468 		       wdev->mesh_id_up_len);
2469 		wdev_unlock(wdev);
2470 		break;
2471 	case NL80211_IFTYPE_P2P_DEVICE:
2472 		/*
2473 		 * P2P Device doesn't have a netdev, so doesn't go
2474 		 * through the netdev notifier and must be added here
2475 		 */
2476 		mutex_init(&wdev->mtx);
2477 		INIT_LIST_HEAD(&wdev->event_list);
2478 		spin_lock_init(&wdev->event_lock);
2479 		INIT_LIST_HEAD(&wdev->mgmt_registrations);
2480 		spin_lock_init(&wdev->mgmt_registrations_lock);
2481 
2482 		mutex_lock(&rdev->devlist_mtx);
2483 		wdev->identifier = ++rdev->wdev_id;
2484 		list_add_rcu(&wdev->list, &rdev->wdev_list);
2485 		rdev->devlist_generation++;
2486 		mutex_unlock(&rdev->devlist_mtx);
2487 		break;
2488 	default:
2489 		break;
2490 	}
2491 
2492 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2493 			       rdev, wdev) < 0) {
2494 		nlmsg_free(msg);
2495 		return -ENOBUFS;
2496 	}
2497 
2498 	return genlmsg_reply(msg, info);
2499 }
2500 
2501 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2502 {
2503 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2504 	struct wireless_dev *wdev = info->user_ptr[1];
2505 
2506 	if (!rdev->ops->del_virtual_intf)
2507 		return -EOPNOTSUPP;
2508 
2509 	/*
2510 	 * If we remove a wireless device without a netdev then clear
2511 	 * user_ptr[1] so that nl80211_post_doit won't dereference it
2512 	 * to check if it needs to do dev_put(). Otherwise it crashes
2513 	 * since the wdev has been freed, unlike with a netdev where
2514 	 * we need the dev_put() for the netdev to really be freed.
2515 	 */
2516 	if (!wdev->netdev)
2517 		info->user_ptr[1] = NULL;
2518 
2519 	return rdev_del_virtual_intf(rdev, wdev);
2520 }
2521 
2522 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2523 {
2524 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2525 	struct net_device *dev = info->user_ptr[1];
2526 	u16 noack_map;
2527 
2528 	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2529 		return -EINVAL;
2530 
2531 	if (!rdev->ops->set_noack_map)
2532 		return -EOPNOTSUPP;
2533 
2534 	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2535 
2536 	return rdev_set_noack_map(rdev, dev, noack_map);
2537 }
2538 
2539 struct get_key_cookie {
2540 	struct sk_buff *msg;
2541 	int error;
2542 	int idx;
2543 };
2544 
2545 static void get_key_callback(void *c, struct key_params *params)
2546 {
2547 	struct nlattr *key;
2548 	struct get_key_cookie *cookie = c;
2549 
2550 	if ((params->key &&
2551 	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2552 		     params->key_len, params->key)) ||
2553 	    (params->seq &&
2554 	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2555 		     params->seq_len, params->seq)) ||
2556 	    (params->cipher &&
2557 	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2558 			 params->cipher)))
2559 		goto nla_put_failure;
2560 
2561 	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2562 	if (!key)
2563 		goto nla_put_failure;
2564 
2565 	if ((params->key &&
2566 	     nla_put(cookie->msg, NL80211_KEY_DATA,
2567 		     params->key_len, params->key)) ||
2568 	    (params->seq &&
2569 	     nla_put(cookie->msg, NL80211_KEY_SEQ,
2570 		     params->seq_len, params->seq)) ||
2571 	    (params->cipher &&
2572 	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2573 			 params->cipher)))
2574 		goto nla_put_failure;
2575 
2576 	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2577 		goto nla_put_failure;
2578 
2579 	nla_nest_end(cookie->msg, key);
2580 
2581 	return;
2582  nla_put_failure:
2583 	cookie->error = 1;
2584 }
2585 
2586 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2587 {
2588 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2589 	int err;
2590 	struct net_device *dev = info->user_ptr[1];
2591 	u8 key_idx = 0;
2592 	const u8 *mac_addr = NULL;
2593 	bool pairwise;
2594 	struct get_key_cookie cookie = {
2595 		.error = 0,
2596 	};
2597 	void *hdr;
2598 	struct sk_buff *msg;
2599 
2600 	if (info->attrs[NL80211_ATTR_KEY_IDX])
2601 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2602 
2603 	if (key_idx > 5)
2604 		return -EINVAL;
2605 
2606 	if (info->attrs[NL80211_ATTR_MAC])
2607 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2608 
2609 	pairwise = !!mac_addr;
2610 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2611 		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2612 		if (kt >= NUM_NL80211_KEYTYPES)
2613 			return -EINVAL;
2614 		if (kt != NL80211_KEYTYPE_GROUP &&
2615 		    kt != NL80211_KEYTYPE_PAIRWISE)
2616 			return -EINVAL;
2617 		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2618 	}
2619 
2620 	if (!rdev->ops->get_key)
2621 		return -EOPNOTSUPP;
2622 
2623 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2624 	if (!msg)
2625 		return -ENOMEM;
2626 
2627 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2628 			     NL80211_CMD_NEW_KEY);
2629 	if (IS_ERR(hdr))
2630 		return PTR_ERR(hdr);
2631 
2632 	cookie.msg = msg;
2633 	cookie.idx = key_idx;
2634 
2635 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2636 	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2637 		goto nla_put_failure;
2638 	if (mac_addr &&
2639 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2640 		goto nla_put_failure;
2641 
2642 	if (pairwise && mac_addr &&
2643 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2644 		return -ENOENT;
2645 
2646 	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2647 			   get_key_callback);
2648 
2649 	if (err)
2650 		goto free_msg;
2651 
2652 	if (cookie.error)
2653 		goto nla_put_failure;
2654 
2655 	genlmsg_end(msg, hdr);
2656 	return genlmsg_reply(msg, info);
2657 
2658  nla_put_failure:
2659 	err = -ENOBUFS;
2660  free_msg:
2661 	nlmsg_free(msg);
2662 	return err;
2663 }
2664 
2665 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2666 {
2667 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2668 	struct key_parse key;
2669 	int err;
2670 	struct net_device *dev = info->user_ptr[1];
2671 
2672 	err = nl80211_parse_key(info, &key);
2673 	if (err)
2674 		return err;
2675 
2676 	if (key.idx < 0)
2677 		return -EINVAL;
2678 
2679 	/* only support setting default key */
2680 	if (!key.def && !key.defmgmt)
2681 		return -EINVAL;
2682 
2683 	wdev_lock(dev->ieee80211_ptr);
2684 
2685 	if (key.def) {
2686 		if (!rdev->ops->set_default_key) {
2687 			err = -EOPNOTSUPP;
2688 			goto out;
2689 		}
2690 
2691 		err = nl80211_key_allowed(dev->ieee80211_ptr);
2692 		if (err)
2693 			goto out;
2694 
2695 		err = rdev_set_default_key(rdev, dev, key.idx,
2696 						 key.def_uni, key.def_multi);
2697 
2698 		if (err)
2699 			goto out;
2700 
2701 #ifdef CONFIG_CFG80211_WEXT
2702 		dev->ieee80211_ptr->wext.default_key = key.idx;
2703 #endif
2704 	} else {
2705 		if (key.def_uni || !key.def_multi) {
2706 			err = -EINVAL;
2707 			goto out;
2708 		}
2709 
2710 		if (!rdev->ops->set_default_mgmt_key) {
2711 			err = -EOPNOTSUPP;
2712 			goto out;
2713 		}
2714 
2715 		err = nl80211_key_allowed(dev->ieee80211_ptr);
2716 		if (err)
2717 			goto out;
2718 
2719 		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2720 		if (err)
2721 			goto out;
2722 
2723 #ifdef CONFIG_CFG80211_WEXT
2724 		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2725 #endif
2726 	}
2727 
2728  out:
2729 	wdev_unlock(dev->ieee80211_ptr);
2730 
2731 	return err;
2732 }
2733 
2734 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2735 {
2736 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2737 	int err;
2738 	struct net_device *dev = info->user_ptr[1];
2739 	struct key_parse key;
2740 	const u8 *mac_addr = NULL;
2741 
2742 	err = nl80211_parse_key(info, &key);
2743 	if (err)
2744 		return err;
2745 
2746 	if (!key.p.key)
2747 		return -EINVAL;
2748 
2749 	if (info->attrs[NL80211_ATTR_MAC])
2750 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2751 
2752 	if (key.type == -1) {
2753 		if (mac_addr)
2754 			key.type = NL80211_KEYTYPE_PAIRWISE;
2755 		else
2756 			key.type = NL80211_KEYTYPE_GROUP;
2757 	}
2758 
2759 	/* for now */
2760 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2761 	    key.type != NL80211_KEYTYPE_GROUP)
2762 		return -EINVAL;
2763 
2764 	if (!rdev->ops->add_key)
2765 		return -EOPNOTSUPP;
2766 
2767 	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2768 					   key.type == NL80211_KEYTYPE_PAIRWISE,
2769 					   mac_addr))
2770 		return -EINVAL;
2771 
2772 	wdev_lock(dev->ieee80211_ptr);
2773 	err = nl80211_key_allowed(dev->ieee80211_ptr);
2774 	if (!err)
2775 		err = rdev_add_key(rdev, dev, key.idx,
2776 				   key.type == NL80211_KEYTYPE_PAIRWISE,
2777 				    mac_addr, &key.p);
2778 	wdev_unlock(dev->ieee80211_ptr);
2779 
2780 	return err;
2781 }
2782 
2783 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2784 {
2785 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2786 	int err;
2787 	struct net_device *dev = info->user_ptr[1];
2788 	u8 *mac_addr = NULL;
2789 	struct key_parse key;
2790 
2791 	err = nl80211_parse_key(info, &key);
2792 	if (err)
2793 		return err;
2794 
2795 	if (info->attrs[NL80211_ATTR_MAC])
2796 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2797 
2798 	if (key.type == -1) {
2799 		if (mac_addr)
2800 			key.type = NL80211_KEYTYPE_PAIRWISE;
2801 		else
2802 			key.type = NL80211_KEYTYPE_GROUP;
2803 	}
2804 
2805 	/* for now */
2806 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2807 	    key.type != NL80211_KEYTYPE_GROUP)
2808 		return -EINVAL;
2809 
2810 	if (!rdev->ops->del_key)
2811 		return -EOPNOTSUPP;
2812 
2813 	wdev_lock(dev->ieee80211_ptr);
2814 	err = nl80211_key_allowed(dev->ieee80211_ptr);
2815 
2816 	if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2817 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2818 		err = -ENOENT;
2819 
2820 	if (!err)
2821 		err = rdev_del_key(rdev, dev, key.idx,
2822 				   key.type == NL80211_KEYTYPE_PAIRWISE,
2823 				   mac_addr);
2824 
2825 #ifdef CONFIG_CFG80211_WEXT
2826 	if (!err) {
2827 		if (key.idx == dev->ieee80211_ptr->wext.default_key)
2828 			dev->ieee80211_ptr->wext.default_key = -1;
2829 		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2830 			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2831 	}
2832 #endif
2833 	wdev_unlock(dev->ieee80211_ptr);
2834 
2835 	return err;
2836 }
2837 
2838 /* This function returns an error or the number of nested attributes */
2839 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2840 {
2841 	struct nlattr *attr;
2842 	int n_entries = 0, tmp;
2843 
2844 	nla_for_each_nested(attr, nl_attr, tmp) {
2845 		if (nla_len(attr) != ETH_ALEN)
2846 			return -EINVAL;
2847 
2848 		n_entries++;
2849 	}
2850 
2851 	return n_entries;
2852 }
2853 
2854 /*
2855  * This function parses ACL information and allocates memory for ACL data.
2856  * On successful return, the calling function is responsible to free the
2857  * ACL buffer returned by this function.
2858  */
2859 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2860 						struct genl_info *info)
2861 {
2862 	enum nl80211_acl_policy acl_policy;
2863 	struct nlattr *attr;
2864 	struct cfg80211_acl_data *acl;
2865 	int i = 0, n_entries, tmp;
2866 
2867 	if (!wiphy->max_acl_mac_addrs)
2868 		return ERR_PTR(-EOPNOTSUPP);
2869 
2870 	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2871 		return ERR_PTR(-EINVAL);
2872 
2873 	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2874 	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2875 	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2876 		return ERR_PTR(-EINVAL);
2877 
2878 	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2879 		return ERR_PTR(-EINVAL);
2880 
2881 	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2882 	if (n_entries < 0)
2883 		return ERR_PTR(n_entries);
2884 
2885 	if (n_entries > wiphy->max_acl_mac_addrs)
2886 		return ERR_PTR(-ENOTSUPP);
2887 
2888 	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2889 		      GFP_KERNEL);
2890 	if (!acl)
2891 		return ERR_PTR(-ENOMEM);
2892 
2893 	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2894 		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2895 		i++;
2896 	}
2897 
2898 	acl->n_acl_entries = n_entries;
2899 	acl->acl_policy = acl_policy;
2900 
2901 	return acl;
2902 }
2903 
2904 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2905 {
2906 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2907 	struct net_device *dev = info->user_ptr[1];
2908 	struct cfg80211_acl_data *acl;
2909 	int err;
2910 
2911 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2912 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2913 		return -EOPNOTSUPP;
2914 
2915 	if (!dev->ieee80211_ptr->beacon_interval)
2916 		return -EINVAL;
2917 
2918 	acl = parse_acl_data(&rdev->wiphy, info);
2919 	if (IS_ERR(acl))
2920 		return PTR_ERR(acl);
2921 
2922 	err = rdev_set_mac_acl(rdev, dev, acl);
2923 
2924 	kfree(acl);
2925 
2926 	return err;
2927 }
2928 
2929 static int nl80211_parse_beacon(struct genl_info *info,
2930 				struct cfg80211_beacon_data *bcn)
2931 {
2932 	bool haveinfo = false;
2933 
2934 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2935 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2936 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2937 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2938 		return -EINVAL;
2939 
2940 	memset(bcn, 0, sizeof(*bcn));
2941 
2942 	if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2943 		bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2944 		bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2945 		if (!bcn->head_len)
2946 			return -EINVAL;
2947 		haveinfo = true;
2948 	}
2949 
2950 	if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2951 		bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2952 		bcn->tail_len =
2953 		    nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2954 		haveinfo = true;
2955 	}
2956 
2957 	if (!haveinfo)
2958 		return -EINVAL;
2959 
2960 	if (info->attrs[NL80211_ATTR_IE]) {
2961 		bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2962 		bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2963 	}
2964 
2965 	if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2966 		bcn->proberesp_ies =
2967 			nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2968 		bcn->proberesp_ies_len =
2969 			nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2970 	}
2971 
2972 	if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2973 		bcn->assocresp_ies =
2974 			nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2975 		bcn->assocresp_ies_len =
2976 			nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2977 	}
2978 
2979 	if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2980 		bcn->probe_resp =
2981 			nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2982 		bcn->probe_resp_len =
2983 			nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2984 	}
2985 
2986 	return 0;
2987 }
2988 
2989 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2990 				   struct cfg80211_ap_settings *params)
2991 {
2992 	struct wireless_dev *wdev;
2993 	bool ret = false;
2994 
2995 	mutex_lock(&rdev->devlist_mtx);
2996 
2997 	list_for_each_entry(wdev, &rdev->wdev_list, list) {
2998 		if (wdev->iftype != NL80211_IFTYPE_AP &&
2999 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
3000 			continue;
3001 
3002 		if (!wdev->preset_chandef.chan)
3003 			continue;
3004 
3005 		params->chandef = wdev->preset_chandef;
3006 		ret = true;
3007 		break;
3008 	}
3009 
3010 	mutex_unlock(&rdev->devlist_mtx);
3011 
3012 	return ret;
3013 }
3014 
3015 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3016 				    enum nl80211_auth_type auth_type,
3017 				    enum nl80211_commands cmd)
3018 {
3019 	if (auth_type > NL80211_AUTHTYPE_MAX)
3020 		return false;
3021 
3022 	switch (cmd) {
3023 	case NL80211_CMD_AUTHENTICATE:
3024 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3025 		    auth_type == NL80211_AUTHTYPE_SAE)
3026 			return false;
3027 		return true;
3028 	case NL80211_CMD_CONNECT:
3029 	case NL80211_CMD_START_AP:
3030 		/* SAE not supported yet */
3031 		if (auth_type == NL80211_AUTHTYPE_SAE)
3032 			return false;
3033 		return true;
3034 	default:
3035 		return false;
3036 	}
3037 }
3038 
3039 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3040 {
3041 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3042 	struct net_device *dev = info->user_ptr[1];
3043 	struct wireless_dev *wdev = dev->ieee80211_ptr;
3044 	struct cfg80211_ap_settings params;
3045 	int err;
3046 	u8 radar_detect_width = 0;
3047 
3048 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3049 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3050 		return -EOPNOTSUPP;
3051 
3052 	if (!rdev->ops->start_ap)
3053 		return -EOPNOTSUPP;
3054 
3055 	if (wdev->beacon_interval)
3056 		return -EALREADY;
3057 
3058 	memset(&params, 0, sizeof(params));
3059 
3060 	/* these are required for START_AP */
3061 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3062 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3063 	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
3064 		return -EINVAL;
3065 
3066 	err = nl80211_parse_beacon(info, &params.beacon);
3067 	if (err)
3068 		return err;
3069 
3070 	params.beacon_interval =
3071 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3072 	params.dtim_period =
3073 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3074 
3075 	err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3076 	if (err)
3077 		return err;
3078 
3079 	/*
3080 	 * In theory, some of these attributes should be required here
3081 	 * but since they were not used when the command was originally
3082 	 * added, keep them optional for old user space programs to let
3083 	 * them continue to work with drivers that do not need the
3084 	 * additional information -- drivers must check!
3085 	 */
3086 	if (info->attrs[NL80211_ATTR_SSID]) {
3087 		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3088 		params.ssid_len =
3089 			nla_len(info->attrs[NL80211_ATTR_SSID]);
3090 		if (params.ssid_len == 0 ||
3091 		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
3092 			return -EINVAL;
3093 	}
3094 
3095 	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3096 		params.hidden_ssid = nla_get_u32(
3097 			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3098 		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3099 		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3100 		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3101 			return -EINVAL;
3102 	}
3103 
3104 	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3105 
3106 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3107 		params.auth_type = nla_get_u32(
3108 			info->attrs[NL80211_ATTR_AUTH_TYPE]);
3109 		if (!nl80211_valid_auth_type(rdev, params.auth_type,
3110 					     NL80211_CMD_START_AP))
3111 			return -EINVAL;
3112 	} else
3113 		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3114 
3115 	err = nl80211_crypto_settings(rdev, info, &params.crypto,
3116 				      NL80211_MAX_NR_CIPHER_SUITES);
3117 	if (err)
3118 		return err;
3119 
3120 	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3121 		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3122 			return -EOPNOTSUPP;
3123 		params.inactivity_timeout = nla_get_u16(
3124 			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3125 	}
3126 
3127 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3128 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3129 			return -EINVAL;
3130 		params.p2p_ctwindow =
3131 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3132 		if (params.p2p_ctwindow > 127)
3133 			return -EINVAL;
3134 		if (params.p2p_ctwindow != 0 &&
3135 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3136 			return -EINVAL;
3137 	}
3138 
3139 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3140 		u8 tmp;
3141 
3142 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3143 			return -EINVAL;
3144 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3145 		if (tmp > 1)
3146 			return -EINVAL;
3147 		params.p2p_opp_ps = tmp;
3148 		if (params.p2p_opp_ps != 0 &&
3149 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3150 			return -EINVAL;
3151 	}
3152 
3153 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3154 		err = nl80211_parse_chandef(rdev, info, &params.chandef);
3155 		if (err)
3156 			return err;
3157 	} else if (wdev->preset_chandef.chan) {
3158 		params.chandef = wdev->preset_chandef;
3159 	} else if (!nl80211_get_ap_channel(rdev, &params))
3160 		return -EINVAL;
3161 
3162 	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3163 		return -EINVAL;
3164 
3165 	err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3166 	if (err < 0)
3167 		return err;
3168 	if (err) {
3169 		radar_detect_width = BIT(params.chandef.width);
3170 		params.radar_required = true;
3171 	}
3172 
3173 	mutex_lock(&rdev->devlist_mtx);
3174 	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3175 					   params.chandef.chan,
3176 					   CHAN_MODE_SHARED,
3177 					   radar_detect_width);
3178 	mutex_unlock(&rdev->devlist_mtx);
3179 
3180 	if (err)
3181 		return err;
3182 
3183 	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3184 		params.acl = parse_acl_data(&rdev->wiphy, info);
3185 		if (IS_ERR(params.acl))
3186 			return PTR_ERR(params.acl);
3187 	}
3188 
3189 	err = rdev_start_ap(rdev, dev, &params);
3190 	if (!err) {
3191 		wdev->preset_chandef = params.chandef;
3192 		wdev->beacon_interval = params.beacon_interval;
3193 		wdev->channel = params.chandef.chan;
3194 		wdev->ssid_len = params.ssid_len;
3195 		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3196 	}
3197 
3198 	kfree(params.acl);
3199 
3200 	return err;
3201 }
3202 
3203 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3204 {
3205 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3206 	struct net_device *dev = info->user_ptr[1];
3207 	struct wireless_dev *wdev = dev->ieee80211_ptr;
3208 	struct cfg80211_beacon_data params;
3209 	int err;
3210 
3211 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3212 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3213 		return -EOPNOTSUPP;
3214 
3215 	if (!rdev->ops->change_beacon)
3216 		return -EOPNOTSUPP;
3217 
3218 	if (!wdev->beacon_interval)
3219 		return -EINVAL;
3220 
3221 	err = nl80211_parse_beacon(info, &params);
3222 	if (err)
3223 		return err;
3224 
3225 	return rdev_change_beacon(rdev, dev, &params);
3226 }
3227 
3228 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3229 {
3230 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3231 	struct net_device *dev = info->user_ptr[1];
3232 
3233 	return cfg80211_stop_ap(rdev, dev);
3234 }
3235 
3236 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3237 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3238 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3239 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3240 	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3241 	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3242 	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3243 };
3244 
3245 static int parse_station_flags(struct genl_info *info,
3246 			       enum nl80211_iftype iftype,
3247 			       struct station_parameters *params)
3248 {
3249 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3250 	struct nlattr *nla;
3251 	int flag;
3252 
3253 	/*
3254 	 * Try parsing the new attribute first so userspace
3255 	 * can specify both for older kernels.
3256 	 */
3257 	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3258 	if (nla) {
3259 		struct nl80211_sta_flag_update *sta_flags;
3260 
3261 		sta_flags = nla_data(nla);
3262 		params->sta_flags_mask = sta_flags->mask;
3263 		params->sta_flags_set = sta_flags->set;
3264 		params->sta_flags_set &= params->sta_flags_mask;
3265 		if ((params->sta_flags_mask |
3266 		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3267 			return -EINVAL;
3268 		return 0;
3269 	}
3270 
3271 	/* if present, parse the old attribute */
3272 
3273 	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3274 	if (!nla)
3275 		return 0;
3276 
3277 	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3278 			     nla, sta_flags_policy))
3279 		return -EINVAL;
3280 
3281 	/*
3282 	 * Only allow certain flags for interface types so that
3283 	 * other attributes are silently ignored. Remember that
3284 	 * this is backward compatibility code with old userspace
3285 	 * and shouldn't be hit in other cases anyway.
3286 	 */
3287 	switch (iftype) {
3288 	case NL80211_IFTYPE_AP:
3289 	case NL80211_IFTYPE_AP_VLAN:
3290 	case NL80211_IFTYPE_P2P_GO:
3291 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3292 					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3293 					 BIT(NL80211_STA_FLAG_WME) |
3294 					 BIT(NL80211_STA_FLAG_MFP);
3295 		break;
3296 	case NL80211_IFTYPE_P2P_CLIENT:
3297 	case NL80211_IFTYPE_STATION:
3298 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3299 					 BIT(NL80211_STA_FLAG_TDLS_PEER);
3300 		break;
3301 	case NL80211_IFTYPE_MESH_POINT:
3302 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3303 					 BIT(NL80211_STA_FLAG_MFP) |
3304 					 BIT(NL80211_STA_FLAG_AUTHORIZED);
3305 	default:
3306 		return -EINVAL;
3307 	}
3308 
3309 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3310 		if (flags[flag]) {
3311 			params->sta_flags_set |= (1<<flag);
3312 
3313 			/* no longer support new API additions in old API */
3314 			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3315 				return -EINVAL;
3316 		}
3317 	}
3318 
3319 	return 0;
3320 }
3321 
3322 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3323 				 int attr)
3324 {
3325 	struct nlattr *rate;
3326 	u32 bitrate;
3327 	u16 bitrate_compat;
3328 
3329 	rate = nla_nest_start(msg, attr);
3330 	if (!rate)
3331 		return false;
3332 
3333 	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3334 	bitrate = cfg80211_calculate_bitrate(info);
3335 	/* report 16-bit bitrate only if we can */
3336 	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3337 	if (bitrate > 0 &&
3338 	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3339 		return false;
3340 	if (bitrate_compat > 0 &&
3341 	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3342 		return false;
3343 
3344 	if (info->flags & RATE_INFO_FLAGS_MCS) {
3345 		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3346 			return false;
3347 		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3348 		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3349 			return false;
3350 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3351 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3352 			return false;
3353 	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3354 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3355 			return false;
3356 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3357 			return false;
3358 		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3359 		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3360 			return false;
3361 		if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3362 		    nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3363 			return false;
3364 		if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3365 		    nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3366 			return false;
3367 		if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3368 		    nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3369 			return false;
3370 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3371 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3372 			return false;
3373 	}
3374 
3375 	nla_nest_end(msg, rate);
3376 	return true;
3377 }
3378 
3379 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3380 				int flags,
3381 				struct cfg80211_registered_device *rdev,
3382 				struct net_device *dev,
3383 				const u8 *mac_addr, struct station_info *sinfo)
3384 {
3385 	void *hdr;
3386 	struct nlattr *sinfoattr, *bss_param;
3387 
3388 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3389 	if (!hdr)
3390 		return -1;
3391 
3392 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3393 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3394 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3395 		goto nla_put_failure;
3396 
3397 	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3398 	if (!sinfoattr)
3399 		goto nla_put_failure;
3400 	if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3401 	    nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3402 			sinfo->connected_time))
3403 		goto nla_put_failure;
3404 	if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3405 	    nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3406 			sinfo->inactive_time))
3407 		goto nla_put_failure;
3408 	if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3409 			      STATION_INFO_RX_BYTES64)) &&
3410 	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3411 			(u32)sinfo->rx_bytes))
3412 		goto nla_put_failure;
3413 	if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3414 			      STATION_INFO_TX_BYTES64)) &&
3415 	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3416 			(u32)sinfo->tx_bytes))
3417 		goto nla_put_failure;
3418 	if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3419 	    nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3420 			sinfo->rx_bytes))
3421 		goto nla_put_failure;
3422 	if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3423 	    nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3424 			sinfo->tx_bytes))
3425 		goto nla_put_failure;
3426 	if ((sinfo->filled & STATION_INFO_LLID) &&
3427 	    nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3428 		goto nla_put_failure;
3429 	if ((sinfo->filled & STATION_INFO_PLID) &&
3430 	    nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3431 		goto nla_put_failure;
3432 	if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3433 	    nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3434 		       sinfo->plink_state))
3435 		goto nla_put_failure;
3436 	switch (rdev->wiphy.signal_type) {
3437 	case CFG80211_SIGNAL_TYPE_MBM:
3438 		if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3439 		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3440 			       sinfo->signal))
3441 			goto nla_put_failure;
3442 		if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3443 		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3444 			       sinfo->signal_avg))
3445 			goto nla_put_failure;
3446 		break;
3447 	default:
3448 		break;
3449 	}
3450 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3451 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3452 					  NL80211_STA_INFO_TX_BITRATE))
3453 			goto nla_put_failure;
3454 	}
3455 	if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3456 		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3457 					  NL80211_STA_INFO_RX_BITRATE))
3458 			goto nla_put_failure;
3459 	}
3460 	if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3461 	    nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3462 			sinfo->rx_packets))
3463 		goto nla_put_failure;
3464 	if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3465 	    nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3466 			sinfo->tx_packets))
3467 		goto nla_put_failure;
3468 	if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3469 	    nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3470 			sinfo->tx_retries))
3471 		goto nla_put_failure;
3472 	if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3473 	    nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3474 			sinfo->tx_failed))
3475 		goto nla_put_failure;
3476 	if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3477 	    nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3478 			sinfo->beacon_loss_count))
3479 		goto nla_put_failure;
3480 	if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3481 	    nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3482 			sinfo->local_pm))
3483 		goto nla_put_failure;
3484 	if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3485 	    nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3486 			sinfo->peer_pm))
3487 		goto nla_put_failure;
3488 	if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3489 	    nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3490 			sinfo->nonpeer_pm))
3491 		goto nla_put_failure;
3492 	if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3493 		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3494 		if (!bss_param)
3495 			goto nla_put_failure;
3496 
3497 		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3498 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3499 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3500 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3501 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3502 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3503 		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3504 			       sinfo->bss_param.dtim_period) ||
3505 		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3506 				sinfo->bss_param.beacon_interval))
3507 			goto nla_put_failure;
3508 
3509 		nla_nest_end(msg, bss_param);
3510 	}
3511 	if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3512 	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3513 		    sizeof(struct nl80211_sta_flag_update),
3514 		    &sinfo->sta_flags))
3515 		goto nla_put_failure;
3516 	if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3517 		nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3518 			    sinfo->t_offset))
3519 		goto nla_put_failure;
3520 	nla_nest_end(msg, sinfoattr);
3521 
3522 	if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3523 	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3524 		    sinfo->assoc_req_ies))
3525 		goto nla_put_failure;
3526 
3527 	return genlmsg_end(msg, hdr);
3528 
3529  nla_put_failure:
3530 	genlmsg_cancel(msg, hdr);
3531 	return -EMSGSIZE;
3532 }
3533 
3534 static int nl80211_dump_station(struct sk_buff *skb,
3535 				struct netlink_callback *cb)
3536 {
3537 	struct station_info sinfo;
3538 	struct cfg80211_registered_device *dev;
3539 	struct wireless_dev *wdev;
3540 	u8 mac_addr[ETH_ALEN];
3541 	int sta_idx = cb->args[2];
3542 	int err;
3543 
3544 	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3545 	if (err)
3546 		return err;
3547 
3548 	if (!wdev->netdev) {
3549 		err = -EINVAL;
3550 		goto out_err;
3551 	}
3552 
3553 	if (!dev->ops->dump_station) {
3554 		err = -EOPNOTSUPP;
3555 		goto out_err;
3556 	}
3557 
3558 	while (1) {
3559 		memset(&sinfo, 0, sizeof(sinfo));
3560 		err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3561 					mac_addr, &sinfo);
3562 		if (err == -ENOENT)
3563 			break;
3564 		if (err)
3565 			goto out_err;
3566 
3567 		if (nl80211_send_station(skb,
3568 				NETLINK_CB(cb->skb).portid,
3569 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
3570 				dev, wdev->netdev, mac_addr,
3571 				&sinfo) < 0)
3572 			goto out;
3573 
3574 		sta_idx++;
3575 	}
3576 
3577 
3578  out:
3579 	cb->args[2] = sta_idx;
3580 	err = skb->len;
3581  out_err:
3582 	nl80211_finish_wdev_dump(dev);
3583 
3584 	return err;
3585 }
3586 
3587 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3588 {
3589 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3590 	struct net_device *dev = info->user_ptr[1];
3591 	struct station_info sinfo;
3592 	struct sk_buff *msg;
3593 	u8 *mac_addr = NULL;
3594 	int err;
3595 
3596 	memset(&sinfo, 0, sizeof(sinfo));
3597 
3598 	if (!info->attrs[NL80211_ATTR_MAC])
3599 		return -EINVAL;
3600 
3601 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3602 
3603 	if (!rdev->ops->get_station)
3604 		return -EOPNOTSUPP;
3605 
3606 	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3607 	if (err)
3608 		return err;
3609 
3610 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3611 	if (!msg)
3612 		return -ENOMEM;
3613 
3614 	if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3615 				 rdev, dev, mac_addr, &sinfo) < 0) {
3616 		nlmsg_free(msg);
3617 		return -ENOBUFS;
3618 	}
3619 
3620 	return genlmsg_reply(msg, info);
3621 }
3622 
3623 int cfg80211_check_station_change(struct wiphy *wiphy,
3624 				  struct station_parameters *params,
3625 				  enum cfg80211_station_type statype)
3626 {
3627 	if (params->listen_interval != -1)
3628 		return -EINVAL;
3629 	if (params->aid)
3630 		return -EINVAL;
3631 
3632 	/* When you run into this, adjust the code below for the new flag */
3633 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3634 
3635 	switch (statype) {
3636 	case CFG80211_STA_MESH_PEER_KERNEL:
3637 	case CFG80211_STA_MESH_PEER_USER:
3638 		/*
3639 		 * No ignoring the TDLS flag here -- the userspace mesh
3640 		 * code doesn't have the bug of including TDLS in the
3641 		 * mask everywhere.
