net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 193         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 194 };
 195
 196 /* policy for the key attributes */
 197 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 198         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 199         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 200         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 201         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 202         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 203         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 204         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 205         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 206 };
 207
 208 /* policy for the key default flags */
 209 static const struct nla_policy
 210 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 211         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 212         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 213 };
 214
 215 /* policy for WoWLAN attributes */
 216 static const struct nla_policy
 217 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 218         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 219         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 220         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 221         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 222         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 223         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 224         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 225         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 226 };
 227
 228 /* policy for GTK rekey offload attributes */
 229 static const struct nla_policy
 230 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 231         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 232         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 233         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 234 };
 235
 236 static const struct nla_policy
 237 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 238         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
 239                                                  .len = IEEE80211_MAX_SSID_LEN },
 240 };
 241
 242 /* ifidx get helper */
 243 static int nl80211_get_ifidx(struct netlink_callback *cb)
 244 {
 245         int res;
 246
 247         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 248                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 249                           nl80211_policy);
 250         if (res)
 251                 return res;
 252
 253         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 254                 return -EINVAL;
 255
 256         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 257         if (!res)
 258                 return -EINVAL;
 259         return res;
 260 }
 261
 262 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 263                                        struct netlink_callback *cb,
 264                                        struct cfg80211_registered_device **rdev,
 265                                        struct net_device **dev)
 266 {
 267         int ifidx = cb->args[0];
 268         int err;
 269
 270         if (!ifidx)
 271                 ifidx = nl80211_get_ifidx(cb);
 272         if (ifidx < 0)
 273                 return ifidx;
 274
 275         cb->args[0] = ifidx;
 276
 277         rtnl_lock();
 278
 279         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 280         if (!*dev) {
 281                 err = -ENODEV;
 282                 goto out_rtnl;
 283         }
 284
 285         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 286         if (IS_ERR(*rdev)) {
 287                 err = PTR_ERR(*rdev);
 288                 goto out_rtnl;
 289         }
 290
 291         return 0;
 292  out_rtnl:
 293         rtnl_unlock();
 294         return err;
 295 }
 296
 297 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 298 {
 299         cfg80211_unlock_rdev(rdev);
 300         rtnl_unlock();
 301 }
 302
 303 /* IE validation */
 304 static bool is_valid_ie_attr(const struct nlattr *attr)
 305 {
 306         const u8 *pos;
 307         int len;
 308
 309         if (!attr)
 310                 return true;
 311
 312         pos = nla_data(attr);
 313         len = nla_len(attr);
 314
 315         while (len) {
 316                 u8 elemlen;
 317
 318                 if (len < 2)
 319                         return false;
 320                 len -= 2;
 321
 322                 elemlen = pos[1];
 323                 if (elemlen > len)
 324                         return false;
 325
 326                 len -= elemlen;
 327                 pos += 2 + elemlen;
 328         }
 329
 330         return true;
 331 }
 332
 333 /* message building helper */
 334 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 335                                    int flags, u8 cmd)
 336 {
 337         /* since there is no private header just add the generic one */
 338         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 339 }
 340
 341 static int nl80211_msg_put_channel(struct sk_buff *msg,
 342                                    struct ieee80211_channel *chan)
 343 {
 344         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 345                     chan->center_freq);
 346
 347         if (chan->flags & IEEE80211_CHAN_DISABLED)
 348                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 349         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 350                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 351         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 352                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 353         if (chan->flags & IEEE80211_CHAN_RADAR)
 354                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 355
 356         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 357                     DBM_TO_MBM(chan->max_power));
 358
 359         return 0;
 360
 361  nla_put_failure:
 362         return -ENOBUFS;
 363 }
 364
 365 /* netlink command implementations */
 366
 367 struct key_parse {
 368         struct key_params p;
 369         int idx;
 370         int type;
 371         bool def, defmgmt;
 372         bool def_uni, def_multi;
 373 };
 374
 375 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 376 {
 377         struct nlattr *tb[NL80211_KEY_MAX + 1];
 378         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 379                                    nl80211_key_policy);
 380         if (err)
 381                 return err;
 382
 383         k->def = !!tb[NL80211_KEY_DEFAULT];
 384         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 385
 386         if (k->def) {
 387                 k->def_uni = true;
 388                 k->def_multi = true;
 389         }
 390         if (k->defmgmt)
 391                 k->def_multi = true;
 392
 393         if (tb[NL80211_KEY_IDX])
 394                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 395
 396         if (tb[NL80211_KEY_DATA]) {
 397                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 398                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 399         }
 400
 401         if (tb[NL80211_KEY_SEQ]) {
 402                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 403                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 404         }
 405
 406         if (tb[NL80211_KEY_CIPHER])
 407                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 408
 409         if (tb[NL80211_KEY_TYPE]) {
 410                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 411                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 412                         return -EINVAL;
 413         }
 414
 415         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 416                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 417                 int err = nla_parse_nested(kdt,
 418                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 419                                            tb[NL80211_KEY_DEFAULT_TYPES],
 420                                            nl80211_key_default_policy);
 421                 if (err)
 422                         return err;
 423
 424                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 425                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 426         }
 427
 428         return 0;
 429 }
 430
 431 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 432 {
 433         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 434                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 435                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 436         }
 437
 438         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 439                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 440                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 441         }
 442
 443         if (info->attrs[NL80211_ATTR_KEY_IDX])
 444                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 445
 446         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 447                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 448
 449         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 450         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 451
 452         if (k->def) {
 453                 k->def_uni = true;
 454                 k->def_multi = true;
 455         }
 456         if (k->defmgmt)
 457                 k->def_multi = true;
 458
 459         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 460                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 461                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 462                         return -EINVAL;
 463         }
 464
 465         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 466                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 467                 int err = nla_parse_nested(
 468                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 469                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 470                                 nl80211_key_default_policy);
 471                 if (err)
 472                         return err;
 473
 474                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 475                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 476         }
 477
 478         return 0;
 479 }
 480
 481 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 482 {
 483         int err;
 484
 485         memset(k, 0, sizeof(*k));
 486         k->idx = -1;
 487         k->type = -1;
 488
 489         if (info->attrs[NL80211_ATTR_KEY])
 490                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 491         else
 492                 err = nl80211_parse_key_old(info, k);
 493
 494         if (err)
 495                 return err;
 496
 497         if (k->def && k->defmgmt)
 498                 return -EINVAL;
 499
 500         if (k->defmgmt) {
 501                 if (k->def_uni || !k->def_multi)
 502                         return -EINVAL;
 503         }
 504
 505         if (k->idx != -1) {
 506                 if (k->defmgmt) {
 507                         if (k->idx < 4 || k->idx > 5)
 508                                 return -EINVAL;
 509                 } else if (k->def) {
 510                         if (k->idx < 0 || k->idx > 3)
 511                                 return -EINVAL;
 512                 } else {
 513                         if (k->idx < 0 || k->idx > 5)
 514                                 return -EINVAL;
 515                 }
 516         }
 517
 518         return 0;
 519 }
 520
 521 static struct cfg80211_cached_keys *
 522 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 523                        struct nlattr *keys)
 524 {
 525         struct key_parse parse;
 526         struct nlattr *key;
 527         struct cfg80211_cached_keys *result;
 528         int rem, err, def = 0;
 529
 530         result = kzalloc(sizeof(*result), GFP_KERNEL);
 531         if (!result)
 532                 return ERR_PTR(-ENOMEM);
 533
 534         result->def = -1;
 535         result->defmgmt = -1;
 536
 537         nla_for_each_nested(key, keys, rem) {
 538                 memset(&parse, 0, sizeof(parse));
 539                 parse.idx = -1;
 540
 541                 err = nl80211_parse_key_new(key, &parse);
 542                 if (err)
 543                         goto error;
 544                 err = -EINVAL;
 545                 if (!parse.p.key)
 546                         goto error;
 547                 if (parse.idx < 0 || parse.idx > 4)
 548                         goto error;
 549                 if (parse.def) {
 550                         if (def)
 551                                 goto error;
 552                         def = 1;
 553                         result->def = parse.idx;
 554                         if (!parse.def_uni || !parse.def_multi)
 555                                 goto error;
 556                 } else if (parse.defmgmt)
 557                         goto error;
 558                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 559                                                      parse.idx, false, NULL);
 560                 if (err)
 561                         goto error;
 562                 result->params[parse.idx].cipher = parse.p.cipher;
 563                 result->params[parse.idx].key_len = parse.p.key_len;
 564                 result->params[parse.idx].key = result->data[parse.idx];
 565                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 566         }
 567
 568         return result;
 569  error:
 570         kfree(result);
 571         return ERR_PTR(err);
 572 }
 573
 574 static int nl80211_key_allowed(struct wireless_dev *wdev)
 575 {
 576         ASSERT_WDEV_LOCK(wdev);
 577
 578         switch (wdev->iftype) {
 579         case NL80211_IFTYPE_AP:
 580         case NL80211_IFTYPE_AP_VLAN:
 581         case NL80211_IFTYPE_P2P_GO:
 582         case NL80211_IFTYPE_MESH_POINT:
 583                 break;
 584         case NL80211_IFTYPE_ADHOC:
 585                 if (!wdev->current_bss)
 586                         return -ENOLINK;
 587                 break;
 588         case NL80211_IFTYPE_STATION:
 589         case NL80211_IFTYPE_P2P_CLIENT:
 590                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 591                         return -ENOLINK;
 592                 break;
 593         default:
 594                 return -EINVAL;
 595         }
 596
 597         return 0;
 598 }
 599
 600 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 601 {
 602         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 603         int i;
 604
 605         if (!nl_modes)
 606                 goto nla_put_failure;
 607
 608         i = 0;
 609         while (ifmodes) {
 610                 if (ifmodes & 1)
 611                         NLA_PUT_FLAG(msg, i);
 612                 ifmodes >>= 1;
 613                 i++;
 614         }
 615
 616         nla_nest_end(msg, nl_modes);
 617         return 0;
 618
 619 nla_put_failure:
 620         return -ENOBUFS;
 621 }
 622
 623 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 624                                           struct sk_buff *msg)
 625 {
 626         struct nlattr *nl_combis;
 627         int i, j;
 628
 629         nl_combis = nla_nest_start(msg,
 630                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 631         if (!nl_combis)
 632                 goto nla_put_failure;
 633
 634         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 635                 const struct ieee80211_iface_combination *c;
 636                 struct nlattr *nl_combi, *nl_limits;
 637
 638                 c = &wiphy->iface_combinations[i];
 639
 640                 nl_combi = nla_nest_start(msg, i + 1);
 641                 if (!nl_combi)
 642                         goto nla_put_failure;
 643
 644                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 645                 if (!nl_limits)
 646                         goto nla_put_failure;
 647
 648                 for (j = 0; j < c->n_limits; j++) {
 649                         struct nlattr *nl_limit;
 650
 651                         nl_limit = nla_nest_start(msg, j + 1);
 652                         if (!nl_limit)
 653                                 goto nla_put_failure;
 654                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 655                                     c->limits[j].max);
 656                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 657                                                 c->limits[j].types))
 658                                 goto nla_put_failure;
 659                         nla_nest_end(msg, nl_limit);
 660                 }
 661
 662                 nla_nest_end(msg, nl_limits);
 663
 664                 if (c->beacon_int_infra_match)
 665                         NLA_PUT_FLAG(msg,
 666                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 667                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 668                             c->num_different_channels);
 669                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 670                             c->max_interfaces);
 671
 672                 nla_nest_end(msg, nl_combi);
 673         }
 674
 675         nla_nest_end(msg, nl_combis);
 676
 677         return 0;
 678 nla_put_failure:
 679         return -ENOBUFS;
 680 }
 681
 682 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 683                               struct cfg80211_registered_device *dev)
 684 {
 685         void *hdr;
 686         struct nlattr *nl_bands, *nl_band;
 687         struct nlattr *nl_freqs, *nl_freq;
 688         struct nlattr *nl_rates, *nl_rate;
 689         struct nlattr *nl_cmds;
 690         enum ieee80211_band band;
 691         struct ieee80211_channel *chan;
 692         struct ieee80211_rate *rate;
 693         int i;
 694         const struct ieee80211_txrx_stypes *mgmt_stypes =
 695                                 dev->wiphy.mgmt_stypes;
 696
 697         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 698         if (!hdr)
 699                 return -1;
 700
 701         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 702         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 703
 704         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 705                     cfg80211_rdev_list_generation);
 706
 707         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 708                    dev->wiphy.retry_short);
 709         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 710                    dev->wiphy.retry_long);
 711         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 712                     dev->wiphy.frag_threshold);
 713         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 714                     dev->wiphy.rts_threshold);
 715         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 716                     dev->wiphy.coverage_class);
 717         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 718                    dev->wiphy.max_scan_ssids);
 719         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 720                    dev->wiphy.max_sched_scan_ssids);
 721         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 722                     dev->wiphy.max_scan_ie_len);
 723         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 724                     dev->wiphy.max_sched_scan_ie_len);
 725         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 726                    dev->wiphy.max_match_sets);
 727
 728         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 729                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 730         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 731                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 732         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 733                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 734
 735         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 736                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 737
 738         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 739                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 740                 dev->wiphy.cipher_suites);
 741
 742         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 743                    dev->wiphy.max_num_pmkids);
 744
 745         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 746                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 747
 748         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 749                     dev->wiphy.available_antennas_tx);
 750         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 751                     dev->wiphy.available_antennas_rx);
 752
 753         if ((dev->wiphy.available_antennas_tx ||
 754              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 755                 u32 tx_ant = 0, rx_ant = 0;
 756                 int res;
 757                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 758                 if (!res) {
 759                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 760                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 761                 }
 762         }
 763
 764         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 765                                 dev->wiphy.interface_modes))
 766                 goto nla_put_failure;
 767
 768         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 769         if (!nl_bands)
 770                 goto nla_put_failure;
 771
 772         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 773                 if (!dev->wiphy.bands[band])
 774                         continue;
 775
 776                 nl_band = nla_nest_start(msg, band);
 777                 if (!nl_band)
 778                         goto nla_put_failure;
 779
 780                 /* add HT info */
 781                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 782                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 783                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 784                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 785                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 786                                 dev->wiphy.bands[band]->ht_cap.cap);
 787                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 788                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 789                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 790                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 791                 }
 792
 793                 /* add frequencies */
 794                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 795                 if (!nl_freqs)
 796                         goto nla_put_failure;
 797
 798                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 799                         nl_freq = nla_nest_start(msg, i);
 800                         if (!nl_freq)
 801                                 goto nla_put_failure;
 802
 803                         chan = &dev->wiphy.bands[band]->channels[i];
 804
 805                         if (nl80211_msg_put_channel(msg, chan))
 806                                 goto nla_put_failure;
 807
 808                         nla_nest_end(msg, nl_freq);
 809                 }
 810
 811                 nla_nest_end(msg, nl_freqs);
 812
 813                 /* add bitrates */
 814                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 815                 if (!nl_rates)
 816                         goto nla_put_failure;
 817
 818                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 819                         nl_rate = nla_nest_start(msg, i);
 820                         if (!nl_rate)
 821                                 goto nla_put_failure;
 822
 823                         rate = &dev->wiphy.bands[band]->bitrates[i];
 824                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 825                                     rate->bitrate);
 826                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 827                                 NLA_PUT_FLAG(msg,
 828                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 829
 830                         nla_nest_end(msg, nl_rate);
 831                 }
 832
 833                 nla_nest_end(msg, nl_rates);
 834
 835                 nla_nest_end(msg, nl_band);
 836         }
 837         nla_nest_end(msg, nl_bands);
 838
 839         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 840         if (!nl_cmds)
 841                 goto nla_put_failure;
 842
 843         i = 0;
 844 #define CMD(op, n)                                              \
 845          do {                                                   \
 846                 if (dev->ops->op) {                             \
 847                         i++;                                    \
 848                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 849                 }                                               \
 850         } while (0)
 851
 852         CMD(add_virtual_intf, NEW_INTERFACE);
 853         CMD(change_virtual_intf, SET_INTERFACE);
 854         CMD(add_key, NEW_KEY);
 855         CMD(add_beacon, NEW_BEACON);
 856         CMD(add_station, NEW_STATION);
 857         CMD(add_mpath, NEW_MPATH);
 858         CMD(update_mesh_config, SET_MESH_CONFIG);
 859         CMD(change_bss, SET_BSS);
 860         CMD(auth, AUTHENTICATE);
 861         CMD(assoc, ASSOCIATE);
 862         CMD(deauth, DEAUTHENTICATE);
 863         CMD(disassoc, DISASSOCIATE);
 864         CMD(join_ibss, JOIN_IBSS);
 865         CMD(join_mesh, JOIN_MESH);
 866         CMD(set_pmksa, SET_PMKSA);
 867         CMD(del_pmksa, DEL_PMKSA);
 868         CMD(flush_pmksa, FLUSH_PMKSA);
 869         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 870         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 871         CMD(mgmt_tx, FRAME);
 872         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 873         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 874                 i++;
 875                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 876         }
 877         CMD(set_channel, SET_CHANNEL);
 878         CMD(set_wds_peer, SET_WDS_PEER);
 879         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 880                 CMD(sched_scan_start, START_SCHED_SCAN);
 881
 882 #undef CMD
 883
 884         if (dev->ops->connect || dev->ops->auth) {
 885                 i++;
 886                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 887         }
 888
 889         if (dev->ops->disconnect || dev->ops->deauth) {
 890                 i++;
 891                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 892         }
 893
 894         nla_nest_end(msg, nl_cmds);
 895
 896         if (dev->ops->remain_on_channel)
 897                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 898                             dev->wiphy.max_remain_on_channel_duration);
 899
 900         if (dev->ops->mgmt_tx_cancel_wait)
 901                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 902
 903         if (mgmt_stypes) {
 904                 u16 stypes;
 905                 struct nlattr *nl_ftypes, *nl_ifs;
 906                 enum nl80211_iftype ift;
 907
 908                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 909                 if (!nl_ifs)
 910                         goto nla_put_failure;
 911
 912                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 913                         nl_ftypes = nla_nest_start(msg, ift);
 914                         if (!nl_ftypes)
 915                                 goto nla_put_failure;
 916                         i = 0;
 917                         stypes = mgmt_stypes[ift].tx;
 918                         while (stypes) {
 919                                 if (stypes & 1)
 920                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 921                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 922                                 stypes >>= 1;
 923                                 i++;
 924                         }
 925                         nla_nest_end(msg, nl_ftypes);
 926                 }
 927
 928                 nla_nest_end(msg, nl_ifs);
 929
 930                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 931                 if (!nl_ifs)
 932                         goto nla_put_failure;
 933
 934                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 935                         nl_ftypes = nla_nest_start(msg, ift);
 936                         if (!nl_ftypes)
 937                                 goto nla_put_failure;
 938                         i = 0;
 939                         stypes = mgmt_stypes[ift].rx;
 940                         while (stypes) {
 941                                 if (stypes & 1)
 942                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 943                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 944                                 stypes >>= 1;
 945                                 i++;
 946                         }
 947                         nla_nest_end(msg, nl_ftypes);
 948                 }
 949                 nla_nest_end(msg, nl_ifs);
 950         }
 951
 952         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 953                 struct nlattr *nl_wowlan;
 954
 955                 nl_wowlan = nla_nest_start(msg,
 956                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 957                 if (!nl_wowlan)
 958                         goto nla_put_failure;
 959
 960                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 961                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 962                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 963                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 964                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 965                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 966                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 967                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 968                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 969                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 970                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 971                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 972                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 973                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 974                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 975                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 976                 if (dev->wiphy.wowlan.n_patterns) {
 977                         struct nl80211_wowlan_pattern_support pat = {
 978                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 979                                 .min_pattern_len =
 980                                         dev->wiphy.wowlan.pattern_min_len,
 981                                 .max_pattern_len =
 982                                         dev->wiphy.wowlan.pattern_max_len,
 983                         };
 984                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 985                                 sizeof(pat), &pat);
 986                 }
 987
 988                 nla_nest_end(msg, nl_wowlan);
 989         }
 990
 991         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 992                                 dev->wiphy.software_iftypes))
 993                 goto nla_put_failure;
 994
 995         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 996                 goto nla_put_failure;
 997
 998         return genlmsg_end(msg, hdr);
 999
1000  nla_put_failure:
1001         genlmsg_cancel(msg, hdr);
1002         return -EMSGSIZE;
1003 }
1004
1005 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1006 {
1007         int idx = 0;
1008         int start = cb->args[0];
1009         struct cfg80211_registered_device *dev;
1010
1011         mutex_lock(&cfg80211_mutex);
1012         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1013                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1014                         continue;
1015                 if (++idx <= start)
1016                         continue;
1017                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1018                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1019                                        dev) < 0) {
1020                         idx--;
1021                         break;
1022                 }
1023         }
1024         mutex_unlock(&cfg80211_mutex);
1025
1026         cb->args[0] = idx;
1027
1028         return skb->len;
1029 }
1030
1031 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1032 {
1033         struct sk_buff *msg;
1034         struct cfg80211_registered_device *dev = info->user_ptr[0];
1035
1036         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1037         if (!msg)
1038                 return -ENOMEM;
1039
1040         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1041                 nlmsg_free(msg);
1042                 return -ENOBUFS;
1043         }
1044
1045         return genlmsg_reply(msg, info);
1046 }
1047
1048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1049         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1050         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1051         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1052         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1053         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1054 };
1055
1056 static int parse_txq_params(struct nlattr *tb[],
1057                             struct ieee80211_txq_params *txq_params)
1058 {
1059         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1060             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1061             !tb[NL80211_TXQ_ATTR_AIFS])
1062                 return -EINVAL;
1063
1064         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1065         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1066         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1067         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1068         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1069
1070         return 0;
1071 }
1072
1073 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1074 {
1075         /*
1076          * You can only set the channel explicitly for AP, mesh
1077          * and WDS type interfaces; all others have their channel
1078          * managed via their respective "establish a connection"
1079          * command (connect, join, ...)
1080          *
1081          * Monitors are special as they are normally slaved to
1082          * whatever else is going on, so they behave as though
1083          * you tried setting the wiphy channel itself.
