net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 193         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 194         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 195 };
 196
 197 /* policy for the key attributes */
 198 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 199         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 200         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 201         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 202         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 203         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 204         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 205         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 206         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 207 };
 208
 209 /* policy for the key default flags */
 210 static const struct nla_policy
 211 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 212         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 213         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 214 };
 215
 216 /* policy for WoWLAN attributes */
 217 static const struct nla_policy
 218 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 219         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 220         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 221         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 222         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 223         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 224         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 225         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 226         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 227 };
 228
 229 /* policy for GTK rekey offload attributes */
 230 static const struct nla_policy
 231 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 232         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 233         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 234         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 235 };
 236
 237 static const struct nla_policy
 238 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 239         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
 240                                                  .len = IEEE80211_MAX_SSID_LEN },
 241 };
 242
 243 /* ifidx get helper */
 244 static int nl80211_get_ifidx(struct netlink_callback *cb)
 245 {
 246         int res;
 247
 248         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 249                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 250                           nl80211_policy);
 251         if (res)
 252                 return res;
 253
 254         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 255                 return -EINVAL;
 256
 257         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 258         if (!res)
 259                 return -EINVAL;
 260         return res;
 261 }
 262
 263 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 264                                        struct netlink_callback *cb,
 265                                        struct cfg80211_registered_device **rdev,
 266                                        struct net_device **dev)
 267 {
 268         int ifidx = cb->args[0];
 269         int err;
 270
 271         if (!ifidx)
 272                 ifidx = nl80211_get_ifidx(cb);
 273         if (ifidx < 0)
 274                 return ifidx;
 275
 276         cb->args[0] = ifidx;
 277
 278         rtnl_lock();
 279
 280         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 281         if (!*dev) {
 282                 err = -ENODEV;
 283                 goto out_rtnl;
 284         }
 285
 286         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 287         if (IS_ERR(*rdev)) {
 288                 err = PTR_ERR(*rdev);
 289                 goto out_rtnl;
 290         }
 291
 292         return 0;
 293  out_rtnl:
 294         rtnl_unlock();
 295         return err;
 296 }
 297
 298 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 299 {
 300         cfg80211_unlock_rdev(rdev);
 301         rtnl_unlock();
 302 }
 303
 304 /* IE validation */
 305 static bool is_valid_ie_attr(const struct nlattr *attr)
 306 {
 307         const u8 *pos;
 308         int len;
 309
 310         if (!attr)
 311                 return true;
 312
 313         pos = nla_data(attr);
 314         len = nla_len(attr);
 315
 316         while (len) {
 317                 u8 elemlen;
 318
 319                 if (len < 2)
 320                         return false;
 321                 len -= 2;
 322
 323                 elemlen = pos[1];
 324                 if (elemlen > len)
 325                         return false;
 326
 327                 len -= elemlen;
 328                 pos += 2 + elemlen;
 329         }
 330
 331         return true;
 332 }
 333
 334 /* message building helper */
 335 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 336                                    int flags, u8 cmd)
 337 {
 338         /* since there is no private header just add the generic one */
 339         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 340 }
 341
 342 static int nl80211_msg_put_channel(struct sk_buff *msg,
 343                                    struct ieee80211_channel *chan)
 344 {
 345         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 346                     chan->center_freq);
 347
 348         if (chan->flags & IEEE80211_CHAN_DISABLED)
 349                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 350         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 351                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 352         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 353                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 354         if (chan->flags & IEEE80211_CHAN_RADAR)
 355                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 356
 357         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 358                     DBM_TO_MBM(chan->max_power));
 359
 360         return 0;
 361
 362  nla_put_failure:
 363         return -ENOBUFS;
 364 }
 365
 366 /* netlink command implementations */
 367
 368 struct key_parse {
 369         struct key_params p;
 370         int idx;
 371         int type;
 372         bool def, defmgmt;
 373         bool def_uni, def_multi;
 374 };
 375
 376 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 377 {
 378         struct nlattr *tb[NL80211_KEY_MAX + 1];
 379         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 380                                    nl80211_key_policy);
 381         if (err)
 382                 return err;
 383
 384         k->def = !!tb[NL80211_KEY_DEFAULT];
 385         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 386
 387         if (k->def) {
 388                 k->def_uni = true;
 389                 k->def_multi = true;
 390         }
 391         if (k->defmgmt)
 392                 k->def_multi = true;
 393
 394         if (tb[NL80211_KEY_IDX])
 395                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 396
 397         if (tb[NL80211_KEY_DATA]) {
 398                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 399                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 400         }
 401
 402         if (tb[NL80211_KEY_SEQ]) {
 403                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 404                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 405         }
 406
 407         if (tb[NL80211_KEY_CIPHER])
 408                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 409
 410         if (tb[NL80211_KEY_TYPE]) {
 411                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 412                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 413                         return -EINVAL;