3642 		 */
3643 		if (params->sta_flags_mask &
3644 				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3645 				  BIT(NL80211_STA_FLAG_MFP) |
3646 				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
3647 			return -EINVAL;
3648 		break;
3649 	case CFG80211_STA_TDLS_PEER_SETUP:
3650 	case CFG80211_STA_TDLS_PEER_ACTIVE:
3651 		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3652 			return -EINVAL;
3653 		/* ignore since it can't change */
3654 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3655 		break;
3656 	default:
3657 		/* disallow mesh-specific things */
3658 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3659 			return -EINVAL;
3660 		if (params->local_pm)
3661 			return -EINVAL;
3662 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3663 			return -EINVAL;
3664 	}
3665 
3666 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3667 	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3668 		/* TDLS can't be set, ... */
3669 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3670 			return -EINVAL;
3671 		/*
3672 		 * ... but don't bother the driver with it. This works around
3673 		 * a hostapd/wpa_supplicant issue -- it always includes the
3674 		 * TLDS_PEER flag in the mask even for AP mode.
3675 		 */
3676 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3677 	}
3678 
3679 	if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3680 		/* reject other things that can't change */
3681 		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3682 			return -EINVAL;
3683 		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3684 			return -EINVAL;
3685 		if (params->supported_rates)
3686 			return -EINVAL;
3687 		if (params->ext_capab || params->ht_capa || params->vht_capa)
3688 			return -EINVAL;
3689 	}
3690 
3691 	if (statype != CFG80211_STA_AP_CLIENT) {
3692 		if (params->vlan)
3693 			return -EINVAL;
3694 	}
3695 
3696 	switch (statype) {
3697 	case CFG80211_STA_AP_MLME_CLIENT:
3698 		/* Use this only for authorizing/unauthorizing a station */
3699 		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3700 			return -EOPNOTSUPP;
3701 		break;
3702 	case CFG80211_STA_AP_CLIENT:
3703 		/* accept only the listed bits */
3704 		if (params->sta_flags_mask &
3705 				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3706 				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3707 				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
3708 				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3709 				  BIT(NL80211_STA_FLAG_WME) |
3710 				  BIT(NL80211_STA_FLAG_MFP)))
3711 			return -EINVAL;
3712 
3713 		/* but authenticated/associated only if driver handles it */
3714 		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3715 		    params->sta_flags_mask &
3716 				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3717 				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
3718 			return -EINVAL;
3719 		break;
3720 	case CFG80211_STA_IBSS:
3721 	case CFG80211_STA_AP_STA:
3722 		/* reject any changes other than AUTHORIZED */
3723 		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3724 			return -EINVAL;
3725 		break;
3726 	case CFG80211_STA_TDLS_PEER_SETUP:
3727 		/* reject any changes other than AUTHORIZED or WME */
3728 		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3729 					       BIT(NL80211_STA_FLAG_WME)))
3730 			return -EINVAL;
3731 		/* force (at least) rates when authorizing */
3732 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3733 		    !params->supported_rates)
3734 			return -EINVAL;
3735 		break;
3736 	case CFG80211_STA_TDLS_PEER_ACTIVE:
3737 		/* reject any changes */
3738 		return -EINVAL;
3739 	case CFG80211_STA_MESH_PEER_KERNEL:
3740 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3741 			return -EINVAL;
3742 		break;
3743 	case CFG80211_STA_MESH_PEER_USER:
3744 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3745 			return -EINVAL;
3746 		break;
3747 	}
3748 
3749 	return 0;
3750 }
3751 EXPORT_SYMBOL(cfg80211_check_station_change);
3752 
3753 /*
3754  * Get vlan interface making sure it is running and on the right wiphy.
3755  */
3756 static struct net_device *get_vlan(struct genl_info *info,
3757 				   struct cfg80211_registered_device *rdev)
3758 {
3759 	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3760 	struct net_device *v;
3761 	int ret;
3762 
3763 	if (!vlanattr)
3764 		return NULL;
3765 
3766 	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3767 	if (!v)
3768 		return ERR_PTR(-ENODEV);
3769 
3770 	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3771 		ret = -EINVAL;
3772 		goto error;
3773 	}
3774 
3775 	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3776 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3777 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3778 		ret = -EINVAL;
3779 		goto error;
3780 	}
3781 
3782 	if (!netif_running(v)) {
3783 		ret = -ENETDOWN;
3784 		goto error;
3785 	}
3786 
3787 	return v;
3788  error:
3789 	dev_put(v);
3790 	return ERR_PTR(ret);
3791 }
3792 
3793 static struct nla_policy
3794 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3795 	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3796 	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3797 };
3798 
3799 static int nl80211_parse_sta_wme(struct genl_info *info,
3800 				 struct station_parameters *params)
3801 {
3802 	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3803 	struct nlattr *nla;
3804 	int err;
3805 
3806 	/* parse WME attributes if present */
3807 	if (!info->attrs[NL80211_ATTR_STA_WME])
3808 		return 0;
3809 
3810 	nla = info->attrs[NL80211_ATTR_STA_WME];
3811 	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3812 			       nl80211_sta_wme_policy);
3813 	if (err)
3814 		return err;
3815 
3816 	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3817 		params->uapsd_queues = nla_get_u8(
3818 			tb[NL80211_STA_WME_UAPSD_QUEUES]);
3819 	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3820 		return -EINVAL;
3821 
3822 	if (tb[NL80211_STA_WME_MAX_SP])
3823 		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3824 
3825 	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3826 		return -EINVAL;
3827 
3828 	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3829 
3830 	return 0;
3831 }
3832 
3833 static int nl80211_set_station_tdls(struct genl_info *info,
3834 				    struct station_parameters *params)
3835 {
3836 	/* Dummy STA entry gets updated once the peer capabilities are known */
3837 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3838 		params->ht_capa =
3839 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3840 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3841 		params->vht_capa =
3842 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3843 
3844 	return nl80211_parse_sta_wme(info, params);
3845 }
3846 
3847 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3848 {
3849 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3850 	struct net_device *dev = info->user_ptr[1];
3851 	struct station_parameters params;
3852 	u8 *mac_addr;
3853 	int err;
3854 
3855 	memset(&params, 0, sizeof(params));
3856 
3857 	params.listen_interval = -1;
3858 
3859 	if (!rdev->ops->change_station)
3860 		return -EOPNOTSUPP;
3861 
3862 	if (info->attrs[NL80211_ATTR_STA_AID])
3863 		return -EINVAL;
3864 
3865 	if (!info->attrs[NL80211_ATTR_MAC])
3866 		return -EINVAL;
3867 
3868 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3869 
3870 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3871 		params.supported_rates =
3872 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3873 		params.supported_rates_len =
3874 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3875 	}
3876 
3877 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3878 		params.capability =
3879 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3880 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3881 	}
3882 
3883 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3884 		params.ext_capab =
3885 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3886 		params.ext_capab_len =
3887 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3888 	}
3889 
3890 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3891 		return -EINVAL;
3892 
3893 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3894 		return -EINVAL;
3895 
3896 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3897 		params.plink_action =
3898 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3899 		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3900 			return -EINVAL;
3901 	}
3902 
3903 	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3904 		params.plink_state =
3905 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3906 		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3907 			return -EINVAL;
3908 		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3909 	}
3910 
3911 	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3912 		enum nl80211_mesh_power_mode pm = nla_get_u32(
3913 			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3914 
3915 		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3916 		    pm > NL80211_MESH_POWER_MAX)
3917 			return -EINVAL;
3918 
3919 		params.local_pm = pm;
3920 	}
3921 
3922 	/* Include parameters for TDLS peer (will check later) */
3923 	err = nl80211_set_station_tdls(info, &params);
3924 	if (err)
3925 		return err;
3926 
3927 	params.vlan = get_vlan(info, rdev);
3928 	if (IS_ERR(params.vlan))
3929 		return PTR_ERR(params.vlan);
3930 
3931 	switch (dev->ieee80211_ptr->iftype) {
3932 	case NL80211_IFTYPE_AP:
3933 	case NL80211_IFTYPE_AP_VLAN:
3934 	case NL80211_IFTYPE_P2P_GO:
3935 	case NL80211_IFTYPE_P2P_CLIENT:
3936 	case NL80211_IFTYPE_STATION:
3937 	case NL80211_IFTYPE_ADHOC:
3938 	case NL80211_IFTYPE_MESH_POINT:
3939 		break;
3940 	default:
3941 		err = -EOPNOTSUPP;
3942 		goto out_put_vlan;
3943 	}
3944 
3945 	/* driver will call cfg80211_check_station_change() */
3946 	err = rdev_change_station(rdev, dev, mac_addr, &params);
3947 
3948  out_put_vlan:
3949 	if (params.vlan)
3950 		dev_put(params.vlan);
3951 
3952 	return err;
3953 }
3954 
3955 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3956 {
3957 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3958 	int err;
3959 	struct net_device *dev = info->user_ptr[1];
3960 	struct station_parameters params;
3961 	u8 *mac_addr = NULL;
3962 
3963 	memset(&params, 0, sizeof(params));
3964 
3965 	if (!rdev->ops->add_station)
3966 		return -EOPNOTSUPP;
3967 
3968 	if (!info->attrs[NL80211_ATTR_MAC])
3969 		return -EINVAL;
3970 
3971 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3972 		return -EINVAL;
3973 
3974 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3975 		return -EINVAL;
3976 
3977 	if (!info->attrs[NL80211_ATTR_STA_AID])
3978 		return -EINVAL;
3979 
3980 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3981 	params.supported_rates =
3982 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3983 	params.supported_rates_len =
3984 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3985 	params.listen_interval =
3986 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3987 
3988 	params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3989 	if (!params.aid || params.aid > IEEE80211_MAX_AID)
3990 		return -EINVAL;
3991 
3992 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3993 		params.capability =
3994 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3995 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3996 	}
3997 
3998 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3999 		params.ext_capab =
4000 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4001 		params.ext_capab_len =
4002 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4003 	}
4004 
4005 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4006 		params.ht_capa =
4007 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4008 
4009 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4010 		params.vht_capa =
4011 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4012 
4013 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4014 		params.plink_action =
4015 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4016 		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4017 			return -EINVAL;
4018 	}
4019 
4020 	err = nl80211_parse_sta_wme(info, &params);
4021 	if (err)
4022 		return err;
4023 
4024 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4025 		return -EINVAL;
4026 
4027 	/* When you run into this, adjust the code below for the new flag */
4028 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4029 
4030 	switch (dev->ieee80211_ptr->iftype) {
4031 	case NL80211_IFTYPE_AP:
4032 	case NL80211_IFTYPE_AP_VLAN:
4033 	case NL80211_IFTYPE_P2P_GO:
4034 		/* ignore WME attributes if iface/sta is not capable */
4035 		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4036 		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4037 			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4038 
4039 		/* TDLS peers cannot be added */
4040 		if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4041 			return -EINVAL;
4042 		/* but don't bother the driver with it */
4043 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4044 
4045 		/* allow authenticated/associated only if driver handles it */
4046 		if (!(rdev->wiphy.features &
4047 				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4048 		    params.sta_flags_mask &
4049 				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4050 				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4051 			return -EINVAL;
4052 
4053 		/* must be last in here for error handling */
4054 		params.vlan = get_vlan(info, rdev);
4055 		if (IS_ERR(params.vlan))
4056 			return PTR_ERR(params.vlan);
4057 		break;
4058 	case NL80211_IFTYPE_MESH_POINT:
4059 		/* ignore uAPSD data */
4060 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4061 
4062 		/* associated is disallowed */
4063 		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4064 			return -EINVAL;
4065 		/* TDLS peers cannot be added */
4066 		if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4067 			return -EINVAL;
4068 		break;
4069 	case NL80211_IFTYPE_STATION:
4070 	case NL80211_IFTYPE_P2P_CLIENT:
4071 		/* ignore uAPSD data */
4072 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4073 
4074 		/* these are disallowed */
4075 		if (params.sta_flags_mask &
4076 				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
4077 				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4078 			return -EINVAL;
4079 		/* Only TDLS peers can be added */
4080 		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4081 			return -EINVAL;
4082 		/* Can only add if TDLS ... */
4083 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4084 			return -EOPNOTSUPP;
4085 		/* ... with external setup is supported */
4086 		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4087 			return -EOPNOTSUPP;
4088 		/*
4089 		 * Older wpa_supplicant versions always mark the TDLS peer
4090 		 * as authorized, but it shouldn't yet be.
4091 		 */
4092 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4093 		break;
4094 	default:
4095 		return -EOPNOTSUPP;
4096 	}
4097 
4098 	/* be aware of params.vlan when changing code here */
4099 
4100 	err = rdev_add_station(rdev, dev, mac_addr, &params);
4101 
4102 	if (params.vlan)
4103 		dev_put(params.vlan);
4104 	return err;
4105 }
4106 
4107 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4108 {
4109 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4110 	struct net_device *dev = info->user_ptr[1];
4111 	u8 *mac_addr = NULL;
4112 
4113 	if (info->attrs[NL80211_ATTR_MAC])
4114 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4115 
4116 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4117 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4118 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4119 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4120 		return -EINVAL;
4121 
4122 	if (!rdev->ops->del_station)
4123 		return -EOPNOTSUPP;
4124 
4125 	return rdev_del_station(rdev, dev, mac_addr);
4126 }
4127 
4128 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4129 				int flags, struct net_device *dev,
4130 				u8 *dst, u8 *next_hop,
4131 				struct mpath_info *pinfo)
4132 {
4133 	void *hdr;
4134 	struct nlattr *pinfoattr;
4135 
4136 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4137 	if (!hdr)
4138 		return -1;
4139 
4140 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4141 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4142 	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4143 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4144 		goto nla_put_failure;
4145 
4146 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4147 	if (!pinfoattr)
4148 		goto nla_put_failure;
4149 	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4150 	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4151 			pinfo->frame_qlen))
4152 		goto nla_put_failure;
4153 	if (((pinfo->filled & MPATH_INFO_SN) &&
4154 	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4155 	    ((pinfo->filled & MPATH_INFO_METRIC) &&
4156 	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4157 			 pinfo->metric)) ||
4158 	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4159 	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4160 			 pinfo->exptime)) ||
4161 	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
4162 	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4163 			pinfo->flags)) ||
4164 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4165 	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4166 			 pinfo->discovery_timeout)) ||
4167 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4168 	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4169 			pinfo->discovery_retries)))
4170 		goto nla_put_failure;
4171 
4172 	nla_nest_end(msg, pinfoattr);
4173 
4174 	return genlmsg_end(msg, hdr);
4175 
4176  nla_put_failure:
4177 	genlmsg_cancel(msg, hdr);
4178 	return -EMSGSIZE;
4179 }
4180 
4181 static int nl80211_dump_mpath(struct sk_buff *skb,
4182 			      struct netlink_callback *cb)
4183 {
4184 	struct mpath_info pinfo;
4185 	struct cfg80211_registered_device *dev;
4186 	struct wireless_dev *wdev;
4187 	u8 dst[ETH_ALEN];
4188 	u8 next_hop[ETH_ALEN];
4189 	int path_idx = cb->args[2];
4190 	int err;
4191 
4192 	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4193 	if (err)
4194 		return err;
4195 
4196 	if (!dev->ops->dump_mpath) {
4197 		err = -EOPNOTSUPP;
4198 		goto out_err;
4199 	}
4200 
4201 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4202 		err = -EOPNOTSUPP;
4203 		goto out_err;
4204 	}
4205 
4206 	while (1) {
4207 		err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4208 				      next_hop, &pinfo);
4209 		if (err == -ENOENT)
4210 			break;
4211 		if (err)
4212 			goto out_err;
4213 
4214 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4215 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
4216 				       wdev->netdev, dst, next_hop,
4217 				       &pinfo) < 0)
4218 			goto out;
4219 
4220 		path_idx++;
4221 	}
4222 
4223 
4224  out:
4225 	cb->args[2] = path_idx;
4226 	err = skb->len;
4227  out_err:
4228 	nl80211_finish_wdev_dump(dev);
4229 	return err;
4230 }
4231 
4232 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4233 {
4234 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4235 	int err;
4236 	struct net_device *dev = info->user_ptr[1];
4237 	struct mpath_info pinfo;
4238 	struct sk_buff *msg;
4239 	u8 *dst = NULL;
4240 	u8 next_hop[ETH_ALEN];
4241 
4242 	memset(&pinfo, 0, sizeof(pinfo));
4243 
4244 	if (!info->attrs[NL80211_ATTR_MAC])
4245 		return -EINVAL;
4246 
4247 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4248 
4249 	if (!rdev->ops->get_mpath)
4250 		return -EOPNOTSUPP;
4251 
4252 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4253 		return -EOPNOTSUPP;
4254 
4255 	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4256 	if (err)
4257 		return err;
4258 
4259 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4260 	if (!msg)
4261 		return -ENOMEM;
4262 
4263 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4264 				 dev, dst, next_hop, &pinfo) < 0) {
4265 		nlmsg_free(msg);
4266 		return -ENOBUFS;
4267 	}
4268 
4269 	return genlmsg_reply(msg, info);
4270 }
4271 
4272 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4273 {
4274 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4275 	struct net_device *dev = info->user_ptr[1];
4276 	u8 *dst = NULL;
4277 	u8 *next_hop = NULL;
4278 
4279 	if (!info->attrs[NL80211_ATTR_MAC])
4280 		return -EINVAL;
4281 
4282 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4283 		return -EINVAL;
4284 
4285 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4286 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4287 
4288 	if (!rdev->ops->change_mpath)
4289 		return -EOPNOTSUPP;
4290 
4291 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4292 		return -EOPNOTSUPP;
4293 
4294 	return rdev_change_mpath(rdev, dev, dst, next_hop);
4295 }
4296 
4297 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4298 {
4299 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4300 	struct net_device *dev = info->user_ptr[1];
4301 	u8 *dst = NULL;
4302 	u8 *next_hop = NULL;
4303 
4304 	if (!info->attrs[NL80211_ATTR_MAC])
4305 		return -EINVAL;
4306 
4307 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4308 		return -EINVAL;
4309 
4310 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4311 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4312 
4313 	if (!rdev->ops->add_mpath)
4314 		return -EOPNOTSUPP;
4315 
4316 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4317 		return -EOPNOTSUPP;
4318 
4319 	return rdev_add_mpath(rdev, dev, dst, next_hop);
4320 }
4321 
4322 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4323 {
4324 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4325 	struct net_device *dev = info->user_ptr[1];
4326 	u8 *dst = NULL;
4327 
4328 	if (info->attrs[NL80211_ATTR_MAC])
4329 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4330 
4331 	if (!rdev->ops->del_mpath)
4332 		return -EOPNOTSUPP;
4333 
4334 	return rdev_del_mpath(rdev, dev, dst);
4335 }
4336 
4337 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4338 {
4339 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4340 	struct net_device *dev = info->user_ptr[1];
4341 	struct bss_parameters params;
4342 
4343 	memset(&params, 0, sizeof(params));
4344 	/* default to not changing parameters */
4345 	params.use_cts_prot = -1;
4346 	params.use_short_preamble = -1;
4347 	params.use_short_slot_time = -1;
4348 	params.ap_isolate = -1;
4349 	params.ht_opmode = -1;
4350 	params.p2p_ctwindow = -1;
4351 	params.p2p_opp_ps = -1;
4352 
4353 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4354 		params.use_cts_prot =
4355 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4356 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4357 		params.use_short_preamble =
4358 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4359 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4360 		params.use_short_slot_time =
4361 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4362 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4363 		params.basic_rates =
4364 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4365 		params.basic_rates_len =
4366 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4367 	}
4368 	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4369 		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4370 	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4371 		params.ht_opmode =
4372 			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4373 
4374 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4375 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4376 			return -EINVAL;
4377 		params.p2p_ctwindow =
4378 			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4379 		if (params.p2p_ctwindow < 0)
4380 			return -EINVAL;
4381 		if (params.p2p_ctwindow != 0 &&
4382 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4383 			return -EINVAL;
4384 	}
4385 
4386 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4387 		u8 tmp;
4388 
4389 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4390 			return -EINVAL;
4391 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4392 		if (tmp > 1)
4393 			return -EINVAL;
4394 		params.p2p_opp_ps = tmp;
4395 		if (params.p2p_opp_ps &&
4396 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4397 			return -EINVAL;
4398 	}
4399 
4400 	if (!rdev->ops->change_bss)
4401 		return -EOPNOTSUPP;
4402 
4403 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4404 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4405 		return -EOPNOTSUPP;
4406 
4407 	return rdev_change_bss(rdev, dev, &params);
4408 }
4409 
4410 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4411 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
4412 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
4413 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
4414 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
4415 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
4416 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
4417 };
4418 
4419 static int parse_reg_rule(struct nlattr *tb[],
4420 	struct ieee80211_reg_rule *reg_rule)
4421 {
4422 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4423 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4424 
4425 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4426 		return -EINVAL;
4427 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4428 		return -EINVAL;
4429 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4430 		return -EINVAL;
4431 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4432 		return -EINVAL;
4433 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4434 		return -EINVAL;
4435 
4436 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4437 
4438 	freq_range->start_freq_khz =
4439 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4440 	freq_range->end_freq_khz =
4441 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4442 	freq_range->max_bandwidth_khz =
4443 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4444 
4445 	power_rule->max_eirp =
4446 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4447 
4448 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4449 		power_rule->max_antenna_gain =
4450 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4451 
4452 	return 0;
4453 }
4454 
4455 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4456 {
4457 	int r;
4458 	char *data = NULL;
4459 	enum nl80211_user_reg_hint_type user_reg_hint_type;
4460 
4461 	/*
4462 	 * You should only get this when cfg80211 hasn't yet initialized
4463 	 * completely when built-in to the kernel right between the time
4464 	 * window between nl80211_init() and regulatory_init(), if that is
4465 	 * even possible.