1084          */
1085         return !wdev ||
1086                 wdev->iftype == NL80211_IFTYPE_AP ||
1087                 wdev->iftype == NL80211_IFTYPE_WDS ||
1088                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1089                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1090                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1091 }
1092
1093 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1094                                  struct wireless_dev *wdev,
1095                                  struct genl_info *info)
1096 {
1097         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1098         u32 freq;
1099         int result;
1100
1101         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1102                 return -EINVAL;
1103
1104         if (!nl80211_can_set_dev_channel(wdev))
1105                 return -EOPNOTSUPP;
1106
1107         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1108                 channel_type = nla_get_u32(info->attrs[
1109                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1110                 if (channel_type != NL80211_CHAN_NO_HT &&
1111                     channel_type != NL80211_CHAN_HT20 &&
1112                     channel_type != NL80211_CHAN_HT40PLUS &&
1113                     channel_type != NL80211_CHAN_HT40MINUS)
1114                         return -EINVAL;
1115         }
1116
1117         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1118
1119         mutex_lock(&rdev->devlist_mtx);
1120         if (wdev) {
1121                 wdev_lock(wdev);
1122                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1123                 wdev_unlock(wdev);
1124         } else {
1125                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1126         }
1127         mutex_unlock(&rdev->devlist_mtx);
1128
1129         return result;
1130 }
1131
1132 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1133 {
1134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1135         struct net_device *netdev = info->user_ptr[1];
1136
1137         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1138 }
1139
1140 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1141 {
1142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1143         struct net_device *dev = info->user_ptr[1];
1144         struct wireless_dev *wdev = dev->ieee80211_ptr;
1145         const u8 *bssid;
1146
1147         if (!info->attrs[NL80211_ATTR_MAC])
1148                 return -EINVAL;
1149
1150         if (netif_running(dev))
1151                 return -EBUSY;
1152
1153         if (!rdev->ops->set_wds_peer)
1154                 return -EOPNOTSUPP;
1155
1156         if (wdev->iftype != NL80211_IFTYPE_WDS)
1157                 return -EOPNOTSUPP;
1158
1159         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1160         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1161 }
1162
1163
1164 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1165 {
1166         struct cfg80211_registered_device *rdev;
1167         struct net_device *netdev = NULL;
1168         struct wireless_dev *wdev;
1169         int result = 0, rem_txq_params = 0;
1170         struct nlattr *nl_txq_params;
1171         u32 changed;
1172         u8 retry_short = 0, retry_long = 0;
1173         u32 frag_threshold = 0, rts_threshold = 0;
1174         u8 coverage_class = 0;
1175
1176         /*
1177          * Try to find the wiphy and netdev. Normally this
1178          * function shouldn't need the netdev, but this is
1179          * done for backward compatibility -- previously
1180          * setting the channel was done per wiphy, but now
1181          * it is per netdev. Previous userland like hostapd
1182          * also passed a netdev to set_wiphy, so that it is
1183          * possible to let that go to the right netdev!
1184          */
1185         mutex_lock(&cfg80211_mutex);
1186
1187         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1188                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1189
1190                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1191                 if (netdev && netdev->ieee80211_ptr) {
1192                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1193                         mutex_lock(&rdev->mtx);
1194                 } else
1195                         netdev = NULL;
1196         }
1197
1198         if (!netdev) {
1199                 rdev = __cfg80211_rdev_from_info(info);
1200                 if (IS_ERR(rdev)) {
1201                         mutex_unlock(&cfg80211_mutex);
1202                         return PTR_ERR(rdev);
1203                 }
1204                 wdev = NULL;
1205                 netdev = NULL;
1206                 result = 0;
1207
1208                 mutex_lock(&rdev->mtx);
1209         } else if (netif_running(netdev) &&
1210                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1211                 wdev = netdev->ieee80211_ptr;
1212         else
1213                 wdev = NULL;
1214
1215         /*
1216          * end workaround code, by now the rdev is available
1217          * and locked, and wdev may or may not be NULL.
1218          */
1219
1220         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1221                 result = cfg80211_dev_rename(
1222                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1223
1224         mutex_unlock(&cfg80211_mutex);
1225
1226         if (result)
1227                 goto bad_res;
1228
1229         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1230                 struct ieee80211_txq_params txq_params;
1231                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1232
1233                 if (!rdev->ops->set_txq_params) {
1234                         result = -EOPNOTSUPP;
1235                         goto bad_res;
1236                 }
1237
1238                 nla_for_each_nested(nl_txq_params,
1239                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1240                                     rem_txq_params) {
1241                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1242                                   nla_data(nl_txq_params),
1243                                   nla_len(nl_txq_params),
1244                                   txq_params_policy);
1245                         result = parse_txq_params(tb, &txq_params);
1246                         if (result)
1247                                 goto bad_res;
1248
1249                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1250                                                            &txq_params);
1251                         if (result)
1252                                 goto bad_res;
1253                 }
1254         }
1255
1256         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1257                 result = __nl80211_set_channel(rdev, wdev, info);
1258                 if (result)
1259                         goto bad_res;
1260         }
1261
1262         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1263                 enum nl80211_tx_power_setting type;
1264                 int idx, mbm = 0;
1265
1266                 if (!rdev->ops->set_tx_power) {
1267                         result = -EOPNOTSUPP;
1268                         goto bad_res;
1269                 }
1270
1271                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1272                 type = nla_get_u32(info->attrs[idx]);
1273
1274                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1275                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1276                         result = -EINVAL;
1277                         goto bad_res;
1278                 }
1279
1280                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1281                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1282                         mbm = nla_get_u32(info->attrs[idx]);
1283                 }
1284
1285                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1286                 if (result)
1287                         goto bad_res;
1288         }
1289
1290         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1291             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1292                 u32 tx_ant, rx_ant;
1293                 if ((!rdev->wiphy.available_antennas_tx &&
1294                      !rdev->wiphy.available_antennas_rx) ||
1295                     !rdev->ops->set_antenna) {
1296                         result = -EOPNOTSUPP;
1297                         goto bad_res;
1298                 }
1299
1300                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1301                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1302
1303                 /* reject antenna configurations which don't match the
1304                  * available antenna masks, except for the "all" mask */
1305                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1306                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1307                         result = -EINVAL;
1308                         goto bad_res;
1309                 }
1310
1311                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1312                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1313
1314                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1315                 if (result)
1316                         goto bad_res;
1317         }
1318
1319         changed = 0;
1320
1321         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1322                 retry_short = nla_get_u8(
1323                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1324                 if (retry_short == 0) {
1325                         result = -EINVAL;
1326                         goto bad_res;
1327                 }
1328                 changed |= WIPHY_PARAM_RETRY_SHORT;
1329         }
1330
1331         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1332                 retry_long = nla_get_u8(
1333                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1334                 if (retry_long == 0) {
1335                         result = -EINVAL;
1336                         goto bad_res;
1337                 }
1338                 changed |= WIPHY_PARAM_RETRY_LONG;
1339         }
1340
1341         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1342                 frag_threshold = nla_get_u32(
1343                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1344                 if (frag_threshold < 256) {
1345                         result = -EINVAL;
1346                         goto bad_res;
1347                 }
1348                 if (frag_threshold != (u32) -1) {
1349                         /*
1350                          * Fragments (apart from the last one) are required to
1351                          * have even length. Make the fragmentation code
1352                          * simpler by stripping LSB should someone try to use
1353                          * odd threshold value.
1354                          */
1355                         frag_threshold &= ~0x1;
1356                 }
1357                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1358         }
1359
1360         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1361                 rts_threshold = nla_get_u32(
1362                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1363                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1364         }
1365
1366         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1367                 coverage_class = nla_get_u8(
1368                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1369                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1370         }
1371
1372         if (changed) {
1373                 u8 old_retry_short, old_retry_long;
1374                 u32 old_frag_threshold, old_rts_threshold;
1375                 u8 old_coverage_class;
1376
1377                 if (!rdev->ops->set_wiphy_params) {
1378                         result = -EOPNOTSUPP;
1379                         goto bad_res;
1380                 }
1381
1382                 old_retry_short = rdev->wiphy.retry_short;
1383                 old_retry_long = rdev->wiphy.retry_long;
1384                 old_frag_threshold = rdev->wiphy.frag_threshold;
1385                 old_rts_threshold = rdev->wiphy.rts_threshold;
1386                 old_coverage_class = rdev->wiphy.coverage_class;
1387
1388                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1389                         rdev->wiphy.retry_short = retry_short;
1390                 if (changed & WIPHY_PARAM_RETRY_LONG)
1391                         rdev->wiphy.retry_long = retry_long;
1392                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1393                         rdev->wiphy.frag_threshold = frag_threshold;
1394                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1395                         rdev->wiphy.rts_threshold = rts_threshold;
1396                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1397                         rdev->wiphy.coverage_class = coverage_class;
1398
1399                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1400                 if (result) {
1401                         rdev->wiphy.retry_short = old_retry_short;
1402                         rdev->wiphy.retry_long = old_retry_long;
1403                         rdev->wiphy.frag_threshold = old_frag_threshold;
1404                         rdev->wiphy.rts_threshold = old_rts_threshold;
1405                         rdev->wiphy.coverage_class = old_coverage_class;
1406                 }
1407         }
1408
1409  bad_res:
1410         mutex_unlock(&rdev->mtx);
1411         if (netdev)
1412                 dev_put(netdev);
1413         return result;
1414 }
1415
1416
1417 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1418                               struct cfg80211_registered_device *rdev,
1419                               struct net_device *dev)
1420 {
1421         void *hdr;
1422
1423         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1424         if (!hdr)
1425                 return -1;
1426
1427         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1428         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1429         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1430         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1431
1432         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1433                     rdev->devlist_generation ^
1434                         (cfg80211_rdev_list_generation << 2));
1435
1436         return genlmsg_end(msg, hdr);
1437
1438  nla_put_failure:
1439         genlmsg_cancel(msg, hdr);
1440         return -EMSGSIZE;
1441 }
1442
1443 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1444 {
1445         int wp_idx = 0;
1446         int if_idx = 0;
1447         int wp_start = cb->args[0];
1448         int if_start = cb->args[1];
1449         struct cfg80211_registered_device *rdev;
1450         struct wireless_dev *wdev;
1451
1452         mutex_lock(&cfg80211_mutex);
1453         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1454                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1455                         continue;
1456                 if (wp_idx < wp_start) {
1457                         wp_idx++;
1458                         continue;
1459                 }
1460                 if_idx = 0;
1461
1462                 mutex_lock(&rdev->devlist_mtx);
1463                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1464                         if (if_idx < if_start) {
1465                                 if_idx++;
1466                                 continue;
1467                         }
1468                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1469                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1470                                                rdev, wdev->netdev) < 0) {
1471                                 mutex_unlock(&rdev->devlist_mtx);
1472                                 goto out;
1473                         }
1474                         if_idx++;
1475                 }
1476                 mutex_unlock(&rdev->devlist_mtx);
1477
1478                 wp_idx++;
1479         }
1480  out:
1481         mutex_unlock(&cfg80211_mutex);
1482
1483         cb->args[0] = wp_idx;
1484         cb->args[1] = if_idx;
1485
1486         return skb->len;
1487 }
1488
1489 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1490 {
1491         struct sk_buff *msg;
1492         struct cfg80211_registered_device *dev = info->user_ptr[0];
1493         struct net_device *netdev = info->user_ptr[1];
1494
1495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1496         if (!msg)
1497                 return -ENOMEM;
1498
1499         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1500                                dev, netdev) < 0) {
1501                 nlmsg_free(msg);
1502                 return -ENOBUFS;
1503         }
1504
1505         return genlmsg_reply(msg, info);
1506 }
1507
1508 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1509         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1510         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1511         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1512         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1513         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1514 };
1515
1516 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1517 {
1518         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1519         int flag;
1520
1521         *mntrflags = 0;
1522
1523         if (!nla)
1524                 return -EINVAL;
1525
1526         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1527                              nla, mntr_flags_policy))
1528                 return -EINVAL;
1529
1530         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1531                 if (flags[flag])
1532                         *mntrflags |= (1<<flag);
1533
1534         return 0;
1535 }
1536
1537 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1538                                struct net_device *netdev, u8 use_4addr,
1539                                enum nl80211_iftype iftype)
1540 {
1541         if (!use_4addr) {
1542                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1543                         return -EBUSY;
1544                 return 0;
1545         }
1546
1547         switch (iftype) {
1548         case NL80211_IFTYPE_AP_VLAN:
1549                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1550                         return 0;
1551                 break;
1552         case NL80211_IFTYPE_STATION:
1553                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1554                         return 0;
1555                 break;
1556         default:
1557                 break;
1558         }
1559
1560         return -EOPNOTSUPP;
1561 }
1562
1563 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1564 {
1565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1566         struct vif_params params;
1567         int err;
1568         enum nl80211_iftype otype, ntype;
1569         struct net_device *dev = info->user_ptr[1];
1570         u32 _flags, *flags = NULL;
1571         bool change = false;
1572
1573         memset(&params, 0, sizeof(params));
1574
1575         otype = ntype = dev->ieee80211_ptr->iftype;
1576
1577         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1578                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1579                 if (otype != ntype)
1580                         change = true;
1581                 if (ntype > NL80211_IFTYPE_MAX)
1582                         return -EINVAL;
1583         }
1584
1585         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1586                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1587
1588                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1589                         return -EINVAL;
1590                 if (netif_running(dev))
1591                         return -EBUSY;
1592
1593                 wdev_lock(wdev);
1594                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1595                              IEEE80211_MAX_MESH_ID_LEN);
1596                 wdev->mesh_id_up_len =
1597                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1598                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1599                        wdev->mesh_id_up_len);
1600                 wdev_unlock(wdev);
1601         }
1602
1603         if (info->attrs[NL80211_ATTR_4ADDR]) {
1604                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1605                 change = true;
1606                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1607                 if (err)
1608                         return err;
1609         } else {
1610                 params.use_4addr = -1;
1611         }
1612
1613         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1614                 if (ntype != NL80211_IFTYPE_MONITOR)
1615                         return -EINVAL;
1616                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1617                                           &_flags);
1618                 if (err)
1619                         return err;
1620
1621                 flags = &_flags;
1622                 change = true;
1623         }
1624
1625         if (change)
1626                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1627         else
1628                 err = 0;
1629
1630         if (!err && params.use_4addr != -1)
1631                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1632
1633         return err;
1634 }
1635
1636 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1637 {
1638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1639         struct vif_params params;
1640         struct net_device *dev;
1641         int err;
1642         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1643         u32 flags;
1644
1645         memset(&params, 0, sizeof(params));
1646
1647         if (!info->attrs[NL80211_ATTR_IFNAME])
1648                 return -EINVAL;
1649
1650         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1651                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1652                 if (type > NL80211_IFTYPE_MAX)
1653                         return -EINVAL;
1654         }
1655
1656         if (!rdev->ops->add_virtual_intf ||
1657             !(rdev->wiphy.interface_modes & (1 << type)))
1658                 return -EOPNOTSUPP;
1659
1660         if (info->attrs[NL80211_ATTR_4ADDR]) {
1661                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1662                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1663                 if (err)
1664                         return err;
1665         }
1666
1667         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1668                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1669                                   &flags);
1670         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1671                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1672                 type, err ? NULL : &flags, &params);
1673         if (IS_ERR(dev))
1674                 return PTR_ERR(dev);
1675
1676         if (type == NL80211_IFTYPE_MESH_POINT &&
1677             info->attrs[NL80211_ATTR_MESH_ID]) {
1678                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1679
1680                 wdev_lock(wdev);
1681                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1682                              IEEE80211_MAX_MESH_ID_LEN);
1683                 wdev->mesh_id_up_len =
1684                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1685                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1686                        wdev->mesh_id_up_len);
1687                 wdev_unlock(wdev);
1688         }
1689
1690         return 0;
1691 }
1692
1693 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1694 {
1695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1696         struct net_device *dev = info->user_ptr[1];
1697
1698         if (!rdev->ops->del_virtual_intf)
1699                 return -EOPNOTSUPP;
1700
1701         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1702 }
1703
1704 struct get_key_cookie {
1705         struct sk_buff *msg;
1706         int error;
1707         int idx;
1708 };
1709
1710 static void get_key_callback(void *c, struct key_params *params)
1711 {
1712         struct nlattr *key;
1713         struct get_key_cookie *cookie = c;
1714
1715         if (params->key)
1716                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1717                         params->key_len, params->key);
1718
1719         if (params->seq)
1720                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1721                         params->seq_len, params->seq);
1722
1723         if (params->cipher)
1724                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1725                             params->cipher);
1726
1727         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1728         if (!key)
1729                 goto nla_put_failure;
1730
1731         if (params->key)
1732                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1733                         params->key_len, params->key);
1734
1735         if (params->seq)
1736                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1737                         params->seq_len, params->seq);
1738
1739         if (params->cipher)
1740                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1741                             params->cipher);
1742
1743         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1744
1745         nla_nest_end(cookie->msg, key);
1746
1747         return;
1748  nla_put_failure:
1749         cookie->error = 1;
1750 }
1751
1752 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1753 {
1754         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1755         int err;
1756         struct net_device *dev = info->user_ptr[1];
1757         u8 key_idx = 0;
1758         const u8 *mac_addr = NULL;
1759         bool pairwise;
1760         struct get_key_cookie cookie = {
1761                 .error = 0,
1762         };
1763         void *hdr;
1764         struct sk_buff *msg;
1765
1766         if (info->attrs[NL80211_ATTR_KEY_IDX])
1767                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1768
1769         if (key_idx > 5)
1770                 return -EINVAL;
1771
1772         if (info->attrs[NL80211_ATTR_MAC])
1773                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1774
1775         pairwise = !!mac_addr;
1776         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1777                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1778                 if (kt >= NUM_NL80211_KEYTYPES)
1779                         return -EINVAL;
1780                 if (kt != NL80211_KEYTYPE_GROUP &&
1781                     kt != NL80211_KEYTYPE_PAIRWISE)
1782                         return -EINVAL;
1783                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1784         }
1785
1786         if (!rdev->ops->get_key)
1787                 return -EOPNOTSUPP;
1788
1789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1790         if (!msg)
1791                 return -ENOMEM;
1792
1793         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1794                              NL80211_CMD_NEW_KEY);
1795         if (IS_ERR(hdr))
1796                 return PTR_ERR(hdr);
1797
1798         cookie.msg = msg;
1799         cookie.idx = key_idx;
1800
1801         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1802         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1803         if (mac_addr)
1804                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1805
1806         if (pairwise && mac_addr &&
1807             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1808                 return -ENOENT;
1809
1810         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1811                                  mac_addr, &cookie, get_key_callback);
1812
1813         if (err)
1814                 goto free_msg;
1815
1816         if (cookie.error)
1817                 goto nla_put_failure;
1818
1819         genlmsg_end(msg, hdr);
1820         return genlmsg_reply(msg, info);
1821
1822  nla_put_failure:
1823         err = -ENOBUFS;
1824  free_msg:
1825         nlmsg_free(msg);
1826         return err;
1827 }
1828
1829 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1830 {
1831         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1832         struct key_parse key;
1833         int err;
1834         struct net_device *dev = info->user_ptr[1];
1835
1836         err = nl80211_parse_key(info, &key);
1837         if (err)
1838                 return err;
1839
1840         if (key.idx < 0)
1841                 return -EINVAL;
1842
1843         /* only support setting default key */
1844         if (!key.def && !key.defmgmt)
1845                 return -EINVAL;
1846
1847         wdev_lock(dev->ieee80211_ptr);
1848
1849         if (key.def) {
1850                 if (!rdev->ops->set_default_key) {
1851                         err = -EOPNOTSUPP;
1852                         goto out;
1853                 }
1854
1855                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1856                 if (err)
1857                         goto out;
1858
1859                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1860                                                  key.def_uni, key.def_multi);
1861
1862                 if (err)
1863                         goto out;
1864
1865 #ifdef CONFIG_CFG80211_WEXT
1866                 dev->ieee80211_ptr->wext.default_key = key.idx;
1867 #endif
1868         } else {
1869                 if (key.def_uni || !key.def_multi) {
1870                         err = -EINVAL;
1871                         goto out;
1872                 }
1873
1874                 if (!rdev->ops->set_default_mgmt_key) {
1875                         err = -EOPNOTSUPP;
1876                         goto out;
1877                 }
1878
1879                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1880                 if (err)
1881                         goto out;
1882
1883                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1884                                                       dev, key.idx);
1885                 if (err)
1886                         goto out;
1887
1888 #ifdef CONFIG_CFG80211_WEXT
1889                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1890 #endif
1891         }
1892
1893  out:
1894         wdev_unlock(dev->ieee80211_ptr);
1895
1896         return err;
1897 }
1898
1899 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1900 {
1901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1902         int err;
1903         struct net_device *dev = info->user_ptr[1];
1904         struct key_parse key;
1905         const u8 *mac_addr = NULL;
1906
1907         err = nl80211_parse_key(info, &key);
1908         if (err)
1909                 return err;
1910
1911         if (!key.p.key)
1912                 return -EINVAL;
1913
1914         if (info->attrs[NL80211_ATTR_MAC])
1915                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1916
1917         if (key.type == -1) {
1918                 if (mac_addr)
1919                         key.type = NL80211_KEYTYPE_PAIRWISE;
1920                 else
1921                         key.type = NL80211_KEYTYPE_GROUP;
1922         }
1923
1924         /* for now */
1925         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1926             key.type != NL80211_KEYTYPE_GROUP)
1927                 return -EINVAL;
1928
1929         if (!rdev->ops->add_key)
1930                 return -EOPNOTSUPP;
1931
1932         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1933                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1934                                            mac_addr))
1935                 return -EINVAL;
1936
1937         wdev_lock(dev->ieee80211_ptr);
1938         err = nl80211_key_allowed(dev->ieee80211_ptr);
1939         if (!err)
1940                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1941                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1942                                          mac_addr, &key.p);
1943         wdev_unlock(dev->ieee80211_ptr);
1944
1945         return err;
1946 }
1947
1948 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1949 {
1950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1951         int err;
1952         struct net_device *dev = info->user_ptr[1];
1953         u8 *mac_addr = NULL;
1954         struct key_parse key;
1955
1956         err = nl80211_parse_key(info, &key);
1957         if (err)
1958                 return err;
1959
1960         if (info->attrs[NL80211_ATTR_MAC])
1961                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1962
1963         if (key.type == -1) {
1964                 if (mac_addr)
1965                         key.type = NL80211_KEYTYPE_PAIRWISE;
1966                 else
1967                         key.type = NL80211_KEYTYPE_GROUP;
1968         }
1969
1970         /* for now */
1971         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1972             key.type != NL80211_KEYTYPE_GROUP)
1973                 return -EINVAL;
1974
1975         if (!rdev->ops->del_key)
1976                 return -EOPNOTSUPP;
1977
1978         wdev_lock(dev->ieee80211_ptr);
1979         err = nl80211_key_allowed(dev->ieee80211_ptr);
1980
1981         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1982             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1983                 err = -ENOENT;
1984
1985         if (!err)
1986                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1987                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1988                                          mac_addr);
1989
1990 #ifdef CONFIG_CFG80211_WEXT
1991         if (!err) {
1992                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1993                         dev->ieee80211_ptr->wext.default_key = -1;
1994                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1995                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1996         }
1997 #endif
1998         wdev_unlock(dev->ieee80211_ptr);
1999
2000         return err;
2001 }
2002
2003 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2004 {
2005         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2006                     struct beacon_parameters *info);
2007         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2008         struct net_device *dev = info->user_ptr[1];
2009         struct wireless_dev *wdev = dev->ieee80211_ptr;
2010         struct beacon_parameters params;
2011         int haveinfo = 0, err;
2012
2013         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2014             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2015             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2016             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2017                 return -EINVAL;
2018
2019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2020             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2021                 return -EOPNOTSUPP;
2022
2023         memset(&params, 0, sizeof(params));
2024
2025         switch (info->genlhdr->cmd) {
2026         case NL80211_CMD_NEW_BEACON:
2027                 /* these are required for NEW_BEACON */
2028                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2029                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2030                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2031                         return -EINVAL;
2032
2033                 params.interval =
2034                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2035                 params.dtim_period =
2036                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2037
2038                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2039                 if (err)
2040                         return err;
2041
2042                 /*
2043                  * In theory, some of these attributes could be required for
2044                  * NEW_BEACON, but since they were not used when the command was
2045                  * originally added, keep them optional for old user space
2046                  * programs to work with drivers that do not need the additional
2047                  * information.