 414         }
 415
 416         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 417                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 418                 int err = nla_parse_nested(kdt,
 419                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 420                                            tb[NL80211_KEY_DEFAULT_TYPES],
 421                                            nl80211_key_default_policy);
 422                 if (err)
 423                         return err;
 424
 425                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 426                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 427         }
 428
 429         return 0;
 430 }
 431
 432 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 433 {
 434         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 435                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 436                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 437         }
 438
 439         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 440                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 441                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 442         }
 443
 444         if (info->attrs[NL80211_ATTR_KEY_IDX])
 445                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 446
 447         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 448                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 449
 450         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 451         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 452
 453         if (k->def) {
 454                 k->def_uni = true;
 455                 k->def_multi = true;
 456         }
 457         if (k->defmgmt)
 458                 k->def_multi = true;
 459
 460         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 461                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 462                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 463                         return -EINVAL;
 464         }
 465
 466         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 467                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 468                 int err = nla_parse_nested(
 469                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 470                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 471                                 nl80211_key_default_policy);
 472                 if (err)
 473                         return err;
 474
 475                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 476                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 477         }
 478
 479         return 0;
 480 }
 481
 482 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 483 {
 484         int err;
 485
 486         memset(k, 0, sizeof(*k));
 487         k->idx = -1;
 488         k->type = -1;
 489
 490         if (info->attrs[NL80211_ATTR_KEY])
 491                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 492         else
 493                 err = nl80211_parse_key_old(info, k);
 494
 495         if (err)
 496                 return err;
 497
 498         if (k->def && k->defmgmt)
 499                 return -EINVAL;
 500
 501         if (k->defmgmt) {
 502                 if (k->def_uni || !k->def_multi)
 503                         return -EINVAL;
 504         }
 505
 506         if (k->idx != -1) {
 507                 if (k->defmgmt) {
 508                         if (k->idx < 4 || k->idx > 5)
 509                                 return -EINVAL;
 510                 } else if (k->def) {
 511                         if (k->idx < 0 || k->idx > 3)
 512                                 return -EINVAL;
 513                 } else {
 514                         if (k->idx < 0 || k->idx > 5)
 515                                 return -EINVAL;
 516                 }
 517         }
 518
 519         return 0;
 520 }
 521
 522 static struct cfg80211_cached_keys *
 523 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 524                        struct nlattr *keys)
 525 {
 526         struct key_parse parse;
 527         struct nlattr *key;
 528         struct cfg80211_cached_keys *result;
 529         int rem, err, def = 0;
 530
 531         result = kzalloc(sizeof(*result), GFP_KERNEL);
 532         if (!result)
 533                 return ERR_PTR(-ENOMEM);
 534
 535         result->def = -1;
 536         result->defmgmt = -1;
 537
 538         nla_for_each_nested(key, keys, rem) {
 539                 memset(&parse, 0, sizeof(parse));
 540                 parse.idx = -1;
 541
 542                 err = nl80211_parse_key_new(key, &parse);
 543                 if (err)
 544                         goto error;
 545                 err = -EINVAL;
 546                 if (!parse.p.key)
 547                         goto error;
 548                 if (parse.idx < 0 || parse.idx > 4)
 549                         goto error;
 550                 if (parse.def) {
 551                         if (def)
 552                                 goto error;
 553                         def = 1;
 554                         result->def = parse.idx;
 555                         if (!parse.def_uni || !parse.def_multi)
 556                                 goto error;
 557                 } else if (parse.defmgmt)
 558                         goto error;
 559                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 560                                                      parse.idx, false, NULL);
 561                 if (err)
 562                         goto error;
 563                 result->params[parse.idx].cipher = parse.p.cipher;
 564                 result->params[parse.idx].key_len = parse.p.key_len;
 565                 result->params[parse.idx].key = result->data[parse.idx];
 566                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 567         }
 568
 569         return result;
 570  error:
 571         kfree(result);
 572         return ERR_PTR(err);
 573 }
 574
 575 static int nl80211_key_allowed(struct wireless_dev *wdev)
 576 {
 577         ASSERT_WDEV_LOCK(wdev);
 578
 579         switch (wdev->iftype) {
 580         case NL80211_IFTYPE_AP:
 581         case NL80211_IFTYPE_AP_VLAN:
 582         case NL80211_IFTYPE_P2P_GO:
 583         case NL80211_IFTYPE_MESH_POINT:
 584                 break;
 585         case NL80211_IFTYPE_ADHOC:
 586                 if (!wdev->current_bss)
 587                         return -ENOLINK;
 588                 break;
 589         case NL80211_IFTYPE_STATION:
 590         case NL80211_IFTYPE_P2P_CLIENT:
 591                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 592                         return -ENOLINK;
 593                 break;
 594         default:
 595                 return -EINVAL;
 596         }
 597
 598         return 0;
 599 }
 600
 601 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 602 {
 603         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 604         int i;
 605
 606         if (!nl_modes)
 607                 goto nla_put_failure;
 608
 609         i = 0;
 610         while (ifmodes) {
 611                 if (ifmodes & 1)
 612                         NLA_PUT_FLAG(msg, i);
 613                 ifmodes >>= 1;
 614                 i++;
 615         }
 616
 617         nla_nest_end(msg, nl_modes);
 618         return 0;
 619
 620 nla_put_failure:
 621         return -ENOBUFS;
 622 }
 623
 624 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 625                                           struct sk_buff *msg)
 626 {
 627         struct nlattr *nl_combis;
 628         int i, j;
 629
 630         nl_combis = nla_nest_start(msg,
 631                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 632         if (!nl_combis)