4466 	 */
4467 	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4468 		return -EINPROGRESS;
4469 
4470 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4471 		return -EINVAL;
4472 
4473 	data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4474 
4475 	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4476 		user_reg_hint_type =
4477 		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4478 	else
4479 		user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4480 
4481 	switch (user_reg_hint_type) {
4482 	case NL80211_USER_REG_HINT_USER:
4483 	case NL80211_USER_REG_HINT_CELL_BASE:
4484 		break;
4485 	default:
4486 		return -EINVAL;
4487 	}
4488 
4489 	r = regulatory_hint_user(data, user_reg_hint_type);
4490 
4491 	return r;
4492 }
4493 
4494 static int nl80211_get_mesh_config(struct sk_buff *skb,
4495 				   struct genl_info *info)
4496 {
4497 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4498 	struct net_device *dev = info->user_ptr[1];
4499 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4500 	struct mesh_config cur_params;
4501 	int err = 0;
4502 	void *hdr;
4503 	struct nlattr *pinfoattr;
4504 	struct sk_buff *msg;
4505 
4506 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4507 		return -EOPNOTSUPP;
4508 
4509 	if (!rdev->ops->get_mesh_config)
4510 		return -EOPNOTSUPP;
4511 
4512 	wdev_lock(wdev);
4513 	/* If not connected, get default parameters */
4514 	if (!wdev->mesh_id_len)
4515 		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4516 	else
4517 		err = rdev_get_mesh_config(rdev, dev, &cur_params);
4518 	wdev_unlock(wdev);
4519 
4520 	if (err)
4521 		return err;
4522 
4523 	/* Draw up a netlink message to send back */
4524 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4525 	if (!msg)
4526 		return -ENOMEM;
4527 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4528 			     NL80211_CMD_GET_MESH_CONFIG);
4529 	if (!hdr)
4530 		goto out;
4531 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4532 	if (!pinfoattr)
4533 		goto nla_put_failure;
4534 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4535 	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4536 			cur_params.dot11MeshRetryTimeout) ||
4537 	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4538 			cur_params.dot11MeshConfirmTimeout) ||
4539 	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4540 			cur_params.dot11MeshHoldingTimeout) ||
4541 	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4542 			cur_params.dot11MeshMaxPeerLinks) ||
4543 	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4544 		       cur_params.dot11MeshMaxRetries) ||
4545 	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
4546 		       cur_params.dot11MeshTTL) ||
4547 	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4548 		       cur_params.element_ttl) ||
4549 	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4550 		       cur_params.auto_open_plinks) ||
4551 	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4552 			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4553 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4554 		       cur_params.dot11MeshHWMPmaxPREQretries) ||
4555 	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4556 			cur_params.path_refresh_time) ||
4557 	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4558 			cur_params.min_discovery_timeout) ||
4559 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4560 			cur_params.dot11MeshHWMPactivePathTimeout) ||
4561 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4562 			cur_params.dot11MeshHWMPpreqMinInterval) ||
4563 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4564 			cur_params.dot11MeshHWMPperrMinInterval) ||
4565 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4566 			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4567 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4568 		       cur_params.dot11MeshHWMPRootMode) ||
4569 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4570 			cur_params.dot11MeshHWMPRannInterval) ||
4571 	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4572 		       cur_params.dot11MeshGateAnnouncementProtocol) ||
4573 	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4574 		       cur_params.dot11MeshForwarding) ||
4575 	    nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4576 			cur_params.rssi_threshold) ||
4577 	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4578 			cur_params.ht_opmode) ||
4579 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4580 			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4581 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4582 			cur_params.dot11MeshHWMProotInterval) ||
4583 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4584 			cur_params.dot11MeshHWMPconfirmationInterval) ||
4585 	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4586 			cur_params.power_mode) ||
4587 	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4588 			cur_params.dot11MeshAwakeWindowDuration))
4589 		goto nla_put_failure;
4590 	nla_nest_end(msg, pinfoattr);
4591 	genlmsg_end(msg, hdr);
4592 	return genlmsg_reply(msg, info);
4593 
4594  nla_put_failure:
4595 	genlmsg_cancel(msg, hdr);
4596  out:
4597 	nlmsg_free(msg);
4598 	return -ENOBUFS;
4599 }
4600 
4601 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4602 	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4603 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4604 	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4605 	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4606 	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4607 	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4608 	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4609 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4610 	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4611 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4612 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4613 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4614 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4615 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4616 	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4617 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4618 	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4619 	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4620 	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4621 	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4622 	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4623 	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4624 	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4625 	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4626 	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4627 	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4628 	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4629 };
4630 
4631 static const struct nla_policy
4632 	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4633 	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4634 	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4635 	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4636 	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4637 	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4638 	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4639 				    .len = IEEE80211_MAX_DATA_LEN },
4640 	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4641 };
4642 
4643 static int nl80211_parse_mesh_config(struct genl_info *info,
4644 				     struct mesh_config *cfg,
4645 				     u32 *mask_out)
4646 {
4647 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4648 	u32 mask = 0;
4649 
4650 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4651 do {									    \
4652 	if (tb[attr]) {							    \
4653 		if (fn(tb[attr]) < min || fn(tb[attr]) > max)		    \
4654 			return -EINVAL;					    \
4655 		cfg->param = fn(tb[attr]);				    \
4656 		mask |= (1 << (attr - 1));				    \
4657 	}								    \
4658 } while (0)
4659 
4660 
4661 	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4662 		return -EINVAL;
4663 	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4664 			     info->attrs[NL80211_ATTR_MESH_CONFIG],
4665 			     nl80211_meshconf_params_policy))
4666 		return -EINVAL;
4667 
4668 	/* This makes sure that there aren't more than 32 mesh config
4669 	 * parameters (otherwise our bitfield scheme would not work.) */
4670 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4671 
4672 	/* Fill in the params struct */
4673 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4674 				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4675 				  nla_get_u16);
4676 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4677 				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4678 				  nla_get_u16);
4679 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4680 				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4681 				  nla_get_u16);
4682 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4683 				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4684 				  nla_get_u16);
4685 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4686 				  mask, NL80211_MESHCONF_MAX_RETRIES,
4687 				  nla_get_u8);
4688 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4689 				  mask, NL80211_MESHCONF_TTL, nla_get_u8);
4690 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4691 				  mask, NL80211_MESHCONF_ELEMENT_TTL,
4692 				  nla_get_u8);
4693 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4694 				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4695 				  nla_get_u8);
4696 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4697 				  1, 255, mask,
4698 				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4699 				  nla_get_u32);
4700 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4701 				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4702 				  nla_get_u8);
4703 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4704 				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4705 				  nla_get_u32);
4706 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4707 				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4708 				  nla_get_u16);
4709 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4710 				  1, 65535, mask,
4711 				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4712 				  nla_get_u32);
4713 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4714 				  1, 65535, mask,
4715 				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4716 				  nla_get_u16);
4717 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4718 				  1, 65535, mask,
4719 				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4720 				  nla_get_u16);
4721 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4722 				  dot11MeshHWMPnetDiameterTraversalTime,
4723 				  1, 65535, mask,
4724 				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4725 				  nla_get_u16);
4726 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4727 				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4728 				  nla_get_u8);
4729 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4730 				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4731 				  nla_get_u16);
4732 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4733 				  dot11MeshGateAnnouncementProtocol, 0, 1,
4734 				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4735 				  nla_get_u8);
4736 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4737 				  mask, NL80211_MESHCONF_FORWARDING,
4738 				  nla_get_u8);
4739 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4740 				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4741 				  nla_get_u32);
4742 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4743 				  mask, NL80211_MESHCONF_HT_OPMODE,
4744 				  nla_get_u16);
4745 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4746 				  1, 65535, mask,
4747 				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4748 				  nla_get_u32);
4749 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4750 				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4751 				  nla_get_u16);
4752 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4753 				  dot11MeshHWMPconfirmationInterval,
4754 				  1, 65535, mask,
4755 				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4756 				  nla_get_u16);
4757 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4758 				  NL80211_MESH_POWER_ACTIVE,
4759 				  NL80211_MESH_POWER_MAX,
4760 				  mask, NL80211_MESHCONF_POWER_MODE,
4761 				  nla_get_u32);
4762 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4763 				  0, 65535, mask,
4764 				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4765 	if (mask_out)
4766 		*mask_out = mask;
4767 
4768 	return 0;
4769 
4770 #undef FILL_IN_MESH_PARAM_IF_SET
4771 }
4772 
4773 static int nl80211_parse_mesh_setup(struct genl_info *info,
4774 				     struct mesh_setup *setup)
4775 {
4776 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4777 	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4778 
4779 	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4780 		return -EINVAL;
4781 	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4782 			     info->attrs[NL80211_ATTR_MESH_SETUP],
4783 			     nl80211_mesh_setup_params_policy))
4784 		return -EINVAL;
4785 
4786 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4787 		setup->sync_method =
4788 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4789 		 IEEE80211_SYNC_METHOD_VENDOR :
4790 		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4791 
4792 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4793 		setup->path_sel_proto =
4794 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4795 		 IEEE80211_PATH_PROTOCOL_VENDOR :
4796 		 IEEE80211_PATH_PROTOCOL_HWMP;
4797 
4798 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4799 		setup->path_metric =
4800 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4801 		 IEEE80211_PATH_METRIC_VENDOR :
4802 		 IEEE80211_PATH_METRIC_AIRTIME;
4803 
4804 
4805 	if (tb[NL80211_MESH_SETUP_IE]) {
4806 		struct nlattr *ieattr =
4807 			tb[NL80211_MESH_SETUP_IE];
4808 		if (!is_valid_ie_attr(ieattr))
4809 			return -EINVAL;
4810 		setup->ie = nla_data(ieattr);
4811 		setup->ie_len = nla_len(ieattr);
4812 	}
4813 	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4814 	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4815 		return -EINVAL;
4816 	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4817 	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4818 	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4819 	if (setup->is_secure)
4820 		setup->user_mpm = true;
4821 
4822 	return 0;
4823 }
4824 
4825 static int nl80211_update_mesh_config(struct sk_buff *skb,
4826 				      struct genl_info *info)
4827 {
4828 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4829 	struct net_device *dev = info->user_ptr[1];
4830 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4831 	struct mesh_config cfg;
4832 	u32 mask;
4833 	int err;
4834 
4835 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4836 		return -EOPNOTSUPP;
4837 
4838 	if (!rdev->ops->update_mesh_config)
4839 		return -EOPNOTSUPP;
4840 
4841 	err = nl80211_parse_mesh_config(info, &cfg, &mask);
4842 	if (err)
4843 		return err;
4844 
4845 	wdev_lock(wdev);
4846 	if (!wdev->mesh_id_len)
4847 		err = -ENOLINK;
4848 
4849 	if (!err)
4850 		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4851 
4852 	wdev_unlock(wdev);
4853 
4854 	return err;
4855 }
4856 
4857 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4858 {
4859 	const struct ieee80211_regdomain *regdom;
4860 	struct sk_buff *msg;
4861 	void *hdr = NULL;
4862 	struct nlattr *nl_reg_rules;
4863 	unsigned int i;
4864 	int err = -EINVAL;
4865 
4866 	mutex_lock(&cfg80211_mutex);
4867 
4868 	if (!cfg80211_regdomain)
4869 		goto out;
4870 
4871 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4872 	if (!msg) {
4873 		err = -ENOBUFS;
4874 		goto out;
4875 	}
4876 
4877 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4878 			     NL80211_CMD_GET_REG);
4879 	if (!hdr)
4880 		goto put_failure;
4881 
4882 	if (reg_last_request_cell_base() &&
4883 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4884 			NL80211_USER_REG_HINT_CELL_BASE))
4885 		goto nla_put_failure;
4886 
4887 	rcu_read_lock();
4888 	regdom = rcu_dereference(cfg80211_regdomain);
4889 
4890 	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4891 	    (regdom->dfs_region &&
4892 	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4893 		goto nla_put_failure_rcu;
4894 
4895 	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4896 	if (!nl_reg_rules)
4897 		goto nla_put_failure_rcu;
4898 
4899 	for (i = 0; i < regdom->n_reg_rules; i++) {
4900 		struct nlattr *nl_reg_rule;
4901 		const struct ieee80211_reg_rule *reg_rule;
4902 		const struct ieee80211_freq_range *freq_range;
4903 		const struct ieee80211_power_rule *power_rule;
4904 
4905 		reg_rule = &regdom->reg_rules[i];
4906 		freq_range = &reg_rule->freq_range;
4907 		power_rule = &reg_rule->power_rule;
4908 
4909 		nl_reg_rule = nla_nest_start(msg, i);
4910 		if (!nl_reg_rule)
4911 			goto nla_put_failure_rcu;
4912 
4913 		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4914 				reg_rule->flags) ||
4915 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4916 				freq_range->start_freq_khz) ||
4917 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4918 				freq_range->end_freq_khz) ||
4919 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4920 				freq_range->max_bandwidth_khz) ||
4921 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4922 				power_rule->max_antenna_gain) ||
4923 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4924 				power_rule->max_eirp))
4925 			goto nla_put_failure_rcu;
4926 
4927 		nla_nest_end(msg, nl_reg_rule);
4928 	}
4929 	rcu_read_unlock();
4930 
4931 	nla_nest_end(msg, nl_reg_rules);
4932 
4933 	genlmsg_end(msg, hdr);
4934 	err = genlmsg_reply(msg, info);
4935 	goto out;
4936 
4937 nla_put_failure_rcu:
4938 	rcu_read_unlock();
4939 nla_put_failure:
4940 	genlmsg_cancel(msg, hdr);
4941 put_failure:
4942 	nlmsg_free(msg);
4943 	err = -EMSGSIZE;
4944 out:
4945 	mutex_unlock(&cfg80211_mutex);
4946 	return err;
4947 }
4948 
4949 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4950 {
4951 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4952 	struct nlattr *nl_reg_rule;
4953 	char *alpha2 = NULL;
4954 	int rem_reg_rules = 0, r = 0;
4955 	u32 num_rules = 0, rule_idx = 0, size_of_regd;
4956 	u8 dfs_region = 0;
4957 	struct ieee80211_regdomain *rd = NULL;
4958 
4959 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4960 		return -EINVAL;
4961 
4962 	if (!info->attrs[NL80211_ATTR_REG_RULES])
4963 		return -EINVAL;
4964 
4965 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4966 
4967 	if (info->attrs[NL80211_ATTR_DFS_REGION])
4968 		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4969 
4970 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4971 			    rem_reg_rules) {
4972 		num_rules++;
4973 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4974 			return -EINVAL;
4975 	}
4976 
4977 	size_of_regd = sizeof(struct ieee80211_regdomain) +
4978 		       num_rules * sizeof(struct ieee80211_reg_rule);
4979 
4980 	rd = kzalloc(size_of_regd, GFP_KERNEL);
4981 	if (!rd)
4982 		return -ENOMEM;
4983 
4984 	rd->n_reg_rules = num_rules;
4985 	rd->alpha2[0] = alpha2[0];
4986 	rd->alpha2[1] = alpha2[1];
4987 
4988 	/*
4989 	 * Disable DFS master mode if the DFS region was
4990 	 * not supported or known on this kernel.
4991 	 */
4992 	if (reg_supported_dfs_region(dfs_region))
4993 		rd->dfs_region = dfs_region;
4994 
4995 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4996 			    rem_reg_rules) {
4997 		nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4998 			  nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4999 			  reg_rule_policy);
5000 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5001 		if (r)
5002 			goto bad_reg;
5003 
5004 		rule_idx++;
5005 
5006 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5007 			r = -EINVAL;
5008 			goto bad_reg;
5009 		}
5010 	}
5011 
5012 	mutex_lock(&cfg80211_mutex);
5013 
5014 	r = set_regdom(rd);
5015 	/* set_regdom took ownership */
5016 	rd = NULL;
5017 	mutex_unlock(&cfg80211_mutex);
5018 
5019  bad_reg:
5020 	kfree(rd);
5021 	return r;
5022 }
5023 
5024 static int validate_scan_freqs(struct nlattr *freqs)
5025 {
5026 	struct nlattr *attr1, *attr2;
5027 	int n_channels = 0, tmp1, tmp2;
5028 
5029 	nla_for_each_nested(attr1, freqs, tmp1) {
5030 		n_channels++;
5031 		/*
5032 		 * Some hardware has a limited channel list for
5033 		 * scanning, and it is pretty much nonsensical
5034 		 * to scan for a channel twice, so disallow that
5035 		 * and don't require drivers to check that the
5036 		 * channel list they get isn't longer than what
5037 		 * they can scan, as long as they can scan all
5038 		 * the channels they registered at once.
5039 		 */
5040 		nla_for_each_nested(attr2, freqs, tmp2)
5041 			if (attr1 != attr2 &&
5042 			    nla_get_u32(attr1) == nla_get_u32(attr2))
5043 				return 0;
5044 	}
5045 
5046 	return n_channels;
5047 }
5048 
5049 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5050 {
5051 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5052 	struct wireless_dev *wdev = info->user_ptr[1];
5053 	struct cfg80211_scan_request *request;
5054 	struct nlattr *attr;
5055 	struct wiphy *wiphy;
5056 	int err, tmp, n_ssids = 0, n_channels, i;
5057 	size_t ie_len;
5058 
5059 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5060 		return -EINVAL;
5061 
5062 	wiphy = &rdev->wiphy;
5063 
5064 	if (!rdev->ops->scan)
5065 		return -EOPNOTSUPP;
5066 
5067 	mutex_lock(&rdev->sched_scan_mtx);
5068 	if (rdev->scan_req) {
5069 		err = -EBUSY;
5070 		goto unlock;
5071 	}
5072 
5073 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5074 		n_channels = validate_scan_freqs(
5075 				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5076 		if (!n_channels) {
5077 			err = -EINVAL;
5078 			goto unlock;
5079 		}
5080 	} else {
5081 		enum ieee80211_band band;
5082 		n_channels = 0;
5083 
5084 		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5085 			if (wiphy->bands[band])
5086 				n_channels += wiphy->bands[band]->n_channels;
5087 	}
5088 
5089 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5090 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5091 			n_ssids++;
5092 
5093 	if (n_ssids > wiphy->max_scan_ssids) {
5094 		err = -EINVAL;
5095 		goto unlock;
5096 	}
5097 
5098 	if (info->attrs[NL80211_ATTR_IE])
5099 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5100 	else
5101 		ie_len = 0;
5102 
5103 	if (ie_len > wiphy->max_scan_ie_len) {
5104 		err = -EINVAL;
5105 		goto unlock;
5106 	}
5107 
5108 	request = kzalloc(sizeof(*request)
5109 			+ sizeof(*request->ssids) * n_ssids
5110 			+ sizeof(*request->channels) * n_channels
5111 			+ ie_len, GFP_KERNEL);
5112 	if (!request) {
5113 		err = -ENOMEM;
5114 		goto unlock;
5115 	}
5116 
5117 	if (n_ssids)
5118 		request->ssids = (void *)&request->channels[n_channels];
5119 	request->n_ssids = n_ssids;
5120 	if (ie_len) {
5121 		if (request->ssids)
5122 			request->ie = (void *)(request->ssids + n_ssids);
5123 		else
5124 			request->ie = (void *)(request->channels + n_channels);
5125 	}
5126 
5127 	i = 0;
5128 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5129 		/* user specified, bail out if channel not found */
5130 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5131 			struct ieee80211_channel *chan;
5132 
5133 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5134 
5135 			if (!chan) {
5136 				err = -EINVAL;
5137 				goto out_free;
5138 			}
5139 
5140 			/* ignore disabled channels */
5141 			if (chan->flags & IEEE80211_CHAN_DISABLED)
5142 				continue;
5143 
5144 			request->channels[i] = chan;
5145 			i++;
5146 		}
5147 	} else {
5148 		enum ieee80211_band band;
5149 
5150 		/* all channels */
5151 		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5152 			int j;
5153 			if (!wiphy->bands[band])
5154 				continue;
5155 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5156 				struct ieee80211_channel *chan;
5157 
5158 				chan = &wiphy->bands[band]->channels[j];
5159 
5160 				if (chan->flags & IEEE80211_CHAN_DISABLED)
5161 					continue;
5162 
5163 				request->channels[i] = chan;
5164 				i++;
5165 			}
5166 		}
5167 	}
5168 
5169 	if (!i) {
5170 		err = -EINVAL;
5171 		goto out_free;
5172 	}
5173 
5174 	request->n_channels = i;
5175 
5176 	i = 0;
5177 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5178 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5179 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5180 				err = -EINVAL;
5181 				goto out_free;
5182 			}
5183 			request->ssids[i].ssid_len = nla_len(attr);
5184 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5185 			i++;
5186 		}
5187 	}
5188 
5189 	if (info->attrs[NL80211_ATTR_IE]) {
5190 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5191 		memcpy((void *)request->ie,
5192 		       nla_data(info->attrs[NL80211_ATTR_IE]),
5193 		       request->ie_len);
5194 	}
5195 
5196 	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5197 		if (wiphy->bands[i])
5198 			request->rates[i] =
5199 				(1 << wiphy->bands[i]->n_bitrates) - 1;
5200 
5201 	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5202 		nla_for_each_nested(attr,
5203 				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5204 				    tmp) {
5205 			enum ieee80211_band band = nla_type(attr);
5206 
5207 			if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5208 				err = -EINVAL;
5209 				goto out_free;
5210 			}
5211 			err = ieee80211_get_ratemask(wiphy->bands[band],
5212 						     nla_data(attr),
5213 						     nla_len(attr),
5214 						     &request->rates[band]);
5215 			if (err)
5216 				goto out_free;
5217 		}
5218 	}
5219 
5220 	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5221 		request->flags = nla_get_u32(
5222 			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5223 		if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5224 		     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5225 		    ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5226 		     !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5227 			err = -EOPNOTSUPP;
5228 			goto out_free;
5229 		}
5230 	}
5231 
5232 	request->no_cck =
5233 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5234 
5235 	request->wdev = wdev;
5236 	request->wiphy = &rdev->wiphy;
5237 	request->scan_start = jiffies;
5238 
5239 	rdev->scan_req = request;
5240 	err = rdev_scan(rdev, request);
5241 
5242 	if (!err) {
5243 		nl80211_send_scan_start(rdev, wdev);
5244 		if (wdev->netdev)
5245 			dev_hold(wdev->netdev);
5246 	} else {
5247  out_free:
5248 		rdev->scan_req = NULL;
5249 		kfree(request);
5250 	}
5251 
5252  unlock:
5253 	mutex_unlock(&rdev->sched_scan_mtx);
5254 	return err;
5255 }
5256 
5257 static int nl80211_start_sched_scan(struct sk_buff *skb,
5258 				    struct genl_info *info)
5259 {
5260 	struct cfg80211_sched_scan_request *request;
5261 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5262 	struct net_device *dev = info->user_ptr[1];
5263 	struct nlattr *attr;
5264 	struct wiphy *wiphy;
5265 	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5266 	u32 interval;
5267 	enum ieee80211_band band;
5268 	size_t ie_len;
5269 	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5270 
5271 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5272 	    !rdev->ops->sched_scan_start)
5273 		return -EOPNOTSUPP;
5274 
5275 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5276 		return -EINVAL;
5277 
5278 	if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5279 		return -EINVAL;
5280 
5281 	interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5282 	if (interval == 0)
5283 		return -EINVAL;
5284 
5285 	wiphy = &rdev->wiphy;
5286 
5287 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5288 		n_channels = validate_scan_freqs(
5289 				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5290 		if (!n_channels)
5291 			return -EINVAL;
5292 	} else {
5293 		n_channels = 0;
5294 
5295 		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5296 			if (wiphy->bands[band])
5297 				n_channels += wiphy->bands[band]->n_channels;
5298 	}
5299 
5300 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5301 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5302 				    tmp)
5303 			n_ssids++;
5304 
5305 	if (n_ssids > wiphy->max_sched_scan_ssids)
5306 		return -EINVAL;
5307 
5308 	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5309 		nla_for_each_nested(attr,
5310 				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5311 				    tmp)
5312 			n_match_sets++;
5313 
5314 	if (n_match_sets > wiphy->max_match_sets)
5315 		return -EINVAL;
5316 
5317 	if (info->attrs[NL80211_ATTR_IE])
5318 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5319 	else
5320 		ie_len = 0;
5321 
5322 	if (ie_len > wiphy->max_sched_scan_ie_len)
5323 		return -EINVAL;
5324 
5325 	mutex_lock(&rdev->sched_scan_mtx);
5326 
5327 	if (rdev->sched_scan_req) {
5328 		err = -EINPROGRESS;
5329 		goto out;
5330 	}
5331 
5332 	request = kzalloc(sizeof(*request)
5333 			+ sizeof(*request->ssids) * n_ssids
5334 			+ sizeof(*request->match_sets) * n_match_sets
5335 			+ sizeof(*request->channels) * n_channels
5336 			+ ie_len, GFP_KERNEL);
5337 	if (!request) {
5338 		err = -ENOMEM;
5339 		goto out;
5340 	}
5341 
5342 	if (n_ssids)
5343 		request->ssids = (void *)&request->channels[n_channels];
5344 	request->n_ssids = n_ssids;
5345 	if (ie_len) {
5346 		if (request->ssids)
5347 			request->ie = (void *)(request->ssids + n_ssids);
5348 		else
5349 			request->ie = (void *)(request->channels + n_channels);
5350 	}
5351 
5352 	if (n_match_sets) {
5353 		if (request->ie)
5354 			request->match_sets = (void *)(request->ie + ie_len);
5355 		else if (request->ssids)
5356 			request->match_sets =
5357 				(void *)(request->ssids + n_ssids);
5358 		else
5359 			request->match_sets =
5360 				(void *)(request->channels + n_channels);
5361 	}
5362 	request->n_match_sets = n_match_sets;
5363 
5364 	i = 0;
5365 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5366 		/* user specified, bail out if channel not found */
5367 		nla_for_each_nested(attr,
5368 				    info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5369 				    tmp) {
5370 			struct ieee80211_channel *chan;
5371 
5372 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5373 
5374 			if (!chan) {
5375 				err = -EINVAL;
5376 				goto out_free;
5377 			}
5378 
5379 			/* ignore disabled channels */
5380 			if (chan->flags & IEEE80211_CHAN_DISABLED)
5381 				continue;
5382 
5383 			request->channels[i] = chan;
5384 			i++;
5385 		}
5386 	} else {
5387 		/* all channels */
5388 		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5389 			int j;
5390 			if (!wiphy->bands[band])
5391 				continue;
5392 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5393 				struct ieee80211_channel *chan;
5394 
5395 				chan = &wiphy->bands[band]->channels[j];
5396 
5397 				if (chan->flags & IEEE80211_CHAN_DISABLED)
5398 					continue;
5399 
5400 				request->channels[i] = chan;
5401 				i++;
5402 			}
5403 		}
5404 	}
5405 
5406 	if (!i) {
5407 		err = -EINVAL;
5408 		goto out_free;
5409 	}
5410 
5411 	request->n_channels = i;
5412 
5413 	i = 0;
5414 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5415 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5416 				    tmp) {
5417 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5418 				err = -EINVAL;
5419 				goto out_free;
5420 			}
5421 			request->ssids[i].ssid_len = nla_len(attr);
5422 			memcpy(request->ssids[i].ssid, nla_data(attr),
5423 			       nla_len(attr));
5424 			i++;
5425 		}
5426 	}
5427 
5428 	i = 0;
5429 	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5430 		nla_for_each_nested(attr,
5431 				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5432 				    tmp) {
5433 			struct nlattr *ssid, *rssi;
5434 
5435 			nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5436 				  nla_data(attr), nla_len(attr),
5437 				  nl80211_match_policy);
5438 			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5439 			if (ssid) {
5440 				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5441 					err = -EINVAL;
5442 					goto out_free;
5443 				}
5444 				memcpy(request->match_sets[i].ssid.ssid,
5445 				       nla_data(ssid), nla_len(ssid));
5446 				request->match_sets[i].ssid.ssid_len =
5447 					nla_len(ssid);
5448 			}
5449 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5450 			if (rssi)
5451 				request->rssi_thold = nla_get_u32(rssi);
5452 			else
5453 				request->rssi_thold =
5454 						   NL80211_SCAN_RSSI_THOLD_OFF;
5455 			i++;
5456 		}
5457 	}
5458 
5459 	if (info->attrs[NL80211_ATTR_IE]) {
5460 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5461 		memcpy((void *)request->ie,
5462 		       nla_data(info->attrs[NL80211_ATTR_IE]),
5463 		       request->ie_len);
5464 	}
5465 
5466 	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5467 		request->flags = nla_get_u32(
5468 			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5469 		if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5470 		     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5471 		    ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5472 		     !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5473 			err = -EOPNOTSUPP;
5474 			goto out_free;
5475 		}
5476 	}
5477 
5478 	request->dev = dev;
5479 	request->wiphy = &rdev->wiphy;
5480 	request->interval = interval;
5481 	request->scan_start = jiffies;
5482 
5483 	err = rdev_sched_scan_start(rdev, dev, request);
5484 	if (!err) {
5485 		rdev->sched_scan_req = request;
5486 		nl80211_send_sched_scan(rdev, dev,
5487 					NL80211_CMD_START_SCHED_SCAN);
5488 		goto out;
5489 	}
5490 
5491 out_free:
5492 	kfree(request);
5493 out:
5494 	mutex_unlock(&rdev->sched_scan_mtx);
5495 	return err;
5496 }
5497 
5498 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5499 				   struct genl_info *info)
5500 {
5501 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5502 	int err;
5503 
5504 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5505 	    !rdev->ops->sched_scan_stop)
5506 		return -EOPNOTSUPP;
5507 
5508 	mutex_lock(&rdev->sched_scan_mtx);
5509 	err = __cfg80211_stop_sched_scan(rdev, false);
5510 	mutex_unlock(&rdev->sched_scan_mtx);
5511 
5512 	return err;
5513 }
5514 
5515 static int nl80211_start_radar_detection(struct sk_buff *skb,
5516 					 struct genl_info *info)
5517 {
5518 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5519 	struct net_device *dev = info->user_ptr[1];
5520 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5521 	struct cfg80211_chan_def chandef;
5522 	int err;
5523 
5524 	err = nl80211_parse_chandef(rdev, info, &chandef);
5525 	if (err)
5526 		return err;
5527 
5528 	if (wdev->cac_started)
5529 		return -EBUSY;
5530 
5531 	err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5532 	if (err < 0)
5533 		return err;
5534 
5535 	if (err == 0)
5536 		return -EINVAL;
5537 
5538 	if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5539 		return -EINVAL;
5540 
5541 	if (!rdev->ops->start_radar_detection)
5542 		return -EOPNOTSUPP;
5543 
5544 	mutex_lock(&rdev->devlist_mtx);
5545 	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5546 					   chandef.chan, CHAN_MODE_SHARED,
5547 					   BIT(chandef.width));
5548 	if (err)
5549 		goto err_locked;
5550 
5551 	err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5552 	if (!err) {
5553 		wdev->channel = chandef.chan;
5554 		wdev->cac_started = true;
5555 		wdev->cac_start_time = jiffies;
5556 	}
5557 err_locked:
5558 	mutex_unlock(&rdev->devlist_mtx);
5559 
5560 	return err;
5561 }
5562 
5563 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5564 			    u32 seq, int flags,
5565 			    struct cfg80211_registered_device *rdev,
5566 			    struct wireless_dev *wdev,
5567 			    struct cfg80211_internal_bss *intbss)
5568 {
5569 	struct cfg80211_bss *res = &intbss->pub;
5570 	const struct cfg80211_bss_ies *ies;
5571 	void *hdr;
5572 	struct nlattr *bss;
5573 	bool tsf = false;
5574 
5575 	ASSERT_WDEV_LOCK(wdev);
5576 
5577 	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5578 			     NL80211_CMD_NEW_SCAN_RESULTS);
5579 	if (!hdr)
5580 		return -1;
5581 
5582 	genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5583 
5584 	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5585 		goto nla_put_failure;
5586 	if (wdev->netdev &&
5587 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5588 		goto nla_put_failure;
5589 	if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5590 		goto nla_put_failure;
5591 
5592 	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5593 	if (!bss)
5594 		goto nla_put_failure;
5595 	if ((!is_zero_ether_addr(res->bssid) &&
5596 	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5597 		goto nla_put_failure;
5598 
5599 	rcu_read_lock();
5600 	ies = rcu_dereference(res->ies);
5601 	if (ies) {
5602 		if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5603 			goto fail_unlock_rcu;
5604 		tsf = true;
5605 		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5606 					ies->len, ies->data))
5607 			goto fail_unlock_rcu;
5608 	}
5609 	ies = rcu_dereference(res->beacon_ies);
5610 	if (ies) {
5611 		if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5612 			goto fail_unlock_rcu;
5613 		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5614 					ies->len, ies->data))
5615 			goto fail_unlock_rcu;
5616 	}
5617 	rcu_read_unlock();
5618 
5619 	if (res->beacon_interval &&
5620 	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5621 		goto nla_put_failure;
5622 	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5623 	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5624 	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5625 			jiffies_to_msecs(jiffies - intbss->ts)))
5626 		goto nla_put_failure;
5627 
5628 	switch (rdev->wiphy.signal_type) {
5629 	case CFG80211_SIGNAL_TYPE_MBM:
5630 		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5631 			goto nla_put_failure;
5632 		break;
5633 	case CFG80211_SIGNAL_TYPE_UNSPEC:
5634 		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5635 			goto nla_put_failure;
5636 		break;
5637 	default:
5638 		break;
5639 	}
5640 
5641 	switch (wdev->iftype) {
5642 	case NL80211_IFTYPE_P2P_CLIENT:
5643 	case NL80211_IFTYPE_STATION:
5644 		if (intbss == wdev->current_bss &&
5645 		    nla_put_u32(msg, NL80211_BSS_STATUS,
5646 				NL80211_BSS_STATUS_ASSOCIATED))
5647 			goto nla_put_failure;
5648 		break;
5649 	case NL80211_IFTYPE_ADHOC:
5650 		if (intbss == wdev->current_bss &&
5651 		    nla_put_u32(msg, NL80211_BSS_STATUS,
5652 				NL80211_BSS_STATUS_IBSS_JOINED))
5653 			goto nla_put_failure;
5654 		break;
5655 	default:
5656 		break;
5657 	}
5658 
5659 	nla_nest_end(msg, bss);
5660 
5661 	return genlmsg_end(msg, hdr);
5662 
5663  fail_unlock_rcu:
5664 	rcu_read_unlock();
5665  nla_put_failure:
5666 	genlmsg_cancel(msg, hdr);
5667 	return -EMSGSIZE;
5668 }
5669 
5670 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5671 {
5672 	struct cfg80211_registered_device *rdev;
5673 	struct cfg80211_internal_bss *scan;
5674 	struct wireless_dev *wdev;
5675 	int start = cb->args[2], idx = 0;
5676 	int err;
5677 
5678 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5679 	if (err)
5680 		return err;
5681 
5682 	wdev_lock(wdev);
5683 	spin_lock_bh(&rdev->bss_lock);
5684 	cfg80211_bss_expire(rdev);
5685 
5686 	cb->seq = rdev->bss_generation;
5687 
5688 	list_for_each_entry(scan, &rdev->bss_list, list) {
5689 		if (++idx <= start)
5690 			continue;
5691 		if (nl80211_send_bss(skb, cb,
5692 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
5693 				rdev, wdev, scan) < 0) {
5694 			idx--;
5695 			break;
5696 		}
5697 	}
5698 
5699 	spin_unlock_bh(&rdev->bss_lock);
5700 	wdev_unlock(wdev);
5701 
5702 	cb->args[2] = idx;
5703 	nl80211_finish_wdev_dump(rdev);
5704 
5705 	return skb->len;
5706 }
5707 
5708 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5709 				int flags, struct net_device *dev,
5710 				struct survey_info *survey)
5711 {
5712 	void *hdr;
5713 	struct nlattr *infoattr;
5714 
5715 	hdr = nl80211hdr_put(msg, portid, seq, flags,
5716 			     NL80211_CMD_NEW_SURVEY_RESULTS);
5717 	if (!hdr)
5718 		return -ENOMEM;
5719 
5720 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5721 		goto nla_put_failure;
5722 
5723 	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5724 	if (!infoattr)
5725 		goto nla_put_failure;
5726 
5727 	if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5728 			survey->channel->center_freq))
5729 		goto nla_put_failure;
5730 
5731 	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5732 	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5733 		goto nla_put_failure;
5734 	if ((survey->filled & SURVEY_INFO_IN_USE) &&
5735 	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5736 		goto nla_put_failure;
5737 	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5738 	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5739 			survey->channel_time))
5740 		goto nla_put_failure;
5741 	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5742 	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5743 			survey->channel_time_busy))
5744 		goto nla_put_failure;
5745 	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5746 	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5747 			survey->channel_time_ext_busy))
5748 		goto nla_put_failure;
5749 	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5750 	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5751 			survey->channel_time_rx))
5752 		goto nla_put_failure;
5753 	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5754 	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5755 			survey->channel_time_tx))
5756 		goto nla_put_failure;
5757 
5758 	nla_nest_end(msg, infoattr);
5759 
5760 	return genlmsg_end(msg, hdr);
5761 
5762  nla_put_failure:
5763 	genlmsg_cancel(msg, hdr);
5764 	return -EMSGSIZE;
5765 }
5766 
5767 static int nl80211_dump_survey(struct sk_buff *skb,
5768 			struct netlink_callback *cb)
5769 {
5770 	struct survey_info survey;
5771 	struct cfg80211_registered_device *dev;
5772 	struct wireless_dev *wdev;
5773 	int survey_idx = cb->args[2];
5774 	int res;
5775 
5776 	res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5777 	if (res)
5778 		return res;
5779 
5780 	if (!wdev->netdev) {
5781 		res = -EINVAL;
5782 		goto out_err;
5783 	}
5784 
5785 	if (!dev->ops->dump_survey) {
5786 		res = -EOPNOTSUPP;
5787 		goto out_err;
5788 	}
5789 
5790 	while (1) {
5791 		struct ieee80211_channel *chan;
5792 
5793 		res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5794 		if (res == -ENOENT)
5795 			break;
5796 		if (res)
5797 			goto out_err;
5798 
5799 		/* Survey without a channel doesn't make sense */
5800 		if (!survey.channel) {
5801 			res = -EINVAL;
5802 			goto out;
5803 		}
5804 
5805 		chan = ieee80211_get_channel(&dev->wiphy,
5806 					     survey.channel->center_freq);
5807 		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5808 			survey_idx++;
5809 			continue;
5810 		}
5811 
5812 		if (nl80211_send_survey(skb,
5813 				NETLINK_CB(cb->skb).portid,
5814 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
5815 				wdev->netdev, &survey) < 0)
5816 			goto out;
5817 		survey_idx++;
5818 	}
5819 
5820  out:
5821 	cb->args[2] = survey_idx;
5822 	res = skb->len;
5823  out_err:
5824 	nl80211_finish_wdev_dump(dev);
5825 	return res;
5826 }
5827 
5828 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5829 {
5830 	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5831 				  NL80211_WPA_VERSION_2));
5832 }
5833 
5834 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5835 {
5836 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5837 	struct net_device *dev = info->user_ptr[1];
5838 	struct ieee80211_channel *chan;
5839 	const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5840 	int err, ssid_len, ie_len = 0, sae_data_len = 0;
5841 	enum nl80211_auth_type auth_type;
5842 	struct key_parse key;
5843 	bool local_state_change;
5844 
5845 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5846 		return -EINVAL;
5847 
5848 	if (!info->attrs[NL80211_ATTR_MAC])
5849 		return -EINVAL;
5850 
5851 	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5852 		return -EINVAL;
5853 
5854 	if (!info->attrs[NL80211_ATTR_SSID])
5855 		return -EINVAL;
5856 
5857 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5858 		return -EINVAL;
5859 
5860 	err = nl80211_parse_key(info, &key);
5861 	if (err)
5862 		return err;
5863 
5864 	if (key.idx >= 0) {
5865 		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5866 			return -EINVAL;
5867 		if (!key.p.key || !key.p.key_len)
5868 			return -EINVAL;
5869 		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5870 		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5871 		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5872 		     key.p.key_len != WLAN_KEY_LEN_WEP104))
5873 			return -EINVAL;
5874 		if (key.idx > 4)
5875 			return -EINVAL;
5876 	} else {
5877 		key.p.key_len = 0;
5878 		key.p.key = NULL;
5879 	}
5880 
5881 	if (key.idx >= 0) {
5882 		int i;
5883 		bool ok = false;
5884 		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5885 			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5886 				ok = true;
5887 				break;
5888 			}
5889 		}
5890 		if (!ok)
5891 			return -EINVAL;
5892 	}
5893 
5894 	if (!rdev->ops->auth)
5895 		return -EOPNOTSUPP;
5896 
5897 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5898 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5899 		return -EOPNOTSUPP;
5900 
5901 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5902 	chan = ieee80211_get_channel(&rdev->wiphy,
5903 		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5904 	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5905 		return -EINVAL;
5906 
5907 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5908 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5909 
5910 	if (info->attrs[NL80211_ATTR_IE]) {
5911 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5912 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5913 	}
5914 
5915 	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5916 	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5917 		return -EINVAL;
5918 
5919 	if (auth_type == NL80211_AUTHTYPE_SAE &&
5920 	    !info->attrs[NL80211_ATTR_SAE_DATA])
5921 		return -EINVAL;
5922 
5923 	if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5924 		if (auth_type != NL80211_AUTHTYPE_SAE)
5925 			return -EINVAL;
5926 		sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5927 		sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5928 		/* need to include at least Auth Transaction and Status Code */
5929 		if (sae_data_len < 4)
5930 			return -EINVAL;
5931 	}
5932 
5933 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5934 
5935 	/*
5936 	 * Since we no longer track auth state, ignore
5937 	 * requests to only change local state.
5938 	 */
5939 	if (local_state_change)
5940 		return 0;
5941 
5942 	return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5943 				  ssid, ssid_len, ie, ie_len,
5944 				  key.p.key, key.p.key_len, key.idx,
5945 				  sae_data, sae_data_len);
5946 }
5947 
5948 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5949 				   struct genl_info *info,
5950 				   struct cfg80211_crypto_settings *settings,
5951 				   int cipher_limit)
5952 {
5953 	memset(settings, 0, sizeof(*settings));
5954 
5955 	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5956 
5957 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5958 		u16 proto;
5959 		proto = nla_get_u16(
5960 			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5961 		settings->control_port_ethertype = cpu_to_be16(proto);
5962 		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5963 		    proto != ETH_P_PAE)
5964 			return -EINVAL;
5965 		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5966 			settings->control_port_no_encrypt = true;
5967 	} else
5968 		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5969 
5970 	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5971 		void *data;
5972 		int len, i;
5973 
5974 		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5975 		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5976 		settings->n_ciphers_pairwise = len / sizeof(u32);
5977 
5978 		if (len % sizeof(u32))
5979 			return -EINVAL;
5980 
5981 		if (settings->n_ciphers_pairwise > cipher_limit)
5982 			return -EINVAL;
5983 
5984 		memcpy(settings->ciphers_pairwise, data, len);
5985 
5986 		for (i = 0; i < settings->n_ciphers_pairwise; i++)
5987 			if (!cfg80211_supported_cipher_suite(
5988 					&rdev->wiphy,
5989 					settings->ciphers_pairwise[i]))
5990 				return -EINVAL;
5991 	}
5992 
5993 	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5994 		settings->cipher_group =
5995 			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5996 		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5997 						     settings->cipher_group))
5998 			return -EINVAL;
5999 	}
6000 
6001 	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6002 		settings->wpa_versions =
6003 			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6004 		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6005 			return -EINVAL;
6006 	}
6007 
6008 	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6009 		void *data;
6010 		int len;
6011 
6012 		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6013 		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6014 		settings->n_akm_suites = len / sizeof(u32);
6015 
6016 		if (len % sizeof(u32))
6017 			return -EINVAL;
6018 
6019 		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6020 			return -EINVAL;
6021 
6022 		memcpy(settings->akm_suites, data, len);
6023 	}
6024 
6025 	return 0;
6026 }
6027 
6028 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6029 {
6030 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6031 	struct net_device *dev = info->user_ptr[1];
6032 	struct ieee80211_channel *chan;
6033 	struct cfg80211_assoc_request req = {};
6034 	const u8 *bssid, *ssid;
6035 	int err, ssid_len = 0;
6036 
6037 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6038 		return -EINVAL;
6039 
6040 	if (!info->attrs[NL80211_ATTR_MAC] ||
6041 	    !info->attrs[NL80211_ATTR_SSID] ||
6042 	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6043 		return -EINVAL;
6044 
6045 	if (!rdev->ops->assoc)
6046 		return -EOPNOTSUPP;
6047 
6048 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6049 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6050 		return -EOPNOTSUPP;
6051 
6052 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6053 
6054 	chan = ieee80211_get_channel(&rdev->wiphy,
6055 		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6056 	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6057 		return -EINVAL;
6058 
6059 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6060 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6061 
6062 	if (info->attrs[NL80211_ATTR_IE]) {
6063 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6064 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6065 	}
6066 
6067 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
6068 		enum nl80211_mfp mfp =
6069 			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6070 		if (mfp == NL80211_MFP_REQUIRED)
6071 			req.use_mfp = true;
6072 		else if (mfp != NL80211_MFP_NO)
6073 			return -EINVAL;
6074 	}
6075 
6076 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
6077 		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6078 
6079 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6080 		req.flags |= ASSOC_REQ_DISABLE_HT;
6081 
6082 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6083 		memcpy(&req.ht_capa_mask,
6084 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6085 		       sizeof(req.ht_capa_mask));
6086 
6087 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6088 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6089 			return -EINVAL;
6090 		memcpy(&req.ht_capa,
6091 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6092 		       sizeof(req.ht_capa));
6093 	}
6094 
6095 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6096 		req.flags |= ASSOC_REQ_DISABLE_VHT;
6097 
6098 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6099 		memcpy(&req.vht_capa_mask,
6100 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6101 		       sizeof(req.vht_capa_mask));
6102 
6103 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6104 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6105 			return -EINVAL;
6106 		memcpy(&req.vht_capa,
6107 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6108 		       sizeof(req.vht_capa));
6109 	}
6110 
6111 	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6112 	if (!err)
6113 		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6114 					  ssid, ssid_len, &req);
6115 
6116 	return err;
6117 }
6118 
6119 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6120 {
6121 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6122 	struct net_device *dev = info->user_ptr[1];
6123 	const u8 *ie = NULL, *bssid;
6124 	int ie_len = 0;
6125 	u16 reason_code;
6126 	bool local_state_change;
6127 
6128 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6129 		return -EINVAL;
6130 
6131 	if (!info->attrs[NL80211_ATTR_MAC])
6132 		return -EINVAL;
6133 
6134 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
6135 		return -EINVAL;
6136 
6137 	if (!rdev->ops->deauth)
6138 		return -EOPNOTSUPP;
6139 
6140 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6141 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6142 		return -EOPNOTSUPP;
6143 
6144 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6145 
6146 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6147 	if (reason_code == 0) {
6148 		/* Reason Code 0 is reserved */
6149 		return -EINVAL;
6150 	}
6151 
6152 	if (info->attrs[NL80211_ATTR_IE]) {
6153 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6154 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6155 	}
6156 
6157 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6158 
6159 	return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6160 				    local_state_change);
6161 }
6162 
6163 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6164 {
6165 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6166 	struct net_device *dev = info->user_ptr[1];
6167 	const u8 *ie = NULL, *bssid;
6168 	int ie_len = 0;
6169 	u16 reason_code;
6170 	bool local_state_change;
6171 
6172 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6173 		return -EINVAL;
6174 
6175 	if (!info->attrs[NL80211_ATTR_MAC])
6176 		return -EINVAL;
6177 
6178 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
6179 		return -EINVAL;
6180 
6181 	if (!rdev->ops->disassoc)
6182 		return -EOPNOTSUPP;
6183 
6184 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6185 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6186 		return -EOPNOTSUPP;
6187 
6188 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6189 
6190 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6191 	if (reason_code == 0) {
6192 		/* Reason Code 0 is reserved */
6193 		return -EINVAL;
6194 	}
6195 
6196 	if (info->attrs[NL80211_ATTR_IE]) {
6197 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6198 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6199 	}
6200 
6201 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6202 
6203 	return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6204 				      local_state_change);
6205 }
6206 
6207 static bool
6208 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6209 			 int mcast_rate[IEEE80211_NUM_BANDS],
6210 			 int rateval)
6211 {
6212 	struct wiphy *wiphy = &rdev->wiphy;
6213 	bool found = false;
6214 	int band, i;
6215 
6216 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6217 		struct ieee80211_supported_band *sband;
6218 
6219 		sband = wiphy->bands[band];
6220 		if (!sband)
6221 			continue;
6222 
6223 		for (i = 0; i < sband->n_bitrates; i++) {
6224 			if (sband->bitrates[i].bitrate == rateval) {
6225 				mcast_rate[band] = i + 1;
6226 				found = true;
6227 				break;
6228 			}
6229 		}
6230 	}
6231 
6232 	return found;
6233 }
6234 
6235 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6236 {
6237 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6238 	struct net_device *dev = info->user_ptr[1];
6239 	struct cfg80211_ibss_params ibss;
6240 	struct wiphy *wiphy;
6241 	struct cfg80211_cached_keys *connkeys = NULL;
6242 	int err;
6243 
6244 	memset(&ibss, 0, sizeof(ibss));
6245 
6246 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6247 		return -EINVAL;
6248 
6249 	if (!info->attrs[NL80211_ATTR_SSID] ||
6250 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
6251 		return -EINVAL;
6252 
6253 	ibss.beacon_interval = 100;
6254 
6255 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6256 		ibss.beacon_interval =
6257 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6258 		if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6259 			return -EINVAL;
6260 	}
6261 
6262 	if (!rdev->ops->join_ibss)
6263 		return -EOPNOTSUPP;
6264 
6265 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6266 		return -EOPNOTSUPP;
6267 
6268 	wiphy = &rdev->wiphy;
6269 
6270 	if (info->attrs[NL80211_ATTR_MAC]) {
6271 		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6272 
6273 		if (!is_valid_ether_addr(ibss.bssid))
6274 			return -EINVAL;
6275 	}
6276 	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6277 	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6278 
6279 	if (info->attrs[NL80211_ATTR_IE]) {
6280 		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6281 		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6282 	}
6283 
6284 	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6285 	if (err)
6286 		return err;
6287 
6288 	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6289 		return -EINVAL;
6290 
6291 	if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6292 		return -EINVAL;
6293 	if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6294 	    !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6295 		return -EINVAL;
6296 
6297 	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6298 	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6299 
6300 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6301 		u8 *rates =
6302 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6303 		int n_rates =
6304 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6305 		struct ieee80211_supported_band *sband =
6306 			wiphy->bands[ibss.chandef.chan->band];
6307 
6308 		err = ieee80211_get_ratemask(sband, rates, n_rates,
6309 					     &ibss.basic_rates);
6310 		if (err)
6311 			return err;
6312 	}
6313 
6314 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6315 	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6316 			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6317 		return -EINVAL;
6318 
6319 	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6320 		bool no_ht = false;
6321 
6322 		connkeys = nl80211_parse_connkeys(rdev,
6323 					  info->attrs[NL80211_ATTR_KEYS],
6324 					  &no_ht);
6325 		if (IS_ERR(connkeys))
6326 			return PTR_ERR(connkeys);
6327 
6328 		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6329 		    no_ht) {
6330 			kfree(connkeys);
6331 			return -EINVAL;
6332 		}
6333 	}
6334 
6335 	ibss.control_port =
6336 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6337 
6338 	err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6339 	if (err)
6340 		kfree(connkeys);
6341 	return err;
6342 }
6343 
6344 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6345 {
6346 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6347 	struct net_device *dev = info->user_ptr[1];
6348 
6349 	if (!rdev->ops->leave_ibss)
6350 		return -EOPNOTSUPP;
6351 
6352 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6353 		return -EOPNOTSUPP;
6354 
6355 	return cfg80211_leave_ibss(rdev, dev, false);
6356 }
6357 
6358 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6359 {
6360 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6361 	struct net_device *dev = info->user_ptr[1];
6362 	int mcast_rate[IEEE80211_NUM_BANDS];
6363 	u32 nla_rate;
6364 	int err;
6365 
6366 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6367 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6368 		return -EOPNOTSUPP;
6369 
6370 	if (!rdev->ops->set_mcast_rate)
6371 		return -EOPNOTSUPP;
6372 
6373 	memset(mcast_rate, 0, sizeof(mcast_rate));
6374 
6375 	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6376 		return -EINVAL;
6377 
6378 	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6379 	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6380 		return -EINVAL;
6381 
6382 	err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6383 
6384 	return err;
6385 }
6386 
6387 
6388 #ifdef CONFIG_NL80211_TESTMODE
6389 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6390 	.name = "testmode",
6391 };
6392 
6393 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6394 {
6395 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6396 	int err;
6397 
6398 	if (!info->attrs[NL80211_ATTR_TESTDATA])
6399 		return -EINVAL;
6400 
6401 	err = -EOPNOTSUPP;
6402 	if (rdev->ops->testmode_cmd) {
6403 		rdev->testmode_info = info;
6404 		err = rdev_testmode_cmd(rdev,
6405 				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6406 				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6407 		rdev->testmode_info = NULL;
6408 	}
6409 
6410 	return err;
6411 }
6412 
6413 static int nl80211_testmode_dump(struct sk_buff *skb,
6414 				 struct netlink_callback *cb)
6415 {
6416 	struct cfg80211_registered_device *rdev;
6417 	int err;
6418 	long phy_idx;
6419 	void *data = NULL;
6420 	int data_len = 0;
6421 
6422 	if (cb->args[0]) {
6423 		/*
6424 		 * 0 is a valid index, but not valid for args[0],
6425 		 * so we need to offset by 1.
6426 		 */
6427 		phy_idx = cb->args[0] - 1;
6428 	} else {
6429 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6430 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
6431 				  nl80211_policy);
6432 		if (err)
6433 			return err;
6434 
6435 		mutex_lock(&cfg80211_mutex);
6436 		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6437 						  nl80211_fam.attrbuf);
6438 		if (IS_ERR(rdev)) {
6439 			mutex_unlock(&cfg80211_mutex);
6440 			return PTR_ERR(rdev);
6441 		}
6442 		phy_idx = rdev->wiphy_idx;
6443 		rdev = NULL;
6444 		mutex_unlock(&cfg80211_mutex);
6445 
6446 		if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6447 			cb->args[1] =
6448 				(long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6449 	}
6450 
6451 	if (cb->args[1]) {
6452 		data = nla_data((void *)cb->args[1]);
6453 		data_len = nla_len((void *)cb->args[1]);
6454 	}
6455 
6456 	mutex_lock(&cfg80211_mutex);
6457 	rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6458 	if (!rdev) {
6459 		mutex_unlock(&cfg80211_mutex);
6460 		return -ENOENT;
6461 	}
6462 	cfg80211_lock_rdev(rdev);
6463 	mutex_unlock(&cfg80211_mutex);
6464 
6465 	if (!rdev->ops->testmode_dump) {
6466 		err = -EOPNOTSUPP;
6467 		goto out_err;
6468 	}
6469 
6470 	while (1) {
6471 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6472 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
6473 					   NL80211_CMD_TESTMODE);
6474 		struct nlattr *tmdata;
6475 
6476 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6477 			genlmsg_cancel(skb, hdr);
6478 			break;
6479 		}
6480 
6481 		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6482 		if (!tmdata) {
6483 			genlmsg_cancel(skb, hdr);
6484 			break;
6485 		}
6486 		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6487 		nla_nest_end(skb, tmdata);
6488 
6489 		if (err == -ENOBUFS || err == -ENOENT) {
6490 			genlmsg_cancel(skb, hdr);
6491 			break;
6492 		} else if (err) {
6493 			genlmsg_cancel(skb, hdr);
6494 			goto out_err;
6495 		}
6496 
6497 		genlmsg_end(skb, hdr);
6498 	}
6499 
6500 	err = skb->len;
6501 	/* see above */
6502 	cb->args[0] = phy_idx + 1;
6503  out_err:
6504 	cfg80211_unlock_rdev(rdev);
6505 	return err;
6506 }
6507 
6508 static struct sk_buff *
6509 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6510 			      int approxlen, u32 portid, u32 seq, gfp_t gfp)
6511 {
6512 	struct sk_buff *skb;
6513 	void *hdr;
6514 	struct nlattr *data;
6515 
6516 	skb = nlmsg_new(approxlen + 100, gfp);
6517 	if (!skb)
6518 		return NULL;
6519 
6520 	hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6521 	if (!hdr) {
6522 		kfree_skb(skb);
6523 		return NULL;
6524 	}
6525 
6526 	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6527 		goto nla_put_failure;
6528 	data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6529 
6530 	((void **)skb->cb)[0] = rdev;
6531 	((void **)skb->cb)[1] = hdr;
6532 	((void **)skb->cb)[2] = data;
6533 
6534 	return skb;
6535 
6536  nla_put_failure:
6537 	kfree_skb(skb);
6538 	return NULL;
6539 }
6540 
6541 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6542 						  int approxlen)
6543 {
6544 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6545 
6546 	if (WARN_ON(!rdev->testmode_info))
6547 		return NULL;
6548 
6549 	return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6550 				rdev->testmode_info->snd_portid,
6551 				rdev->testmode_info->snd_seq,
6552 				GFP_KERNEL);
6553 }
6554 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6555 
6556 int cfg80211_testmode_reply(struct sk_buff *skb)
6557 {
6558 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6559 	void *hdr = ((void **)skb->cb)[1];
6560 	struct nlattr *data = ((void **)skb->cb)[2];
6561 
6562 	if (WARN_ON(!rdev->testmode_info)) {
6563 		kfree_skb(skb);
6564 		return -EINVAL;
6565 	}
6566 
6567 	nla_nest_end(skb, data);
6568 	genlmsg_end(skb, hdr);
6569 	return genlmsg_reply(skb, rdev->testmode_info);
6570 }
6571 EXPORT_SYMBOL(cfg80211_testmode_reply);
6572 
6573 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6574 						  int approxlen, gfp_t gfp)
6575 {
6576 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6577 
6578 	return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6579 }
6580 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6581 
6582 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6583 {
6584 	void *hdr = ((void **)skb->cb)[1];
6585 	struct nlattr *data = ((void **)skb->cb)[2];
6586 
6587 	nla_nest_end(skb, data);
6588 	genlmsg_end(skb, hdr);
6589 	genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6590 }
6591 EXPORT_SYMBOL(cfg80211_testmode_event);
6592 #endif
6593 
6594 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6595 {
6596 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6597 	struct net_device *dev = info->user_ptr[1];
6598 	struct cfg80211_connect_params connect;
6599 	struct wiphy *wiphy;
6600 	struct cfg80211_cached_keys *connkeys = NULL;
6601 	int err;
6602 
6603 	memset(&connect, 0, sizeof(connect));
6604 
6605 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6606 		return -EINVAL;
6607 
6608 	if (!info->attrs[NL80211_ATTR_SSID] ||
6609 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
6610 		return -EINVAL;
6611 
6612 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6613 		connect.auth_type =
6614 			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6615 		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6616 					     NL80211_CMD_CONNECT))
6617 			return -EINVAL;
6618 	} else
6619 		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6620 
6621 	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6622 
6623 	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6624 				      NL80211_MAX_NR_CIPHER_SUITES);
6625 	if (err)
6626 		return err;
6627 
6628 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6629 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6630 		return -EOPNOTSUPP;
6631 
6632 	wiphy = &rdev->wiphy;
6633 
6634 	connect.bg_scan_period = -1;
6635 	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6636 		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6637 		connect.bg_scan_period =
6638 			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6639 	}
6640 
6641 	if (info->attrs[NL80211_ATTR_MAC])
6642 		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6643 	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6644 	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6645 
6646 	if (info->attrs[NL80211_ATTR_IE]) {
6647 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6648 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6649 	}
6650 
6651 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
6652 		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6653 		if (connect.mfp != NL80211_MFP_REQUIRED &&
6654 		    connect.mfp != NL80211_MFP_NO)
6655 			return -EINVAL;
6656 	} else {
6657 		connect.mfp = NL80211_MFP_NO;
6658 	}
6659 
6660 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6661 		connect.channel =
6662 			ieee80211_get_channel(wiphy,
6663 			    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6664 		if (!connect.channel ||
6665 		    connect.channel->flags & IEEE80211_CHAN_DISABLED)
6666 			return -EINVAL;
6667 	}
6668 
6669 	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6670 		connkeys = nl80211_parse_connkeys(rdev,
6671 					  info->attrs[NL80211_ATTR_KEYS], NULL);
6672 		if (IS_ERR(connkeys))
6673 			return PTR_ERR(connkeys);
6674 	}
6675 
6676 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6677 		connect.flags |= ASSOC_REQ_DISABLE_HT;
6678 
6679 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6680 		memcpy(&connect.ht_capa_mask,
6681 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6682 		       sizeof(connect.ht_capa_mask));
6683 
6684 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6685 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6686 			kfree(connkeys);
6687 			return -EINVAL;
6688 		}
6689 		memcpy(&connect.ht_capa,
6690 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6691 		       sizeof(connect.ht_capa));
6692 	}
6693 
6694 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6695 		connect.flags |= ASSOC_REQ_DISABLE_VHT;
6696 
6697 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6698 		memcpy(&connect.vht_capa_mask,
6699 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6700 		       sizeof(connect.vht_capa_mask));
6701 
6702 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6703 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6704 			kfree(connkeys);
6705 			return -EINVAL;
6706 		}
6707 		memcpy(&connect.vht_capa,
6708 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6709 		       sizeof(connect.vht_capa));
6710 	}
6711 
6712 	err = cfg80211_connect(rdev, dev, &connect, connkeys);
6713 	if (err)
6714 		kfree(connkeys);
6715 	return err;
6716 }
6717 
6718 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6719 {
6720 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6721 	struct net_device *dev = info->user_ptr[1];
6722 	u16 reason;
6723 
6724 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
6725 		reason = WLAN_REASON_DEAUTH_LEAVING;
6726 	else
6727 		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6728 
6729 	if (reason == 0)
6730 		return -EINVAL;
6731 
6732 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6733 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6734 		return -EOPNOTSUPP;
6735 
6736 	return cfg80211_disconnect(rdev, dev, reason, true);
6737 }
6738 
6739 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6740 {
6741 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6742 	struct net *net;
6743 	int err;
6744 	u32 pid;
6745 
6746 	if (!info->attrs[NL80211_ATTR_PID])
6747 		return -EINVAL;
6748 
6749 	pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6750 
6751 	net = get_net_ns_by_pid(pid);
6752 	if (IS_ERR(net))
6753 		return PTR_ERR(net);
6754 
6755 	err = 0;
6756 
6757 	/* check if anything to do */
6758 	if (!net_eq(wiphy_net(&rdev->wiphy), net))
6759 		err = cfg80211_switch_netns(rdev, net);
6760 
6761 	put_net(net);
6762 	return err;
6763 }
6764 
6765 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6766 {
6767 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6768 	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6769 			struct cfg80211_pmksa *pmksa) = NULL;
6770 	struct net_device *dev = info->user_ptr[1];
6771 	struct cfg80211_pmksa pmksa;
6772 
6773 	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6774 
6775 	if (!info->attrs[NL80211_ATTR_MAC])
6776 		return -EINVAL;
6777 
6778 	if (!info->attrs[NL80211_ATTR_PMKID])
6779 		return -EINVAL;
6780 
6781 	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6782 	pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6783 
6784 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6785 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6786 		return -EOPNOTSUPP;
6787 
6788 	switch (info->genlhdr->cmd) {
6789 	case NL80211_CMD_SET_PMKSA:
6790 		rdev_ops = rdev->ops->set_pmksa;
6791 		break;
6792 	case NL80211_CMD_DEL_PMKSA:
6793 		rdev_ops = rdev->ops->del_pmksa;
6794 		break;
6795 	default:
6796 		WARN_ON(1);
6797 		break;
6798 	}
6799 
6800 	if (!rdev_ops)
6801 		return -EOPNOTSUPP;
6802 
6803 	return rdev_ops(&rdev->wiphy, dev, &pmksa);
6804 }
6805 
6806 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6807 {
6808 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6809 	struct net_device *dev = info->user_ptr[1];
6810 
6811 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6812 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6813 		return -EOPNOTSUPP;
6814 
6815 	if (!rdev->ops->flush_pmksa)
6816 		return -EOPNOTSUPP;
6817 
6818 	return rdev_flush_pmksa(rdev, dev);
6819 }
6820 
6821 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6822 {
6823 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6824 	struct net_device *dev = info->user_ptr[1];
6825 	u8 action_code, dialog_token;
6826 	u16 status_code;
6827 	u8 *peer;
6828 
6829 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6830 	    !rdev->ops->tdls_mgmt)
6831 		return -EOPNOTSUPP;
6832 
6833 	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6834 	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6835 	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6836 	    !info->attrs[NL80211_ATTR_IE] ||
6837 	    !info->attrs[NL80211_ATTR_MAC])
6838 		return -EINVAL;
6839 
6840 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6841 	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6842 	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6843 	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6844 
6845 	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6846 			      dialog_token, status_code,
6847 			      nla_data(info->attrs[NL80211_ATTR_IE]),
6848 			      nla_len(info->attrs[NL80211_ATTR_IE]));
6849 }
6850 
6851 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6852 {
6853 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6854 	struct net_device *dev = info->user_ptr[1];
6855 	enum nl80211_tdls_operation operation;
6856 	u8 *peer;
6857 
6858 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6859 	    !rdev->ops->tdls_oper)
6860 		return -EOPNOTSUPP;
6861 
6862 	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6863 	    !info->attrs[NL80211_ATTR_MAC])
6864 		return -EINVAL;
6865 
6866 	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6867 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6868 
6869 	return rdev_tdls_oper(rdev, dev, peer, operation);
6870 }
6871 
6872 static int nl80211_remain_on_channel(struct sk_buff *skb,
6873 				     struct genl_info *info)
6874 {
6875 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6876 	struct wireless_dev *wdev = info->user_ptr[1];
6877 	struct cfg80211_chan_def chandef;
6878 	struct sk_buff *msg;
6879 	void *hdr;
6880 	u64 cookie;
6881 	u32 duration;
6882 	int err;
6883 
6884 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6885 	    !info->attrs[NL80211_ATTR_DURATION])
6886 		return -EINVAL;
6887 
6888 	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6889 
6890 	if (!rdev->ops->remain_on_channel ||
6891 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6892 		return -EOPNOTSUPP;
6893 
6894 	/*
6895 	 * We should be on that channel for at least a minimum amount of
6896 	 * time (10ms) but no longer than the driver supports.