2048                  */
2049                 if (info->attrs[NL80211_ATTR_SSID]) {
2050                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2051                         params.ssid_len =
2052                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2053                         if (params.ssid_len == 0 ||
2054                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2055                                 return -EINVAL;
2056                 }
2057
2058                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2059                         params.hidden_ssid = nla_get_u32(
2060                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2061                         if (params.hidden_ssid !=
2062                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2063                             params.hidden_ssid !=
2064                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2065                             params.hidden_ssid !=
2066                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2067                                 return -EINVAL;
2068                 }
2069
2070                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2071
2072                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2073                         params.auth_type = nla_get_u32(
2074                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2075                         if (!nl80211_valid_auth_type(params.auth_type))
2076                                 return -EINVAL;
2077                 } else
2078                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2079
2080                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2081                                               NL80211_MAX_NR_CIPHER_SUITES);
2082                 if (err)
2083                         return err;
2084
2085                 call = rdev->ops->add_beacon;
2086                 break;
2087         case NL80211_CMD_SET_BEACON:
2088                 call = rdev->ops->set_beacon;
2089                 break;
2090         default:
2091                 WARN_ON(1);
2092                 return -EOPNOTSUPP;
2093         }
2094
2095         if (!call)
2096                 return -EOPNOTSUPP;
2097
2098         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2099                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2100                 params.head_len =
2101                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2102                 haveinfo = 1;
2103         }
2104
2105         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2106                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2107                 params.tail_len =
2108                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2109                 haveinfo = 1;
2110         }
2111
2112         if (!haveinfo)
2113                 return -EINVAL;
2114
2115         if (info->attrs[NL80211_ATTR_IE]) {
2116                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2117                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2118         }
2119
2120         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2121                 params.proberesp_ies =
2122                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2123                 params.proberesp_ies_len =
2124                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2125         }
2126
2127         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2128                 params.assocresp_ies =
2129                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2130                 params.assocresp_ies_len =
2131                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2132         }
2133
2134         err = call(&rdev->wiphy, dev, &params);
2135         if (!err && params.interval)
2136                 wdev->beacon_interval = params.interval;
2137         return err;
2138 }
2139
2140 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2141 {
2142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2143         struct net_device *dev = info->user_ptr[1];
2144         struct wireless_dev *wdev = dev->ieee80211_ptr;
2145         int err;
2146
2147         if (!rdev->ops->del_beacon)
2148                 return -EOPNOTSUPP;
2149
2150         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2151             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2152                 return -EOPNOTSUPP;
2153
2154         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2155         if (!err)
2156                 wdev->beacon_interval = 0;
2157         return err;
2158 }
2159
2160 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2161         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2162         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2163         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2164         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2165         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2166 };
2167
2168 static int parse_station_flags(struct genl_info *info,
2169                                struct station_parameters *params)
2170 {
2171         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2172         struct nlattr *nla;
2173         int flag;
2174
2175         /*
2176          * Try parsing the new attribute first so userspace
2177          * can specify both for older kernels.
2178          */
2179         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2180         if (nla) {
2181                 struct nl80211_sta_flag_update *sta_flags;
2182
2183                 sta_flags = nla_data(nla);
2184                 params->sta_flags_mask = sta_flags->mask;
2185                 params->sta_flags_set = sta_flags->set;
2186                 if ((params->sta_flags_mask |
2187                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2188                         return -EINVAL;
2189                 return 0;
2190         }
2191
2192         /* if present, parse the old attribute */
2193
2194         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2195         if (!nla)
2196                 return 0;
2197
2198         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2199                              nla, sta_flags_policy))
2200                 return -EINVAL;
2201
2202         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2203         params->sta_flags_mask &= ~1;
2204
2205         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2206                 if (flags[flag])
2207                         params->sta_flags_set |= (1<<flag);
2208
2209         return 0;
2210 }
2211
2212 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2213                                  int attr)
2214 {
2215         struct nlattr *rate;
2216         u16 bitrate;
2217
2218         rate = nla_nest_start(msg, attr);
2219         if (!rate)
2220                 goto nla_put_failure;
2221
2222         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2223         bitrate = cfg80211_calculate_bitrate(info);
2224         if (bitrate > 0)
2225                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2226
2227         if (info->flags & RATE_INFO_FLAGS_MCS)
2228                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2229         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2230                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2231         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2232                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2233
2234         nla_nest_end(msg, rate);
2235         return true;
2236
2237 nla_put_failure:
2238         return false;
2239 }
2240
2241 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2242                                 int flags, struct net_device *dev,
2243                                 const u8 *mac_addr, struct station_info *sinfo)
2244 {
2245         void *hdr;
2246         struct nlattr *sinfoattr, *bss_param;
2247
2248         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2249         if (!hdr)
2250                 return -1;
2251
2252         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2253         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2254
2255         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2256
2257         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2258         if (!sinfoattr)
2259                 goto nla_put_failure;
2260         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2261                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2262                             sinfo->connected_time);
2263         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2264                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2265                             sinfo->inactive_time);
2266         if (sinfo->filled & STATION_INFO_RX_BYTES)
2267                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2268                             sinfo->rx_bytes);
2269         if (sinfo->filled & STATION_INFO_TX_BYTES)
2270                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2271                             sinfo->tx_bytes);
2272         if (sinfo->filled & STATION_INFO_LLID)
2273                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2274                             sinfo->llid);
2275         if (sinfo->filled & STATION_INFO_PLID)
2276                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2277                             sinfo->plid);
2278         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2279                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2280                             sinfo->plink_state);
2281         if (sinfo->filled & STATION_INFO_SIGNAL)
2282                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2283                            sinfo->signal);
2284         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2285                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2286                            sinfo->signal_avg);
2287         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2288                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2289                                           NL80211_STA_INFO_TX_BITRATE))
2290                         goto nla_put_failure;
2291         }
2292         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2293                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2294                                           NL80211_STA_INFO_RX_BITRATE))
2295                         goto nla_put_failure;
2296         }
2297         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2298                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2299                             sinfo->rx_packets);
2300         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2301                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2302                             sinfo->tx_packets);
2303         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2304                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2305                             sinfo->tx_retries);
2306         if (sinfo->filled & STATION_INFO_TX_FAILED)
2307                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2308                             sinfo->tx_failed);
2309         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2310                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2311                 if (!bss_param)
2312                         goto nla_put_failure;
2313
2314                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2315                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2316                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2317                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2318                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2319                         NLA_PUT_FLAG(msg,
2320                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2321                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2322                            sinfo->bss_param.dtim_period);
2323                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2324                             sinfo->bss_param.beacon_interval);
2325
2326                 nla_nest_end(msg, bss_param);
2327         }
2328         nla_nest_end(msg, sinfoattr);
2329
2330         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2331                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2332                         sinfo->assoc_req_ies);
2333
2334         return genlmsg_end(msg, hdr);
2335
2336  nla_put_failure:
2337         genlmsg_cancel(msg, hdr);
2338         return -EMSGSIZE;
2339 }
2340
2341 static int nl80211_dump_station(struct sk_buff *skb,
2342                                 struct netlink_callback *cb)
2343 {
2344         struct station_info sinfo;
2345         struct cfg80211_registered_device *dev;
2346         struct net_device *netdev;
2347         u8 mac_addr[ETH_ALEN];
2348         int sta_idx = cb->args[1];
2349         int err;
2350
2351         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2352         if (err)
2353                 return err;
2354
2355         if (!dev->ops->dump_station) {
2356                 err = -EOPNOTSUPP;
2357                 goto out_err;
2358         }
2359
2360         while (1) {
2361                 memset(&sinfo, 0, sizeof(sinfo));
2362                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2363                                              mac_addr, &sinfo);
2364                 if (err == -ENOENT)
2365                         break;
2366                 if (err)
2367                         goto out_err;
2368
2369                 if (nl80211_send_station(skb,
2370                                 NETLINK_CB(cb->skb).pid,
2371                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2372                                 netdev, mac_addr,
2373                                 &sinfo) < 0)
2374                         goto out;
2375
2376                 sta_idx++;
2377         }
2378
2379
2380  out:
2381         cb->args[1] = sta_idx;
2382         err = skb->len;
2383  out_err:
2384         nl80211_finish_netdev_dump(dev);
2385
2386         return err;
2387 }
2388
2389 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2390 {
2391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2392         struct net_device *dev = info->user_ptr[1];
2393         struct station_info sinfo;
2394         struct sk_buff *msg;
2395         u8 *mac_addr = NULL;
2396         int err;
2397
2398         memset(&sinfo, 0, sizeof(sinfo));
2399
2400         if (!info->attrs[NL80211_ATTR_MAC])
2401                 return -EINVAL;
2402
2403         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2404
2405         if (!rdev->ops->get_station)
2406                 return -EOPNOTSUPP;
2407
2408         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2409         if (err)
2410                 return err;
2411
2412         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2413         if (!msg)
2414                 return -ENOMEM;
2415
2416         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2417                                  dev, mac_addr, &sinfo) < 0) {
2418                 nlmsg_free(msg);
2419                 return -ENOBUFS;
2420         }
2421
2422         return genlmsg_reply(msg, info);
2423 }
2424
2425 /*
2426  * Get vlan interface making sure it is running and on the right wiphy.
2427  */
2428 static int get_vlan(struct genl_info *info,
2429                     struct cfg80211_registered_device *rdev,
2430                     struct net_device **vlan)
2431 {
2432         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2433         *vlan = NULL;
2434
2435         if (vlanattr) {
2436                 *vlan = dev_get_by_index(genl_info_net(info),
2437                                          nla_get_u32(vlanattr));
2438                 if (!*vlan)
2439                         return -ENODEV;
2440                 if (!(*vlan)->ieee80211_ptr)
2441                         return -EINVAL;
2442                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2443                         return -EINVAL;
2444                 if (!netif_running(*vlan))
2445                         return -ENETDOWN;
2446         }
2447         return 0;
2448 }
2449
2450 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2451 {
2452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2453         int err;
2454         struct net_device *dev = info->user_ptr[1];
2455         struct station_parameters params;
2456         u8 *mac_addr = NULL;
2457
2458         memset(&params, 0, sizeof(params));
2459
2460         params.listen_interval = -1;
2461         params.plink_state = -1;
2462
2463         if (info->attrs[NL80211_ATTR_STA_AID])
2464                 return -EINVAL;
2465
2466         if (!info->attrs[NL80211_ATTR_MAC])
2467                 return -EINVAL;
2468
2469         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2470
2471         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2472                 params.supported_rates =
2473                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2474                 params.supported_rates_len =
2475                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2476         }
2477
2478         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2479                 params.listen_interval =
2480                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2481
2482         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2483                 params.ht_capa =
2484                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2485
2486         if (parse_station_flags(info, &params))
2487                 return -EINVAL;
2488
2489         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2490                 params.plink_action =
2491                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2492
2493         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2494                 params.plink_state =
2495                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2496
2497         err = get_vlan(info, rdev, &params.vlan);
2498         if (err)
2499                 goto out;
2500
2501         /* validate settings */
2502         err = 0;
2503
2504         switch (dev->ieee80211_ptr->iftype) {
2505         case NL80211_IFTYPE_AP:
2506         case NL80211_IFTYPE_AP_VLAN:
2507         case NL80211_IFTYPE_P2P_GO:
2508                 /* disallow mesh-specific things */
2509                 if (params.plink_action)
2510                         err = -EINVAL;
2511                 break;
2512         case NL80211_IFTYPE_P2P_CLIENT:
2513         case NL80211_IFTYPE_STATION:
2514                 /* disallow everything but AUTHORIZED flag */
2515                 if (params.plink_action)
2516                         err = -EINVAL;
2517                 if (params.vlan)
2518                         err = -EINVAL;
2519                 if (params.supported_rates)
2520                         err = -EINVAL;
2521                 if (params.ht_capa)
2522                         err = -EINVAL;
2523                 if (params.listen_interval >= 0)
2524                         err = -EINVAL;
2525                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2526                         err = -EINVAL;
2527                 break;
2528         case NL80211_IFTYPE_MESH_POINT:
2529                 /* disallow things mesh doesn't support */
2530                 if (params.vlan)
2531                         err = -EINVAL;
2532                 if (params.ht_capa)
2533                         err = -EINVAL;
2534                 if (params.listen_interval >= 0)
2535                         err = -EINVAL;
2536                 if (params.sta_flags_mask &
2537                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2538                                   BIT(NL80211_STA_FLAG_MFP) |
2539                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2540                         err = -EINVAL;
2541                 break;
2542         default:
2543                 err = -EINVAL;
2544         }
2545
2546         if (err)
2547                 goto out;
2548
2549         if (!rdev->ops->change_station) {
2550                 err = -EOPNOTSUPP;
2551                 goto out;
2552         }
2553
2554         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2555
2556  out:
2557         if (params.vlan)
2558                 dev_put(params.vlan);
2559
2560         return err;
2561 }
2562
2563 static struct nla_policy
2564 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2565         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2566         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2567 };
2568
2569 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2570 {
2571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2572         int err;
2573         struct net_device *dev = info->user_ptr[1];
2574         struct station_parameters params;
2575         u8 *mac_addr = NULL;
2576
2577         memset(&params, 0, sizeof(params));
2578
2579         if (!info->attrs[NL80211_ATTR_MAC])
2580                 return -EINVAL;
2581
2582         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2583                 return -EINVAL;
2584
2585         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2586                 return -EINVAL;
2587
2588         if (!info->attrs[NL80211_ATTR_STA_AID])
2589                 return -EINVAL;
2590
2591         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2592         params.supported_rates =
2593                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2594         params.supported_rates_len =
2595                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2596         params.listen_interval =
2597                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2598
2599         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2600         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2601                 return -EINVAL;
2602
2603         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2604                 params.ht_capa =
2605                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2606
2607         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2608                 params.plink_action =
2609                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2610
2611         if (parse_station_flags(info, &params))
2612                 return -EINVAL;
2613
2614         /* parse WME attributes if sta is WME capable */
2615         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2616             (params.sta_flags_set & NL80211_STA_FLAG_WME) &&
2617             info->attrs[NL80211_ATTR_STA_WME]) {
2618                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2619                 struct nlattr *nla;
2620
2621                 nla = info->attrs[NL80211_ATTR_STA_WME];
2622                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2623                                        nl80211_sta_wme_policy);
2624                 if (err)
2625                         return err;
2626
2627                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2628                         params.uapsd_queues =
2629                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2630                 if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2631                         return -EINVAL;
2632
2633                 if (tb[NL80211_STA_WME_MAX_SP])
2634                         params.max_sp =
2635                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2636
2637                 if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2638                         return -EINVAL;
2639         }
2640
2641         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2642             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2643             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2644             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2645                 return -EINVAL;
2646
2647         err = get_vlan(info, rdev, &params.vlan);
2648         if (err)
2649                 goto out;
2650
2651         /* validate settings */
2652         err = 0;
2653
2654         if (!rdev->ops->add_station) {
2655                 err = -EOPNOTSUPP;
2656                 goto out;
2657         }
2658
2659         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2660
2661  out:
2662         if (params.vlan)
2663                 dev_put(params.vlan);
2664         return err;
2665 }
2666
2667 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2668 {
2669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2670         struct net_device *dev = info->user_ptr[1];
2671         u8 *mac_addr = NULL;
2672
2673         if (info->attrs[NL80211_ATTR_MAC])
2674                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2675
2676         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2677             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2678             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2679             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2680                 return -EINVAL;
2681
2682         if (!rdev->ops->del_station)
2683                 return -EOPNOTSUPP;
2684
2685         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2686 }
2687
2688 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2689                                 int flags, struct net_device *dev,
2690                                 u8 *dst, u8 *next_hop,
2691                                 struct mpath_info *pinfo)
2692 {
2693         void *hdr;
2694         struct nlattr *pinfoattr;
2695
2696         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2697         if (!hdr)
2698                 return -1;
2699
2700         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2701         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2702         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2703
2704         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2705
2706         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2707         if (!pinfoattr)
2708                 goto nla_put_failure;
2709         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2710                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2711                             pinfo->frame_qlen);
2712         if (pinfo->filled & MPATH_INFO_SN)
2713                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2714                             pinfo->sn);
2715         if (pinfo->filled & MPATH_INFO_METRIC)
2716                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2717                             pinfo->metric);
2718         if (pinfo->filled & MPATH_INFO_EXPTIME)
2719                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2720                             pinfo->exptime);
2721         if (pinfo->filled & MPATH_INFO_FLAGS)
2722                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2723                             pinfo->flags);
2724         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2725                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2726                             pinfo->discovery_timeout);
2727         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2728                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2729                             pinfo->discovery_retries);
2730
2731         nla_nest_end(msg, pinfoattr);
2732
2733         return genlmsg_end(msg, hdr);
2734
2735  nla_put_failure:
2736         genlmsg_cancel(msg, hdr);
2737         return -EMSGSIZE;
2738 }
2739
2740 static int nl80211_dump_mpath(struct sk_buff *skb,
2741                               struct netlink_callback *cb)
2742 {
2743         struct mpath_info pinfo;
2744         struct cfg80211_registered_device *dev;
2745         struct net_device *netdev;
2746         u8 dst[ETH_ALEN];
2747         u8 next_hop[ETH_ALEN];
2748         int path_idx = cb->args[1];
2749         int err;
2750
2751         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2752         if (err)
2753                 return err;
2754
2755         if (!dev->ops->dump_mpath) {
2756                 err = -EOPNOTSUPP;
2757                 goto out_err;
2758         }
2759
2760         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2761                 err = -EOPNOTSUPP;
2762                 goto out_err;
2763         }
2764
2765         while (1) {
2766                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2767                                            dst, next_hop, &pinfo);
2768                 if (err == -ENOENT)
2769                         break;
2770                 if (err)
2771                         goto out_err;
2772
2773                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2774                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2775                                        netdev, dst, next_hop,
2776                                        &pinfo) < 0)
2777                         goto out;
2778
2779                 path_idx++;
2780         }
2781
2782
2783  out:
2784         cb->args[1] = path_idx;
2785         err = skb->len;
2786  out_err:
2787         nl80211_finish_netdev_dump(dev);
2788         return err;
2789 }
2790
2791 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2792 {
2793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2794         int err;
2795         struct net_device *dev = info->user_ptr[1];
2796         struct mpath_info pinfo;
2797         struct sk_buff *msg;
2798         u8 *dst = NULL;
2799         u8 next_hop[ETH_ALEN];
2800
2801         memset(&pinfo, 0, sizeof(pinfo));
2802
2803         if (!info->attrs[NL80211_ATTR_MAC])
2804                 return -EINVAL;
2805
2806         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2807
2808         if (!rdev->ops->get_mpath)
2809                 return -EOPNOTSUPP;
2810
2811         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2812                 return -EOPNOTSUPP;
2813
2814         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2815         if (err)
2816                 return err;
2817
2818         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2819         if (!msg)
2820                 return -ENOMEM;
2821
2822         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2823                                  dev, dst, next_hop, &pinfo) < 0) {
2824                 nlmsg_free(msg);
2825                 return -ENOBUFS;
2826         }
2827
2828         return genlmsg_reply(msg, info);
2829 }
2830
2831 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2832 {
2833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2834         struct net_device *dev = info->user_ptr[1];
2835         u8 *dst = NULL;
2836         u8 *next_hop = NULL;
2837
2838         if (!info->attrs[NL80211_ATTR_MAC])
2839                 return -EINVAL;
2840
2841         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2842                 return -EINVAL;
2843
2844         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2845         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2846
2847         if (!rdev->ops->change_mpath)
2848                 return -EOPNOTSUPP;
2849
2850         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2851                 return -EOPNOTSUPP;
2852
2853         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2854 }
2855
2856 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2857 {
2858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2859         struct net_device *dev = info->user_ptr[1];
2860         u8 *dst = NULL;
2861         u8 *next_hop = NULL;
2862
2863         if (!info->attrs[NL80211_ATTR_MAC])
2864                 return -EINVAL;
2865
2866         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2867                 return -EINVAL;
2868
2869         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2870         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2871
2872         if (!rdev->ops->add_mpath)
2873                 return -EOPNOTSUPP;
2874
2875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2876                 return -EOPNOTSUPP;
2877
2878         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2879 }
2880
2881 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2882 {
2883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2884         struct net_device *dev = info->user_ptr[1];
2885         u8 *dst = NULL;
2886
2887         if (info->attrs[NL80211_ATTR_MAC])
2888                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2889
2890         if (!rdev->ops->del_mpath)
2891                 return -EOPNOTSUPP;
2892
2893         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2894 }
2895
2896 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2897 {
2898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2899         struct net_device *dev = info->user_ptr[1];
2900         struct bss_parameters params;
2901
2902         memset(&params, 0, sizeof(params));
2903         /* default to not changing parameters */
2904         params.use_cts_prot = -1;
2905         params.use_short_preamble = -1;
2906         params.use_short_slot_time = -1;
2907         params.ap_isolate = -1;
2908         params.ht_opmode = -1;
2909
2910         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2911                 params.use_cts_prot =
2912                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2913         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2914                 params.use_short_preamble =
2915                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2916         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2917                 params.use_short_slot_time =
2918                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2919         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2920                 params.basic_rates =
2921                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2922                 params.basic_rates_len =
2923                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2924         }
2925         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2926                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2927         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2928                 params.ht_opmode =
2929                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2930
2931         if (!rdev->ops->change_bss)
2932                 return -EOPNOTSUPP;
2933
2934         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2935             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2936                 return -EOPNOTSUPP;
2937
2938         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2939 }
2940
2941 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2942         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2943         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2944         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2945         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2946         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2947         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2948 };
2949
2950 static int parse_reg_rule(struct nlattr *tb[],
2951         struct ieee80211_reg_rule *reg_rule)
2952 {
2953         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2954         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2955
2956         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2957                 return -EINVAL;
2958         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2959                 return -EINVAL;
2960         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2961                 return -EINVAL;
2962         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2963                 return -EINVAL;
2964         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2965                 return -EINVAL;
2966
2967         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2968
2969         freq_range->start_freq_khz =
2970                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2971         freq_range->end_freq_khz =
2972                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2973         freq_range->max_bandwidth_khz =
2974                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2975
2976         power_rule->max_eirp =
2977                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2978
2979         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2980                 power_rule->max_antenna_gain =
2981                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2982
2983         return 0;
2984 }
2985
2986 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2987 {
2988         int r;
2989         char *data = NULL;
2990
2991         /*
2992          * You should only get this when cfg80211 hasn't yet initialized
2993          * completely when built-in to the kernel right between the time
2994          * window between nl80211_init() and regulatory_init(), if that is
2995          * even possible.
2996          */
2997         mutex_lock(&cfg80211_mutex);
2998         if (unlikely(!cfg80211_regdomain)) {
2999                 mutex_unlock(&cfg80211_mutex);
3000                 return -EINPROGRESS;
3001         }
3002         mutex_unlock(&cfg80211_mutex);
3003
3004         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3005                 return -EINVAL;
3006
3007         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3008
3009         r = regulatory_hint_user(data);
3010
3011         return r;
3012 }
3013
3014 static int nl80211_get_mesh_config(struct sk_buff *skb,
3015                                    struct genl_info *info)
3016 {
3017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3018         struct net_device *dev = info->user_ptr[1];
3019         struct wireless_dev *wdev = dev->ieee80211_ptr;
3020         struct mesh_config cur_params;
3021         int err = 0;
3022         void *hdr;
3023         struct nlattr *pinfoattr;
3024         struct sk_buff *msg;
3025
3026         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3027                 return -EOPNOTSUPP;
3028
3029         if (!rdev->ops->get_mesh_config)
3030                 return -EOPNOTSUPP;
3031
3032         wdev_lock(wdev);
3033         /* If not connected, get default parameters */
3034         if (!wdev->mesh_id_len)
3035                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3036         else
3037                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3038                                                  &cur_params);
3039         wdev_unlock(wdev);
3040
3041         if (err)
3042                 return err;
3043
3044         /* Draw up a netlink message to send back */
3045         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3046         if (!msg)
3047                 return -ENOMEM;
3048         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3049                              NL80211_CMD_GET_MESH_CONFIG);
3050         if (!hdr)
3051                 goto out;
3052         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3053         if (!pinfoattr)
3054                 goto nla_put_failure;
3055         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3056         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3057                         cur_params.dot11MeshRetryTimeout);
3058         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3059                         cur_params.dot11MeshConfirmTimeout);
3060         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3061                         cur_params.dot11MeshHoldingTimeout);
3062         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3063                         cur_params.dot11MeshMaxPeerLinks);
3064         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3065                         cur_params.dot11MeshMaxRetries);
3066         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3067                         cur_params.dot11MeshTTL);
3068         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3069                         cur_params.element_ttl);
3070         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3071                         cur_params.auto_open_plinks);
3072         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3073                         cur_params.dot11MeshHWMPmaxPREQretries);
3074         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3075                         cur_params.path_refresh_time);
3076         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3077                         cur_params.min_discovery_timeout);
3078         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3079                         cur_params.dot11MeshHWMPactivePathTimeout);
3080         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3081                         cur_params.dot11MeshHWMPpreqMinInterval);
3082         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3083                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3084         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3085                         cur_params.dot11MeshHWMPRootMode);
3086         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3087                         cur_params.dot11MeshHWMPRannInterval);
3088         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3089                         cur_params.dot11MeshGateAnnouncementProtocol);
3090         nla_nest_end(msg, pinfoattr);
3091         genlmsg_end(msg, hdr);
3092         return genlmsg_reply(msg, info);
3093
3094  nla_put_failure:
3095         genlmsg_cancel(msg, hdr);
3096  out:
3097         nlmsg_free(msg);
3098         return -ENOBUFS;
3099 }
3100
3101 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3102         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3103         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3104         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3105         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3106         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3107         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3108         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3109         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3110
3111         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3112         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3113         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3114         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3115         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3116         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3117         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3118         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3119         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3120 };
3121
3122 static const struct nla_policy
3123         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3124         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3125         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3126         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3127         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3128                 .len = IEEE80211_MAX_DATA_LEN },
3129         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3130 };
3131
3132 static int nl80211_parse_mesh_config(struct genl_info *info,
3133                                      struct mesh_config *cfg,
3134                                      u32 *mask_out)
3135 {
3136         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3137         u32 mask = 0;
3138
3139 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3140 do {\
3141         if (table[attr_num]) {\
3142                 cfg->param = nla_fn(table[attr_num]); \
3143                 mask |= (1 << (attr_num - 1)); \
3144         } \
3145 } while (0);\
3146
3147
3148         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3149                 return -EINVAL;
3150         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3151                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3152                              nl80211_meshconf_params_policy))
3153                 return -EINVAL;
3154
3155         /* This makes sure that there aren't more than 32 mesh config
3156          * parameters (otherwise our bitfield scheme would not work.) */
3157         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3158
3159         /* Fill in the params struct */
3160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3161                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3162         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3163                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3164         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3165                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3166         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3167                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3168         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3169                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3171                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3172         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3173                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3174         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3175                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3177                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3178                         nla_get_u8);
3179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3180                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3181         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3182                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3183                         nla_get_u16);
3184         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3185                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3186                         nla_get_u32);
3187         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3188                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3189                         nla_get_u16);
3190         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3191                         dot11MeshHWMPnetDiameterTraversalTime,
3192                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3193                         nla_get_u16);
3194         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3195                         dot11MeshHWMPRootMode, mask,
3196                         NL80211_MESHCONF_HWMP_ROOTMODE,
3197                         nla_get_u8);
3198         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3199                         dot11MeshHWMPRannInterval, mask,
3200                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3201                         nla_get_u16);
3202         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3203                         dot11MeshGateAnnouncementProtocol, mask,
3204                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3205                         nla_get_u8);
3206         if (mask_out)
3207                 *mask_out = mask;
3208
3209         return 0;
3210
3211 #undef FILL_IN_MESH_PARAM_IF_SET
3212 }
3213
3214 static int nl80211_parse_mesh_setup(struct genl_info *info,
3215                                      struct mesh_setup *setup)
3216 {
3217         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3218
3219         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3220                 return -EINVAL;
3221         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3222                              info->attrs[NL80211_ATTR_MESH_SETUP],
3223                              nl80211_mesh_setup_params_policy))
3224                 return -EINVAL;
3225
3226         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3227                 setup->path_sel_proto =
3228                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3229                  IEEE80211_PATH_PROTOCOL_VENDOR :
3230                  IEEE80211_PATH_PROTOCOL_HWMP;
3231
3232         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3233                 setup->path_metric =
3234                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3235                  IEEE80211_PATH_METRIC_VENDOR :
3236                  IEEE80211_PATH_METRIC_AIRTIME;
3237
3238
3239         if (tb[NL80211_MESH_SETUP_IE]) {
3240                 struct nlattr *ieattr =
3241                         tb[NL80211_MESH_SETUP_IE];
3242                 if (!is_valid_ie_attr(ieattr))
3243                         return -EINVAL;
3244                 setup->ie = nla_data(ieattr);
3245                 setup->ie_len = nla_len(ieattr);
3246         }
3247         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3248         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3249
3250         return 0;
3251 }
3252
3253 static int nl80211_update_mesh_config(struct sk_buff *skb,
3254                                       struct genl_info *info)
3255 {
3256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3257         struct net_device *dev = info->user_ptr[1];
3258         struct wireless_dev *wdev = dev->ieee80211_ptr;
3259         struct mesh_config cfg;
3260         u32 mask;
3261         int err;
3262
3263         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3264                 return -EOPNOTSUPP;
3265
3266         if (!rdev->ops->update_mesh_config)
3267                 return -EOPNOTSUPP;
3268
3269         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3270         if (err)
3271                 return err;
3272
3273         wdev_lock(wdev);
3274         if (!wdev->mesh_id_len)
3275                 err = -ENOLINK;
3276
3277         if (!err)
3278                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3279                                                     mask, &cfg);
3280
3281         wdev_unlock(wdev);
3282
3283         return err;
3284 }
3285
3286 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3287 {
3288         struct sk_buff *msg;
3289         void *hdr = NULL;
3290         struct nlattr *nl_reg_rules;
3291         unsigned int i;
3292         int err = -EINVAL;
3293
3294         mutex_lock(&cfg80211_mutex);
3295
3296         if (!cfg80211_regdomain)
3297                 goto out;
3298
3299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3300         if (!msg) {
3301                 err = -ENOBUFS;
3302                 goto out;
3303         }
3304
3305         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3306                              NL80211_CMD_GET_REG);
3307         if (!hdr)
3308                 goto put_failure;
3309
3310         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3311                 cfg80211_regdomain->alpha2);
3312
3313         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3314         if (!nl_reg_rules)
3315                 goto nla_put_failure;
3316
3317         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3318                 struct nlattr *nl_reg_rule;
3319                 const struct ieee80211_reg_rule *reg_rule;
3320                 const struct ieee80211_freq_range *freq_range;
3321                 const struct ieee80211_power_rule *power_rule;
3322
3323                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3324                 freq_range = &reg_rule->freq_range;
3325                 power_rule = &reg_rule->power_rule;
3326
3327                 nl_reg_rule = nla_nest_start(msg, i);
3328                 if (!nl_reg_rule)
3329                         goto nla_put_failure;
3330
3331                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3332                         reg_rule->flags);
3333                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3334                         freq_range->start_freq_khz);
3335                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3336                         freq_range->end_freq_khz);
3337                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3338                         freq_range->max_bandwidth_khz);
3339                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3340                         power_rule->max_antenna_gain);
3341                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3342                         power_rule->max_eirp);
3343
3344                 nla_nest_end(msg, nl_reg_rule);
3345         }
3346
3347         nla_nest_end(msg, nl_reg_rules);
3348
3349         genlmsg_end(msg, hdr);
3350         err = genlmsg_reply(msg, info);
3351         goto out;
3352
3353 nla_put_failure:
3354         genlmsg_cancel(msg, hdr);
3355 put_failure:
3356         nlmsg_free(msg);
3357         err = -EMSGSIZE;
3358 out:
3359         mutex_unlock(&cfg80211_mutex);
3360         return err;
3361 }
3362
3363 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3364 {
3365         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3366         struct nlattr *nl_reg_rule;
3367         char *alpha2 = NULL;
3368         int rem_reg_rules = 0, r = 0;
3369         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3370         struct ieee80211_regdomain *rd = NULL;
3371
3372         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3373                 return -EINVAL;
3374
3375         if (!info->attrs[NL80211_ATTR_REG_RULES])
3376                 return -EINVAL;
3377
3378         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3379
3380         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3381                         rem_reg_rules) {
3382                 num_rules++;
3383                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3384                         return -EINVAL;
3385         }
3386
3387         mutex_lock(&cfg80211_mutex);
3388
3389         if (!reg_is_valid_request(alpha2)) {
3390                 r = -EINVAL;
3391                 goto bad_reg;
3392         }
3393
3394         size_of_regd = sizeof(struct ieee80211_regdomain) +
3395                 (num_rules * sizeof(struct ieee80211_reg_rule));
3396
3397         rd = kzalloc(size_of_regd, GFP_KERNEL);
3398         if (!rd) {
3399                 r = -ENOMEM;
3400                 goto bad_reg;
3401         }
3402
3403         rd->n_reg_rules = num_rules;
3404         rd->alpha2[0] = alpha2[0];
3405         rd->alpha2[1] = alpha2[1];
3406
3407         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3408                         rem_reg_rules) {
3409                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3410                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3411                         reg_rule_policy);
3412                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3413                 if (r)
3414                         goto bad_reg;
3415
3416                 rule_idx++;
3417
3418                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3419                         r = -EINVAL;
3420                         goto bad_reg;
3421                 }
3422         }
3423
3424         BUG_ON(rule_idx != num_rules);
3425
3426         r = set_regdom(rd);
3427
3428         mutex_unlock(&cfg80211_mutex);
3429
3430         return r;
3431
3432  bad_reg:
3433         mutex_unlock(&cfg80211_mutex);
3434         kfree(rd);
3435         return r;
3436 }
3437
3438 static int validate_scan_freqs(struct nlattr *freqs)
3439 {
3440         struct nlattr *attr1, *attr2;
3441         int n_channels = 0, tmp1, tmp2;
3442
3443         nla_for_each_nested(attr1, freqs, tmp1) {
3444                 n_channels++;
3445                 /*
3446                  * Some hardware has a limited channel list for
3447                  * scanning, and it is pretty much nonsensical
3448                  * to scan for a channel twice, so disallow that
3449                  * and don't require drivers to check that the
3450                  * channel list they get isn't longer than what
3451                  * they can scan, as long as they can scan all
3452                  * the channels they registered at once.
3453                  */
3454                 nla_for_each_nested(attr2, freqs, tmp2)
3455                         if (attr1 != attr2 &&
3456                             nla_get_u32(attr1) == nla_get_u32(attr2))
3457                                 return 0;
3458         }
3459
3460         return n_channels;
3461 }
3462
3463 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3464 {
3465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3466         struct net_device *dev = info->user_ptr[1];
3467         struct cfg80211_scan_request *request;
3468         struct nlattr *attr;
3469         struct wiphy *wiphy;
3470         int err, tmp, n_ssids = 0, n_channels, i;
3471         size_t ie_len;
3472
3473         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3474                 return -EINVAL;
3475
3476         wiphy = &rdev->wiphy;
3477
3478         if (!rdev->ops->scan)
3479                 return -EOPNOTSUPP;
3480
3481         if (rdev->scan_req)
3482                 return -EBUSY;
3483
3484         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3485                 n_channels = validate_scan_freqs(
3486                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3487                 if (!n_channels)
3488                         return -EINVAL;
3489         } else {
3490                 enum ieee80211_band band;
3491                 n_channels = 0;
3492
3493                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3494                         if (wiphy->bands[band])
3495                                 n_channels += wiphy->bands[band]->n_channels;
3496         }
3497
3498         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3499                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3500                         n_ssids++;
3501
3502         if (n_ssids > wiphy->max_scan_ssids)
3503                 return -EINVAL;
3504
3505         if (info->attrs[NL80211_ATTR_IE])
3506                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3507         else
3508                 ie_len = 0;
3509
3510         if (ie_len > wiphy->max_scan_ie_len)
3511                 return -EINVAL;
3512
3513         request = kzalloc(sizeof(*request)
3514                         + sizeof(*request->ssids) * n_ssids
3515                         + sizeof(*request->channels) * n_channels
3516                         + ie_len, GFP_KERNEL);
3517         if (!request)
3518                 return -ENOMEM;
3519
3520         if (n_ssids)
3521                 request->ssids = (void *)&request->channels[n_channels];
3522         request->n_ssids = n_ssids;
3523         if (ie_len) {
3524                 if (request->ssids)
3525                         request->ie = (void *)(request->ssids + n_ssids);
3526                 else
3527                         request->ie = (void *)(request->channels + n_channels);
3528         }
3529
3530         i = 0;
3531         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3532                 /* user specified, bail out if channel not found */
3533                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3534                         struct ieee80211_channel *chan;
3535
3536                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3537
3538                         if (!chan) {
3539                                 err = -EINVAL;
3540                                 goto out_free;
3541                         }
3542
3543                         /* ignore disabled channels */
3544                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3545                                 continue;
3546
3547                         request->channels[i] = chan;
3548                         i++;
3549                 }
3550         } else {
3551                 enum ieee80211_band band;
3552
3553                 /* all channels */
3554                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3555                         int j;
3556                         if (!wiphy->bands[band])
3557                                 continue;
3558                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3559                                 struct ieee80211_channel *chan;
3560
3561                                 chan = &wiphy->bands[band]->channels[j];
3562
3563                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3564                                         continue;
3565
3566                                 request->channels[i] = chan;
3567                                 i++;
3568                         }
3569                 }
3570         }
3571
3572         if (!i) {
3573                 err = -EINVAL;
3574                 goto out_free;
3575         }
3576
3577         request->n_channels = i;
3578
3579         i = 0;
3580         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3581                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3582                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3583                                 err = -EINVAL;
3584                                 goto out_free;
3585                         }
3586                         request->ssids[i].ssid_len = nla_len(attr);
3587                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3588                         i++;
3589                 }
3590         }
3591
3592         if (info->attrs[NL80211_ATTR_IE]) {
3593                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3594                 memcpy((void *)request->ie,
3595                        nla_data(info->attrs[NL80211_ATTR_IE]),
3596                        request->ie_len);
3597         }
3598
3599         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3600                 if (wiphy->bands[i])
3601                         request->rates[i] =
3602                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3603
3604         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3605                 nla_for_each_nested(attr,
3606                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3607                                     tmp) {
3608                         enum ieee80211_band band = nla_type(attr);
3609
3610                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3611                                 err = -EINVAL;
3612                                 goto out_free;
3613                         }
3614                         err = ieee80211_get_ratemask(wiphy->bands[band],
3615                                                      nla_data(attr),
3616                                                      nla_len(attr),
3617                                                      &request->rates[band]);
3618                         if (err)
3619                                 goto out_free;
3620                 }
3621         }
3622
3623         request->dev = dev;
3624         request->wiphy = &rdev->wiphy;
3625
3626         rdev->scan_req = request;
3627         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3628
3629         if (!err) {
3630                 nl80211_send_scan_start(rdev, dev);
3631                 dev_hold(dev);
3632         } else {
3633  out_free:
3634                 rdev->scan_req = NULL;
3635                 kfree(request);
3636         }
3637
3638         return err;
3639 }
3640
3641 static int nl80211_start_sched_scan(struct sk_buff *skb,
3642                                     struct genl_info *info)
3643 {
3644         struct cfg80211_sched_scan_request *request;
3645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3646         struct net_device *dev = info->user_ptr[1];
3647         struct nlattr *attr;
3648         struct wiphy *wiphy;
3649         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
3650         u32 interval;
3651         enum ieee80211_band band;
3652         size_t ie_len;
3653         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
3654
3655         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3656             !rdev->ops->sched_scan_start)
3657                 return -EOPNOTSUPP;
3658
3659         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3660                 return -EINVAL;
3661
3662         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3663                 return -EINVAL;
3664
3665         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3666         if (interval == 0)
3667                 return -EINVAL;
3668
3669         wiphy = &rdev->wiphy;
3670
3671         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3672                 n_channels = validate_scan_freqs(
3673                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3674                 if (!n_channels)
3675                         return -EINVAL;
3676         } else {
3677                 n_channels = 0;
3678
3679                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3680                         if (wiphy->bands[band])
3681                                 n_channels += wiphy->bands[band]->n_channels;
3682         }
3683
3684         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3685                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3686                                     tmp)
3687                         n_ssids++;
3688
3689         if (n_ssids > wiphy->max_sched_scan_ssids)
3690                 return -EINVAL;
3691
3692         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
3693                 nla_for_each_nested(attr,
3694                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3695                                     tmp)
3696                         n_match_sets++;
3697
3698         if (n_match_sets > wiphy->max_match_sets)
3699                 return -EINVAL;
3700
3701         if (info->attrs[NL80211_ATTR_IE])
3702                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3703         else
3704                 ie_len = 0;
3705
3706         if (ie_len > wiphy->max_sched_scan_ie_len)
3707                 return -EINVAL;
3708
3709         mutex_lock(&rdev->sched_scan_mtx);
3710
3711         if (rdev->sched_scan_req) {
3712                 err = -EINPROGRESS;
3713                 goto out;
3714         }
3715
3716         request = kzalloc(sizeof(*request)
3717                         + sizeof(*request->ssids) * n_ssids
3718                         + sizeof(*request->match_sets) * n_match_sets
3719                         + sizeof(*request->channels) * n_channels
3720                         + ie_len, GFP_KERNEL);
3721         if (!request) {
3722                 err = -ENOMEM;
3723                 goto out;
3724         }
3725
3726         if (n_ssids)
3727                 request->ssids = (void *)&request->channels[n_channels];
3728         request->n_ssids = n_ssids;
3729         if (ie_len) {
3730                 if (request->ssids)
3731                         request->ie = (void *)(request->ssids + n_ssids);
3732                 else
3733                         request->ie = (void *)(request->channels + n_channels);
3734         }
3735
3736         if (n_match_sets) {
3737                 if (request->ie)
3738                         request->match_sets = (void *)(request->ie + ie_len);
3739                 else if (request->ssids)
3740                         request->match_sets =
3741                                 (void *)(request->ssids + n_ssids);
3742                 else
3743                         request->match_sets =
3744                                 (void *)(request->channels + n_channels);
3745         }
3746         request->n_match_sets = n_match_sets;
3747
3748         i = 0;
3749         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3750                 /* user specified, bail out if channel not found */
3751                 nla_for_each_nested(attr,
3752                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3753                                     tmp) {
3754                         struct ieee80211_channel *chan;
3755
3756                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3757
3758                         if (!chan) {
3759                                 err = -EINVAL;
3760                                 goto out_free;
3761                         }
3762
3763                         /* ignore disabled channels */
3764                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3765                                 continue;
3766
3767                         request->channels[i] = chan;
3768                         i++;
3769                 }
3770         } else {
3771                 /* all channels */
3772                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3773                         int j;
3774                         if (!wiphy->bands[band])
3775                                 continue;
3776                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3777                                 struct ieee80211_channel *chan;
3778
3779                                 chan = &wiphy->bands[band]->channels[j];
3780
3781                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3782                                         continue;
3783
3784                                 request->channels[i] = chan;
3785                                 i++;
3786                         }
3787                 }
3788         }
3789
3790         if (!i) {
3791                 err = -EINVAL;
3792                 goto out_free;
3793         }
3794
3795         request->n_channels = i;
3796
3797         i = 0;