6897 	 */
6898 	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6899 	    duration > rdev->wiphy.max_remain_on_channel_duration)
6900 		return -EINVAL;
6901 
6902 	err = nl80211_parse_chandef(rdev, info, &chandef);
6903 	if (err)
6904 		return err;
6905 
6906 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6907 	if (!msg)
6908 		return -ENOMEM;
6909 
6910 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6911 			     NL80211_CMD_REMAIN_ON_CHANNEL);
6912 
6913 	if (IS_ERR(hdr)) {
6914 		err = PTR_ERR(hdr);
6915 		goto free_msg;
6916 	}
6917 
6918 	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6919 				     duration, &cookie);
6920 
6921 	if (err)
6922 		goto free_msg;
6923 
6924 	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6925 		goto nla_put_failure;
6926 
6927 	genlmsg_end(msg, hdr);
6928 
6929 	return genlmsg_reply(msg, info);
6930 
6931  nla_put_failure:
6932 	err = -ENOBUFS;
6933  free_msg:
6934 	nlmsg_free(msg);
6935 	return err;
6936 }
6937 
6938 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6939 					    struct genl_info *info)
6940 {
6941 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6942 	struct wireless_dev *wdev = info->user_ptr[1];
6943 	u64 cookie;
6944 
6945 	if (!info->attrs[NL80211_ATTR_COOKIE])
6946 		return -EINVAL;
6947 
6948 	if (!rdev->ops->cancel_remain_on_channel)
6949 		return -EOPNOTSUPP;
6950 
6951 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6952 
6953 	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6954 }
6955 
6956 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6957 			   u8 *rates, u8 rates_len)
6958 {
6959 	u8 i;
6960 	u32 mask = 0;
6961 
6962 	for (i = 0; i < rates_len; i++) {
6963 		int rate = (rates[i] & 0x7f) * 5;
6964 		int ridx;
6965 		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6966 			struct ieee80211_rate *srate =
6967 				&sband->bitrates[ridx];
6968 			if (rate == srate->bitrate) {
6969 				mask |= 1 << ridx;
6970 				break;
6971 			}
6972 		}
6973 		if (ridx == sband->n_bitrates)
6974 			return 0; /* rate not found */
6975 	}
6976 
6977 	return mask;
6978 }
6979 
6980 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6981 			       u8 *rates, u8 rates_len,
6982 			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6983 {
6984 	u8 i;
6985 
6986 	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6987 
6988 	for (i = 0; i < rates_len; i++) {
6989 		int ridx, rbit;
6990 
6991 		ridx = rates[i] / 8;
6992 		rbit = BIT(rates[i] % 8);
6993 
6994 		/* check validity */
6995 		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6996 			return false;
6997 
6998 		/* check availability */
6999 		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7000 			mcs[ridx] |= rbit;
7001 		else
7002 			return false;
7003 	}
7004 
7005 	return true;
7006 }
7007 
7008 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7009 	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7010 				    .len = NL80211_MAX_SUPP_RATES },
7011 	[NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7012 				 .len = NL80211_MAX_SUPP_HT_RATES },
7013 };
7014 
7015 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7016 				       struct genl_info *info)
7017 {
7018 	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7019 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7020 	struct cfg80211_bitrate_mask mask;
7021 	int rem, i;
7022 	struct net_device *dev = info->user_ptr[1];
7023 	struct nlattr *tx_rates;
7024 	struct ieee80211_supported_band *sband;
7025 
7026 	if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7027 		return -EINVAL;
7028 
7029 	if (!rdev->ops->set_bitrate_mask)
7030 		return -EOPNOTSUPP;
7031 
7032 	memset(&mask, 0, sizeof(mask));
7033 	/* Default to all rates enabled */
7034 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7035 		sband = rdev->wiphy.bands[i];
7036 		mask.control[i].legacy =
7037 			sband ? (1 << sband->n_bitrates) - 1 : 0;
7038 		if (sband)
7039 			memcpy(mask.control[i].mcs,
7040 			       sband->ht_cap.mcs.rx_mask,
7041 			       sizeof(mask.control[i].mcs));
7042 		else
7043 			memset(mask.control[i].mcs, 0,
7044 			       sizeof(mask.control[i].mcs));
7045 	}
7046 
7047 	/*
7048 	 * The nested attribute uses enum nl80211_band as the index. This maps
7049 	 * directly to the enum ieee80211_band values used in cfg80211.
7050 	 */
7051 	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7052 	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7053 	{
7054 		enum ieee80211_band band = nla_type(tx_rates);
7055 		if (band < 0 || band >= IEEE80211_NUM_BANDS)
7056 			return -EINVAL;
7057 		sband = rdev->wiphy.bands[band];
7058 		if (sband == NULL)
7059 			return -EINVAL;
7060 		nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7061 			  nla_len(tx_rates), nl80211_txattr_policy);
7062 		if (tb[NL80211_TXRATE_LEGACY]) {
7063 			mask.control[band].legacy = rateset_to_mask(
7064 				sband,
7065 				nla_data(tb[NL80211_TXRATE_LEGACY]),
7066 				nla_len(tb[NL80211_TXRATE_LEGACY]));
7067 			if ((mask.control[band].legacy == 0) &&
7068 			    nla_len(tb[NL80211_TXRATE_LEGACY]))
7069 				return -EINVAL;
7070 		}
7071 		if (tb[NL80211_TXRATE_MCS]) {
7072 			if (!ht_rateset_to_mask(
7073 					sband,
7074 					nla_data(tb[NL80211_TXRATE_MCS]),
7075 					nla_len(tb[NL80211_TXRATE_MCS]),
7076 					mask.control[band].mcs))
7077 				return -EINVAL;
7078 		}
7079 
7080 		if (mask.control[band].legacy == 0) {
7081 			/* don't allow empty legacy rates if HT
7082 			 * is not even supported. */
7083 			if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7084 				return -EINVAL;
7085 
7086 			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7087 				if (mask.control[band].mcs[i])
7088 					break;
7089 
7090 			/* legacy and mcs rates may not be both empty */
7091 			if (i == IEEE80211_HT_MCS_MASK_LEN)
7092 				return -EINVAL;
7093 		}
7094 	}
7095 
7096 	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7097 }
7098 
7099 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7100 {
7101 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7102 	struct wireless_dev *wdev = info->user_ptr[1];
7103 	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7104 
7105 	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7106 		return -EINVAL;
7107 
7108 	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7109 		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7110 
7111 	switch (wdev->iftype) {
7112 	case NL80211_IFTYPE_STATION:
7113 	case NL80211_IFTYPE_ADHOC:
7114 	case NL80211_IFTYPE_P2P_CLIENT:
7115 	case NL80211_IFTYPE_AP:
7116 	case NL80211_IFTYPE_AP_VLAN:
7117 	case NL80211_IFTYPE_MESH_POINT:
7118 	case NL80211_IFTYPE_P2P_GO:
7119 	case NL80211_IFTYPE_P2P_DEVICE:
7120 		break;
7121 	default:
7122 		return -EOPNOTSUPP;
7123 	}
7124 
7125 	/* not much point in registering if we can't reply */
7126 	if (!rdev->ops->mgmt_tx)
7127 		return -EOPNOTSUPP;
7128 
7129 	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7130 			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7131 			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7132 }
7133 
7134 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7135 {
7136 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7137 	struct wireless_dev *wdev = info->user_ptr[1];
7138 	struct cfg80211_chan_def chandef;
7139 	int err;
7140 	void *hdr = NULL;
7141 	u64 cookie;
7142 	struct sk_buff *msg = NULL;
7143 	unsigned int wait = 0;
7144 	bool offchan, no_cck, dont_wait_for_ack;
7145 
7146 	dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7147 
7148 	if (!info->attrs[NL80211_ATTR_FRAME])
7149 		return -EINVAL;
7150 
7151 	if (!rdev->ops->mgmt_tx)
7152 		return -EOPNOTSUPP;
7153 
7154 	switch (wdev->iftype) {
7155 	case NL80211_IFTYPE_STATION:
7156 	case NL80211_IFTYPE_ADHOC:
7157 	case NL80211_IFTYPE_P2P_CLIENT:
7158 	case NL80211_IFTYPE_AP:
7159 	case NL80211_IFTYPE_AP_VLAN:
7160 	case NL80211_IFTYPE_MESH_POINT:
7161 	case NL80211_IFTYPE_P2P_GO:
7162 	case NL80211_IFTYPE_P2P_DEVICE:
7163 		break;
7164 	default:
7165 		return -EOPNOTSUPP;
7166 	}
7167 
7168 	if (info->attrs[NL80211_ATTR_DURATION]) {
7169 		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7170 			return -EINVAL;
7171 		wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7172 
7173 		/*
7174 		 * We should wait on the channel for at least a minimum amount
7175 		 * of time (10ms) but no longer than the driver supports.
7176 		 */
7177 		if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7178 		    wait > rdev->wiphy.max_remain_on_channel_duration)
7179 			return -EINVAL;
7180 
7181 	}
7182 
7183 	offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7184 
7185 	if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7186 		return -EINVAL;
7187 
7188 	no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7189 
7190 	err = nl80211_parse_chandef(rdev, info, &chandef);
7191 	if (err)
7192 		return err;
7193 
7194 	if (!dont_wait_for_ack) {
7195 		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7196 		if (!msg)
7197 			return -ENOMEM;
7198 
7199 		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7200 				     NL80211_CMD_FRAME);
7201 
7202 		if (IS_ERR(hdr)) {
7203 			err = PTR_ERR(hdr);
7204 			goto free_msg;
7205 		}
7206 	}
7207 
7208 	err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7209 				    nla_data(info->attrs[NL80211_ATTR_FRAME]),
7210 				    nla_len(info->attrs[NL80211_ATTR_FRAME]),
7211 				    no_cck, dont_wait_for_ack, &cookie);
7212 	if (err)
7213 		goto free_msg;
7214 
7215 	if (msg) {
7216 		if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7217 			goto nla_put_failure;
7218 
7219 		genlmsg_end(msg, hdr);
7220 		return genlmsg_reply(msg, info);
7221 	}
7222 
7223 	return 0;
7224 
7225  nla_put_failure:
7226 	err = -ENOBUFS;
7227  free_msg:
7228 	nlmsg_free(msg);
7229 	return err;
7230 }
7231 
7232 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7233 {
7234 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7235 	struct wireless_dev *wdev = info->user_ptr[1];
7236 	u64 cookie;
7237 
7238 	if (!info->attrs[NL80211_ATTR_COOKIE])
7239 		return -EINVAL;
7240 
7241 	if (!rdev->ops->mgmt_tx_cancel_wait)
7242 		return -EOPNOTSUPP;
7243 
7244 	switch (wdev->iftype) {
7245 	case NL80211_IFTYPE_STATION:
7246 	case NL80211_IFTYPE_ADHOC:
7247 	case NL80211_IFTYPE_P2P_CLIENT:
7248 	case NL80211_IFTYPE_AP:
7249 	case NL80211_IFTYPE_AP_VLAN:
7250 	case NL80211_IFTYPE_P2P_GO:
7251 	case NL80211_IFTYPE_P2P_DEVICE:
7252 		break;
7253 	default:
7254 		return -EOPNOTSUPP;
7255 	}
7256 
7257 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7258 
7259 	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7260 }
7261 
7262 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7263 {
7264 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7265 	struct wireless_dev *wdev;
7266 	struct net_device *dev = info->user_ptr[1];
7267 	u8 ps_state;
7268 	bool state;
7269 	int err;
7270 
7271 	if (!info->attrs[NL80211_ATTR_PS_STATE])
7272 		return -EINVAL;
7273 
7274 	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7275 
7276 	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7277 		return -EINVAL;
7278 
7279 	wdev = dev->ieee80211_ptr;
7280 
7281 	if (!rdev->ops->set_power_mgmt)
7282 		return -EOPNOTSUPP;
7283 
7284 	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7285 
7286 	if (state == wdev->ps)
7287 		return 0;
7288 
7289 	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7290 	if (!err)
7291 		wdev->ps = state;
7292 	return err;
7293 }
7294 
7295 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7296 {
7297 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7298 	enum nl80211_ps_state ps_state;
7299 	struct wireless_dev *wdev;
7300 	struct net_device *dev = info->user_ptr[1];
7301 	struct sk_buff *msg;
7302 	void *hdr;
7303 	int err;
7304 
7305 	wdev = dev->ieee80211_ptr;
7306 
7307 	if (!rdev->ops->set_power_mgmt)
7308 		return -EOPNOTSUPP;
7309 
7310 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7311 	if (!msg)
7312 		return -ENOMEM;
7313 
7314 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7315 			     NL80211_CMD_GET_POWER_SAVE);
7316 	if (!hdr) {
7317 		err = -ENOBUFS;
7318 		goto free_msg;
7319 	}
7320 
7321 	if (wdev->ps)
7322 		ps_state = NL80211_PS_ENABLED;
7323 	else
7324 		ps_state = NL80211_PS_DISABLED;
7325 
7326 	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7327 		goto nla_put_failure;
7328 
7329 	genlmsg_end(msg, hdr);
7330 	return genlmsg_reply(msg, info);
7331 
7332  nla_put_failure:
7333 	err = -ENOBUFS;
7334  free_msg:
7335 	nlmsg_free(msg);
7336 	return err;
7337 }
7338 
7339 static struct nla_policy
7340 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7341 	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7342 	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7343 	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7344 	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7345 	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7346 	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7347 };
7348 
7349 static int nl80211_set_cqm_txe(struct genl_info *info,
7350 			       u32 rate, u32 pkts, u32 intvl)
7351 {
7352 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7353 	struct wireless_dev *wdev;
7354 	struct net_device *dev = info->user_ptr[1];
7355 
7356 	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7357 		return -EINVAL;
7358 
7359 	wdev = dev->ieee80211_ptr;
7360 
7361 	if (!rdev->ops->set_cqm_txe_config)
7362 		return -EOPNOTSUPP;
7363 
7364 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
7365 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7366 		return -EOPNOTSUPP;
7367 
7368 	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7369 }
7370 
7371 static int nl80211_set_cqm_rssi(struct genl_info *info,
7372 				s32 threshold, u32 hysteresis)
7373 {
7374 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7375 	struct wireless_dev *wdev;
7376 	struct net_device *dev = info->user_ptr[1];
7377 
7378 	if (threshold > 0)
7379 		return -EINVAL;
7380 
7381 	wdev = dev->ieee80211_ptr;
7382 
7383 	if (!rdev->ops->set_cqm_rssi_config)
7384 		return -EOPNOTSUPP;
7385 
7386 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
7387 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7388 		return -EOPNOTSUPP;
7389 
7390 	return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7391 }
7392 
7393 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7394 {
7395 	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7396 	struct nlattr *cqm;
7397 	int err;
7398 
7399 	cqm = info->attrs[NL80211_ATTR_CQM];
7400 	if (!cqm) {
7401 		err = -EINVAL;
7402 		goto out;
7403 	}
7404 
7405 	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7406 			       nl80211_attr_cqm_policy);
7407 	if (err)
7408 		goto out;
7409 
7410 	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7411 	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7412 		s32 threshold;
7413 		u32 hysteresis;
7414 		threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7415 		hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7416 		err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7417 	} else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7418 		   attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7419 		   attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7420 		u32 rate, pkts, intvl;
7421 		rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7422 		pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7423 		intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7424 		err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7425 	} else
7426 		err = -EINVAL;
7427 
7428 out:
7429 	return err;
7430 }
7431 
7432 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7433 {
7434 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7435 	struct net_device *dev = info->user_ptr[1];
7436 	struct mesh_config cfg;
7437 	struct mesh_setup setup;
7438 	int err;
7439 
7440 	/* start with default */
7441 	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7442 	memcpy(&setup, &default_mesh_setup, sizeof(setup));
7443 
7444 	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7445 		/* and parse parameters if given */
7446 		err = nl80211_parse_mesh_config(info, &cfg, NULL);
7447 		if (err)
7448 			return err;
7449 	}
7450 
7451 	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7452 	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7453 		return -EINVAL;
7454 
7455 	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7456 	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7457 
7458 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7459 	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7460 			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7461 			return -EINVAL;
7462 
7463 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7464 		setup.beacon_interval =
7465 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7466 		if (setup.beacon_interval < 10 ||
7467 		    setup.beacon_interval > 10000)
7468 			return -EINVAL;
7469 	}
7470 
7471 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7472 		setup.dtim_period =
7473 			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7474 		if (setup.dtim_period < 1 || setup.dtim_period > 100)
7475 			return -EINVAL;
7476 	}
7477 
7478 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7479 		/* parse additional setup parameters if given */
7480 		err = nl80211_parse_mesh_setup(info, &setup);
7481 		if (err)
7482 			return err;
7483 	}
7484 
7485 	if (setup.user_mpm)
7486 		cfg.auto_open_plinks = false;
7487 
7488 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7489 		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7490 		if (err)
7491 			return err;
7492 	} else {
7493 		/* cfg80211_join_mesh() will sort it out */
7494 		setup.chandef.chan = NULL;
7495 	}
7496 
7497 	return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7498 }
7499 
7500 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7501 {
7502 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7503 	struct net_device *dev = info->user_ptr[1];
7504 
7505 	return cfg80211_leave_mesh(rdev, dev);
7506 }
7507 
7508 #ifdef CONFIG_PM
7509 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7510 					struct cfg80211_registered_device *rdev)
7511 {
7512 	struct nlattr *nl_pats, *nl_pat;
7513 	int i, pat_len;
7514 
7515 	if (!rdev->wowlan->n_patterns)
7516 		return 0;
7517 
7518 	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7519 	if (!nl_pats)
7520 		return -ENOBUFS;
7521 
7522 	for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7523 		nl_pat = nla_nest_start(msg, i + 1);
7524 		if (!nl_pat)
7525 			return -ENOBUFS;
7526 		pat_len = rdev->wowlan->patterns[i].pattern_len;
7527 		if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7528 			    DIV_ROUND_UP(pat_len, 8),
7529 			    rdev->wowlan->patterns[i].mask) ||
7530 		    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7531 			    pat_len, rdev->wowlan->patterns[i].pattern) ||
7532 		    nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7533 				rdev->wowlan->patterns[i].pkt_offset))
7534 			return -ENOBUFS;
7535 		nla_nest_end(msg, nl_pat);
7536 	}
7537 	nla_nest_end(msg, nl_pats);
7538 
7539 	return 0;
7540 }
7541 
7542 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7543 				   struct cfg80211_wowlan_tcp *tcp)
7544 {
7545 	struct nlattr *nl_tcp;
7546 
7547 	if (!tcp)
7548 		return 0;
7549 
7550 	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7551 	if (!nl_tcp)
7552 		return -ENOBUFS;
7553 
7554 	if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7555 	    nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7556 	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7557 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7558 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7559 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7560 		    tcp->payload_len, tcp->payload) ||
7561 	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7562 			tcp->data_interval) ||
7563 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7564 		    tcp->wake_len, tcp->wake_data) ||
7565 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7566 		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7567 		return -ENOBUFS;
7568 
7569 	if (tcp->payload_seq.len &&
7570 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7571 		    sizeof(tcp->payload_seq), &tcp->payload_seq))
7572 		return -ENOBUFS;
7573 
7574 	if (tcp->payload_tok.len &&
7575 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7576 		    sizeof(tcp->payload_tok) + tcp->tokens_size,
7577 		    &tcp->payload_tok))
7578 		return -ENOBUFS;
7579 
7580 	nla_nest_end(msg, nl_tcp);
7581 
7582 	return 0;
7583 }
7584 
7585 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7586 {
7587 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7588 	struct sk_buff *msg;
7589 	void *hdr;
7590 	u32 size = NLMSG_DEFAULT_SIZE;
7591 
7592 	if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7593 	    !rdev->wiphy.wowlan.tcp)
7594 		return -EOPNOTSUPP;
7595 
7596 	if (rdev->wowlan && rdev->wowlan->tcp) {
7597 		/* adjust size to have room for all the data */
7598 		size += rdev->wowlan->tcp->tokens_size +
7599 			rdev->wowlan->tcp->payload_len +
7600 			rdev->wowlan->tcp->wake_len +
7601 			rdev->wowlan->tcp->wake_len / 8;
7602 	}
7603 
7604 	msg = nlmsg_new(size, GFP_KERNEL);
7605 	if (!msg)
7606 		return -ENOMEM;
7607 
7608 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7609 			     NL80211_CMD_GET_WOWLAN);
7610 	if (!hdr)
7611 		goto nla_put_failure;
7612 
7613 	if (rdev->wowlan) {
7614 		struct nlattr *nl_wowlan;
7615 
7616 		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7617 		if (!nl_wowlan)
7618 			goto nla_put_failure;
7619 
7620 		if ((rdev->wowlan->any &&
7621 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7622 		    (rdev->wowlan->disconnect &&
7623 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7624 		    (rdev->wowlan->magic_pkt &&
7625 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7626 		    (rdev->wowlan->gtk_rekey_failure &&
7627 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7628 		    (rdev->wowlan->eap_identity_req &&
7629 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7630 		    (rdev->wowlan->four_way_handshake &&
7631 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7632 		    (rdev->wowlan->rfkill_release &&
7633 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7634 			goto nla_put_failure;
7635 
7636 		if (nl80211_send_wowlan_patterns(msg, rdev))
7637 			goto nla_put_failure;
7638 
7639 		if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7640 			goto nla_put_failure;
7641 
7642 		nla_nest_end(msg, nl_wowlan);
7643 	}
7644 
7645 	genlmsg_end(msg, hdr);
7646 	return genlmsg_reply(msg, info);
7647 
7648 nla_put_failure:
7649 	nlmsg_free(msg);
7650 	return -ENOBUFS;
7651 }
7652 
7653 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7654 				    struct nlattr *attr,
7655 				    struct cfg80211_wowlan *trig)
7656 {
7657 	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7658 	struct cfg80211_wowlan_tcp *cfg;
7659 	struct nl80211_wowlan_tcp_data_token *tok = NULL;
7660 	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7661 	u32 size;
7662 	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7663 	int err, port;
7664 
7665 	if (!rdev->wiphy.wowlan.tcp)
7666 		return -EINVAL;
7667 
7668 	err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7669 			nla_data(attr), nla_len(attr),
7670 			nl80211_wowlan_tcp_policy);
7671 	if (err)
7672 		return err;
7673 
7674 	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7675 	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7676 	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7677 	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7678 	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7679 	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7680 	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7681 	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7682 		return -EINVAL;
7683 
7684 	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7685 	if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7686 		return -EINVAL;
7687 
7688 	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7689 			rdev->wiphy.wowlan.tcp->data_interval_max ||
7690 	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7691 		return -EINVAL;
7692 
7693 	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7694 	if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7695 		return -EINVAL;
7696 
7697 	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7698 	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7699 		return -EINVAL;
7700 
7701 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7702 		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7703 
7704 		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7705 		tokens_size = tokln - sizeof(*tok);
7706 
7707 		if (!tok->len || tokens_size % tok->len)
7708 			return -EINVAL;
7709 		if (!rdev->wiphy.wowlan.tcp->tok)
7710 			return -EINVAL;
7711 		if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7712 			return -EINVAL;
7713 		if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7714 			return -EINVAL;
7715 		if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7716 			return -EINVAL;
7717 		if (tok->offset + tok->len > data_size)
7718 			return -EINVAL;
7719 	}
7720 
7721 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7722 		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7723 		if (!rdev->wiphy.wowlan.tcp->seq)
7724 			return -EINVAL;
7725 		if (seq->len == 0 || seq->len > 4)
7726 			return -EINVAL;
7727 		if (seq->len + seq->offset > data_size)
7728 			return -EINVAL;
7729 	}
7730 
7731 	size = sizeof(*cfg);
7732 	size += data_size;
7733 	size += wake_size + wake_mask_size;
7734 	size += tokens_size;
7735 
7736 	cfg = kzalloc(size, GFP_KERNEL);
7737 	if (!cfg)
7738 		return -ENOMEM;
7739 	cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7740 	cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7741 	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7742 	       ETH_ALEN);
7743 	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7744 		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7745 	else
7746 		port = 0;
7747 #ifdef CONFIG_INET
7748 	/* allocate a socket and port for it and use it */
7749 	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7750 			    IPPROTO_TCP, &cfg->sock, 1);
7751 	if (err) {
7752 		kfree(cfg);
7753 		return err;
7754 	}
7755 	if (inet_csk_get_port(cfg->sock->sk, port)) {
7756 		sock_release(cfg->sock);
7757 		kfree(cfg);
7758 		return -EADDRINUSE;
7759 	}
7760 	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7761 #else
7762 	if (!port) {
7763 		kfree(cfg);
7764 		return -EINVAL;
7765 	}
7766 	cfg->src_port = port;
7767 #endif
7768 
7769 	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7770 	cfg->payload_len = data_size;
7771 	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7772 	memcpy((void *)cfg->payload,
7773 	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7774 	       data_size);
7775 	if (seq)
7776 		cfg->payload_seq = *seq;
7777 	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7778 	cfg->wake_len = wake_size;
7779 	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7780 	memcpy((void *)cfg->wake_data,
7781 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7782 	       wake_size);
7783 	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7784 			 data_size + wake_size;
7785 	memcpy((void *)cfg->wake_mask,
7786 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7787 	       wake_mask_size);
7788 	if (tok) {
7789 		cfg->tokens_size = tokens_size;
7790 		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7791 	}
7792 
7793 	trig->tcp = cfg;
7794 
7795 	return 0;
7796 }
7797 
7798 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7799 {
7800 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7801 	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7802 	struct cfg80211_wowlan new_triggers = {};
7803 	struct cfg80211_wowlan *ntrig;
7804 	struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7805 	int err, i;
7806 	bool prev_enabled = rdev->wowlan;
7807 
7808 	if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7809 	    !rdev->wiphy.wowlan.tcp)
7810 		return -EOPNOTSUPP;
7811 
7812 	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7813 		cfg80211_rdev_free_wowlan(rdev);
7814 		rdev->wowlan = NULL;
7815 		goto set_wakeup;
7816 	}
7817 
7818 	err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7819 			nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7820 			nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7821 			nl80211_wowlan_policy);
7822 	if (err)
7823 		return err;
7824 
7825 	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7826 		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7827 			return -EINVAL;
7828 		new_triggers.any = true;
7829 	}
7830 
7831 	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7832 		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7833 			return -EINVAL;
7834 		new_triggers.disconnect = true;
7835 	}
7836 
7837 	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7838 		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7839 			return -EINVAL;
7840 		new_triggers.magic_pkt = true;
7841 	}
7842 
7843 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7844 		return -EINVAL;
7845 
7846 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7847 		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7848 			return -EINVAL;