3798         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3799                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3800                                     tmp) {
3801                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3802                                 err = -EINVAL;
3803                                 goto out_free;
3804                         }
3805                         request->ssids[i].ssid_len = nla_len(attr);
3806                         memcpy(request->ssids[i].ssid, nla_data(attr),
3807                                nla_len(attr));
3808                         i++;
3809                 }
3810         }
3811
3812         i = 0;
3813         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
3814                 nla_for_each_nested(attr,
3815                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3816                                     tmp) {
3817                         struct nlattr *ssid;
3818
3819                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
3820                                   nla_data(attr), nla_len(attr),
3821                                   nl80211_match_policy);
3822                         ssid = tb[NL80211_ATTR_SCHED_SCAN_MATCH_SSID];
3823                         if (ssid) {
3824                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
3825                                         err = -EINVAL;
3826                                         goto out_free;
3827                                 }
3828                                 memcpy(request->match_sets[i].ssid.ssid,
3829                                        nla_data(ssid), nla_len(ssid));
3830                                 request->match_sets[i].ssid.ssid_len =
3831                                         nla_len(ssid);
3832                         }
3833                         i++;
3834                 }
3835         }
3836
3837         if (info->attrs[NL80211_ATTR_IE]) {
3838                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3839                 memcpy((void *)request->ie,
3840                        nla_data(info->attrs[NL80211_ATTR_IE]),
3841                        request->ie_len);
3842         }
3843
3844         request->dev = dev;
3845         request->wiphy = &rdev->wiphy;
3846         request->interval = interval;
3847
3848         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3849         if (!err) {
3850                 rdev->sched_scan_req = request;
3851                 nl80211_send_sched_scan(rdev, dev,
3852                                         NL80211_CMD_START_SCHED_SCAN);
3853                 goto out;
3854         }
3855
3856 out_free:
3857         kfree(request);
3858 out:
3859         mutex_unlock(&rdev->sched_scan_mtx);
3860         return err;
3861 }
3862
3863 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3864                                    struct genl_info *info)
3865 {
3866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3867         int err;
3868
3869         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3870             !rdev->ops->sched_scan_stop)
3871                 return -EOPNOTSUPP;
3872
3873         mutex_lock(&rdev->sched_scan_mtx);
3874         err = __cfg80211_stop_sched_scan(rdev, false);
3875         mutex_unlock(&rdev->sched_scan_mtx);
3876
3877         return err;
3878 }
3879
3880 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3881                             u32 seq, int flags,
3882                             struct cfg80211_registered_device *rdev,
3883                             struct wireless_dev *wdev,
3884                             struct cfg80211_internal_bss *intbss)
3885 {
3886         struct cfg80211_bss *res = &intbss->pub;
3887         void *hdr;
3888         struct nlattr *bss;
3889         int i;
3890
3891         ASSERT_WDEV_LOCK(wdev);
3892
3893         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3894                              NL80211_CMD_NEW_SCAN_RESULTS);
3895         if (!hdr)
3896                 return -1;
3897
3898         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3899
3900         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3901         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3902
3903         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3904         if (!bss)
3905                 goto nla_put_failure;
3906         if (!is_zero_ether_addr(res->bssid))
3907                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3908         if (res->information_elements && res->len_information_elements)
3909                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3910                         res->len_information_elements,
3911                         res->information_elements);
3912         if (res->beacon_ies && res->len_beacon_ies &&
3913             res->beacon_ies != res->information_elements)
3914                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3915                         res->len_beacon_ies, res->beacon_ies);
3916         if (res->tsf)
3917                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3918         if (res->beacon_interval)
3919                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3920         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3921         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3922         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3923                 jiffies_to_msecs(jiffies - intbss->ts));
3924
3925         switch (rdev->wiphy.signal_type) {
3926         case CFG80211_SIGNAL_TYPE_MBM:
3927                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3928                 break;
3929         case CFG80211_SIGNAL_TYPE_UNSPEC:
3930                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3931                 break;
3932         default:
3933                 break;
3934         }
3935
3936         switch (wdev->iftype) {
3937         case NL80211_IFTYPE_P2P_CLIENT:
3938         case NL80211_IFTYPE_STATION:
3939                 if (intbss == wdev->current_bss)
3940                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3941                                     NL80211_BSS_STATUS_ASSOCIATED);
3942                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3943                         if (intbss != wdev->auth_bsses[i])
3944                                 continue;
3945                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3946                                     NL80211_BSS_STATUS_AUTHENTICATED);
3947                         break;
3948                 }
3949                 break;
3950         case NL80211_IFTYPE_ADHOC:
3951                 if (intbss == wdev->current_bss)
3952                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3953                                     NL80211_BSS_STATUS_IBSS_JOINED);
3954                 break;
3955         default:
3956                 break;
3957         }
3958
3959         nla_nest_end(msg, bss);
3960
3961         return genlmsg_end(msg, hdr);
3962
3963  nla_put_failure:
3964         genlmsg_cancel(msg, hdr);
3965         return -EMSGSIZE;
3966 }
3967
3968 static int nl80211_dump_scan(struct sk_buff *skb,
3969                              struct netlink_callback *cb)
3970 {
3971         struct cfg80211_registered_device *rdev;
3972         struct net_device *dev;
3973         struct cfg80211_internal_bss *scan;
3974         struct wireless_dev *wdev;
3975         int start = cb->args[1], idx = 0;
3976         int err;
3977
3978         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3979         if (err)
3980                 return err;
3981
3982         wdev = dev->ieee80211_ptr;
3983
3984         wdev_lock(wdev);
3985         spin_lock_bh(&rdev->bss_lock);
3986         cfg80211_bss_expire(rdev);
3987
3988         cb->seq = rdev->bss_generation;
3989
3990         list_for_each_entry(scan, &rdev->bss_list, list) {
3991                 if (++idx <= start)
3992                         continue;
3993                 if (nl80211_send_bss(skb, cb,
3994                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3995                                 rdev, wdev, scan) < 0) {
3996                         idx--;
3997                         break;
3998                 }
3999         }
4000
4001         spin_unlock_bh(&rdev->bss_lock);
4002         wdev_unlock(wdev);
4003
4004         cb->args[1] = idx;
4005         nl80211_finish_netdev_dump(rdev);
4006
4007         return skb->len;
4008 }
4009
4010 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4011                                 int flags, struct net_device *dev,
4012                                 struct survey_info *survey)
4013 {
4014         void *hdr;
4015         struct nlattr *infoattr;
4016
4017         hdr = nl80211hdr_put(msg, pid, seq, flags,
4018                              NL80211_CMD_NEW_SURVEY_RESULTS);
4019         if (!hdr)
4020                 return -ENOMEM;
4021
4022         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
4023
4024         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4025         if (!infoattr)
4026                 goto nla_put_failure;
4027
4028         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4029                     survey->channel->center_freq);
4030         if (survey->filled & SURVEY_INFO_NOISE_DBM)
4031                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
4032                             survey->noise);
4033         if (survey->filled & SURVEY_INFO_IN_USE)
4034                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
4035         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
4036                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4037                             survey->channel_time);
4038         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
4039                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4040                             survey->channel_time_busy);
4041         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
4042                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4043                             survey->channel_time_ext_busy);
4044         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
4045                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4046                             survey->channel_time_rx);
4047         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
4048                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4049                             survey->channel_time_tx);
4050
4051         nla_nest_end(msg, infoattr);
4052
4053         return genlmsg_end(msg, hdr);
4054
4055  nla_put_failure:
4056         genlmsg_cancel(msg, hdr);
4057         return -EMSGSIZE;
4058 }
4059
4060 static int nl80211_dump_survey(struct sk_buff *skb,
4061                         struct netlink_callback *cb)
4062 {
4063         struct survey_info survey;
4064         struct cfg80211_registered_device *dev;
4065         struct net_device *netdev;
4066         int survey_idx = cb->args[1];
4067         int res;
4068
4069         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4070         if (res)
4071                 return res;
4072
4073         if (!dev->ops->dump_survey) {
4074                 res = -EOPNOTSUPP;
4075                 goto out_err;
4076         }
4077
4078         while (1) {
4079                 struct ieee80211_channel *chan;
4080
4081                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4082                                             &survey);
4083                 if (res == -ENOENT)
4084                         break;
4085                 if (res)
4086                         goto out_err;
4087
4088                 /* Survey without a channel doesn't make sense */
4089                 if (!survey.channel) {
4090                         res = -EINVAL;
4091                         goto out;
4092                 }
4093
4094                 chan = ieee80211_get_channel(&dev->wiphy,
4095                                              survey.channel->center_freq);
4096                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4097                         survey_idx++;
4098                         continue;
4099                 }
4100
4101                 if (nl80211_send_survey(skb,
4102                                 NETLINK_CB(cb->skb).pid,
4103                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4104                                 netdev,
4105                                 &survey) < 0)
4106                         goto out;
4107                 survey_idx++;
4108         }
4109
4110  out:
4111         cb->args[1] = survey_idx;
4112         res = skb->len;
4113  out_err:
4114         nl80211_finish_netdev_dump(dev);
4115         return res;
4116 }
4117
4118 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4119 {
4120         return auth_type <= NL80211_AUTHTYPE_MAX;
4121 }
4122
4123 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4124 {
4125         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4126                                   NL80211_WPA_VERSION_2));
4127 }
4128
4129 static bool nl80211_valid_akm_suite(u32 akm)
4130 {
4131         return akm == WLAN_AKM_SUITE_8021X ||
4132                 akm == WLAN_AKM_SUITE_PSK;
4133 }
4134
4135 static bool nl80211_valid_cipher_suite(u32 cipher)
4136 {
4137         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
4138                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
4139                 cipher == WLAN_CIPHER_SUITE_TKIP ||
4140                 cipher == WLAN_CIPHER_SUITE_CCMP ||
4141                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
4142 }
4143
4144
4145 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4146 {
4147         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4148         struct net_device *dev = info->user_ptr[1];
4149         struct ieee80211_channel *chan;
4150         const u8 *bssid, *ssid, *ie = NULL;
4151         int err, ssid_len, ie_len = 0;
4152         enum nl80211_auth_type auth_type;
4153         struct key_parse key;
4154         bool local_state_change;
4155
4156         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4157                 return -EINVAL;
4158
4159         if (!info->attrs[NL80211_ATTR_MAC])
4160                 return -EINVAL;
4161
4162         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4163                 return -EINVAL;
4164
4165         if (!info->attrs[NL80211_ATTR_SSID])
4166                 return -EINVAL;
4167
4168         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4169                 return -EINVAL;
4170
4171         err = nl80211_parse_key(info, &key);
4172         if (err)
4173                 return err;
4174
4175         if (key.idx >= 0) {
4176                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4177                         return -EINVAL;
4178                 if (!key.p.key || !key.p.key_len)
4179                         return -EINVAL;
4180                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4181                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4182                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4183                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4184                         return -EINVAL;
4185                 if (key.idx > 4)
4186                         return -EINVAL;
4187         } else {
4188                 key.p.key_len = 0;
4189                 key.p.key = NULL;
4190         }
4191
4192         if (key.idx >= 0) {
4193                 int i;
4194                 bool ok = false;
4195                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4196                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4197                                 ok = true;
4198                                 break;
4199                         }
4200                 }
4201                 if (!ok)
4202                         return -EINVAL;
4203         }
4204
4205         if (!rdev->ops->auth)
4206                 return -EOPNOTSUPP;
4207
4208         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4209             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4210                 return -EOPNOTSUPP;
4211
4212         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4213         chan = ieee80211_get_channel(&rdev->wiphy,
4214                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4215         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4216                 return -EINVAL;
4217
4218         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4219         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4220
4221         if (info->attrs[NL80211_ATTR_IE]) {
4222                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4223                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4224         }
4225
4226         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4227         if (!nl80211_valid_auth_type(auth_type))
4228                 return -EINVAL;
4229
4230         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4231
4232         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4233                                   ssid, ssid_len, ie, ie_len,
4234                                   key.p.key, key.p.key_len, key.idx,
4235                                   local_state_change);
4236 }
4237
4238 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4239                                    struct genl_info *info,
4240                                    struct cfg80211_crypto_settings *settings,
4241                                    int cipher_limit)
4242 {
4243         memset(settings, 0, sizeof(*settings));
4244
4245         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4246
4247         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4248                 u16 proto;
4249                 proto = nla_get_u16(
4250                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4251                 settings->control_port_ethertype = cpu_to_be16(proto);
4252                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4253                     proto != ETH_P_PAE)
4254                         return -EINVAL;
4255                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4256                         settings->control_port_no_encrypt = true;
4257         } else
4258                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4259
4260         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4261                 void *data;
4262                 int len, i;
4263
4264                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4265                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4266                 settings->n_ciphers_pairwise = len / sizeof(u32);
4267
4268                 if (len % sizeof(u32))
4269                         return -EINVAL;
4270
4271                 if (settings->n_ciphers_pairwise > cipher_limit)
4272                         return -EINVAL;
4273
4274                 memcpy(settings->ciphers_pairwise, data, len);
4275
4276                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4277                         if (!nl80211_valid_cipher_suite(
4278                                         settings->ciphers_pairwise[i]))
4279                                 return -EINVAL;
4280         }
4281
4282         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4283                 settings->cipher_group =
4284                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4285                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4286                         return -EINVAL;
4287         }
4288
4289         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4290                 settings->wpa_versions =
4291                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4292                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4293                         return -EINVAL;
4294         }
4295
4296         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4297                 void *data;
4298                 int len, i;
4299
4300                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4301                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4302                 settings->n_akm_suites = len / sizeof(u32);
4303
4304                 if (len % sizeof(u32))
4305                         return -EINVAL;
4306
4307                 memcpy(settings->akm_suites, data, len);
4308
4309                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4310                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4311                                 return -EINVAL;
4312         }
4313
4314         return 0;
4315 }
4316
4317 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4318 {
4319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4320         struct net_device *dev = info->user_ptr[1];
4321         struct cfg80211_crypto_settings crypto;
4322         struct ieee80211_channel *chan;
4323         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4324         int err, ssid_len, ie_len = 0;
4325         bool use_mfp = false;
4326
4327         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4328                 return -EINVAL;
4329
4330         if (!info->attrs[NL80211_ATTR_MAC] ||
4331             !info->attrs[NL80211_ATTR_SSID] ||
4332             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4333                 return -EINVAL;
4334
4335         if (!rdev->ops->assoc)
4336                 return -EOPNOTSUPP;
4337
4338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4340                 return -EOPNOTSUPP;
4341
4342         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4343
4344         chan = ieee80211_get_channel(&rdev->wiphy,
4345                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4346         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4347                 return -EINVAL;
4348
4349         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4350         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4351
4352         if (info->attrs[NL80211_ATTR_IE]) {
4353                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4354                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4355         }
4356
4357         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4358                 enum nl80211_mfp mfp =
4359                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4360                 if (mfp == NL80211_MFP_REQUIRED)
4361                         use_mfp = true;
4362                 else if (mfp != NL80211_MFP_NO)
4363                         return -EINVAL;
4364         }
4365
4366         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4367                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4368
4369         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4370         if (!err)
4371                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4372                                           ssid, ssid_len, ie, ie_len, use_mfp,
4373                                           &crypto);
4374
4375         return err;
4376 }
4377
4378 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4379 {
4380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4381         struct net_device *dev = info->user_ptr[1];
4382         const u8 *ie = NULL, *bssid;
4383         int ie_len = 0;
4384         u16 reason_code;
4385         bool local_state_change;
4386
4387         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4388                 return -EINVAL;
4389
4390         if (!info->attrs[NL80211_ATTR_MAC])
4391                 return -EINVAL;
4392
4393         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4394                 return -EINVAL;
4395
4396         if (!rdev->ops->deauth)
4397                 return -EOPNOTSUPP;
4398
4399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4400             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4401                 return -EOPNOTSUPP;
4402
4403         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4404
4405         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4406         if (reason_code == 0) {
4407                 /* Reason Code 0 is reserved */
4408                 return -EINVAL;
4409         }
4410
4411         if (info->attrs[NL80211_ATTR_IE]) {
4412                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4413                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4414         }
4415
4416         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4417
4418         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4419                                     local_state_change);
4420 }
4421
4422 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4423 {
4424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4425         struct net_device *dev = info->user_ptr[1];
4426         const u8 *ie = NULL, *bssid;
4427         int ie_len = 0;
4428         u16 reason_code;
4429         bool local_state_change;
4430
4431         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4432                 return -EINVAL;
4433
4434         if (!info->attrs[NL80211_ATTR_MAC])
4435                 return -EINVAL;
4436
4437         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4438                 return -EINVAL;
4439
4440         if (!rdev->ops->disassoc)
4441                 return -EOPNOTSUPP;
4442
4443         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4444             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4445                 return -EOPNOTSUPP;
4446
4447         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4448
4449         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4450         if (reason_code == 0) {
4451                 /* Reason Code 0 is reserved */
4452                 return -EINVAL;
4453         }
4454
4455         if (info->attrs[NL80211_ATTR_IE]) {
4456                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4457                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4458         }
4459
4460         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4461
4462         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4463                                       local_state_change);
4464 }
4465
4466 static bool
4467 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4468                          int mcast_rate[IEEE80211_NUM_BANDS],
4469                          int rateval)
4470 {
4471         struct wiphy *wiphy = &rdev->wiphy;
4472         bool found = false;
4473         int band, i;
4474
4475         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4476                 struct ieee80211_supported_band *sband;
4477
4478                 sband = wiphy->bands[band];
4479                 if (!sband)
4480                         continue;
4481
4482                 for (i = 0; i < sband->n_bitrates; i++) {
4483                         if (sband->bitrates[i].bitrate == rateval) {
4484                                 mcast_rate[band] = i + 1;
4485                                 found = true;
4486                                 break;
4487                         }
4488                 }
4489         }
4490
4491         return found;
4492 }
4493
4494 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4495 {
4496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4497         struct net_device *dev = info->user_ptr[1];
4498         struct cfg80211_ibss_params ibss;
4499         struct wiphy *wiphy;
4500         struct cfg80211_cached_keys *connkeys = NULL;
4501         int err;
4502
4503         memset(&ibss, 0, sizeof(ibss));
4504
4505         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4506                 return -EINVAL;
4507
4508         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4509             !info->attrs[NL80211_ATTR_SSID] ||
4510             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4511                 return -EINVAL;
4512
4513         ibss.beacon_interval = 100;
4514
4515         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4516                 ibss.beacon_interval =
4517                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4518                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4519                         return -EINVAL;
4520         }
4521
4522         if (!rdev->ops->join_ibss)
4523                 return -EOPNOTSUPP;
4524
4525         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4526                 return -EOPNOTSUPP;
4527
4528         wiphy = &rdev->wiphy;
4529
4530         if (info->attrs[NL80211_ATTR_MAC])
4531                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4532         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4533         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4534
4535         if (info->attrs[NL80211_ATTR_IE]) {
4536                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4537                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4538         }
4539
4540         ibss.channel = ieee80211_get_channel(wiphy,
4541                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4542         if (!ibss.channel ||
4543             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4544             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4545                 return -EINVAL;
4546
4547         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4548         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4549
4550         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4551                 u8 *rates =
4552                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4553                 int n_rates =
4554                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4555                 struct ieee80211_supported_band *sband =
4556                         wiphy->bands[ibss.channel->band];
4557                 int err;
4558
4559                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4560                                              &ibss.basic_rates);
4561                 if (err)
4562                         return err;
4563         }
4564
4565         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4566             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4567                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4568                 return -EINVAL;
4569
4570         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4571                 connkeys = nl80211_parse_connkeys(rdev,
4572                                         info->attrs[NL80211_ATTR_KEYS]);
4573                 if (IS_ERR(connkeys))
4574                         return PTR_ERR(connkeys);
4575         }
4576
4577         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4578         if (err)
4579                 kfree(connkeys);
4580         return err;
4581 }
4582
4583 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4584 {
4585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4586         struct net_device *dev = info->user_ptr[1];
4587
4588         if (!rdev->ops->leave_ibss)
4589                 return -EOPNOTSUPP;
4590
4591         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4592                 return -EOPNOTSUPP;
4593
4594         return cfg80211_leave_ibss(rdev, dev, false);
4595 }
4596
4597 #ifdef CONFIG_NL80211_TESTMODE
4598 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4599         .name = "testmode",
4600 };
4601
4602 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4603 {
4604         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4605         int err;
4606
4607         if (!info->attrs[NL80211_ATTR_TESTDATA])
4608                 return -EINVAL;
4609
4610         err = -EOPNOTSUPP;
4611         if (rdev->ops->testmode_cmd) {
4612                 rdev->testmode_info = info;
4613                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4614                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4615                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4616                 rdev->testmode_info = NULL;
4617         }
4618
4619         return err;
4620 }
4621
4622 static int nl80211_testmode_dump(struct sk_buff *skb,
4623                                  struct netlink_callback *cb)
4624 {
4625         struct cfg80211_registered_device *dev;
4626         int err;
4627         long phy_idx;
4628         void *data = NULL;
4629         int data_len = 0;
4630
4631         if (cb->args[0]) {
4632                 /*
4633                  * 0 is a valid index, but not valid for args[0],
4634                  * so we need to offset by 1.
4635                  */
4636                 phy_idx = cb->args[0] - 1;
4637         } else {
4638                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4639                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4640                                   nl80211_policy);
4641                 if (err)
4642                         return err;
4643                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4644                         return -EINVAL;
4645                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4646                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4647                         cb->args[1] =
4648                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4649         }
4650
4651         if (cb->args[1]) {
4652                 data = nla_data((void *)cb->args[1]);
4653                 data_len = nla_len((void *)cb->args[1]);
4654         }
4655
4656         mutex_lock(&cfg80211_mutex);
4657         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4658         if (!dev) {
4659                 mutex_unlock(&cfg80211_mutex);
4660                 return -ENOENT;
4661         }
4662         cfg80211_lock_rdev(dev);
4663         mutex_unlock(&cfg80211_mutex);
4664
4665         if (!dev->ops->testmode_dump) {
4666                 err = -EOPNOTSUPP;
4667                 goto out_err;
4668         }
4669
4670         while (1) {
4671                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4672                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4673                                            NL80211_CMD_TESTMODE);
4674                 struct nlattr *tmdata;
4675
4676                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4677                         genlmsg_cancel(skb, hdr);
4678                         break;
4679                 }
4680
4681                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4682                 if (!tmdata) {
4683                         genlmsg_cancel(skb, hdr);
4684                         break;
4685                 }
4686                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4687                                               data, data_len);
4688                 nla_nest_end(skb, tmdata);
4689
4690                 if (err == -ENOBUFS || err == -ENOENT) {
4691                         genlmsg_cancel(skb, hdr);
4692                         break;
4693                 } else if (err) {
4694                         genlmsg_cancel(skb, hdr);
4695                         goto out_err;
4696                 }
4697
4698                 genlmsg_end(skb, hdr);
4699         }
4700
4701         err = skb->len;
4702         /* see above */
4703         cb->args[0] = phy_idx + 1;
4704  out_err:
4705         cfg80211_unlock_rdev(dev);
4706         return err;
4707 }
4708
4709 static struct sk_buff *
4710 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4711                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4712 {
4713         struct sk_buff *skb;
4714         void *hdr;
4715         struct nlattr *data;
4716
4717         skb = nlmsg_new(approxlen + 100, gfp);
4718         if (!skb)
4719                 return NULL;
4720
4721         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4722         if (!hdr) {
4723                 kfree_skb(skb);
4724                 return NULL;
4725         }
4726
4727         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4728         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4729
4730         ((void **)skb->cb)[0] = rdev;
4731         ((void **)skb->cb)[1] = hdr;
4732         ((void **)skb->cb)[2] = data;
4733
4734         return skb;
4735
4736  nla_put_failure:
4737         kfree_skb(skb);
4738         return NULL;
4739 }
4740
4741 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4742                                                   int approxlen)
4743 {
4744         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4745
4746         if (WARN_ON(!rdev->testmode_info))
4747                 return NULL;
4748
4749         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4750                                 rdev->testmode_info->snd_pid,
4751                                 rdev->testmode_info->snd_seq,
4752                                 GFP_KERNEL);
4753 }
4754 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4755
4756 int cfg80211_testmode_reply(struct sk_buff *skb)
4757 {
4758         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4759         void *hdr = ((void **)skb->cb)[1];
4760         struct nlattr *data = ((void **)skb->cb)[2];
4761
4762         if (WARN_ON(!rdev->testmode_info)) {
4763                 kfree_skb(skb);
4764                 return -EINVAL;
4765         }
4766
4767         nla_nest_end(skb, data);
4768         genlmsg_end(skb, hdr);
4769         return genlmsg_reply(skb, rdev->testmode_info);
4770 }
4771 EXPORT_SYMBOL(cfg80211_testmode_reply);
4772
4773 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4774                                                   int approxlen, gfp_t gfp)
4775 {
4776         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4777
4778         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4779 }
4780 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4781
4782 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4783 {
4784         void *hdr = ((void **)skb->cb)[1];
4785         struct nlattr *data = ((void **)skb->cb)[2];
4786
4787         nla_nest_end(skb, data);
4788         genlmsg_end(skb, hdr);
4789         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4790 }
4791 EXPORT_SYMBOL(cfg80211_testmode_event);
4792 #endif
4793
4794 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4795 {
4796         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4797         struct net_device *dev = info->user_ptr[1];
4798         struct cfg80211_connect_params connect;
4799         struct wiphy *wiphy;
4800         struct cfg80211_cached_keys *connkeys = NULL;
4801         int err;
4802
4803         memset(&connect, 0, sizeof(connect));
4804
4805         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4806                 return -EINVAL;
4807
4808         if (!info->attrs[NL80211_ATTR_SSID] ||
4809             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4810                 return -EINVAL;
4811
4812         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4813                 connect.auth_type =
4814                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4815                 if (!nl80211_valid_auth_type(connect.auth_type))
4816                         return -EINVAL;
4817         } else
4818                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4819
4820         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4821
4822         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4823                                       NL80211_MAX_NR_CIPHER_SUITES);
4824         if (err)
4825                 return err;
4826
4827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4828             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4829                 return -EOPNOTSUPP;
4830
4831         wiphy = &rdev->wiphy;
4832
4833         if (info->attrs[NL80211_ATTR_MAC])
4834                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4835         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4836         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4837
4838         if (info->attrs[NL80211_ATTR_IE]) {
4839                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4840                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4841         }
4842
4843         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4844                 connect.channel =
4845                         ieee80211_get_channel(wiphy,
4846                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4847                 if (!connect.channel ||
4848                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4849                         return -EINVAL;
4850         }
4851
4852         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4853                 connkeys = nl80211_parse_connkeys(rdev,
4854                                         info->attrs[NL80211_ATTR_KEYS]);
4855                 if (IS_ERR(connkeys))
4856                         return PTR_ERR(connkeys);
4857         }
4858
4859         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4860         if (err)
4861                 kfree(connkeys);
4862         return err;
4863 }
4864
4865 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4866 {
4867         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4868         struct net_device *dev = info->user_ptr[1];
4869         u16 reason;
4870
4871         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4872                 reason = WLAN_REASON_DEAUTH_LEAVING;
4873         else
4874                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4875
4876         if (reason == 0)
4877                 return -EINVAL;
4878
4879         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4880             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4881                 return -EOPNOTSUPP;
4882
4883         return cfg80211_disconnect(rdev, dev, reason, true);
4884 }
4885
4886 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4887 {
4888         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4889         struct net *net;
4890         int err;
4891         u32 pid;
4892
4893         if (!info->attrs[NL80211_ATTR_PID])
4894                 return -EINVAL;
4895
4896         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4897
4898         net = get_net_ns_by_pid(pid);
4899         if (IS_ERR(net))
4900                 return PTR_ERR(net);
4901
4902         err = 0;
4903
4904         /* check if anything to do */
4905         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4906                 err = cfg80211_switch_netns(rdev, net);
4907
4908         put_net(net);
4909         return err;
4910 }
4911
4912 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4913 {
4914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4915         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4916                         struct cfg80211_pmksa *pmksa) = NULL;
4917         struct net_device *dev = info->user_ptr[1];
4918         struct cfg80211_pmksa pmksa;
4919
4920         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4921
4922         if (!info->attrs[NL80211_ATTR_MAC])
4923                 return -EINVAL;
4924
4925         if (!info->attrs[NL80211_ATTR_PMKID])
4926                 return -EINVAL;
4927
4928         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4929         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4930
4931         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4932             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4933                 return -EOPNOTSUPP;
4934
4935         switch (info->genlhdr->cmd) {
4936         case NL80211_CMD_SET_PMKSA:
4937                 rdev_ops = rdev->ops->set_pmksa;
4938                 break;
4939         case NL80211_CMD_DEL_PMKSA:
4940                 rdev_ops = rdev->ops->del_pmksa;
4941                 break;
4942         default:
4943                 WARN_ON(1);
4944                 break;
4945         }
4946
4947         if (!rdev_ops)
4948                 return -EOPNOTSUPP;
4949
4950         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4951 }
4952
4953 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4954 {
4955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4956         struct net_device *dev = info->user_ptr[1];
4957
4958         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4959             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4960                 return -EOPNOTSUPP;
4961
4962         if (!rdev->ops->flush_pmksa)
4963                 return -EOPNOTSUPP;
4964
4965         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4966 }
4967
4968 static int nl80211_remain_on_channel(struct sk_buff *skb,
4969                                      struct genl_info *info)
4970 {
4971         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4972         struct net_device *dev = info->user_ptr[1];
4973         struct ieee80211_channel *chan;
4974         struct sk_buff *msg;
4975         void *hdr;
4976         u64 cookie;
4977         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4978         u32 freq, duration;
4979         int err;
4980
4981         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4982             !info->attrs[NL80211_ATTR_DURATION])
4983                 return -EINVAL;
4984
4985         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4986
4987         /*
4988          * We should be on that channel for at least one jiffie,
4989          * and more than 5 seconds seems excessive.
4990          */
4991         if (!duration || !msecs_to_jiffies(duration) ||
4992             duration > rdev->wiphy.max_remain_on_channel_duration)
4993                 return -EINVAL;
4994
4995         if (!rdev->ops->remain_on_channel)
4996                 return -EOPNOTSUPP;
4997
4998         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4999                 channel_type = nla_get_u32(
5000                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5001                 if (channel_type != NL80211_CHAN_NO_HT &&
5002                     channel_type != NL80211_CHAN_HT20 &&
5003                     channel_type != NL80211_CHAN_HT40PLUS &&
5004                     channel_type != NL80211_CHAN_HT40MINUS)
5005                         return -EINVAL;
5006         }
5007
5008         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5009         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5010         if (chan == NULL)
5011                 return -EINVAL;
5012
5013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5014         if (!msg)
5015                 return -ENOMEM;
5016
5017         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5018                              NL80211_CMD_REMAIN_ON_CHANNEL);
5019
5020         if (IS_ERR(hdr)) {
5021                 err = PTR_ERR(hdr);
5022                 goto free_msg;
5023         }
5024
5025         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5026                                            channel_type, duration, &cookie);
5027
5028         if (err)
5029                 goto free_msg;
5030
5031         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5032
5033         genlmsg_end(msg, hdr);
5034
5035         return genlmsg_reply(msg, info);
5036
5037  nla_put_failure:
5038         err = -ENOBUFS;
5039  free_msg:
5040         nlmsg_free(msg);
5041         return err;
5042 }
5043
5044 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5045                                             struct genl_info *info)
5046 {
5047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5048         struct net_device *dev = info->user_ptr[1];
5049         u64 cookie;
5050
5051         if (!info->attrs[NL80211_ATTR_COOKIE])
5052                 return -EINVAL;
5053
5054         if (!rdev->ops->cancel_remain_on_channel)
5055                 return -EOPNOTSUPP;
5056
5057         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5058
5059         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5060 }
5061
5062 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5063                            u8 *rates, u8 rates_len)
5064 {
5065         u8 i;
5066         u32 mask = 0;
5067
5068         for (i = 0; i < rates_len; i++) {
5069                 int rate = (rates[i] & 0x7f) * 5;
5070                 int ridx;
5071                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5072                         struct ieee80211_rate *srate =
5073                                 &sband->bitrates[ridx];
5074                         if (rate == srate->bitrate) {
5075                                 mask |= 1 << ridx;
5076                                 break;
5077                         }
5078                 }
5079                 if (ridx == sband->n_bitrates)
5080                         return 0; /* rate not found */
5081         }
5082
5083         return mask;
5084 }
5085
5086 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5087         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5088                                     .len = NL80211_MAX_SUPP_RATES },
5089 };
5090
5091 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5092                                        struct genl_info *info)
5093 {
5094         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5096         struct cfg80211_bitrate_mask mask;
5097         int rem, i;
5098         struct net_device *dev = info->user_ptr[1];
5099         struct nlattr *tx_rates;
5100         struct ieee80211_supported_band *sband;
5101
5102         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5103                 return -EINVAL;
5104
5105         if (!rdev->ops->set_bitrate_mask)
5106                 return -EOPNOTSUPP;
5107
5108         memset(&mask, 0, sizeof(mask));
5109         /* Default to all rates enabled */
5110         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5111                 sband = rdev->wiphy.bands[i];
5112                 mask.control[i].legacy =
5113                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5114         }
5115
5116         /*
5117          * The nested attribute uses enum nl80211_band as the index. This maps
5118          * directly to the enum ieee80211_band values used in cfg80211.
5119          */
5120         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5121         {
5122                 enum ieee80211_band band = nla_type(tx_rates);
5123                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5124                         return -EINVAL;
5125                 sband = rdev->wiphy.bands[band];
5126                 if (sband == NULL)
5127                         return -EINVAL;
5128                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5129                           nla_len(tx_rates), nl80211_txattr_policy);
5130                 if (tb[NL80211_TXRATE_LEGACY]) {
5131                         mask.control[band].legacy = rateset_to_mask(
5132                                 sband,
5133                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5134                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5135                         if (mask.control[band].legacy == 0)
5136                                 return -EINVAL;
5137                 }
5138         }
5139
5140         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5141 }
5142
5143 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5144 {
5145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5146         struct net_device *dev = info->user_ptr[1];
5147         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5148
5149         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5150                 return -EINVAL;
5151
5152         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5153                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5154
5155         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5156             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5157             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5158             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5159             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5160             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5161             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5162                 return -EOPNOTSUPP;
5163
5164         /* not much point in registering if we can't reply */
5165         if (!rdev->ops->mgmt_tx)
5166                 return -EOPNOTSUPP;
5167
5168         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5169                         frame_type,
5170                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5171                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5172 }
5173
5174 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5175 {
5176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5177         struct net_device *dev = info->user_ptr[1];
5178         struct ieee80211_channel *chan;
5179         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5180         bool channel_type_valid = false;
5181         u32 freq;
5182         int err;
5183         void *hdr;
5184         u64 cookie;
5185         struct sk_buff *msg;
5186         unsigned int wait = 0;
5187         bool offchan;
5188
5189         if (!info->attrs[NL80211_ATTR_FRAME] ||
5190             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5191                 return -EINVAL;
5192
5193         if (!rdev->ops->mgmt_tx)
5194                 return -EOPNOTSUPP;
5195
5196         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5197             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5198             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5199             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5200             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5201             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5202             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5203                 return -EOPNOTSUPP;
5204
5205         if (info->attrs[NL80211_ATTR_DURATION]) {
5206                 if (!rdev->ops->mgmt_tx_cancel_wait)
5207                         return -EINVAL;
5208                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5209         }
5210
5211         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5212                 channel_type = nla_get_u32(
5213                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5214                 if (channel_type != NL80211_CHAN_NO_HT &&
5215                     channel_type != NL80211_CHAN_HT20 &&
5216                     channel_type != NL80211_CHAN_HT40PLUS &&
5217                     channel_type != NL80211_CHAN_HT40MINUS)
5218                         return -EINVAL;
5219                 channel_type_valid = true;
5220         }
5221
5222         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5223
5224         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5225         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5226         if (chan == NULL)
5227                 return -EINVAL;
5228
5229         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5230         if (!msg)
5231                 return -ENOMEM;
5232
5233         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5234                              NL80211_CMD_FRAME);
5235
5236         if (IS_ERR(hdr)) {
5237                 err = PTR_ERR(hdr);
5238                 goto free_msg;
5239         }
5240         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5241                                     channel_type_valid, wait,
5242                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5243                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5244                                     &cookie);
5245         if (err)
5246                 goto free_msg;
5247
5248         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5249
5250         genlmsg_end(msg, hdr);
5251         return genlmsg_reply(msg, info);
5252
5253  nla_put_failure:
5254         err = -ENOBUFS;
5255  free_msg:
5256         nlmsg_free(msg);
5257         return err;
5258 }
5259
5260 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5261 {
5262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5263         struct net_device *dev = info->user_ptr[1];
5264         u64 cookie;
5265
5266         if (!info->attrs[NL80211_ATTR_COOKIE])
5267                 return -EINVAL;
5268
5269         if (!rdev->ops->mgmt_tx_cancel_wait)
5270                 return -EOPNOTSUPP;
5271
5272         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5273             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5274             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5275             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5276             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5277             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5278                 return -EOPNOTSUPP;
5279
5280         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5281
5282         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5283 }
5284
5285 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5286 {
5287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5288         struct wireless_dev *wdev;
5289         struct net_device *dev = info->user_ptr[1];
5290         u8 ps_state;
5291         bool state;
5292         int err;
5293
5294         if (!info->attrs[NL80211_ATTR_PS_STATE])
5295                 return -EINVAL;
5296
5297         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5298
5299         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5300                 return -EINVAL;
5301
5302         wdev = dev->ieee80211_ptr;
5303
5304         if (!rdev->ops->set_power_mgmt)
5305                 return -EOPNOTSUPP;
5306
5307         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5308
5309         if (state == wdev->ps)
5310                 return 0;
5311
5312         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5313                                         wdev->ps_timeout);
5314         if (!err)
5315                 wdev->ps = state;
5316         return err;
5317 }
5318
5319 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5320 {
5321         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5322         enum nl80211_ps_state ps_state;
5323         struct wireless_dev *wdev;
5324         struct net_device *dev = info->user_ptr[1];
5325         struct sk_buff *msg;
5326         void *hdr;
5327         int err;
5328
5329         wdev = dev->ieee80211_ptr;
5330
5331         if (!rdev->ops->set_power_mgmt)
5332                 return -EOPNOTSUPP;
5333
5334         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5335         if (!msg)
5336                 return -ENOMEM;
5337
5338         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5339                              NL80211_CMD_GET_POWER_SAVE);
5340         if (!hdr) {
5341                 err = -ENOBUFS;
5342                 goto free_msg;
5343         }
5344
5345         if (wdev->ps)
5346                 ps_state = NL80211_PS_ENABLED;
5347         else
5348                 ps_state = NL80211_PS_DISABLED;
5349
5350         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5351
5352         genlmsg_end(msg, hdr);
5353         return genlmsg_reply(msg, info);
5354
5355  nla_put_failure:
5356         err = -ENOBUFS;
5357  free_msg:
5358         nlmsg_free(msg);
5359         return err;
5360 }
5361
5362 static struct nla_policy
5363 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5364         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5365         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5366         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5367 };
5368
5369 static int nl80211_set_cqm_rssi(struct genl_info *info,
5370                                 s32 threshold, u32 hysteresis)
5371 {
5372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5373         struct wireless_dev *wdev;
5374         struct net_device *dev = info->user_ptr[1];
5375
5376         if (threshold > 0)
5377                 return -EINVAL;
5378
5379         wdev = dev->ieee80211_ptr;
5380
5381         if (!rdev->ops->set_cqm_rssi_config)
5382                 return -EOPNOTSUPP;
5383
5384         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5385             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5386                 return -EOPNOTSUPP;
5387
5388         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5389                                               threshold, hysteresis);
5390 }
5391
5392 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5393 {
5394         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5395         struct nlattr *cqm;
5396         int err;
5397
5398         cqm = info->attrs[NL80211_ATTR_CQM];
5399         if (!cqm) {
5400                 err = -EINVAL;
5401                 goto out;
5402         }
5403
5404         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5405                                nl80211_attr_cqm_policy);
5406         if (err)
5407                 goto out;
5408
5409         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5410             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5411                 s32 threshold;
5412                 u32 hysteresis;
5413                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5414                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5415                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5416         } else
5417                 err = -EINVAL;
5418
5419 out:
5420         return err;
5421 }
5422
5423 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5424 {
5425         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5426         struct net_device *dev = info->user_ptr[1];
5427         struct mesh_config cfg;
5428         struct mesh_setup setup;
5429         int err;
5430
5431         /* start with default */
5432         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5433         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5434
5435         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5436                 /* and parse parameters if given */
5437                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5438                 if (err)
5439                         return err;
5440         }
5441
5442         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5443             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5444                 return -EINVAL;
5445
5446         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5447         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5448
5449         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5450                 /* parse additional setup parameters if given */
5451                 err = nl80211_parse_mesh_setup(info, &setup);
5452                 if (err)
5453                         return err;
5454         }
5455
5456         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5457 }
5458
5459 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5460 {
5461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5462         struct net_device *dev = info->user_ptr[1];
5463
5464         return cfg80211_leave_mesh(rdev, dev);
5465 }
5466
5467 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5468 {
5469         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5470         struct sk_buff *msg;
5471         void *hdr;
5472
5473         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5474                 return -EOPNOTSUPP;
5475
5476         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5477         if (!msg)
5478                 return -ENOMEM;
5479
5480         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5481                              NL80211_CMD_GET_WOWLAN);
5482         if (!hdr)
5483                 goto nla_put_failure;
5484
5485         if (rdev->wowlan) {
5486                 struct nlattr *nl_wowlan;
5487
5488                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5489                 if (!nl_wowlan)
5490                         goto nla_put_failure;
5491
5492                 if (rdev->wowlan->any)
5493                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5494                 if (rdev->wowlan->disconnect)
5495                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5496                 if (rdev->wowlan->magic_pkt)
5497                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5498                 if (rdev->wowlan->gtk_rekey_failure)
5499                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5500                 if (rdev->wowlan->eap_identity_req)
5501                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5502                 if (rdev->wowlan->four_way_handshake)
5503                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5504                 if (rdev->wowlan->rfkill_release)
5505                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5506                 if (rdev->wowlan->n_patterns) {
5507                         struct nlattr *nl_pats, *nl_pat;
5508                         int i, pat_len;
5509
5510                         nl_pats = nla_nest_start(msg,
5511                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5512                         if (!nl_pats)
5513                                 goto nla_put_failure;
5514
5515                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5516                                 nl_pat = nla_nest_start(msg, i + 1);
5517                                 if (!nl_pat)
5518                                         goto nla_put_failure;
5519                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5520                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5521                                         DIV_ROUND_UP(pat_len, 8),
5522                                         rdev->wowlan->patterns[i].mask);
5523                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5524                                         pat_len,
5525                                         rdev->wowlan->patterns[i].pattern);
5526                                 nla_nest_end(msg, nl_pat);
5527                         }
5528                         nla_nest_end(msg, nl_pats);
5529                 }
5530
5531                 nla_nest_end(msg, nl_wowlan);
5532         }
5533
5534         genlmsg_end(msg, hdr);
5535         return genlmsg_reply(msg, info);
5536
5537 nla_put_failure:
5538         nlmsg_free(msg);
5539         return -ENOBUFS;
5540 }
5541
5542 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5543 {
5544         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5545         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5546         struct cfg80211_wowlan no_triggers = {};
5547         struct cfg80211_wowlan new_triggers = {};
5548         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5549         int err, i;
5550
5551         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5552                 return -EOPNOTSUPP;
5553
5554         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5555                 goto no_triggers;
5556
5557         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5558                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5559                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5560                         nl80211_wowlan_policy);
5561         if (err)
5562                 return err;
5563
5564         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5565                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5566                         return -EINVAL;
5567                 new_triggers.any = true;
5568         }
5569
5570         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5571                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5572                         return -EINVAL;
5573                 new_triggers.disconnect = true;
5574         }
5575
5576         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5577                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5578                         return -EINVAL;
5579                 new_triggers.magic_pkt = true;
5580         }
5581
5582         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5583                 return -EINVAL;
5584
5585         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5586                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5587                         return -EINVAL;
5588                 new_triggers.gtk_rekey_failure = true;
5589         }
5590
5591         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5592                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5593                         return -EINVAL;
5594                 new_triggers.eap_identity_req = true;
5595         }
5596
5597         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5598                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5599                         return -EINVAL;
5600                 new_triggers.four_way_handshake = true;
5601         }
5602