7849 		new_triggers.gtk_rekey_failure = true;
7850 	}
7851 
7852 	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7853 		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7854 			return -EINVAL;
7855 		new_triggers.eap_identity_req = true;
7856 	}
7857 
7858 	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7859 		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7860 			return -EINVAL;
7861 		new_triggers.four_way_handshake = true;
7862 	}
7863 
7864 	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7865 		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7866 			return -EINVAL;
7867 		new_triggers.rfkill_release = true;
7868 	}
7869 
7870 	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7871 		struct nlattr *pat;
7872 		int n_patterns = 0;
7873 		int rem, pat_len, mask_len, pkt_offset;
7874 		struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7875 
7876 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7877 				    rem)
7878 			n_patterns++;
7879 		if (n_patterns > wowlan->n_patterns)
7880 			return -EINVAL;
7881 
7882 		new_triggers.patterns = kcalloc(n_patterns,
7883 						sizeof(new_triggers.patterns[0]),
7884 						GFP_KERNEL);
7885 		if (!new_triggers.patterns)
7886 			return -ENOMEM;
7887 
7888 		new_triggers.n_patterns = n_patterns;
7889 		i = 0;
7890 
7891 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7892 				    rem) {
7893 			nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7894 				  nla_data(pat), nla_len(pat), NULL);
7895 			err = -EINVAL;
7896 			if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7897 			    !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7898 				goto error;
7899 			pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7900 			mask_len = DIV_ROUND_UP(pat_len, 8);
7901 			if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7902 			    mask_len)
7903 				goto error;
7904 			if (pat_len > wowlan->pattern_max_len ||
7905 			    pat_len < wowlan->pattern_min_len)
7906 				goto error;
7907 
7908 			if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7909 				pkt_offset = 0;
7910 			else
7911 				pkt_offset = nla_get_u32(
7912 					pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7913 			if (pkt_offset > wowlan->max_pkt_offset)
7914 				goto error;
7915 			new_triggers.patterns[i].pkt_offset = pkt_offset;
7916 
7917 			new_triggers.patterns[i].mask =
7918 				kmalloc(mask_len + pat_len, GFP_KERNEL);
7919 			if (!new_triggers.patterns[i].mask) {
7920 				err = -ENOMEM;
7921 				goto error;
7922 			}
7923 			new_triggers.patterns[i].pattern =
7924 				new_triggers.patterns[i].mask + mask_len;
7925 			memcpy(new_triggers.patterns[i].mask,
7926 			       nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7927 			       mask_len);
7928 			new_triggers.patterns[i].pattern_len = pat_len;
7929 			memcpy(new_triggers.patterns[i].pattern,
7930 			       nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7931 			       pat_len);
7932 			i++;
7933 		}
7934 	}
7935 
7936 	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7937 		err = nl80211_parse_wowlan_tcp(
7938 			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7939 			&new_triggers);
7940 		if (err)
7941 			goto error;
7942 	}
7943 
7944 	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7945 	if (!ntrig) {
7946 		err = -ENOMEM;
7947 		goto error;
7948 	}
7949 	cfg80211_rdev_free_wowlan(rdev);
7950 	rdev->wowlan = ntrig;
7951 
7952  set_wakeup:
7953 	if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7954 		rdev_set_wakeup(rdev, rdev->wowlan);
7955 
7956 	return 0;
7957  error:
7958 	for (i = 0; i < new_triggers.n_patterns; i++)
7959 		kfree(new_triggers.patterns[i].mask);
7960 	kfree(new_triggers.patterns);
7961 	if (new_triggers.tcp && new_triggers.tcp->sock)
7962 		sock_release(new_triggers.tcp->sock);
7963 	kfree(new_triggers.tcp);
7964 	return err;
7965 }
7966 #endif
7967 
7968 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7969 {
7970 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7971 	struct net_device *dev = info->user_ptr[1];
7972 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7973 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7974 	struct cfg80211_gtk_rekey_data rekey_data;
7975 	int err;
7976 
7977 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7978 		return -EINVAL;
7979 
7980 	err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7981 			nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7982 			nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7983 			nl80211_rekey_policy);
7984 	if (err)
7985 		return err;
7986 
7987 	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7988 		return -ERANGE;
7989 	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7990 		return -ERANGE;
7991 	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7992 		return -ERANGE;
7993 
7994 	memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7995 	       NL80211_KEK_LEN);
7996 	memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7997 	       NL80211_KCK_LEN);
7998 	memcpy(rekey_data.replay_ctr,
7999 	       nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8000 	       NL80211_REPLAY_CTR_LEN);
8001 
8002 	wdev_lock(wdev);
8003 	if (!wdev->current_bss) {
8004 		err = -ENOTCONN;
8005 		goto out;
8006 	}
8007 
8008 	if (!rdev->ops->set_rekey_data) {
8009 		err = -EOPNOTSUPP;
8010 		goto out;
8011 	}
8012 
8013 	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8014  out:
8015 	wdev_unlock(wdev);
8016 	return err;
8017 }
8018 
8019 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8020 					     struct genl_info *info)
8021 {
8022 	struct net_device *dev = info->user_ptr[1];
8023 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8024 
8025 	if (wdev->iftype != NL80211_IFTYPE_AP &&
8026 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
8027 		return -EINVAL;
8028 
8029 	if (wdev->ap_unexpected_nlportid)
8030 		return -EBUSY;
8031 
8032 	wdev->ap_unexpected_nlportid = info->snd_portid;
8033 	return 0;
8034 }
8035 
8036 static int nl80211_probe_client(struct sk_buff *skb,
8037 				struct genl_info *info)
8038 {
8039 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8040 	struct net_device *dev = info->user_ptr[1];
8041 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8042 	struct sk_buff *msg;
8043 	void *hdr;
8044 	const u8 *addr;
8045 	u64 cookie;
8046 	int err;
8047 
8048 	if (wdev->iftype != NL80211_IFTYPE_AP &&
8049 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
8050 		return -EOPNOTSUPP;
8051 
8052 	if (!info->attrs[NL80211_ATTR_MAC])
8053 		return -EINVAL;
8054 
8055 	if (!rdev->ops->probe_client)
8056 		return -EOPNOTSUPP;
8057 
8058 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8059 	if (!msg)
8060 		return -ENOMEM;
8061 
8062 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8063 			     NL80211_CMD_PROBE_CLIENT);
8064 
8065 	if (IS_ERR(hdr)) {
8066 		err = PTR_ERR(hdr);
8067 		goto free_msg;
8068 	}
8069 
8070 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8071 
8072 	err = rdev_probe_client(rdev, dev, addr, &cookie);
8073 	if (err)
8074 		goto free_msg;
8075 
8076 	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8077 		goto nla_put_failure;
8078 
8079 	genlmsg_end(msg, hdr);
8080 
8081 	return genlmsg_reply(msg, info);
8082 
8083  nla_put_failure:
8084 	err = -ENOBUFS;
8085  free_msg:
8086 	nlmsg_free(msg);
8087 	return err;
8088 }
8089 
8090 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8091 {
8092 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8093 	struct cfg80211_beacon_registration *reg, *nreg;
8094 	int rv;
8095 
8096 	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8097 		return -EOPNOTSUPP;
8098 
8099 	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8100 	if (!nreg)
8101 		return -ENOMEM;
8102 
8103 	/* First, check if already registered. */
8104 	spin_lock_bh(&rdev->beacon_registrations_lock);
8105 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8106 		if (reg->nlportid == info->snd_portid) {
8107 			rv = -EALREADY;
8108 			goto out_err;
8109 		}
8110 	}
8111 	/* Add it to the list */
8112 	nreg->nlportid = info->snd_portid;
8113 	list_add(&nreg->list, &rdev->beacon_registrations);
8114 
8115 	spin_unlock_bh(&rdev->beacon_registrations_lock);
8116 
8117 	return 0;
8118 out_err:
8119 	spin_unlock_bh(&rdev->beacon_registrations_lock);
8120 	kfree(nreg);
8121 	return rv;
8122 }
8123 
8124 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8125 {
8126 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8127 	struct wireless_dev *wdev = info->user_ptr[1];
8128 	int err;
8129 
8130 	if (!rdev->ops->start_p2p_device)
8131 		return -EOPNOTSUPP;
8132 
8133 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8134 		return -EOPNOTSUPP;
8135 
8136 	if (wdev->p2p_started)
8137 		return 0;
8138 
8139 	mutex_lock(&rdev->devlist_mtx);
8140 	err = cfg80211_can_add_interface(rdev, wdev->iftype);
8141 	mutex_unlock(&rdev->devlist_mtx);
8142 	if (err)
8143 		return err;
8144 
8145 	err = rdev_start_p2p_device(rdev, wdev);
8146 	if (err)
8147 		return err;
8148 
8149 	wdev->p2p_started = true;
8150 	mutex_lock(&rdev->devlist_mtx);
8151 	rdev->opencount++;
8152 	mutex_unlock(&rdev->devlist_mtx);
8153 
8154 	return 0;
8155 }
8156 
8157 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8158 {
8159 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8160 	struct wireless_dev *wdev = info->user_ptr[1];
8161 
8162 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8163 		return -EOPNOTSUPP;
8164 
8165 	if (!rdev->ops->stop_p2p_device)
8166 		return -EOPNOTSUPP;
8167 
8168 	mutex_lock(&rdev->devlist_mtx);
8169 	mutex_lock(&rdev->sched_scan_mtx);
8170 	cfg80211_stop_p2p_device(rdev, wdev);
8171 	mutex_unlock(&rdev->sched_scan_mtx);
8172 	mutex_unlock(&rdev->devlist_mtx);
8173 
8174 	return 0;
8175 }
8176 
8177 static int nl80211_get_protocol_features(struct sk_buff *skb,
8178 					 struct genl_info *info)
8179 {
8180 	void *hdr;
8181 	struct sk_buff *msg;
8182 
8183 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8184 	if (!msg)
8185 		return -ENOMEM;
8186 
8187 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8188 			     NL80211_CMD_GET_PROTOCOL_FEATURES);
8189 	if (!hdr)
8190 		goto nla_put_failure;
8191 
8192 	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8193 			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8194 		goto nla_put_failure;
8195 
8196 	genlmsg_end(msg, hdr);
8197 	return genlmsg_reply(msg, info);
8198 
8199  nla_put_failure:
8200 	kfree_skb(msg);
8201 	return -ENOBUFS;
8202 }
8203 
8204 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8205 {
8206 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8207 	struct cfg80211_update_ft_ies_params ft_params;
8208 	struct net_device *dev = info->user_ptr[1];
8209 
8210 	if (!rdev->ops->update_ft_ies)
8211 		return -EOPNOTSUPP;
8212 
8213 	if (!info->attrs[NL80211_ATTR_MDID] ||
8214 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8215 		return -EINVAL;
8216 
8217 	memset(&ft_params, 0, sizeof(ft_params));
8218 	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8219 	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8220 	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8221 
8222 	return rdev_update_ft_ies(rdev, dev, &ft_params);
8223 }
8224 
8225 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8226 				       struct genl_info *info)
8227 {
8228 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8229 	struct wireless_dev *wdev = info->user_ptr[1];
8230 	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8231 	u16 duration;
8232 	int ret;
8233 
8234 	if (!rdev->ops->crit_proto_start)
8235 		return -EOPNOTSUPP;
8236 
8237 	if (WARN_ON(!rdev->ops->crit_proto_stop))
8238 		return -EINVAL;
8239 
8240 	if (rdev->crit_proto_nlportid)
8241 		return -EBUSY;
8242 
8243 	/* determine protocol if provided */
8244 	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8245 		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8246 
8247 	if (proto >= NUM_NL80211_CRIT_PROTO)
8248 		return -EINVAL;
8249 
8250 	/* timeout must be provided */
8251 	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8252 		return -EINVAL;
8253 
8254 	duration =
8255 		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8256 
8257 	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8258 		return -ERANGE;
8259 
8260 	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8261 	if (!ret)
8262 		rdev->crit_proto_nlportid = info->snd_portid;
8263 
8264 	return ret;
8265 }
8266 
8267 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8268 				      struct genl_info *info)
8269 {
8270 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8271 	struct wireless_dev *wdev = info->user_ptr[1];
8272 
8273 	if (!rdev->ops->crit_proto_stop)
8274 		return -EOPNOTSUPP;
8275 
8276 	if (rdev->crit_proto_nlportid) {
8277 		rdev->crit_proto_nlportid = 0;
8278 		rdev_crit_proto_stop(rdev, wdev);
8279 	}
8280 	return 0;
8281 }
8282 
8283 #define NL80211_FLAG_NEED_WIPHY		0x01
8284 #define NL80211_FLAG_NEED_NETDEV	0x02
8285 #define NL80211_FLAG_NEED_RTNL		0x04
8286 #define NL80211_FLAG_CHECK_NETDEV_UP	0x08
8287 #define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
8288 					 NL80211_FLAG_CHECK_NETDEV_UP)
8289 #define NL80211_FLAG_NEED_WDEV		0x10
8290 /* If a netdev is associated, it must be UP, P2P must be started */
8291 #define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
8292 					 NL80211_FLAG_CHECK_NETDEV_UP)
8293 
8294 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8295 			    struct genl_info *info)
8296 {
8297 	struct cfg80211_registered_device *rdev;
8298 	struct wireless_dev *wdev;
8299 	struct net_device *dev;
8300 	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8301 
8302 	if (rtnl)
8303 		rtnl_lock();
8304 
8305 	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8306 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8307 		if (IS_ERR(rdev)) {
8308 			if (rtnl)
8309 				rtnl_unlock();
8310 			return PTR_ERR(rdev);
8311 		}
8312 		info->user_ptr[0] = rdev;
8313 	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8314 		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8315 		mutex_lock(&cfg80211_mutex);
8316 		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8317 						  info->attrs);
8318 		if (IS_ERR(wdev)) {
8319 			mutex_unlock(&cfg80211_mutex);
8320 			if (rtnl)
8321 				rtnl_unlock();
8322 			return PTR_ERR(wdev);
8323 		}
8324 
8325 		dev = wdev->netdev;
8326 		rdev = wiphy_to_dev(wdev->wiphy);
8327 
8328 		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8329 			if (!dev) {
8330 				mutex_unlock(&cfg80211_mutex);
8331 				if (rtnl)
8332 					rtnl_unlock();
8333 				return -EINVAL;
8334 			}
8335 
8336 			info->user_ptr[1] = dev;
8337 		} else {
8338 			info->user_ptr[1] = wdev;
8339 		}
8340 
8341 		if (dev) {
8342 			if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8343 			    !netif_running(dev)) {
8344 				mutex_unlock(&cfg80211_mutex);
8345 				if (rtnl)
8346 					rtnl_unlock();
8347 				return -ENETDOWN;
8348 			}
8349 
8350 			dev_hold(dev);
8351 		} else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8352 			if (!wdev->p2p_started) {
8353 				mutex_unlock(&cfg80211_mutex);
8354 				if (rtnl)
8355 					rtnl_unlock();
8356 				return -ENETDOWN;
8357 			}
8358 		}
8359 
8360 		cfg80211_lock_rdev(rdev);
8361 
8362 		mutex_unlock(&cfg80211_mutex);
8363 
8364 		info->user_ptr[0] = rdev;
8365 	}
8366 
8367 	return 0;
8368 }
8369 
8370 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8371 			      struct genl_info *info)
8372 {
8373 	if (info->user_ptr[0])
8374 		cfg80211_unlock_rdev(info->user_ptr[0]);
8375 	if (info->user_ptr[1]) {
8376 		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8377 			struct wireless_dev *wdev = info->user_ptr[1];
8378 
8379 			if (wdev->netdev)
8380 				dev_put(wdev->netdev);
8381 		} else {
8382 			dev_put(info->user_ptr[1]);
8383 		}
8384 	}
8385 	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8386 		rtnl_unlock();
8387 }
8388 
8389 static struct genl_ops nl80211_ops[] = {
8390 	{
8391 		.cmd = NL80211_CMD_GET_WIPHY,
8392 		.doit = nl80211_get_wiphy,
8393 		.dumpit = nl80211_dump_wiphy,
8394 		.policy = nl80211_policy,
8395 		/* can be retrieved by unprivileged users */
8396 		.internal_flags = NL80211_FLAG_NEED_WIPHY,
8397 	},
8398 	{
8399 		.cmd = NL80211_CMD_SET_WIPHY,
8400 		.doit = nl80211_set_wiphy,
8401 		.policy = nl80211_policy,
8402 		.flags = GENL_ADMIN_PERM,
8403 		.internal_flags = NL80211_FLAG_NEED_RTNL,
8404 	},
8405 	{
8406 		.cmd = NL80211_CMD_GET_INTERFACE,
8407 		.doit = nl80211_get_interface,
8408 		.dumpit = nl80211_dump_interface,
8409 		.policy = nl80211_policy,
8410 		/* can be retrieved by unprivileged users */
8411 		.internal_flags = NL80211_FLAG_NEED_WDEV,
8412 	},
8413 	{
8414 		.cmd = NL80211_CMD_SET_INTERFACE,
8415 		.doit = nl80211_set_interface,
8416 		.policy = nl80211_policy,
8417 		.flags = GENL_ADMIN_PERM,
8418 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8419 				  NL80211_FLAG_NEED_RTNL,
8420 	},
8421 	{
8422 		.cmd = NL80211_CMD_NEW_INTERFACE,
8423 		.doit = nl80211_new_interface,
8424 		.policy = nl80211_policy,
8425 		.flags = GENL_ADMIN_PERM,
8426 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8427 				  NL80211_FLAG_NEED_RTNL,
8428 	},
8429 	{
8430 		.cmd = NL80211_CMD_DEL_INTERFACE,
8431 		.doit = nl80211_del_interface,
8432 		.policy = nl80211_policy,
8433 		.flags = GENL_ADMIN_PERM,
8434 		.internal_flags = NL80211_FLAG_NEED_WDEV |
8435 				  NL80211_FLAG_NEED_RTNL,
8436 	},
8437 	{
8438 		.cmd = NL80211_CMD_GET_KEY,
8439 		.doit = nl80211_get_key,
8440 		.policy = nl80211_policy,
8441 		.flags = GENL_ADMIN_PERM,
8442 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8443 				  NL80211_FLAG_NEED_RTNL,
8444 	},
8445 	{
8446 		.cmd = NL80211_CMD_SET_KEY,
8447 		.doit = nl80211_set_key,
8448 		.policy = nl80211_policy,
8449 		.flags = GENL_ADMIN_PERM,
8450 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8451 				  NL80211_FLAG_NEED_RTNL,
8452 	},
8453 	{
8454 		.cmd = NL80211_CMD_NEW_KEY,
8455 		.doit = nl80211_new_key,
8456 		.policy = nl80211_policy,
8457 		.flags = GENL_ADMIN_PERM,
8458 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8459 				  NL80211_FLAG_NEED_RTNL,
8460 	},
8461 	{
8462 		.cmd = NL80211_CMD_DEL_KEY,
8463 		.doit = nl80211_del_key,
8464 		.policy = nl80211_policy,
8465 		.flags = GENL_ADMIN_PERM,
8466 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8467 				  NL80211_FLAG_NEED_RTNL,
8468 	},
8469 	{
8470 		.cmd = NL80211_CMD_SET_BEACON,
8471 		.policy = nl80211_policy,
8472 		.flags = GENL_ADMIN_PERM,
8473 		.doit = nl80211_set_beacon,
8474 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8475 				  NL80211_FLAG_NEED_RTNL,
8476 	},
8477 	{
8478 		.cmd = NL80211_CMD_START_AP,
8479 		.policy = nl80211_policy,
8480 		.flags = GENL_ADMIN_PERM,
8481 		.doit = nl80211_start_ap,
8482 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8483 				  NL80211_FLAG_NEED_RTNL,
8484 	},
8485 	{
8486 		.cmd = NL80211_CMD_STOP_AP,
8487 		.policy = nl80211_policy,
8488 		.flags = GENL_ADMIN_PERM,
8489 		.doit = nl80211_stop_ap,
8490 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8491 				  NL80211_FLAG_NEED_RTNL,
8492 	},
8493 	{
8494 		.cmd = NL80211_CMD_GET_STATION,
8495 		.doit = nl80211_get_station,
8496 		.dumpit = nl80211_dump_station,
8497 		.policy = nl80211_policy,
8498 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8499 				  NL80211_FLAG_NEED_RTNL,
8500 	},
8501 	{
8502 		.cmd = NL80211_CMD_SET_STATION,
8503 		.doit = nl80211_set_station,
8504 		.policy = nl80211_policy,
8505 		.flags = GENL_ADMIN_PERM,
8506 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8507 				  NL80211_FLAG_NEED_RTNL,
8508 	},
8509 	{
8510 		.cmd = NL80211_CMD_NEW_STATION,
8511 		.doit = nl80211_new_station,
8512 		.policy = nl80211_policy,
8513 		.flags = GENL_ADMIN_PERM,
8514 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8515 				  NL80211_FLAG_NEED_RTNL,
8516 	},
8517 	{
8518 		.cmd = NL80211_CMD_DEL_STATION,
8519 		.doit = nl80211_del_station,
8520 		.policy = nl80211_policy,
8521 		.flags = GENL_ADMIN_PERM,
8522 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8523 				  NL80211_FLAG_NEED_RTNL,
8524 	},
8525 	{
8526 		.cmd = NL80211_CMD_GET_MPATH,
8527 		.doit = nl80211_get_mpath,
8528 		.dumpit = nl80211_dump_mpath,
8529 		.policy = nl80211_policy,
8530 		.flags = GENL_ADMIN_PERM,
8531 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8532 				  NL80211_FLAG_NEED_RTNL,
8533 	},
8534 	{
8535 		.cmd = NL80211_CMD_SET_MPATH,
8536 		.doit = nl80211_set_mpath,
8537 		.policy = nl80211_policy,
8538 		.flags = GENL_ADMIN_PERM,
8539 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8540 				  NL80211_FLAG_NEED_RTNL,
8541 	},
8542 	{
8543 		.cmd = NL80211_CMD_NEW_MPATH,
8544 		.doit = nl80211_new_mpath,
8545 		.policy = nl80211_policy,
8546 		.flags = GENL_ADMIN_PERM,
8547 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8548 				  NL80211_FLAG_NEED_RTNL,
8549 	},
8550 	{
8551 		.cmd = NL80211_CMD_DEL_MPATH,
8552 		.doit = nl80211_del_mpath,
8553 		.policy = nl80211_policy,
8554 		.flags = GENL_ADMIN_PERM,
8555 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8556 				  NL80211_FLAG_NEED_RTNL,
8557 	},
8558 	{
8559 		.cmd = NL80211_CMD_SET_BSS,
8560 		.doit = nl80211_set_bss,
8561 		.policy = nl80211_policy,
8562 		.flags = GENL_ADMIN_PERM,
8563 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8564 				  NL80211_FLAG_NEED_RTNL,
8565 	},
8566 	{
8567 		.cmd = NL80211_CMD_GET_REG,
8568 		.doit = nl80211_get_reg,
8569 		.policy = nl80211_policy,
8570 		/* can be retrieved by unprivileged users */
8571 	},
8572 	{
8573 		.cmd = NL80211_CMD_SET_REG,
8574 		.doit = nl80211_set_reg,
8575 		.policy = nl80211_policy,
8576 		.flags = GENL_ADMIN_PERM,
8577 	},
8578 	{
8579 		.cmd = NL80211_CMD_REQ_SET_REG,
8580 		.doit = nl80211_req_set_reg,
8581 		.policy = nl80211_policy,
8582 		.flags = GENL_ADMIN_PERM,
8583 	},
8584 	{
8585 		.cmd = NL80211_CMD_GET_MESH_CONFIG,
8586 		.doit = nl80211_get_mesh_config,
8587 		.policy = nl80211_policy,
8588 		/* can be retrieved by unprivileged users */
8589 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8590 				  NL80211_FLAG_NEED_RTNL,
8591 	},
8592 	{
8593 		.cmd = NL80211_CMD_SET_MESH_CONFIG,
8594 		.doit = nl80211_update_mesh_config,
8595 		.policy = nl80211_policy,
8596 		.flags = GENL_ADMIN_PERM,
8597 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8598 				  NL80211_FLAG_NEED_RTNL,
8599 	},
8600 	{
8601 		.cmd = NL80211_CMD_TRIGGER_SCAN,
8602 		.doit = nl80211_trigger_scan,
8603 		.policy = nl80211_policy,
8604 		.flags = GENL_ADMIN_PERM,
8605 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8606 				  NL80211_FLAG_NEED_RTNL,
8607 	},
8608 	{
8609 		.cmd = NL80211_CMD_GET_SCAN,
8610 		.policy = nl80211_policy,
8611 		.dumpit = nl80211_dump_scan,
8612 	},
8613 	{
8614 		.cmd = NL80211_CMD_START_SCHED_SCAN,
8615 		.doit = nl80211_start_sched_scan,
8616 		.policy = nl80211_policy,
8617 		.flags = GENL_ADMIN_PERM,
8618 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8619 				  NL80211_FLAG_NEED_RTNL,
8620 	},
8621 	{
8622 		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
8623 		.doit = nl80211_stop_sched_scan,
8624 		.policy = nl80211_policy,
8625 		.flags = GENL_ADMIN_PERM,
8626 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8627 				  NL80211_FLAG_NEED_RTNL,
8628 	},
8629 	{
8630 		.cmd = NL80211_CMD_AUTHENTICATE,
8631 		.doit = nl80211_authenticate,
8632 		.policy = nl80211_policy,
8633 		.flags = GENL_ADMIN_PERM,
8634 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8635 				  NL80211_FLAG_NEED_RTNL,
8636 	},
8637 	{
8638 		.cmd = NL80211_CMD_ASSOCIATE,
8639 		.doit = nl80211_associate,
8640 		.policy = nl80211_policy,
8641 		.flags = GENL_ADMIN_PERM,
8642 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8643 				  NL80211_FLAG_NEED_RTNL,
8644 	},
8645 	{
8646 		.cmd = NL80211_CMD_DEAUTHENTICATE,
8647 		.doit = nl80211_deauthenticate,
8648 		.policy = nl80211_policy,
8649 		.flags = GENL_ADMIN_PERM,
8650 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8651 				  NL80211_FLAG_NEED_RTNL,
8652 	},
8653 	{
8654 		.cmd = NL80211_CMD_DISASSOCIATE,
8655 		.doit = nl80211_disassociate,
8656 		.policy = nl80211_policy,
8657 		.flags = GENL_ADMIN_PERM,
8658 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8659 				  NL80211_FLAG_NEED_RTNL,
8660 	},
8661 	{
8662 		.cmd = NL80211_CMD_JOIN_IBSS,
8663 		.doit = nl80211_join_ibss,
8664 		.policy = nl80211_policy,
8665 		.flags = GENL_ADMIN_PERM,
8666 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8667 				  NL80211_FLAG_NEED_RTNL,
8668 	},
8669 	{
8670 		.cmd = NL80211_CMD_LEAVE_IBSS,
8671 		.doit = nl80211_leave_ibss,
8672 		.policy = nl80211_policy,
8673 		.flags = GENL_ADMIN_PERM,
8674 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8675 				  NL80211_FLAG_NEED_RTNL,
8676 	},
8677 #ifdef CONFIG_NL80211_TESTMODE
8678 	{
8679 		.cmd = NL80211_CMD_TESTMODE,
8680 		.doit = nl80211_testmode_do,
8681 		.dumpit = nl80211_testmode_dump,
8682 		.policy = nl80211_policy,
8683 		.flags = GENL_ADMIN_PERM,
8684 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8685 				  NL80211_FLAG_NEED_RTNL,
8686 	},
8687 #endif
8688 	{
8689 		.cmd = NL80211_CMD_CONNECT,
8690 		.doit = nl80211_connect,
8691 		.policy = nl80211_policy,
8692 		.flags = GENL_ADMIN_PERM,
8693 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8694 				  NL80211_FLAG_NEED_RTNL,
8695 	},
8696 	{
8697 		.cmd = NL80211_CMD_DISCONNECT,
8698 		.doit = nl80211_disconnect,
8699 		.policy = nl80211_policy,
8700 		.flags = GENL_ADMIN_PERM,
8701 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8702 				  NL80211_FLAG_NEED_RTNL,
8703 	},
8704 	{
8705 		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
8706 		.doit = nl80211_wiphy_netns,
8707 		.policy = nl80211_policy,
8708 		.flags = GENL_ADMIN_PERM,
8709 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8710 				  NL80211_FLAG_NEED_RTNL,
8711 	},
8712 	{
8713 		.cmd = NL80211_CMD_GET_SURVEY,
8714 		.policy = nl80211_policy,
8715 		.dumpit = nl80211_dump_survey,
8716 	},
8717 	{
8718 		.cmd = NL80211_CMD_SET_PMKSA,
8719 		.doit = nl80211_setdel_pmksa,
8720 		.policy = nl80211_policy,
8721 		.flags = GENL_ADMIN_PERM,
8722 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8723 				  NL80211_FLAG_NEED_RTNL,
8724 	},
8725 	{
8726 		.cmd = NL80211_CMD_DEL_PMKSA,
8727 		.doit = nl80211_setdel_pmksa,
8728 		.policy = nl80211_policy,
8729 		.flags = GENL_ADMIN_PERM,
8730 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8731 				  NL80211_FLAG_NEED_RTNL,
8732 	},
8733 	{
8734 		.cmd = NL80211_CMD_FLUSH_PMKSA,
8735 		.doit = nl80211_flush_pmksa,
8736 		.policy = nl80211_policy,
8737 		.flags = GENL_ADMIN_PERM,
8738 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8739 				  NL80211_FLAG_NEED_RTNL,
8740 	},
8741 	{
8742 		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8743 		.doit = nl80211_remain_on_channel,
8744 		.policy = nl80211_policy,
8745 		.flags = GENL_ADMIN_PERM,
8746 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8747 				  NL80211_FLAG_NEED_RTNL,
8748 	},
8749 	{
8750 		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8751 		.doit = nl80211_cancel_remain_on_channel,
8752 		.policy = nl80211_policy,
8753 		.flags = GENL_ADMIN_PERM,
8754 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8755 				  NL80211_FLAG_NEED_RTNL,
8756 	},
8757 	{
8758 		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8759 		.doit = nl80211_set_tx_bitrate_mask,
8760 		.policy = nl80211_policy,
8761 		.flags = GENL_ADMIN_PERM,
8762 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8763 				  NL80211_FLAG_NEED_RTNL,
8764 	},
8765 	{
8766 		.cmd = NL80211_CMD_REGISTER_FRAME,
8767 		.doit = nl80211_register_mgmt,
8768 		.policy = nl80211_policy,
8769 		.flags = GENL_ADMIN_PERM,
8770 		.internal_flags = NL80211_FLAG_NEED_WDEV |
8771 				  NL80211_FLAG_NEED_RTNL,
8772 	},
8773 	{
8774 		.cmd = NL80211_CMD_FRAME,
8775 		.doit = nl80211_tx_mgmt,
8776 		.policy = nl80211_policy,
8777 		.flags = GENL_ADMIN_PERM,
8778 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8779 				  NL80211_FLAG_NEED_RTNL,
8780 	},
8781 	{
8782 		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8783 		.doit = nl80211_tx_mgmt_cancel_wait,
8784 		.policy = nl80211_policy,
8785 		.flags = GENL_ADMIN_PERM,
8786 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8787 				  NL80211_FLAG_NEED_RTNL,
8788 	},
8789 	{
8790 		.cmd = NL80211_CMD_SET_POWER_SAVE,
8791 		.doit = nl80211_set_power_save,
8792 		.policy = nl80211_policy,
8793 		.flags = GENL_ADMIN_PERM,
8794 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8795 				  NL80211_FLAG_NEED_RTNL,
8796 	},
8797 	{
8798 		.cmd = NL80211_CMD_GET_POWER_SAVE,
8799 		.doit = nl80211_get_power_save,
8800 		.policy = nl80211_policy,
8801 		/* can be retrieved by unprivileged users */
8802 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8803 				  NL80211_FLAG_NEED_RTNL,
8804 	},
8805 	{
8806 		.cmd = NL80211_CMD_SET_CQM,
8807 		.doit = nl80211_set_cqm,
8808 		.policy = nl80211_policy,
8809 		.flags = GENL_ADMIN_PERM,
8810 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8811 				  NL80211_FLAG_NEED_RTNL,
8812 	},
8813 	{
8814 		.cmd = NL80211_CMD_SET_CHANNEL,
8815 		.doit = nl80211_set_channel,
8816 		.policy = nl80211_policy,
8817 		.flags = GENL_ADMIN_PERM,
8818 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8819 				  NL80211_FLAG_NEED_RTNL,
8820 	},
8821 	{
8822 		.cmd = NL80211_CMD_SET_WDS_PEER,
8823 		.doit = nl80211_set_wds_peer,
8824 		.policy = nl80211_policy,
8825 		.flags = GENL_ADMIN_PERM,
8826 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8827 				  NL80211_FLAG_NEED_RTNL,
8828 	},
8829 	{
8830 		.cmd = NL80211_CMD_JOIN_MESH,
8831 		.doit = nl80211_join_mesh,
8832 		.policy = nl80211_policy,
8833 		.flags = GENL_ADMIN_PERM,
8834 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8835 				  NL80211_FLAG_NEED_RTNL,
8836 	},
8837 	{
8838 		.cmd = NL80211_CMD_LEAVE_MESH,
8839 		.doit = nl80211_leave_mesh,
8840 		.policy = nl80211_policy,
8841 		.flags = GENL_ADMIN_PERM,
8842 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8843 				  NL80211_FLAG_NEED_RTNL,
8844 	},
8845 #ifdef CONFIG_PM
8846 	{
8847 		.cmd = NL80211_CMD_GET_WOWLAN,
8848 		.doit = nl80211_get_wowlan,
8849 		.policy = nl80211_policy,
8850 		/* can be retrieved by unprivileged users */
8851 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8852 				  NL80211_FLAG_NEED_RTNL,
8853 	},
8854 	{
8855 		.cmd = NL80211_CMD_SET_WOWLAN,
8856 		.doit = nl80211_set_wowlan,
8857 		.policy = nl80211_policy,
8858 		.flags = GENL_ADMIN_PERM,
8859 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8860 				  NL80211_FLAG_NEED_RTNL,
8861 	},
8862 #endif
8863 	{
8864 		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8865 		.doit = nl80211_set_rekey_data,
8866 		.policy = nl80211_policy,
8867 		.flags = GENL_ADMIN_PERM,
8868 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8869 				  NL80211_FLAG_NEED_RTNL,
8870 	},
8871 	{
8872 		.cmd = NL80211_CMD_TDLS_MGMT,
8873 		.doit = nl80211_tdls_mgmt,
8874 		.policy = nl80211_policy,
8875 		.flags = GENL_ADMIN_PERM,
8876 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8877 				  NL80211_FLAG_NEED_RTNL,
8878 	},
8879 	{
8880 		.cmd = NL80211_CMD_TDLS_OPER,
8881 		.doit = nl80211_tdls_oper,
8882 		.policy = nl80211_policy,
8883 		.flags = GENL_ADMIN_PERM,
8884 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8885 				  NL80211_FLAG_NEED_RTNL,
8886 	},
8887 	{
8888 		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
8889 		.doit = nl80211_register_unexpected_frame,
8890 		.policy = nl80211_policy,
8891 		.flags = GENL_ADMIN_PERM,
8892 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8893 				  NL80211_FLAG_NEED_RTNL,
8894 	},
8895 	{
8896 		.cmd = NL80211_CMD_PROBE_CLIENT,
8897 		.doit = nl80211_probe_client,
8898 		.policy = nl80211_policy,
8899 		.flags = GENL_ADMIN_PERM,
8900 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8901 				  NL80211_FLAG_NEED_RTNL,
8902 	},
8903 	{
8904 		.cmd = NL80211_CMD_REGISTER_BEACONS,
8905 		.doit = nl80211_register_beacons,
8906 		.policy = nl80211_policy,
8907 		.flags = GENL_ADMIN_PERM,
8908 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
8909 				  NL80211_FLAG_NEED_RTNL,
8910 	},
8911 	{
8912 		.cmd = NL80211_CMD_SET_NOACK_MAP,
8913 		.doit = nl80211_set_noack_map,
8914 		.policy = nl80211_policy,
8915 		.flags = GENL_ADMIN_PERM,
8916 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8917 				  NL80211_FLAG_NEED_RTNL,
8918 	},
8919 	{
8920 		.cmd = NL80211_CMD_START_P2P_DEVICE,
8921 		.doit = nl80211_start_p2p_device,
8922 		.policy = nl80211_policy,
8923 		.flags = GENL_ADMIN_PERM,
8924 		.internal_flags = NL80211_FLAG_NEED_WDEV |
8925 				  NL80211_FLAG_NEED_RTNL,
8926 	},
8927 	{
8928 		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
8929 		.doit = nl80211_stop_p2p_device,
8930 		.policy = nl80211_policy,
8931 		.flags = GENL_ADMIN_PERM,
8932 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8933 				  NL80211_FLAG_NEED_RTNL,
8934 	},
8935 	{
8936 		.cmd = NL80211_CMD_SET_MCAST_RATE,
8937 		.doit = nl80211_set_mcast_rate,
8938 		.policy = nl80211_policy,
8939 		.flags = GENL_ADMIN_PERM,
8940 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8941 				  NL80211_FLAG_NEED_RTNL,
8942 	},
8943 	{
8944 		.cmd = NL80211_CMD_SET_MAC_ACL,
8945 		.doit = nl80211_set_mac_acl,
8946 		.policy = nl80211_policy,
8947 		.flags = GENL_ADMIN_PERM,
8948 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
8949 				  NL80211_FLAG_NEED_RTNL,
8950 	},
8951 	{
8952 		.cmd = NL80211_CMD_RADAR_DETECT,
8953 		.doit = nl80211_start_radar_detection,
8954 		.policy = nl80211_policy,
8955 		.flags = GENL_ADMIN_PERM,
8956 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8957 				  NL80211_FLAG_NEED_RTNL,
8958 	},
8959 	{
8960 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8961 		.doit = nl80211_get_protocol_features,
8962 		.policy = nl80211_policy,
8963 	},
8964 	{
8965 		.cmd = NL80211_CMD_UPDATE_FT_IES,
8966 		.doit = nl80211_update_ft_ies,
8967 		.policy = nl80211_policy,
8968 		.flags = GENL_ADMIN_PERM,
8969 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8970 				  NL80211_FLAG_NEED_RTNL,
8971 	},
8972 	{
8973 		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
8974 		.doit = nl80211_crit_protocol_start,
8975 		.policy = nl80211_policy,
8976 		.flags = GENL_ADMIN_PERM,
8977 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8978 				  NL80211_FLAG_NEED_RTNL,
8979 	},
8980 	{
8981 		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
8982 		.doit = nl80211_crit_protocol_stop,
8983 		.policy = nl80211_policy,
8984 		.flags = GENL_ADMIN_PERM,
8985 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8986 				  NL80211_FLAG_NEED_RTNL,
8987 	}
8988 };
8989 
8990 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8991 	.name = "mlme",
8992 };
8993 
8994 /* multicast groups */
8995 static struct genl_multicast_group nl80211_config_mcgrp = {
8996 	.name = "config",
8997 };
8998 static struct genl_multicast_group nl80211_scan_mcgrp = {
8999 	.name = "scan",
9000 };
9001 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9002 	.name = "regulatory",
9003 };
9004 
9005 /* notification functions */
9006 
9007 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9008 {
9009 	struct sk_buff *msg;
9010 
9011 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9012 	if (!msg)
9013 		return;
9014 
9015 	if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
9016 			       false, NULL, NULL, NULL) < 0) {
9017 		nlmsg_free(msg);
9018 		return;
9019 	}
9020 
9021 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9022 				nl80211_config_mcgrp.id, GFP_KERNEL);
9023 }
9024 
9025 static int nl80211_add_scan_req(struct sk_buff *msg,
9026 				struct cfg80211_registered_device *rdev)
9027 {
9028 	struct cfg80211_scan_request *req = rdev->scan_req;
9029 	struct nlattr *nest;
9030 	int i;
9031 
9032 	lockdep_assert_held(&rdev->sched_scan_mtx);
9033 
9034 	if (WARN_ON(!req))
9035 		return 0;
9036 
9037 	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9038 	if (!nest)
9039 		goto nla_put_failure;
9040 	for (i = 0; i < req->n_ssids; i++) {
9041 		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9042 			goto nla_put_failure;
9043 	}
9044 	nla_nest_end(msg, nest);
9045 
9046 	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9047 	if (!nest)
9048 		goto nla_put_failure;
9049 	for (i = 0; i < req->n_channels; i++) {
9050 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9051 			goto nla_put_failure;
9052 	}
9053 	nla_nest_end(msg, nest);
9054 
9055 	if (req->ie &&
9056 	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9057 		goto nla_put_failure;
9058 
9059 	if (req->flags)
9060 		nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9061 
9062 	return 0;
9063  nla_put_failure:
9064 	return -ENOBUFS;
9065 }
9066 
9067 static int nl80211_send_scan_msg(struct sk_buff *msg,
9068 				 struct cfg80211_registered_device *rdev,
9069 				 struct wireless_dev *wdev,
9070 				 u32 portid, u32 seq, int flags,
9071 				 u32 cmd)
9072 {
9073 	void *hdr;
9074 
9075 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9076 	if (!hdr)
9077 		return -1;
9078 
9079 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9080 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9081 					 wdev->netdev->ifindex)) ||
9082 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9083 		goto nla_put_failure;
9084 
9085 	/* ignore errors and send incomplete event anyway */
9086 	nl80211_add_scan_req(msg, rdev);
9087 
9088 	return genlmsg_end(msg, hdr);
9089 
9090  nla_put_failure:
9091 	genlmsg_cancel(msg, hdr);
9092 	return -EMSGSIZE;
9093 }
9094 
9095 static int
9096 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9097 			    struct cfg80211_registered_device *rdev,
9098 			    struct net_device *netdev,
9099 			    u32 portid, u32 seq, int flags, u32 cmd)
9100 {
9101 	void *hdr;
9102 
9103 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9104 	if (!hdr)
9105 		return -1;
9106 
9107 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9108 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9109 		goto nla_put_failure;
9110 
9111 	return genlmsg_end(msg, hdr);
9112 
9113  nla_put_failure:
9114 	genlmsg_cancel(msg, hdr);
9115 	return -EMSGSIZE;
9116 }
9117 
9118 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9119 			     struct wireless_dev *wdev)
9120 {
9121 	struct sk_buff *msg;
9122 
9123 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9124 	if (!msg)
9125 		return;
9126 
9127 	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9128 				  NL80211_CMD_TRIGGER_SCAN) < 0) {
9129 		nlmsg_free(msg);
9130 		return;
9131 	}
9132 
9133 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9134 				nl80211_scan_mcgrp.id, GFP_KERNEL);
9135 }
9136 
9137 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9138 			    struct wireless_dev *wdev)
9139 {
9140 	struct sk_buff *msg;
9141 
9142 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9143 	if (!msg)
9144 		return;
9145 
9146 	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9147 				  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9148 		nlmsg_free(msg);
9149 		return;
9150 	}
9151 
9152 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9153 				nl80211_scan_mcgrp.id, GFP_KERNEL);
9154 }
9155 
9156 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9157 			       struct wireless_dev *wdev)
9158 {
9159 	struct sk_buff *msg;
9160 
9161 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9162 	if (!msg)
9163 		return;
9164 
9165 	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9166 				  NL80211_CMD_SCAN_ABORTED) < 0) {
9167 		nlmsg_free(msg);
9168 		return;
9169 	}
9170 
9171 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9172 				nl80211_scan_mcgrp.id, GFP_KERNEL);
9173 }
9174 
9175 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9176 				     struct net_device *netdev)
9177 {
9178 	struct sk_buff *msg;
9179 
9180 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9181 	if (!msg)
9182 		return;
9183 
9184 	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9185 					NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9186 		nlmsg_free(msg);
9187 		return;
9188 	}
9189 
9190 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9191 				nl80211_scan_mcgrp.id, GFP_KERNEL);
9192 }
9193 
9194 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9195 			     struct net_device *netdev, u32 cmd)
9196 {
9197 	struct sk_buff *msg;
9198 
9199 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9200 	if (!msg)
9201 		return;
9202 
9203 	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9204 		nlmsg_free(msg);
9205 		return;
9206 	}
9207 
9208 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9209 				nl80211_scan_mcgrp.id, GFP_KERNEL);
9210 }
9211 
9212 /*
9213  * This can happen on global regulatory changes or device specific settings
9214  * based on custom world regulatory domains.
9215  */
9216 void nl80211_send_reg_change_event(struct regulatory_request *request)
9217 {
9218 	struct sk_buff *msg;
9219 	void *hdr;
9220 
9221 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9222 	if (!msg)
9223 		return;
9224 
9225 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9226 	if (!hdr) {
9227 		nlmsg_free(msg);
9228 		return;
9229 	}
9230 
9231 	/* Userspace can always count this one always being set */
9232 	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9233 		goto nla_put_failure;
9234 
9235 	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9236 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9237 			       NL80211_REGDOM_TYPE_WORLD))
9238 			goto nla_put_failure;
9239 	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9240 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9241 			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9242 			goto nla_put_failure;
9243 	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9244 		   request->intersect) {
9245 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9246 			       NL80211_REGDOM_TYPE_INTERSECTION))
9247 			goto nla_put_failure;
9248 	} else {
9249 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9250 			       NL80211_REGDOM_TYPE_COUNTRY) ||
9251 		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9252 				   request->alpha2))
9253 			goto nla_put_failure;
9254 	}
9255 
9256 	if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9257 	    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9258 		goto nla_put_failure;
9259 
9260 	genlmsg_end(msg, hdr);
9261 
9262 	rcu_read_lock();
9263 	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9264 				GFP_ATOMIC);
9265 	rcu_read_unlock();
9266 
9267 	return;
9268 
9269 nla_put_failure:
9270 	genlmsg_cancel(msg, hdr);
9271 	nlmsg_free(msg);
9272 }
9273 
9274 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9275 				    struct net_device *netdev,
9276 				    const u8 *buf, size_t len,
9277 				    enum nl80211_commands cmd, gfp_t gfp)
9278 {
9279 	struct sk_buff *msg;
9280 	void *hdr;
9281 
9282 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9283 	if (!msg)
9284 		return;
9285 
9286 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9287 	if (!hdr) {
9288 		nlmsg_free(msg);
9289 		return;
9290 	}
9291 
9292 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9293 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9294 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9295 		goto nla_put_failure;
9296 
9297 	genlmsg_end(msg, hdr);
9298 
9299 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9300 				nl80211_mlme_mcgrp.id, gfp);
9301 	return;
9302 
9303  nla_put_failure:
9304 	genlmsg_cancel(msg, hdr);
9305 	nlmsg_free(msg);
9306 }
9307 
9308 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9309 			  struct net_device *netdev, const u8 *buf,
9310 			  size_t len, gfp_t gfp)
9311 {
9312 	nl80211_send_mlme_event(rdev, netdev, buf, len,
9313 				NL80211_CMD_AUTHENTICATE, gfp);
9314 }
9315 
9316 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9317 			   struct net_device *netdev, const u8 *buf,
9318 			   size_t len, gfp_t gfp)
9319 {
9320 	nl80211_send_mlme_event(rdev, netdev, buf, len,
9321 				NL80211_CMD_ASSOCIATE, gfp);
9322 }
9323 
9324 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9325 			 struct net_device *netdev, const u8 *buf,
9326 			 size_t len, gfp_t gfp)
9327 {
9328 	nl80211_send_mlme_event(rdev, netdev, buf, len,
9329 				NL80211_CMD_DEAUTHENTICATE, gfp);
9330 }
9331 
9332 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9333 			   struct net_device *netdev, const u8 *buf,
9334 			   size_t len, gfp_t gfp)
9335 {
9336 	nl80211_send_mlme_event(rdev, netdev, buf, len,
9337 				NL80211_CMD_DISASSOCIATE, gfp);
9338 }
9339 
9340 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
9341 				 size_t len)
9342 {
9343 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9344 	struct wiphy *wiphy = wdev->wiphy;
9345 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9346 
9347 	trace_cfg80211_send_unprot_deauth(dev);
9348 	nl80211_send_mlme_event(rdev, dev, buf, len,
9349 				NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
9350 }
9351 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
9352 
9353 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
9354 				   size_t len)
9355 {
9356 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9357 	struct wiphy *wiphy = wdev->wiphy;
9358 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9359 
9360 	trace_cfg80211_send_unprot_disassoc(dev);
9361 	nl80211_send_mlme_event(rdev, dev, buf, len,
9362 				NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
9363 }
9364 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
9365 
9366 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9367 				      struct net_device *netdev, int cmd,
9368 				      const u8 *addr, gfp_t gfp)
9369 {
9370 	struct sk_buff *msg;
9371 	void *hdr;
9372 
9373 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9374 	if (!msg)
9375 		return;
9376 
9377 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9378 	if (!hdr) {
9379 		nlmsg_free(msg);
9380 		return;
9381 	}
9382 
9383 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9384 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9385 	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9386 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9387 		goto nla_put_failure;
9388 
9389 	genlmsg_end(msg, hdr);
9390 
9391 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9392 				nl80211_mlme_mcgrp.id, gfp);
9393 	return;
9394 
9395  nla_put_failure:
9396 	genlmsg_cancel(msg, hdr);
9397 	nlmsg_free(msg);
9398 }
9399 
9400 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9401 			       struct net_device *netdev, const u8 *addr,
9402 			       gfp_t gfp)
9403 {
9404 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9405 				  addr, gfp);
9406 }
9407 
9408 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9409 				struct net_device *netdev, const u8 *addr,
9410 				gfp_t gfp)
9411 {
9412 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9413 				  addr, gfp);
9414 }
9415 
9416 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9417 				 struct net_device *netdev, const u8 *bssid,
9418 				 const u8 *req_ie, size_t req_ie_len,
9419 				 const u8 *resp_ie, size_t resp_ie_len,
9420 				 u16 status, gfp_t gfp)
9421 {
9422 	struct sk_buff *msg;
9423 	void *hdr;
9424 
9425 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9426 	if (!msg)
9427 		return;
9428 
9429 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9430 	if (!hdr) {
9431 		nlmsg_free(msg);
9432 		return;
9433 	}
9434 
9435 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9436 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9437 	    (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9438 	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9439 	    (req_ie &&
9440 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9441 	    (resp_ie &&
9442 	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9443 		goto nla_put_failure;
9444 
9445 	genlmsg_end(msg, hdr);
9446 
9447 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9448 				nl80211_mlme_mcgrp.id, gfp);
9449 	return;
9450 
9451  nla_put_failure:
9452 	genlmsg_cancel(msg, hdr);
9453 	nlmsg_free(msg);
9454 
9455 }
9456 
9457 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9458 			 struct net_device *netdev, const u8 *bssid,
9459 			 const u8 *req_ie, size_t req_ie_len,
9460 			 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9461 {
9462 	struct sk_buff *msg;
9463 	void *hdr;
9464 
9465 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9466 	if (!msg)
9467 		return;
9468 
9469 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9470 	if (!hdr) {
9471 		nlmsg_free(msg);
9472 		return;
9473 	}
9474 
9475 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9476 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9477 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9478 	    (req_ie &&
9479 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9480 	    (resp_ie &&
9481 	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9482 		goto nla_put_failure;
9483 
9484 	genlmsg_end(msg, hdr);
9485 
9486 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9487 				nl80211_mlme_mcgrp.id, gfp);
9488 	return;
9489 
9490  nla_put_failure:
9491 	genlmsg_cancel(msg, hdr);
9492 	nlmsg_free(msg);
9493 
9494 }
9495 
9496 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9497 			       struct net_device *netdev, u16 reason,
9498 			       const u8 *ie, size_t ie_len, bool from_ap)
9499 {
9500 	struct sk_buff *msg;
9501 	void *hdr;
9502 
9503 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9504 	if (!msg)
9505 		return;
9506 
9507 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9508 	if (!hdr) {
9509 		nlmsg_free(msg);
9510 		return;
9511 	}
9512 
9513 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9514 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9515 	    (from_ap && reason &&
9516 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9517 	    (from_ap &&
9518 	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9519 	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9520 		goto nla_put_failure;
9521 
9522 	genlmsg_end(msg, hdr);
9523 
9524 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9525 				nl80211_mlme_mcgrp.id, GFP_KERNEL);
9526 	return;
9527 
9528  nla_put_failure:
9529 	genlmsg_cancel(msg, hdr);
9530 	nlmsg_free(msg);
9531 
9532 }
9533 
9534 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9535 			     struct net_device *netdev, const u8 *bssid,
9536 			     gfp_t gfp)
9537 {
9538 	struct sk_buff *msg;
9539 	void *hdr;
9540 
9541 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9542 	if (!msg)
9543 		return;
9544 
9545 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9546 	if (!hdr) {
9547 		nlmsg_free(msg);
9548 		return;
9549 	}
9550 
9551 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9552 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9553 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9554 		goto nla_put_failure;
9555 
9556 	genlmsg_end(msg, hdr);
9557 
9558 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9559 				nl80211_mlme_mcgrp.id, gfp);
9560 	return;
9561 
9562  nla_put_failure:
9563 	genlmsg_cancel(msg, hdr);
9564 	nlmsg_free(msg);
9565 }
9566 
9567 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9568 					const u8* ie, u8 ie_len, gfp_t gfp)
9569 {
9570 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9571 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9572 	struct sk_buff *msg;
9573 	void *hdr;
9574 
9575 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9576 		return;
9577 
9578 	trace_cfg80211_notify_new_peer_candidate(dev, addr);
9579 
9580 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9581 	if (!msg)
9582 		return;
9583 
9584 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9585 	if (!hdr) {
9586 		nlmsg_free(msg);
9587 		return;
9588 	}
9589 
9590 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9591 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9592 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9593 	    (ie_len && ie &&
9594 	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9595 		goto nla_put_failure;
9596 
9597 	genlmsg_end(msg, hdr);
9598 
9599 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9600 				nl80211_mlme_mcgrp.id, gfp);
9601 	return;
9602 
9603  nla_put_failure:
9604 	genlmsg_cancel(msg, hdr);
9605 	nlmsg_free(msg);
9606 }
9607 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9608 
9609 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9610 				 struct net_device *netdev, const u8 *addr,
9611 				 enum nl80211_key_type key_type, int key_id,
9612 				 const u8 *tsc, gfp_t gfp)
9613 {
9614 	struct sk_buff *msg;
9615 	void *hdr;
9616 
9617 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9618 	if (!msg)
9619 		return;
9620 
9621 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9622 	if (!hdr) {
9623 		nlmsg_free(msg);
9624 		return;
9625 	}
9626 
9627 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9628 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9629 	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9630 	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9631 	    (key_id != -1 &&
9632 	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9633 	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9634 		goto nla_put_failure;
9635 
9636 	genlmsg_end(msg, hdr);
9637 
9638 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9639 				nl80211_mlme_mcgrp.id, gfp);
9640 	return;
9641 
9642  nla_put_failure:
9643 	genlmsg_cancel(msg, hdr);
9644 	nlmsg_free(msg);
9645 }
9646 
9647 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9648 				    struct ieee80211_channel *channel_before,
9649 				    struct ieee80211_channel *channel_after)
9650 {
9651 	struct sk_buff *msg;
9652 	void *hdr;
9653 	struct nlattr *nl_freq;
9654 
9655 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9656 	if (!msg)
9657 		return;
9658 
9659 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9660 	if (!hdr) {
9661 		nlmsg_free(msg);
9662 		return;
9663 	}
9664 
9665 	/*
9666 	 * Since we are applying the beacon hint to a wiphy we know its
9667 	 * wiphy_idx is valid
9668 	 */
9669 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9670 		goto nla_put_failure;
9671 
9672 	/* Before */
9673 	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9674 	if (!nl_freq)
9675 		goto nla_put_failure;
9676 	if (nl80211_msg_put_channel(msg, channel_before, false))
9677 		goto nla_put_failure;
9678 	nla_nest_end(msg, nl_freq);
9679 
9680 	/* After */
9681 	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9682 	if (!nl_freq)
9683 		goto nla_put_failure;
9684 	if (nl80211_msg_put_channel(msg, channel_after, false))
9685 		goto nla_put_failure;
9686 	nla_nest_end(msg, nl_freq);
9687 
9688 	genlmsg_end(msg, hdr);
9689 
9690 	rcu_read_lock();
9691 	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9692 				GFP_ATOMIC);
9693 	rcu_read_unlock();
9694 
9695 	return;
9696 
9697 nla_put_failure:
9698 	genlmsg_cancel(msg, hdr);
9699 	nlmsg_free(msg);
9700 }
9701 
9702 static void nl80211_send_remain_on_chan_event(
9703 	int cmd, struct cfg80211_registered_device *rdev,
9704 	struct wireless_dev *wdev, u64 cookie,
9705 	struct ieee80211_channel *chan,
9706 	unsigned int duration, gfp_t gfp)
9707 {
9708 	struct sk_buff *msg;
9709 	void *hdr;
9710 
9711 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9712 	if (!msg)
9713 		return;
9714 
9715 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9716 	if (!hdr) {
9717 		nlmsg_free(msg);
9718 		return;
9719 	}
9720 
9721 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9722 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9723 					 wdev->netdev->ifindex)) ||
9724 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9725 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9726 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9727 			NL80211_CHAN_NO_HT) ||
9728 	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9729 		goto nla_put_failure;
9730 
9731 	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9732 	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9733 		goto nla_put_failure;
9734 
9735 	genlmsg_end(msg, hdr);
9736 
9737 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9738 				nl80211_mlme_mcgrp.id, gfp);
9739 	return;
9740 
9741  nla_put_failure:
9742 	genlmsg_cancel(msg, hdr);
9743 	nlmsg_free(msg);
9744 }
9745 
9746 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9747 			       struct ieee80211_channel *chan,
9748 			       unsigned int duration, gfp_t gfp)
9749 {
9750 	struct wiphy *wiphy = wdev->wiphy;
9751 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9752 
9753 	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9754 	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9755 					  rdev, wdev, cookie, chan,
9756 					  duration, gfp);
9757 }
9758 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9759 
9760 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9761 					struct ieee80211_channel *chan,
9762 					gfp_t gfp)
9763 {
9764 	struct wiphy *wiphy = wdev->wiphy;
9765 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9766 
9767 	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9768 	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9769 					  rdev, wdev, cookie, chan, 0, gfp);
9770 }
9771 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9772 
9773 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9774 		      struct station_info *sinfo, gfp_t gfp)
9775 {
9776 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9777 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9778 	struct sk_buff *msg;
9779 
9780 	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9781 
9782 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9783 	if (!msg)
9784 		return;
9785 
9786 	if (nl80211_send_station(msg, 0, 0, 0,
9787 				 rdev, dev, mac_addr, sinfo) < 0) {
9788 		nlmsg_free(msg);
9789 		return;
9790 	}
9791 
9792 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9793 				nl80211_mlme_mcgrp.id, gfp);
9794 }
9795 EXPORT_SYMBOL(cfg80211_new_sta);
9796 
9797 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9798 {
9799 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9800 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9801 	struct sk_buff *msg;
9802 	void *hdr;
9803 
9804 	trace_cfg80211_del_sta(dev, mac_addr);
9805 
9806 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9807 	if (!msg)
9808 		return;
9809 
9810 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9811 	if (!hdr) {
9812 		nlmsg_free(msg);
9813 		return;
9814 	}
9815 
9816 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9817 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9818 		goto nla_put_failure;
9819 
9820 	genlmsg_end(msg, hdr);
9821 
9822 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9823 				nl80211_mlme_mcgrp.id, gfp);