5603         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5604                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5605                         return -EINVAL;
5606                 new_triggers.rfkill_release = true;
5607         }
5608
5609         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5610                 struct nlattr *pat;
5611                 int n_patterns = 0;
5612                 int rem, pat_len, mask_len;
5613                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5614
5615                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5616                                     rem)
5617                         n_patterns++;
5618                 if (n_patterns > wowlan->n_patterns)
5619                         return -EINVAL;
5620
5621                 new_triggers.patterns = kcalloc(n_patterns,
5622                                                 sizeof(new_triggers.patterns[0]),
5623                                                 GFP_KERNEL);
5624                 if (!new_triggers.patterns)
5625                         return -ENOMEM;
5626
5627                 new_triggers.n_patterns = n_patterns;
5628                 i = 0;
5629
5630                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5631                                     rem) {
5632                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5633                                   nla_data(pat), nla_len(pat), NULL);
5634                         err = -EINVAL;
5635                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5636                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5637                                 goto error;
5638                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5639                         mask_len = DIV_ROUND_UP(pat_len, 8);
5640                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5641                             mask_len)
5642                                 goto error;
5643                         if (pat_len > wowlan->pattern_max_len ||
5644                             pat_len < wowlan->pattern_min_len)
5645                                 goto error;
5646
5647                         new_triggers.patterns[i].mask =
5648                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5649                         if (!new_triggers.patterns[i].mask) {
5650                                 err = -ENOMEM;
5651                                 goto error;
5652                         }
5653                         new_triggers.patterns[i].pattern =
5654                                 new_triggers.patterns[i].mask + mask_len;
5655                         memcpy(new_triggers.patterns[i].mask,
5656                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5657                                mask_len);
5658                         new_triggers.patterns[i].pattern_len = pat_len;
5659                         memcpy(new_triggers.patterns[i].pattern,
5660                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5661                                pat_len);
5662                         i++;
5663                 }
5664         }
5665
5666         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5667                 struct cfg80211_wowlan *ntrig;
5668                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5669                                 GFP_KERNEL);
5670                 if (!ntrig) {
5671                         err = -ENOMEM;
5672                         goto error;
5673                 }
5674                 cfg80211_rdev_free_wowlan(rdev);
5675                 rdev->wowlan = ntrig;
5676         } else {
5677  no_triggers:
5678                 cfg80211_rdev_free_wowlan(rdev);
5679                 rdev->wowlan = NULL;
5680         }
5681
5682         return 0;
5683  error:
5684         for (i = 0; i < new_triggers.n_patterns; i++)
5685                 kfree(new_triggers.patterns[i].mask);
5686         kfree(new_triggers.patterns);
5687         return err;
5688 }
5689
5690 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5691 {
5692         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5693         struct net_device *dev = info->user_ptr[1];
5694         struct wireless_dev *wdev = dev->ieee80211_ptr;
5695         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5696         struct cfg80211_gtk_rekey_data rekey_data;
5697         int err;
5698
5699         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5700                 return -EINVAL;
5701
5702         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5703                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5704                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5705                         nl80211_rekey_policy);
5706         if (err)
5707                 return err;
5708
5709         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5710                 return -ERANGE;
5711         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5712                 return -ERANGE;
5713         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5714                 return -ERANGE;
5715
5716         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5717                NL80211_KEK_LEN);
5718         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5719                NL80211_KCK_LEN);
5720         memcpy(rekey_data.replay_ctr,
5721                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5722                NL80211_REPLAY_CTR_LEN);
5723
5724         wdev_lock(wdev);
5725         if (!wdev->current_bss) {
5726                 err = -ENOTCONN;
5727                 goto out;
5728         }
5729
5730         if (!rdev->ops->set_rekey_data) {
5731                 err = -EOPNOTSUPP;
5732                 goto out;
5733         }
5734
5735         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5736  out:
5737         wdev_unlock(wdev);
5738         return err;
5739 }
5740
5741 #define NL80211_FLAG_NEED_WIPHY         0x01
5742 #define NL80211_FLAG_NEED_NETDEV        0x02
5743 #define NL80211_FLAG_NEED_RTNL          0x04
5744 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5745 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5746                                          NL80211_FLAG_CHECK_NETDEV_UP)
5747
5748 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5749                             struct genl_info *info)
5750 {
5751         struct cfg80211_registered_device *rdev;
5752         struct net_device *dev;
5753         int err;
5754         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5755
5756         if (rtnl)
5757                 rtnl_lock();
5758
5759         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5760                 rdev = cfg80211_get_dev_from_info(info);
5761                 if (IS_ERR(rdev)) {
5762                         if (rtnl)
5763                                 rtnl_unlock();
5764                         return PTR_ERR(rdev);
5765                 }
5766                 info->user_ptr[0] = rdev;
5767         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5768                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5769                 if (err) {
5770                         if (rtnl)
5771                                 rtnl_unlock();
5772                         return err;
5773                 }
5774                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5775                     !netif_running(dev)) {
5776                         cfg80211_unlock_rdev(rdev);
5777                         dev_put(dev);
5778                         if (rtnl)
5779                                 rtnl_unlock();
5780                         return -ENETDOWN;
5781                 }
5782                 info->user_ptr[0] = rdev;
5783                 info->user_ptr[1] = dev;
5784         }
5785
5786         return 0;
5787 }
5788
5789 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5790                               struct genl_info *info)
5791 {
5792         if (info->user_ptr[0])
5793                 cfg80211_unlock_rdev(info->user_ptr[0]);
5794         if (info->user_ptr[1])
5795                 dev_put(info->user_ptr[1]);
5796         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5797                 rtnl_unlock();
5798 }
5799
5800 static struct genl_ops nl80211_ops[] = {
5801         {
5802                 .cmd = NL80211_CMD_GET_WIPHY,
5803                 .doit = nl80211_get_wiphy,
5804                 .dumpit = nl80211_dump_wiphy,
5805                 .policy = nl80211_policy,
5806                 /* can be retrieved by unprivileged users */
5807                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5808         },
5809         {
5810                 .cmd = NL80211_CMD_SET_WIPHY,
5811                 .doit = nl80211_set_wiphy,
5812                 .policy = nl80211_policy,
5813                 .flags = GENL_ADMIN_PERM,
5814                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5815         },
5816         {
5817                 .cmd = NL80211_CMD_GET_INTERFACE,
5818                 .doit = nl80211_get_interface,
5819                 .dumpit = nl80211_dump_interface,
5820                 .policy = nl80211_policy,
5821                 /* can be retrieved by unprivileged users */
5822                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5823         },
5824         {
5825                 .cmd = NL80211_CMD_SET_INTERFACE,
5826                 .doit = nl80211_set_interface,
5827                 .policy = nl80211_policy,
5828                 .flags = GENL_ADMIN_PERM,
5829                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5830                                   NL80211_FLAG_NEED_RTNL,
5831         },
5832         {
5833                 .cmd = NL80211_CMD_NEW_INTERFACE,
5834                 .doit = nl80211_new_interface,
5835                 .policy = nl80211_policy,
5836                 .flags = GENL_ADMIN_PERM,
5837                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5838                                   NL80211_FLAG_NEED_RTNL,
5839         },
5840         {
5841                 .cmd = NL80211_CMD_DEL_INTERFACE,
5842                 .doit = nl80211_del_interface,
5843                 .policy = nl80211_policy,
5844                 .flags = GENL_ADMIN_PERM,
5845                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5846                                   NL80211_FLAG_NEED_RTNL,
5847         },
5848         {
5849                 .cmd = NL80211_CMD_GET_KEY,
5850                 .doit = nl80211_get_key,
5851                 .policy = nl80211_policy,
5852                 .flags = GENL_ADMIN_PERM,
5853                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5854                                   NL80211_FLAG_NEED_RTNL,
5855         },
5856         {
5857                 .cmd = NL80211_CMD_SET_KEY,
5858                 .doit = nl80211_set_key,
5859                 .policy = nl80211_policy,
5860                 .flags = GENL_ADMIN_PERM,
5861                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5862                                   NL80211_FLAG_NEED_RTNL,
5863         },
5864         {
5865                 .cmd = NL80211_CMD_NEW_KEY,
5866                 .doit = nl80211_new_key,
5867                 .policy = nl80211_policy,
5868                 .flags = GENL_ADMIN_PERM,
5869                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5870                                   NL80211_FLAG_NEED_RTNL,
5871         },
5872         {
5873                 .cmd = NL80211_CMD_DEL_KEY,
5874                 .doit = nl80211_del_key,
5875                 .policy = nl80211_policy,
5876                 .flags = GENL_ADMIN_PERM,
5877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5878                                   NL80211_FLAG_NEED_RTNL,
5879         },
5880         {
5881                 .cmd = NL80211_CMD_SET_BEACON,
5882                 .policy = nl80211_policy,
5883                 .flags = GENL_ADMIN_PERM,
5884                 .doit = nl80211_addset_beacon,
5885                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5886                                   NL80211_FLAG_NEED_RTNL,
5887         },
5888         {
5889                 .cmd = NL80211_CMD_NEW_BEACON,
5890                 .policy = nl80211_policy,
5891                 .flags = GENL_ADMIN_PERM,
5892                 .doit = nl80211_addset_beacon,
5893                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5894                                   NL80211_FLAG_NEED_RTNL,
5895         },
5896         {
5897                 .cmd = NL80211_CMD_DEL_BEACON,
5898                 .policy = nl80211_policy,
5899                 .flags = GENL_ADMIN_PERM,
5900                 .doit = nl80211_del_beacon,
5901                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5902                                   NL80211_FLAG_NEED_RTNL,
5903         },
5904         {
5905                 .cmd = NL80211_CMD_GET_STATION,
5906                 .doit = nl80211_get_station,
5907                 .dumpit = nl80211_dump_station,
5908                 .policy = nl80211_policy,
5909                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5910                                   NL80211_FLAG_NEED_RTNL,
5911         },
5912         {
5913                 .cmd = NL80211_CMD_SET_STATION,
5914                 .doit = nl80211_set_station,
5915                 .policy = nl80211_policy,
5916                 .flags = GENL_ADMIN_PERM,
5917                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5918                                   NL80211_FLAG_NEED_RTNL,
5919         },
5920         {
5921                 .cmd = NL80211_CMD_NEW_STATION,
5922                 .doit = nl80211_new_station,
5923                 .policy = nl80211_policy,
5924                 .flags = GENL_ADMIN_PERM,
5925                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5926                                   NL80211_FLAG_NEED_RTNL,
5927         },
5928         {
5929                 .cmd = NL80211_CMD_DEL_STATION,
5930                 .doit = nl80211_del_station,
5931                 .policy = nl80211_policy,
5932                 .flags = GENL_ADMIN_PERM,
5933                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5934                                   NL80211_FLAG_NEED_RTNL,
5935         },
5936         {
5937                 .cmd = NL80211_CMD_GET_MPATH,
5938                 .doit = nl80211_get_mpath,
5939                 .dumpit = nl80211_dump_mpath,
5940                 .policy = nl80211_policy,
5941                 .flags = GENL_ADMIN_PERM,
5942                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5943                                   NL80211_FLAG_NEED_RTNL,
5944         },
5945         {
5946                 .cmd = NL80211_CMD_SET_MPATH,
5947                 .doit = nl80211_set_mpath,
5948                 .policy = nl80211_policy,
5949                 .flags = GENL_ADMIN_PERM,
5950                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5951                                   NL80211_FLAG_NEED_RTNL,
5952         },
5953         {
5954                 .cmd = NL80211_CMD_NEW_MPATH,
5955                 .doit = nl80211_new_mpath,
5956                 .policy = nl80211_policy,
5957                 .flags = GENL_ADMIN_PERM,
5958                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5959                                   NL80211_FLAG_NEED_RTNL,
5960         },
5961         {
5962                 .cmd = NL80211_CMD_DEL_MPATH,
5963                 .doit = nl80211_del_mpath,
5964                 .policy = nl80211_policy,
5965                 .flags = GENL_ADMIN_PERM,
5966                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5967                                   NL80211_FLAG_NEED_RTNL,
5968         },
5969         {
5970                 .cmd = NL80211_CMD_SET_BSS,
5971                 .doit = nl80211_set_bss,
5972                 .policy = nl80211_policy,
5973                 .flags = GENL_ADMIN_PERM,
5974                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5975                                   NL80211_FLAG_NEED_RTNL,
5976         },
5977         {
5978                 .cmd = NL80211_CMD_GET_REG,
5979                 .doit = nl80211_get_reg,
5980                 .policy = nl80211_policy,
5981                 /* can be retrieved by unprivileged users */
5982         },
5983         {
5984                 .cmd = NL80211_CMD_SET_REG,
5985                 .doit = nl80211_set_reg,
5986                 .policy = nl80211_policy,
5987                 .flags = GENL_ADMIN_PERM,
5988         },
5989         {
5990                 .cmd = NL80211_CMD_REQ_SET_REG,
5991                 .doit = nl80211_req_set_reg,
5992                 .policy = nl80211_policy,
5993                 .flags = GENL_ADMIN_PERM,
5994         },
5995         {
5996                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5997                 .doit = nl80211_get_mesh_config,
5998                 .policy = nl80211_policy,
5999                 /* can be retrieved by unprivileged users */
6000                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6001                                   NL80211_FLAG_NEED_RTNL,
6002         },
6003         {
6004                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
6005                 .doit = nl80211_update_mesh_config,
6006                 .policy = nl80211_policy,
6007                 .flags = GENL_ADMIN_PERM,
6008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6009                                   NL80211_FLAG_NEED_RTNL,
6010         },
6011         {
6012                 .cmd = NL80211_CMD_TRIGGER_SCAN,
6013                 .doit = nl80211_trigger_scan,
6014                 .policy = nl80211_policy,
6015                 .flags = GENL_ADMIN_PERM,
6016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6017                                   NL80211_FLAG_NEED_RTNL,
6018         },
6019         {
6020                 .cmd = NL80211_CMD_GET_SCAN,
6021                 .policy = nl80211_policy,
6022                 .dumpit = nl80211_dump_scan,
6023         },
6024         {
6025                 .cmd = NL80211_CMD_START_SCHED_SCAN,
6026                 .doit = nl80211_start_sched_scan,
6027                 .policy = nl80211_policy,
6028                 .flags = GENL_ADMIN_PERM,
6029                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6030                                   NL80211_FLAG_NEED_RTNL,
6031         },
6032         {
6033                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
6034                 .doit = nl80211_stop_sched_scan,
6035                 .policy = nl80211_policy,
6036                 .flags = GENL_ADMIN_PERM,
6037                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6038                                   NL80211_FLAG_NEED_RTNL,
6039         },
6040         {
6041                 .cmd = NL80211_CMD_AUTHENTICATE,
6042                 .doit = nl80211_authenticate,
6043                 .policy = nl80211_policy,
6044                 .flags = GENL_ADMIN_PERM,
6045                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6046                                   NL80211_FLAG_NEED_RTNL,
6047         },
6048         {
6049                 .cmd = NL80211_CMD_ASSOCIATE,
6050                 .doit = nl80211_associate,
6051                 .policy = nl80211_policy,
6052                 .flags = GENL_ADMIN_PERM,
6053                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6054                                   NL80211_FLAG_NEED_RTNL,
6055         },
6056         {
6057                 .cmd = NL80211_CMD_DEAUTHENTICATE,
6058                 .doit = nl80211_deauthenticate,
6059                 .policy = nl80211_policy,
6060                 .flags = GENL_ADMIN_PERM,
6061                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6062                                   NL80211_FLAG_NEED_RTNL,
6063         },
6064         {
6065                 .cmd = NL80211_CMD_DISASSOCIATE,
6066                 .doit = nl80211_disassociate,
6067                 .policy = nl80211_policy,
6068                 .flags = GENL_ADMIN_PERM,
6069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6070                                   NL80211_FLAG_NEED_RTNL,
6071         },
6072         {
6073                 .cmd = NL80211_CMD_JOIN_IBSS,
6074                 .doit = nl80211_join_ibss,
6075                 .policy = nl80211_policy,
6076                 .flags = GENL_ADMIN_PERM,
6077                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6078                                   NL80211_FLAG_NEED_RTNL,
6079         },
6080         {
6081                 .cmd = NL80211_CMD_LEAVE_IBSS,
6082                 .doit = nl80211_leave_ibss,
6083                 .policy = nl80211_policy,
6084                 .flags = GENL_ADMIN_PERM,
6085                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6086                                   NL80211_FLAG_NEED_RTNL,
6087         },
6088 #ifdef CONFIG_NL80211_TESTMODE
6089         {
6090                 .cmd = NL80211_CMD_TESTMODE,
6091                 .doit = nl80211_testmode_do,
6092                 .dumpit = nl80211_testmode_dump,
6093                 .policy = nl80211_policy,
6094                 .flags = GENL_ADMIN_PERM,
6095                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6096                                   NL80211_FLAG_NEED_RTNL,
6097         },
6098 #endif
6099         {
6100                 .cmd = NL80211_CMD_CONNECT,
6101                 .doit = nl80211_connect,
6102                 .policy = nl80211_policy,
6103                 .flags = GENL_ADMIN_PERM,
6104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6105                                   NL80211_FLAG_NEED_RTNL,
6106         },
6107         {
6108                 .cmd = NL80211_CMD_DISCONNECT,
6109                 .doit = nl80211_disconnect,
6110                 .policy = nl80211_policy,
6111                 .flags = GENL_ADMIN_PERM,
6112                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6113                                   NL80211_FLAG_NEED_RTNL,
6114         },
6115         {
6116                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6117                 .doit = nl80211_wiphy_netns,
6118                 .policy = nl80211_policy,
6119                 .flags = GENL_ADMIN_PERM,
6120                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6121                                   NL80211_FLAG_NEED_RTNL,
6122         },
6123         {
6124                 .cmd = NL80211_CMD_GET_SURVEY,
6125                 .policy = nl80211_policy,
6126                 .dumpit = nl80211_dump_survey,
6127         },
6128         {
6129                 .cmd = NL80211_CMD_SET_PMKSA,
6130                 .doit = nl80211_setdel_pmksa,
6131                 .policy = nl80211_policy,
6132                 .flags = GENL_ADMIN_PERM,
6133                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6134                                   NL80211_FLAG_NEED_RTNL,
6135         },
6136         {
6137                 .cmd = NL80211_CMD_DEL_PMKSA,
6138                 .doit = nl80211_setdel_pmksa,
6139                 .policy = nl80211_policy,
6140                 .flags = GENL_ADMIN_PERM,
6141                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6142                                   NL80211_FLAG_NEED_RTNL,
6143         },
6144         {
6145                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6146                 .doit = nl80211_flush_pmksa,
6147                 .policy = nl80211_policy,
6148                 .flags = GENL_ADMIN_PERM,
6149                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6150                                   NL80211_FLAG_NEED_RTNL,
6151         },
6152         {
6153                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6154                 .doit = nl80211_remain_on_channel,
6155                 .policy = nl80211_policy,
6156                 .flags = GENL_ADMIN_PERM,
6157                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6158                                   NL80211_FLAG_NEED_RTNL,
6159         },
6160         {
6161                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6162                 .doit = nl80211_cancel_remain_on_channel,
6163                 .policy = nl80211_policy,
6164                 .flags = GENL_ADMIN_PERM,
6165                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6166                                   NL80211_FLAG_NEED_RTNL,
6167         },
6168         {
6169                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6170                 .doit = nl80211_set_tx_bitrate_mask,
6171                 .policy = nl80211_policy,
6172                 .flags = GENL_ADMIN_PERM,
6173                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6174                                   NL80211_FLAG_NEED_RTNL,
6175         },
6176         {
6177                 .cmd = NL80211_CMD_REGISTER_FRAME,
6178                 .doit = nl80211_register_mgmt,
6179                 .policy = nl80211_policy,
6180                 .flags = GENL_ADMIN_PERM,
6181                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6182                                   NL80211_FLAG_NEED_RTNL,
6183         },
6184         {
6185                 .cmd = NL80211_CMD_FRAME,
6186                 .doit = nl80211_tx_mgmt,
6187                 .policy = nl80211_policy,
6188                 .flags = GENL_ADMIN_PERM,
6189                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6190                                   NL80211_FLAG_NEED_RTNL,
6191         },
6192         {
6193                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6194                 .doit = nl80211_tx_mgmt_cancel_wait,
6195                 .policy = nl80211_policy,
6196                 .flags = GENL_ADMIN_PERM,
6197                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6198                                   NL80211_FLAG_NEED_RTNL,
6199         },
6200         {
6201                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6202                 .doit = nl80211_set_power_save,
6203                 .policy = nl80211_policy,
6204                 .flags = GENL_ADMIN_PERM,
6205                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6206                                   NL80211_FLAG_NEED_RTNL,
6207         },
6208         {
6209                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6210                 .doit = nl80211_get_power_save,
6211                 .policy = nl80211_policy,
6212                 /* can be retrieved by unprivileged users */
6213                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6214                                   NL80211_FLAG_NEED_RTNL,
6215         },
6216         {
6217                 .cmd = NL80211_CMD_SET_CQM,
6218                 .doit = nl80211_set_cqm,
6219                 .policy = nl80211_policy,
6220                 .flags = GENL_ADMIN_PERM,
6221                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6222                                   NL80211_FLAG_NEED_RTNL,
6223         },
6224         {
6225                 .cmd = NL80211_CMD_SET_CHANNEL,
6226                 .doit = nl80211_set_channel,
6227                 .policy = nl80211_policy,
6228                 .flags = GENL_ADMIN_PERM,
6229                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6230                                   NL80211_FLAG_NEED_RTNL,
6231         },
6232         {
6233                 .cmd = NL80211_CMD_SET_WDS_PEER,
6234                 .doit = nl80211_set_wds_peer,
6235                 .policy = nl80211_policy,
6236                 .flags = GENL_ADMIN_PERM,
6237                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6238                                   NL80211_FLAG_NEED_RTNL,
6239         },
6240         {
6241                 .cmd = NL80211_CMD_JOIN_MESH,
6242                 .doit = nl80211_join_mesh,
6243                 .policy = nl80211_policy,
6244                 .flags = GENL_ADMIN_PERM,
6245                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6246                                   NL80211_FLAG_NEED_RTNL,
6247         },
6248         {
6249                 .cmd = NL80211_CMD_LEAVE_MESH,
6250                 .doit = nl80211_leave_mesh,
6251                 .policy = nl80211_policy,
6252                 .flags = GENL_ADMIN_PERM,
6253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6254                                   NL80211_FLAG_NEED_RTNL,
6255         },
6256         {
6257                 .cmd = NL80211_CMD_GET_WOWLAN,
6258                 .doit = nl80211_get_wowlan,
6259                 .policy = nl80211_policy,
6260                 /* can be retrieved by unprivileged users */
6261                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6262                                   NL80211_FLAG_NEED_RTNL,
6263         },
6264         {
6265                 .cmd = NL80211_CMD_SET_WOWLAN,
6266                 .doit = nl80211_set_wowlan,
6267                 .policy = nl80211_policy,
6268                 .flags = GENL_ADMIN_PERM,
6269                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6270                                   NL80211_FLAG_NEED_RTNL,
6271         },
6272         {
6273                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6274                 .doit = nl80211_set_rekey_data,
6275                 .policy = nl80211_policy,
6276                 .flags = GENL_ADMIN_PERM,
6277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6278                                   NL80211_FLAG_NEED_RTNL,
6279         },
6280 };
6281
6282 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6283         .name = "mlme",
6284 };
6285
6286 /* multicast groups */
6287 static struct genl_multicast_group nl80211_config_mcgrp = {
6288         .name = "config",
6289 };
6290 static struct genl_multicast_group nl80211_scan_mcgrp = {
6291         .name = "scan",
6292 };
6293 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6294         .name = "regulatory",
6295 };
6296
6297 /* notification functions */
6298
6299 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6300 {
6301         struct sk_buff *msg;
6302
6303         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6304         if (!msg)
6305                 return;
6306
6307         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6308                 nlmsg_free(msg);
6309                 return;
6310         }
6311
6312         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6313                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6314 }
6315
6316 static int nl80211_add_scan_req(struct sk_buff *msg,
6317                                 struct cfg80211_registered_device *rdev)
6318 {
6319         struct cfg80211_scan_request *req = rdev->scan_req;
6320         struct nlattr *nest;
6321         int i;
6322
6323         ASSERT_RDEV_LOCK(rdev);
6324
6325         if (WARN_ON(!req))
6326                 return 0;
6327
6328         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6329         if (!nest)
6330                 goto nla_put_failure;
6331         for (i = 0; i < req->n_ssids; i++)
6332                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6333         nla_nest_end(msg, nest);
6334
6335         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6336         if (!nest)
6337                 goto nla_put_failure;
6338         for (i = 0; i < req->n_channels; i++)
6339                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6340         nla_nest_end(msg, nest);
6341
6342         if (req->ie)
6343                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6344
6345         return 0;
6346  nla_put_failure:
6347         return -ENOBUFS;
6348 }
6349
6350 static int nl80211_send_scan_msg(struct sk_buff *msg,
6351                                  struct cfg80211_registered_device *rdev,
6352                                  struct net_device *netdev,
6353                                  u32 pid, u32 seq, int flags,
6354                                  u32 cmd)
6355 {
6356         void *hdr;
6357
6358         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6359         if (!hdr)
6360                 return -1;
6361
6362         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6363         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6364
6365         /* ignore errors and send incomplete event anyway */
6366         nl80211_add_scan_req(msg, rdev);
6367
6368         return genlmsg_end(msg, hdr);
6369
6370  nla_put_failure:
6371         genlmsg_cancel(msg, hdr);
6372         return -EMSGSIZE;
6373 }
6374
6375 static int
6376 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6377                             struct cfg80211_registered_device *rdev,
6378                             struct net_device *netdev,
6379                             u32 pid, u32 seq, int flags, u32 cmd)
6380 {
6381         void *hdr;
6382
6383         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6384         if (!hdr)
6385                 return -1;
6386
6387         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6388         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6389
6390         return genlmsg_end(msg, hdr);
6391
6392  nla_put_failure:
6393         genlmsg_cancel(msg, hdr);
6394         return -EMSGSIZE;
6395 }
6396
6397 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6398                              struct net_device *netdev)
6399 {
6400         struct sk_buff *msg;
6401
6402         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6403         if (!msg)
6404                 return;
6405
6406         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6407                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6408                 nlmsg_free(msg);
6409                 return;
6410         }
6411
6412         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6413                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6414 }
6415
6416 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6417                             struct net_device *netdev)
6418 {
6419         struct sk_buff *msg;
6420
6421         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6422         if (!msg)
6423                 return;
6424
6425         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6426                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6427                 nlmsg_free(msg);
6428                 return;
6429         }
6430
6431         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6432                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6433 }
6434
6435 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6436                                struct net_device *netdev)
6437 {
6438         struct sk_buff *msg;
6439
6440         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6441         if (!msg)
6442                 return;
6443
6444         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6445                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6446                 nlmsg_free(msg);
6447                 return;
6448         }
6449
6450         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6451                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6452 }
6453
6454 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6455                                      struct net_device *netdev)
6456 {
6457         struct sk_buff *msg;
6458
6459         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6460         if (!msg)
6461                 return;
6462
6463         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6464                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6465                 nlmsg_free(msg);
6466                 return;
6467         }
6468
6469         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6470                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6471 }
6472
6473 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6474                              struct net_device *netdev, u32 cmd)
6475 {
6476         struct sk_buff *msg;
6477
6478         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6479         if (!msg)
6480                 return;
6481
6482         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6483                 nlmsg_free(msg);
6484                 return;
6485         }
6486
6487         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6488                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6489 }
6490
6491 /*
6492  * This can happen on global regulatory changes or device specific settings
6493  * based on custom world regulatory domains.