9824 	return;
9825 
9826  nla_put_failure:
9827 	genlmsg_cancel(msg, hdr);
9828 	nlmsg_free(msg);
9829 }
9830 EXPORT_SYMBOL(cfg80211_del_sta);
9831 
9832 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9833 			  enum nl80211_connect_failed_reason reason,
9834 			  gfp_t gfp)
9835 {
9836 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9837 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9838 	struct sk_buff *msg;
9839 	void *hdr;
9840 
9841 	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9842 	if (!msg)
9843 		return;
9844 
9845 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9846 	if (!hdr) {
9847 		nlmsg_free(msg);
9848 		return;
9849 	}
9850 
9851 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9852 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9853 	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9854 		goto nla_put_failure;
9855 
9856 	genlmsg_end(msg, hdr);
9857 
9858 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9859 				nl80211_mlme_mcgrp.id, gfp);
9860 	return;
9861 
9862  nla_put_failure:
9863 	genlmsg_cancel(msg, hdr);
9864 	nlmsg_free(msg);
9865 }
9866 EXPORT_SYMBOL(cfg80211_conn_failed);
9867 
9868 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9869 				       const u8 *addr, gfp_t gfp)
9870 {
9871 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9872 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9873 	struct sk_buff *msg;
9874 	void *hdr;
9875 	int err;
9876 	u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9877 
9878 	if (!nlportid)
9879 		return false;
9880 
9881 	msg = nlmsg_new(100, gfp);
9882 	if (!msg)
9883 		return true;
9884 
9885 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9886 	if (!hdr) {
9887 		nlmsg_free(msg);
9888 		return true;
9889 	}
9890 
9891 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9892 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9893 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9894 		goto nla_put_failure;
9895 
9896 	err = genlmsg_end(msg, hdr);
9897 	if (err < 0) {
9898 		nlmsg_free(msg);
9899 		return true;
9900 	}
9901 
9902 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9903 	return true;
9904 
9905  nla_put_failure:
9906 	genlmsg_cancel(msg, hdr);
9907 	nlmsg_free(msg);
9908 	return true;
9909 }
9910 
9911 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9912 				const u8 *addr, gfp_t gfp)
9913 {
9914 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9915 	bool ret;
9916 
9917 	trace_cfg80211_rx_spurious_frame(dev, addr);
9918 
9919 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9920 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9921 		trace_cfg80211_return_bool(false);
9922 		return false;
9923 	}
9924 	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9925 					 addr, gfp);
9926 	trace_cfg80211_return_bool(ret);
9927 	return ret;
9928 }
9929 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9930 
9931 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9932 					const u8 *addr, gfp_t gfp)
9933 {
9934 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9935 	bool ret;
9936 
9937 	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9938 
9939 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9940 		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9941 		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9942 		trace_cfg80211_return_bool(false);
9943 		return false;
9944 	}
9945 	ret = __nl80211_unexpected_frame(dev,
9946 					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9947 					 addr, gfp);
9948 	trace_cfg80211_return_bool(ret);
9949 	return ret;
9950 }
9951 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9952 
9953 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9954 		      struct wireless_dev *wdev, u32 nlportid,
9955 		      int freq, int sig_dbm,
9956 		      const u8 *buf, size_t len, gfp_t gfp)
9957 {
9958 	struct net_device *netdev = wdev->netdev;
9959 	struct sk_buff *msg;
9960 	void *hdr;
9961 
9962 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9963 	if (!msg)
9964 		return -ENOMEM;
9965 
9966 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9967 	if (!hdr) {
9968 		nlmsg_free(msg);
9969 		return -ENOMEM;
9970 	}
9971 
9972 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9973 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9974 					netdev->ifindex)) ||
9975 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9976 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9977 	    (sig_dbm &&
9978 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9979 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9980 		goto nla_put_failure;
9981 
9982 	genlmsg_end(msg, hdr);
9983 
9984 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9985 
9986  nla_put_failure:
9987 	genlmsg_cancel(msg, hdr);
9988 	nlmsg_free(msg);
9989 	return -ENOBUFS;
9990 }
9991 
9992 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
9993 			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
9994 {
9995 	struct wiphy *wiphy = wdev->wiphy;
9996 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9997 	struct net_device *netdev = wdev->netdev;
9998 	struct sk_buff *msg;
9999 	void *hdr;
10000 
10001 	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10002 
10003 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10004 	if (!msg)
10005 		return;
10006 
10007 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10008 	if (!hdr) {
10009 		nlmsg_free(msg);
10010 		return;
10011 	}
10012 
10013 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10014 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10015 				   netdev->ifindex)) ||
10016 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10017 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10018 	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10019 	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10020 		goto nla_put_failure;
10021 
10022 	genlmsg_end(msg, hdr);
10023 
10024 	genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
10025 	return;
10026 
10027  nla_put_failure:
10028 	genlmsg_cancel(msg, hdr);
10029 	nlmsg_free(msg);
10030 }
10031 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10032 
10033 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10034 			      enum nl80211_cqm_rssi_threshold_event rssi_event,
10035 			      gfp_t gfp)
10036 {
10037 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10038 	struct wiphy *wiphy = wdev->wiphy;
10039 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10040 	struct sk_buff *msg;
10041 	struct nlattr *pinfoattr;
10042 	void *hdr;
10043 
10044 	trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10045 
10046 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10047 	if (!msg)
10048 		return;
10049 
10050 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10051 	if (!hdr) {
10052 		nlmsg_free(msg);
10053 		return;
10054 	}
10055 
10056 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10057 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10058 		goto nla_put_failure;
10059 
10060 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10061 	if (!pinfoattr)
10062 		goto nla_put_failure;
10063 
10064 	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10065 			rssi_event))
10066 		goto nla_put_failure;
10067 
10068 	nla_nest_end(msg, pinfoattr);
10069 
10070 	genlmsg_end(msg, hdr);
10071 
10072 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10073 				nl80211_mlme_mcgrp.id, gfp);
10074 	return;
10075 
10076  nla_put_failure:
10077 	genlmsg_cancel(msg, hdr);
10078 	nlmsg_free(msg);
10079 }
10080 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10081 
10082 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10083 				     struct net_device *netdev, const u8 *bssid,
10084 				     const u8 *replay_ctr, gfp_t gfp)
10085 {
10086 	struct sk_buff *msg;
10087 	struct nlattr *rekey_attr;
10088 	void *hdr;
10089 
10090 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10091 	if (!msg)
10092 		return;
10093 
10094 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10095 	if (!hdr) {
10096 		nlmsg_free(msg);
10097 		return;
10098 	}
10099 
10100 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10101 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10102 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10103 		goto nla_put_failure;
10104 
10105 	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10106 	if (!rekey_attr)
10107 		goto nla_put_failure;
10108 
10109 	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10110 		    NL80211_REPLAY_CTR_LEN, replay_ctr))
10111 		goto nla_put_failure;
10112 
10113 	nla_nest_end(msg, rekey_attr);
10114 
10115 	genlmsg_end(msg, hdr);
10116 
10117 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10118 				nl80211_mlme_mcgrp.id, gfp);
10119 	return;
10120 
10121  nla_put_failure:
10122 	genlmsg_cancel(msg, hdr);
10123 	nlmsg_free(msg);
10124 }
10125 
10126 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10127 			       const u8 *replay_ctr, gfp_t gfp)
10128 {
10129 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10130 	struct wiphy *wiphy = wdev->wiphy;
10131 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10132 
10133 	trace_cfg80211_gtk_rekey_notify(dev, bssid);
10134 	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10135 }
10136 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10137 
10138 static void
10139 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10140 			       struct net_device *netdev, int index,
10141 			       const u8 *bssid, bool preauth, gfp_t gfp)
10142 {
10143 	struct sk_buff *msg;
10144 	struct nlattr *attr;
10145 	void *hdr;
10146 
10147 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10148 	if (!msg)
10149 		return;
10150 
10151 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10152 	if (!hdr) {
10153 		nlmsg_free(msg);
10154 		return;
10155 	}
10156 
10157 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10158 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10159 		goto nla_put_failure;
10160 
10161 	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10162 	if (!attr)
10163 		goto nla_put_failure;
10164 
10165 	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10166 	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10167 	    (preauth &&
10168 	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10169 		goto nla_put_failure;
10170 
10171 	nla_nest_end(msg, attr);
10172 
10173 	genlmsg_end(msg, hdr);
10174 
10175 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10176 				nl80211_mlme_mcgrp.id, gfp);
10177 	return;
10178 
10179  nla_put_failure:
10180 	genlmsg_cancel(msg, hdr);
10181 	nlmsg_free(msg);
10182 }
10183 
10184 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10185 				     const u8 *bssid, bool preauth, gfp_t gfp)
10186 {
10187 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10188 	struct wiphy *wiphy = wdev->wiphy;
10189 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10190 
10191 	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10192 	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10193 }
10194 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10195 
10196 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10197 				     struct net_device *netdev,
10198 				     struct cfg80211_chan_def *chandef,
10199 				     gfp_t gfp)
10200 {
10201 	struct sk_buff *msg;
10202 	void *hdr;
10203 
10204 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10205 	if (!msg)
10206 		return;
10207 
10208 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10209 	if (!hdr) {
10210 		nlmsg_free(msg);
10211 		return;
10212 	}
10213 
10214 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10215 		goto nla_put_failure;
10216 
10217 	if (nl80211_send_chandef(msg, chandef))
10218 		goto nla_put_failure;
10219 
10220 	genlmsg_end(msg, hdr);
10221 
10222 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10223 				nl80211_mlme_mcgrp.id, gfp);
10224 	return;
10225 
10226  nla_put_failure:
10227 	genlmsg_cancel(msg, hdr);
10228 	nlmsg_free(msg);
10229 }
10230 
10231 void cfg80211_ch_switch_notify(struct net_device *dev,
10232 			       struct cfg80211_chan_def *chandef)
10233 {
10234 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10235 	struct wiphy *wiphy = wdev->wiphy;
10236 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10237 
10238 	trace_cfg80211_ch_switch_notify(dev, chandef);
10239 
10240 	wdev_lock(wdev);
10241 
10242 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10243 		    wdev->iftype != NL80211_IFTYPE_P2P_GO))
10244 		goto out;
10245 
10246 	wdev->channel = chandef->chan;
10247 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10248 out:
10249 	wdev_unlock(wdev);
10250 	return;
10251 }
10252 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10253 
10254 void cfg80211_cqm_txe_notify(struct net_device *dev,
10255 			     const u8 *peer, u32 num_packets,
10256 			     u32 rate, u32 intvl, gfp_t gfp)
10257 {
10258 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10259 	struct wiphy *wiphy = wdev->wiphy;
10260 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10261 	struct sk_buff *msg;
10262 	struct nlattr *pinfoattr;
10263 	void *hdr;
10264 
10265 	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10266 	if (!msg)
10267 		return;
10268 
10269 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10270 	if (!hdr) {
10271 		nlmsg_free(msg);
10272 		return;
10273 	}
10274 
10275 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10276 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10277 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10278 		goto nla_put_failure;
10279 
10280 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10281 	if (!pinfoattr)
10282 		goto nla_put_failure;
10283 
10284 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10285 		goto nla_put_failure;
10286 
10287 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10288 		goto nla_put_failure;
10289 
10290 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10291 		goto nla_put_failure;
10292 
10293 	nla_nest_end(msg, pinfoattr);
10294 
10295 	genlmsg_end(msg, hdr);
10296 
10297 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10298 				nl80211_mlme_mcgrp.id, gfp);
10299 	return;
10300 
10301  nla_put_failure:
10302 	genlmsg_cancel(msg, hdr);
10303 	nlmsg_free(msg);
10304 }
10305 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10306 
10307 void
10308 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10309 		     struct cfg80211_chan_def *chandef,
10310 		     enum nl80211_radar_event event,
10311 		     struct net_device *netdev, gfp_t gfp)
10312 {
10313 	struct sk_buff *msg;
10314 	void *hdr;
10315 
10316 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10317 	if (!msg)
10318 		return;
10319 
10320 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10321 	if (!hdr) {
10322 		nlmsg_free(msg);
10323 		return;
10324 	}
10325 
10326 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10327 		goto nla_put_failure;
10328 
10329 	/* NOP and radar events don't need a netdev parameter */
10330 	if (netdev) {
10331 		struct wireless_dev *wdev = netdev->ieee80211_ptr;
10332 
10333 		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10334 		    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10335 			goto nla_put_failure;
10336 	}
10337 
10338 	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10339 		goto nla_put_failure;
10340 
10341 	if (nl80211_send_chandef(msg, chandef))
10342 		goto nla_put_failure;
10343 
10344 	if (genlmsg_end(msg, hdr) < 0) {
10345 		nlmsg_free(msg);
10346 		return;
10347 	}
10348 
10349 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10350 				nl80211_mlme_mcgrp.id, gfp);
10351 	return;
10352 
10353  nla_put_failure:
10354 	genlmsg_cancel(msg, hdr);
10355 	nlmsg_free(msg);
10356 }
10357 
10358 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10359 				 const u8 *peer, u32 num_packets, gfp_t gfp)
10360 {
10361 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10362 	struct wiphy *wiphy = wdev->wiphy;
10363 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10364 	struct sk_buff *msg;
10365 	struct nlattr *pinfoattr;
10366 	void *hdr;
10367 
10368 	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10369 
10370 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10371 	if (!msg)
10372 		return;
10373 
10374 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10375 	if (!hdr) {
10376 		nlmsg_free(msg);
10377 		return;
10378 	}
10379 
10380 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10381 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10382 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10383 		goto nla_put_failure;
10384 
10385 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10386 	if (!pinfoattr)
10387 		goto nla_put_failure;
10388 
10389 	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10390 		goto nla_put_failure;
10391 
10392 	nla_nest_end(msg, pinfoattr);
10393 
10394 	genlmsg_end(msg, hdr);
10395 
10396 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10397 				nl80211_mlme_mcgrp.id, gfp);
10398 	return;
10399 
10400  nla_put_failure:
10401 	genlmsg_cancel(msg, hdr);
10402 	nlmsg_free(msg);
10403 }
10404 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10405 
10406 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10407 			   u64 cookie, bool acked, gfp_t gfp)
10408 {
10409 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10410 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10411 	struct sk_buff *msg;
10412 	void *hdr;
10413 	int err;
10414 
10415 	trace_cfg80211_probe_status(dev, addr, cookie, acked);
10416 
10417 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10418 
10419 	if (!msg)
10420 		return;
10421 
10422 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10423 	if (!hdr) {
10424 		nlmsg_free(msg);
10425 		return;
10426 	}
10427 
10428 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10429 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10430 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10431 	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10432 	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10433 		goto nla_put_failure;
10434 
10435 	err = genlmsg_end(msg, hdr);
10436 	if (err < 0) {
10437 		nlmsg_free(msg);
10438 		return;
10439 	}
10440 
10441 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10442 				nl80211_mlme_mcgrp.id, gfp);
10443 	return;
10444 
10445  nla_put_failure:
10446 	genlmsg_cancel(msg, hdr);
10447 	nlmsg_free(msg);
10448 }
10449 EXPORT_SYMBOL(cfg80211_probe_status);
10450 
10451 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10452 				 const u8 *frame, size_t len,
10453 				 int freq, int sig_dbm)
10454 {
10455 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10456 	struct sk_buff *msg;
10457 	void *hdr;
10458 	struct cfg80211_beacon_registration *reg;
10459 
10460 	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10461 
10462 	spin_lock_bh(&rdev->beacon_registrations_lock);
10463 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10464 		msg = nlmsg_new(len + 100, GFP_ATOMIC);
10465 		if (!msg) {
10466 			spin_unlock_bh(&rdev->beacon_registrations_lock);
10467 			return;
10468 		}
10469 
10470 		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10471 		if (!hdr)
10472 			goto nla_put_failure;
10473 
10474 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10475 		    (freq &&
10476 		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10477 		    (sig_dbm &&
10478 		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10479 		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10480 			goto nla_put_failure;
10481 
10482 		genlmsg_end(msg, hdr);
10483 
10484 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10485 	}
10486 	spin_unlock_bh(&rdev->beacon_registrations_lock);
10487 	return;
10488 
10489  nla_put_failure:
10490 	spin_unlock_bh(&rdev->beacon_registrations_lock);
10491 	if (hdr)
10492 		genlmsg_cancel(msg, hdr);
10493 	nlmsg_free(msg);
10494 }
10495 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10496 
10497 #ifdef CONFIG_PM
10498 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10499 				   struct cfg80211_wowlan_wakeup *wakeup,
10500 				   gfp_t gfp)
10501 {
10502 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10503 	struct sk_buff *msg;
10504 	void *hdr;
10505 	int err, size = 200;
10506 
10507 	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10508 
10509 	if (wakeup)
10510 		size += wakeup->packet_present_len;
10511 
10512 	msg = nlmsg_new(size, gfp);
10513 	if (!msg)
10514 		return;
10515 
10516 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10517 	if (!hdr)
10518 		goto free_msg;
10519 
10520 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10521 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10522 		goto free_msg;
10523 
10524 	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10525 					wdev->netdev->ifindex))
10526 		goto free_msg;
10527 
10528 	if (wakeup) {
10529 		struct nlattr *reasons;
10530 
10531 		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10532 
10533 		if (wakeup->disconnect &&
10534 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10535 			goto free_msg;
10536 		if (wakeup->magic_pkt &&
10537 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10538 			goto free_msg;
10539 		if (wakeup->gtk_rekey_failure &&
10540 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10541 			goto free_msg;
10542 		if (wakeup->eap_identity_req &&
10543 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10544 			goto free_msg;
10545 		if (wakeup->four_way_handshake &&
10546 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10547 			goto free_msg;
10548 		if (wakeup->rfkill_release &&
10549 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10550 			goto free_msg;
10551 
10552 		if (wakeup->pattern_idx >= 0 &&
10553 		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10554 				wakeup->pattern_idx))
10555 			goto free_msg;
10556 
10557 		if (wakeup->tcp_match)
10558 			nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10559 
10560 		if (wakeup->tcp_connlost)
10561 			nla_put_flag(msg,
10562 				     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10563 
10564 		if (wakeup->tcp_nomoretokens)
10565 			nla_put_flag(msg,
10566 				NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10567 
10568 		if (wakeup->packet) {
10569 			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10570 			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10571 
10572 			if (!wakeup->packet_80211) {
10573 				pkt_attr =
10574 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10575 				len_attr =
10576 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10577 			}
10578 
10579 			if (wakeup->packet_len &&
10580 			    nla_put_u32(msg, len_attr, wakeup->packet_len))
10581 				goto free_msg;
10582 
10583 			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10584 				    wakeup->packet))
10585 				goto free_msg;
10586 		}
10587 
10588 		nla_nest_end(msg, reasons);
10589 	}
10590 
10591 	err = genlmsg_end(msg, hdr);
10592 	if (err < 0)
10593 		goto free_msg;
10594 
10595 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10596 				nl80211_mlme_mcgrp.id, gfp);
10597 	return;
10598 
10599  free_msg:
10600 	nlmsg_free(msg);
10601 }
10602 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10603 #endif
10604 
10605 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10606 				enum nl80211_tdls_operation oper,
10607 				u16 reason_code, gfp_t gfp)
10608 {
10609 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10610 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10611 	struct sk_buff *msg;
10612 	void *hdr;
10613 	int err;
10614 
10615 	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10616 					 reason_code);
10617 
10618 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10619 	if (!msg)
10620 		return;
10621 
10622 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10623 	if (!hdr) {
10624 		nlmsg_free(msg);
10625 		return;
10626 	}
10627 
10628 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10629 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10630 	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10631 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10632 	    (reason_code > 0 &&
10633 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10634 		goto nla_put_failure;
10635 
10636 	err = genlmsg_end(msg, hdr);
10637 	if (err < 0) {
10638 		nlmsg_free(msg);
10639 		return;
10640 	}
10641 
10642 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10643 				nl80211_mlme_mcgrp.id, gfp);
10644 	return;
10645 
10646  nla_put_failure:
10647 	genlmsg_cancel(msg, hdr);
10648 	nlmsg_free(msg);
10649 }
10650 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10651 
10652 static int nl80211_netlink_notify(struct notifier_block * nb,
10653 				  unsigned long state,
10654 				  void *_notify)
10655 {
10656 	struct netlink_notify *notify = _notify;
10657 	struct cfg80211_registered_device *rdev;
10658 	struct wireless_dev *wdev;
10659 	struct cfg80211_beacon_registration *reg, *tmp;
10660 
10661 	if (state != NETLINK_URELEASE)
10662 		return NOTIFY_DONE;
10663 
10664 	rcu_read_lock();
10665 
10666 	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10667 		list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10668 			cfg80211_mlme_unregister_socket(wdev, notify->portid);
10669 
10670 		spin_lock_bh(&rdev->beacon_registrations_lock);
10671 		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10672 					 list) {
10673 			if (reg->nlportid == notify->portid) {
10674 				list_del(&reg->list);
10675 				kfree(reg);
10676 				break;
10677 			}
10678 		}
10679 		spin_unlock_bh(&rdev->beacon_registrations_lock);
10680 	}
10681 
10682 	rcu_read_unlock();
10683 
10684 	return NOTIFY_DONE;
10685 }
10686 
10687 static struct notifier_block nl80211_netlink_notifier = {
10688 	.notifier_call = nl80211_netlink_notify,
10689 };
10690 
10691 void cfg80211_ft_event(struct net_device *netdev,
10692 		       struct cfg80211_ft_event_params *ft_event)
10693 {
10694 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10695 	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10696 	struct sk_buff *msg;
10697 	void *hdr;
10698 	int err;
10699 
10700 	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10701 
10702 	if (!ft_event->target_ap)
10703 		return;
10704 
10705 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10706 	if (!msg)
10707 		return;
10708 
10709 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10710 	if (!hdr) {
10711 		nlmsg_free(msg);
10712 		return;
10713 	}
10714 
10715 	nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10716 	nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10717 	nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10718 	if (ft_event->ies)
10719 		nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10720 	if (ft_event->ric_ies)
10721 		nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10722 			ft_event->ric_ies);
10723 
10724 	err = genlmsg_end(msg, hdr);
10725 	if (err < 0) {
10726 		nlmsg_free(msg);
10727 		return;
10728 	}
10729 
10730 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10731 				nl80211_mlme_mcgrp.id, GFP_KERNEL);
10732 }
10733 EXPORT_SYMBOL(cfg80211_ft_event);
10734 
10735 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10736 {
10737 	struct cfg80211_registered_device *rdev;
10738 	struct sk_buff *msg;
10739 	void *hdr;
10740 	u32 nlportid;
10741 
10742 	rdev = wiphy_to_dev(wdev->wiphy);
10743 	if (!rdev->crit_proto_nlportid)
10744 		return;
10745 
10746 	nlportid = rdev->crit_proto_nlportid;
10747 	rdev->crit_proto_nlportid = 0;
10748 
10749 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10750 	if (!msg)
10751 		return;
10752 
10753 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10754 	if (!hdr)
10755 		goto nla_put_failure;
10756 
10757 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10758 	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10759 		goto nla_put_failure;
10760 
10761 	genlmsg_end(msg, hdr);
10762 
10763 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10764 	return;
10765 
10766  nla_put_failure:
10767 	if (hdr)
10768 		genlmsg_cancel(msg, hdr);
10769 	nlmsg_free(msg);
10770 
10771 }
10772 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10773 
10774 /* initialisation/exit functions */
10775 
10776 int nl80211_init(void)
10777 {
10778 	int err;
10779 
10780 	err = genl_register_family_with_ops(&nl80211_fam,
10781 		nl80211_ops, ARRAY_SIZE(nl80211_ops));
10782 	if (err)
10783 		return err;
10784 
10785 	err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10786 	if (err)
10787 		goto err_out;
10788 
10789 	err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10790 	if (err)
10791 		goto err_out;
10792 
10793 	err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10794 	if (err)
10795 		goto err_out;
10796 
10797 	err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10798 	if (err)
10799 		goto err_out;
10800 
10801 #ifdef CONFIG_NL80211_TESTMODE
10802 	err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10803 	if (err)
10804 		goto err_out;
10805 #endif
10806 
10807 	err = netlink_register_notifier(&nl80211_netlink_notifier);
10808 	if (err)
10809 		goto err_out;
10810 
10811 	return 0;
10812  err_out:
10813 	genl_unregister_family(&nl80211_fam);
10814 	return err;
10815 }
10816 
10817 void nl80211_exit(void)
10818 {
10819 	netlink_unregister_notifier(&nl80211_netlink_notifier);
10820 	genl_unregister_family(&nl80211_fam);
10821 }
10822