6494  */
6495 void nl80211_send_reg_change_event(struct regulatory_request *request)
6496 {
6497         struct sk_buff *msg;
6498         void *hdr;
6499
6500         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6501         if (!msg)
6502                 return;
6503
6504         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6505         if (!hdr) {
6506                 nlmsg_free(msg);
6507                 return;
6508         }
6509
6510         /* Userspace can always count this one always being set */
6511         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6512
6513         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6514                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6515                            NL80211_REGDOM_TYPE_WORLD);
6516         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6517                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6518                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6519         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6520                  request->intersect)
6521                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6522                            NL80211_REGDOM_TYPE_INTERSECTION);
6523         else {
6524                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6525                            NL80211_REGDOM_TYPE_COUNTRY);
6526                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6527         }
6528
6529         if (wiphy_idx_valid(request->wiphy_idx))
6530                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6531
6532         if (genlmsg_end(msg, hdr) < 0) {
6533                 nlmsg_free(msg);
6534                 return;
6535         }
6536
6537         rcu_read_lock();
6538         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6539                                 GFP_ATOMIC);
6540         rcu_read_unlock();
6541
6542         return;
6543
6544 nla_put_failure:
6545         genlmsg_cancel(msg, hdr);
6546         nlmsg_free(msg);
6547 }
6548
6549 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6550                                     struct net_device *netdev,
6551                                     const u8 *buf, size_t len,
6552                                     enum nl80211_commands cmd, gfp_t gfp)
6553 {
6554         struct sk_buff *msg;
6555         void *hdr;
6556
6557         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6558         if (!msg)
6559                 return;
6560
6561         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6562         if (!hdr) {
6563                 nlmsg_free(msg);
6564                 return;
6565         }
6566
6567         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6568         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6569         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6570
6571         if (genlmsg_end(msg, hdr) < 0) {
6572                 nlmsg_free(msg);
6573                 return;
6574         }
6575
6576         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6577                                 nl80211_mlme_mcgrp.id, gfp);
6578         return;
6579
6580  nla_put_failure:
6581         genlmsg_cancel(msg, hdr);
6582         nlmsg_free(msg);
6583 }
6584
6585 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6586                           struct net_device *netdev, const u8 *buf,
6587                           size_t len, gfp_t gfp)
6588 {
6589         nl80211_send_mlme_event(rdev, netdev, buf, len,
6590                                 NL80211_CMD_AUTHENTICATE, gfp);
6591 }
6592
6593 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6594                            struct net_device *netdev, const u8 *buf,
6595                            size_t len, gfp_t gfp)
6596 {
6597         nl80211_send_mlme_event(rdev, netdev, buf, len,
6598                                 NL80211_CMD_ASSOCIATE, gfp);
6599 }
6600
6601 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6602                          struct net_device *netdev, const u8 *buf,
6603                          size_t len, gfp_t gfp)
6604 {
6605         nl80211_send_mlme_event(rdev, netdev, buf, len,
6606                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6607 }
6608
6609 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6610                            struct net_device *netdev, const u8 *buf,
6611                            size_t len, gfp_t gfp)
6612 {
6613         nl80211_send_mlme_event(rdev, netdev, buf, len,
6614                                 NL80211_CMD_DISASSOCIATE, gfp);
6615 }
6616
6617 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6618                                 struct net_device *netdev, const u8 *buf,
6619                                 size_t len, gfp_t gfp)
6620 {
6621         nl80211_send_mlme_event(rdev, netdev, buf, len,
6622                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6623 }
6624
6625 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6626                                   struct net_device *netdev, const u8 *buf,
6627                                   size_t len, gfp_t gfp)
6628 {
6629         nl80211_send_mlme_event(rdev, netdev, buf, len,
6630                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6631 }
6632
6633 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6634                                       struct net_device *netdev, int cmd,
6635                                       const u8 *addr, gfp_t gfp)
6636 {
6637         struct sk_buff *msg;
6638         void *hdr;
6639
6640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6641         if (!msg)
6642                 return;
6643
6644         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6645         if (!hdr) {
6646                 nlmsg_free(msg);
6647                 return;
6648         }
6649
6650         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6651         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6652         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6653         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6654
6655         if (genlmsg_end(msg, hdr) < 0) {
6656                 nlmsg_free(msg);
6657                 return;
6658         }
6659
6660         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6661                                 nl80211_mlme_mcgrp.id, gfp);
6662         return;
6663
6664  nla_put_failure:
6665         genlmsg_cancel(msg, hdr);
6666         nlmsg_free(msg);
6667 }
6668
6669 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6670                                struct net_device *netdev, const u8 *addr,
6671                                gfp_t gfp)
6672 {
6673         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6674                                   addr, gfp);
6675 }
6676
6677 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6678                                 struct net_device *netdev, const u8 *addr,
6679                                 gfp_t gfp)
6680 {
6681         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6682                                   addr, gfp);
6683 }
6684
6685 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6686                                  struct net_device *netdev, const u8 *bssid,
6687                                  const u8 *req_ie, size_t req_ie_len,
6688                                  const u8 *resp_ie, size_t resp_ie_len,
6689                                  u16 status, gfp_t gfp)
6690 {
6691         struct sk_buff *msg;
6692         void *hdr;
6693
6694         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6695         if (!msg)
6696                 return;
6697
6698         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6699         if (!hdr) {
6700                 nlmsg_free(msg);
6701                 return;
6702         }
6703
6704         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6705         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6706         if (bssid)
6707                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6708         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6709         if (req_ie)
6710                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6711         if (resp_ie)
6712                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6713
6714         if (genlmsg_end(msg, hdr) < 0) {
6715                 nlmsg_free(msg);
6716                 return;
6717         }
6718
6719         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6720                                 nl80211_mlme_mcgrp.id, gfp);
6721         return;
6722
6723  nla_put_failure:
6724         genlmsg_cancel(msg, hdr);
6725         nlmsg_free(msg);
6726
6727 }
6728
6729 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6730                          struct net_device *netdev, const u8 *bssid,
6731                          const u8 *req_ie, size_t req_ie_len,
6732                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6733 {
6734         struct sk_buff *msg;
6735         void *hdr;
6736
6737         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6738         if (!msg)
6739                 return;
6740
6741         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6742         if (!hdr) {
6743                 nlmsg_free(msg);
6744                 return;
6745         }
6746
6747         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6748         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6749         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6750         if (req_ie)
6751                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6752         if (resp_ie)
6753                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6754
6755         if (genlmsg_end(msg, hdr) < 0) {
6756                 nlmsg_free(msg);
6757                 return;
6758         }
6759
6760         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6761                                 nl80211_mlme_mcgrp.id, gfp);
6762         return;
6763
6764  nla_put_failure:
6765         genlmsg_cancel(msg, hdr);
6766         nlmsg_free(msg);
6767
6768 }
6769
6770 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6771                                struct net_device *netdev, u16 reason,
6772                                const u8 *ie, size_t ie_len, bool from_ap)
6773 {
6774         struct sk_buff *msg;
6775         void *hdr;
6776
6777         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6778         if (!msg)
6779                 return;
6780
6781         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6782         if (!hdr) {
6783                 nlmsg_free(msg);
6784                 return;
6785         }
6786
6787         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6788         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6789         if (from_ap && reason)
6790                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6791         if (from_ap)
6792                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6793         if (ie)
6794                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6795
6796         if (genlmsg_end(msg, hdr) < 0) {
6797                 nlmsg_free(msg);
6798                 return;
6799         }
6800
6801         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6802                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6803         return;
6804
6805  nla_put_failure:
6806         genlmsg_cancel(msg, hdr);
6807         nlmsg_free(msg);
6808
6809 }
6810
6811 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6812                              struct net_device *netdev, const u8 *bssid,
6813                              gfp_t gfp)
6814 {
6815         struct sk_buff *msg;
6816         void *hdr;
6817
6818         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6819         if (!msg)
6820                 return;
6821
6822         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6823         if (!hdr) {
6824                 nlmsg_free(msg);
6825                 return;
6826         }
6827
6828         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6829         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6830         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6831
6832         if (genlmsg_end(msg, hdr) < 0) {
6833                 nlmsg_free(msg);
6834                 return;
6835         }
6836
6837         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6838                                 nl80211_mlme_mcgrp.id, gfp);
6839         return;
6840
6841  nla_put_failure:
6842         genlmsg_cancel(msg, hdr);
6843         nlmsg_free(msg);
6844 }
6845
6846 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6847                 struct net_device *netdev,
6848                 const u8 *macaddr, const u8* ie, u8 ie_len,
6849                 gfp_t gfp)
6850 {
6851         struct sk_buff *msg;
6852         void *hdr;
6853
6854         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6855         if (!msg)
6856                 return;
6857
6858         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6859         if (!hdr) {
6860                 nlmsg_free(msg);
6861                 return;
6862         }
6863
6864         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6865         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6866         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6867         if (ie_len && ie)
6868                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6869
6870         if (genlmsg_end(msg, hdr) < 0) {
6871                 nlmsg_free(msg);
6872                 return;
6873         }
6874
6875         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6876                                 nl80211_mlme_mcgrp.id, gfp);
6877         return;
6878
6879  nla_put_failure:
6880         genlmsg_cancel(msg, hdr);
6881         nlmsg_free(msg);
6882 }
6883
6884 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6885                                  struct net_device *netdev, const u8 *addr,
6886                                  enum nl80211_key_type key_type, int key_id,
6887                                  const u8 *tsc, gfp_t gfp)
6888 {
6889         struct sk_buff *msg;
6890         void *hdr;
6891
6892         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6893         if (!msg)
6894                 return;
6895
6896         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6897         if (!hdr) {
6898                 nlmsg_free(msg);
6899                 return;
6900         }
6901
6902         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6903         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6904         if (addr)
6905                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6906         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6907         if (key_id != -1)
6908                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6909         if (tsc)
6910                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6911
6912         if (genlmsg_end(msg, hdr) < 0) {
6913                 nlmsg_free(msg);
6914                 return;
6915         }
6916
6917         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6918                                 nl80211_mlme_mcgrp.id, gfp);
6919         return;
6920
6921  nla_put_failure:
6922         genlmsg_cancel(msg, hdr);
6923         nlmsg_free(msg);
6924 }
6925
6926 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6927                                     struct ieee80211_channel *channel_before,
6928                                     struct ieee80211_channel *channel_after)
6929 {
6930         struct sk_buff *msg;
6931         void *hdr;
6932         struct nlattr *nl_freq;
6933
6934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6935         if (!msg)
6936                 return;
6937
6938         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6939         if (!hdr) {
6940                 nlmsg_free(msg);
6941                 return;
6942         }
6943
6944         /*
6945          * Since we are applying the beacon hint to a wiphy we know its
6946          * wiphy_idx is valid
6947          */
6948         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6949
6950         /* Before */
6951         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6952         if (!nl_freq)
6953                 goto nla_put_failure;
6954         if (nl80211_msg_put_channel(msg, channel_before))
6955                 goto nla_put_failure;
6956         nla_nest_end(msg, nl_freq);
6957
6958         /* After */
6959         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6960         if (!nl_freq)
6961                 goto nla_put_failure;
6962         if (nl80211_msg_put_channel(msg, channel_after))
6963                 goto nla_put_failure;
6964         nla_nest_end(msg, nl_freq);
6965
6966         if (genlmsg_end(msg, hdr) < 0) {
6967                 nlmsg_free(msg);
6968                 return;
6969         }
6970
6971         rcu_read_lock();
6972         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6973                                 GFP_ATOMIC);
6974         rcu_read_unlock();
6975
6976         return;
6977
6978 nla_put_failure:
6979         genlmsg_cancel(msg, hdr);
6980         nlmsg_free(msg);
6981 }
6982
6983 static void nl80211_send_remain_on_chan_event(
6984         int cmd, struct cfg80211_registered_device *rdev,
6985         struct net_device *netdev, u64 cookie,
6986         struct ieee80211_channel *chan,
6987         enum nl80211_channel_type channel_type,
6988         unsigned int duration, gfp_t gfp)
6989 {
6990         struct sk_buff *msg;
6991         void *hdr;
6992
6993         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6994         if (!msg)
6995                 return;
6996
6997         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6998         if (!hdr) {
6999                 nlmsg_free(msg);
7000                 return;
7001         }
7002
7003         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7004         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7005         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
7006         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
7007         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7008
7009         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
7010                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
7011
7012         if (genlmsg_end(msg, hdr) < 0) {
7013                 nlmsg_free(msg);
7014                 return;
7015         }
7016
7017         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7018                                 nl80211_mlme_mcgrp.id, gfp);
7019         return;
7020
7021  nla_put_failure:
7022         genlmsg_cancel(msg, hdr);
7023         nlmsg_free(msg);
7024 }
7025
7026 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
7027                                     struct net_device *netdev, u64 cookie,
7028                                     struct ieee80211_channel *chan,
7029                                     enum nl80211_channel_type channel_type,
7030                                     unsigned int duration, gfp_t gfp)
7031 {
7032         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
7033                                           rdev, netdev, cookie, chan,
7034                                           channel_type, duration, gfp);
7035 }
7036
7037 void nl80211_send_remain_on_channel_cancel(
7038         struct cfg80211_registered_device *rdev, struct net_device *netdev,
7039         u64 cookie, struct ieee80211_channel *chan,
7040         enum nl80211_channel_type channel_type, gfp_t gfp)
7041 {
7042         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7043                                           rdev, netdev, cookie, chan,
7044                                           channel_type, 0, gfp);
7045 }
7046
7047 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
7048                             struct net_device *dev, const u8 *mac_addr,
7049                             struct station_info *sinfo, gfp_t gfp)
7050 {
7051         struct sk_buff *msg;
7052
7053         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7054         if (!msg)
7055                 return;
7056
7057         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
7058                 nlmsg_free(msg);
7059                 return;
7060         }
7061
7062         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7063                                 nl80211_mlme_mcgrp.id, gfp);
7064 }
7065
7066 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7067                                 struct net_device *dev, const u8 *mac_addr,
7068                                 gfp_t gfp)
7069 {
7070         struct sk_buff *msg;
7071         void *hdr;
7072
7073         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7074         if (!msg)
7075                 return;
7076
7077         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7078         if (!hdr) {
7079                 nlmsg_free(msg);
7080                 return;
7081         }
7082
7083         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7084         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7085
7086         if (genlmsg_end(msg, hdr) < 0) {
7087                 nlmsg_free(msg);
7088                 return;
7089         }
7090
7091         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7092                                 nl80211_mlme_mcgrp.id, gfp);
7093         return;
7094
7095  nla_put_failure:
7096         genlmsg_cancel(msg, hdr);
7097         nlmsg_free(msg);
7098 }
7099
7100 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7101                       struct net_device *netdev, u32 nlpid,
7102                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7103 {
7104         struct sk_buff *msg;
7105         void *hdr;
7106         int err;
7107
7108         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7109         if (!msg)
7110                 return -ENOMEM;
7111
7112         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7113         if (!hdr) {
7114                 nlmsg_free(msg);
7115                 return -ENOMEM;
7116         }
7117
7118         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7119         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7120         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7121         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7122
7123         err = genlmsg_end(msg, hdr);
7124         if (err < 0) {
7125                 nlmsg_free(msg);
7126                 return err;
7127         }
7128
7129         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7130         if (err < 0)
7131                 return err;
7132         return 0;
7133
7134  nla_put_failure:
7135         genlmsg_cancel(msg, hdr);
7136         nlmsg_free(msg);
7137         return -ENOBUFS;
7138 }
7139
7140 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7141                                  struct net_device *netdev, u64 cookie,
7142                                  const u8 *buf, size_t len, bool ack,
7143                                  gfp_t gfp)
7144 {
7145         struct sk_buff *msg;
7146         void *hdr;
7147
7148         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7149         if (!msg)
7150                 return;
7151
7152         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7153         if (!hdr) {
7154                 nlmsg_free(msg);
7155                 return;
7156         }
7157
7158         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7159         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7160         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7161         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7162         if (ack)
7163                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7164
7165         if (genlmsg_end(msg, hdr) < 0) {
7166                 nlmsg_free(msg);
7167                 return;
7168         }
7169
7170         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7171         return;
7172
7173  nla_put_failure:
7174         genlmsg_cancel(msg, hdr);
7175         nlmsg_free(msg);
7176 }
7177
7178 void
7179 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7180                              struct net_device *netdev,
7181                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7182                              gfp_t gfp)
7183 {
7184         struct sk_buff *msg;
7185         struct nlattr *pinfoattr;
7186         void *hdr;
7187
7188         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7189         if (!msg)
7190                 return;
7191
7192         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7193         if (!hdr) {
7194                 nlmsg_free(msg);
7195                 return;
7196         }
7197
7198         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7199         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7200
7201         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7202         if (!pinfoattr)
7203                 goto nla_put_failure;
7204
7205         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7206                     rssi_event);
7207
7208         nla_nest_end(msg, pinfoattr);
7209
7210         if (genlmsg_end(msg, hdr) < 0) {
7211                 nlmsg_free(msg);
7212                 return;
7213         }
7214
7215         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7216                                 nl80211_mlme_mcgrp.id, gfp);
7217         return;
7218
7219  nla_put_failure:
7220         genlmsg_cancel(msg, hdr);
7221         nlmsg_free(msg);
7222 }
7223
7224 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7225                               struct net_device *netdev, const u8 *bssid,
7226                               const u8 *replay_ctr, gfp_t gfp)
7227 {
7228         struct sk_buff *msg;
7229         struct nlattr *rekey_attr;
7230         void *hdr;
7231
7232         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7233         if (!msg)
7234                 return;
7235
7236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7237         if (!hdr) {
7238                 nlmsg_free(msg);
7239                 return;
7240         }
7241
7242         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7243         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7244         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7245
7246         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7247         if (!rekey_attr)
7248                 goto nla_put_failure;
7249
7250         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7251                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7252
7253         nla_nest_end(msg, rekey_attr);
7254
7255         if (genlmsg_end(msg, hdr) < 0) {
7256                 nlmsg_free(msg);
7257                 return;
7258         }
7259
7260         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7261                                 nl80211_mlme_mcgrp.id, gfp);
7262         return;
7263
7264  nla_put_failure:
7265         genlmsg_cancel(msg, hdr);
7266         nlmsg_free(msg);
7267 }
7268
7269 void
7270 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7271                                 struct net_device *netdev, const u8 *peer,
7272                                 u32 num_packets, gfp_t gfp)
7273 {
7274         struct sk_buff *msg;
7275         struct nlattr *pinfoattr;
7276         void *hdr;
7277
7278         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7279         if (!msg)
7280                 return;
7281
7282         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7283         if (!hdr) {
7284                 nlmsg_free(msg);
7285                 return;
7286         }
7287
7288         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7289         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7290         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7291
7292         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7293         if (!pinfoattr)
7294                 goto nla_put_failure;
7295
7296         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7297
7298         nla_nest_end(msg, pinfoattr);
7299
7300         if (genlmsg_end(msg, hdr) < 0) {
7301                 nlmsg_free(msg);
7302                 return;
7303         }
7304
7305         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7306                                 nl80211_mlme_mcgrp.id, gfp);
7307         return;
7308
7309  nla_put_failure:
7310         genlmsg_cancel(msg, hdr);
7311         nlmsg_free(msg);
7312 }
7313
7314 static int nl80211_netlink_notify(struct notifier_block * nb,
7315                                   unsigned long state,
7316                                   void *_notify)
7317 {
7318         struct netlink_notify *notify = _notify;
7319         struct cfg80211_registered_device *rdev;
7320         struct wireless_dev *wdev;
7321
7322         if (state != NETLINK_URELEASE)
7323                 return NOTIFY_DONE;
7324
7325         rcu_read_lock();
7326
7327         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7328                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7329                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7330
7331         rcu_read_unlock();
7332
7333         return NOTIFY_DONE;
7334 }
7335
7336 static struct notifier_block nl80211_netlink_notifier = {
7337         .notifier_call = nl80211_netlink_notify,
7338 };
7339
7340 /* initialisation/exit functions */
7341
7342 int nl80211_init(void)
7343 {
7344         int err;
7345
7346         err = genl_register_family_with_ops(&nl80211_fam,
7347                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7348         if (err)
7349                 return err;
7350
7351         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7352         if (err)
7353                 goto err_out;
7354
7355         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7356         if (err)
7357                 goto err_out;
7358
7359         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7360         if (err)
7361                 goto err_out;
7362
7363         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7364         if (err)
7365                 goto err_out;
7366
7367 #ifdef CONFIG_NL80211_TESTMODE
7368         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7369         if (err)
7370                 goto err_out;
7371 #endif
7372
7373         err = netlink_register_notifier(&nl80211_netlink_notifier);
7374         if (err)
7375                 goto err_out;
7376
7377         return 0;
7378  err_out:
7379         genl_unregister_family(&nl80211_fam);
7380         return err;
7381 }
7382
7383 void nl80211_exit(void)
7384 {
7385         netlink_unregister_notifier(&nl80211_netlink_notifier);
7386         genl_unregister_family(&nl80211_fam);
7387 }