 633                 goto nla_put_failure;
 634
 635         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 636                 const struct ieee80211_iface_combination *c;
 637                 struct nlattr *nl_combi, *nl_limits;
 638
 639                 c = &wiphy->iface_combinations[i];
 640
 641                 nl_combi = nla_nest_start(msg, i + 1);
 642                 if (!nl_combi)
 643                         goto nla_put_failure;
 644
 645                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 646                 if (!nl_limits)
 647                         goto nla_put_failure;
 648
 649                 for (j = 0; j < c->n_limits; j++) {
 650                         struct nlattr *nl_limit;
 651
 652                         nl_limit = nla_nest_start(msg, j + 1);
 653                         if (!nl_limit)
 654                                 goto nla_put_failure;
 655                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 656                                     c->limits[j].max);
 657                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 658                                                 c->limits[j].types))
 659                                 goto nla_put_failure;
 660                         nla_nest_end(msg, nl_limit);
 661                 }
 662
 663                 nla_nest_end(msg, nl_limits);
 664
 665                 if (c->beacon_int_infra_match)
 666                         NLA_PUT_FLAG(msg,
 667                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 668                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 669                             c->num_different_channels);
 670                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 671                             c->max_interfaces);
 672
 673                 nla_nest_end(msg, nl_combi);
 674         }
 675
 676         nla_nest_end(msg, nl_combis);
 677
 678         return 0;
 679 nla_put_failure:
 680         return -ENOBUFS;
 681 }
 682
 683 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 684                               struct cfg80211_registered_device *dev)
 685 {
 686         void *hdr;
 687         struct nlattr *nl_bands, *nl_band;
 688         struct nlattr *nl_freqs, *nl_freq;
 689         struct nlattr *nl_rates, *nl_rate;
 690         struct nlattr *nl_cmds;
 691         enum ieee80211_band band;
 692         struct ieee80211_channel *chan;
 693         struct ieee80211_rate *rate;
 694         int i;
 695         const struct ieee80211_txrx_stypes *mgmt_stypes =
 696                                 dev->wiphy.mgmt_stypes;
 697
 698         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 699         if (!hdr)
 700                 return -1;
 701
 702         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 703         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 704
 705         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 706                     cfg80211_rdev_list_generation);
 707
 708         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 709                    dev->wiphy.retry_short);
 710         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 711                    dev->wiphy.retry_long);
 712         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 713                     dev->wiphy.frag_threshold);
 714         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 715                     dev->wiphy.rts_threshold);
 716         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 717                     dev->wiphy.coverage_class);
 718         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 719                    dev->wiphy.max_scan_ssids);
 720         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 721                    dev->wiphy.max_sched_scan_ssids);
 722         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 723                     dev->wiphy.max_scan_ie_len);
 724         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 725                     dev->wiphy.max_sched_scan_ie_len);
 726         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 727                    dev->wiphy.max_match_sets);
 728
 729         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 730                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 731         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 732                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 733         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 734                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 735
 736         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 737                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 738
 739         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 740                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 741                 dev->wiphy.cipher_suites);
 742
 743         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 744                    dev->wiphy.max_num_pmkids);
 745
 746         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 747                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 748
 749         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 750                     dev->wiphy.available_antennas_tx);
 751         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 752                     dev->wiphy.available_antennas_rx);
 753
 754         if ((dev->wiphy.available_antennas_tx ||
 755              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 756                 u32 tx_ant = 0, rx_ant = 0;
 757                 int res;
 758                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 759                 if (!res) {
 760                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 761                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 762                 }
 763         }
 764
 765         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 766                                 dev->wiphy.interface_modes))
 767                 goto nla_put_failure;
 768
 769         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 770         if (!nl_bands)
 771                 goto nla_put_failure;
 772
 773         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 774                 if (!dev->wiphy.bands[band])
 775                         continue;
 776
 777                 nl_band = nla_nest_start(msg, band);
 778                 if (!nl_band)
 779                         goto nla_put_failure;
 780
 781                 /* add HT info */
 782                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 783                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 784                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 785                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 786                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 787                                 dev->wiphy.bands[band]->ht_cap.cap);
 788                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 789                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 790                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 791                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 792                 }
 793
 794                 /* add frequencies */
 795                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 796                 if (!nl_freqs)
 797                         goto nla_put_failure;
 798
 799                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 800                         nl_freq = nla_nest_start(msg, i);
 801                         if (!nl_freq)
 802                                 goto nla_put_failure;
 803
 804                         chan = &dev->wiphy.bands[band]->channels[i];
 805
 806                         if (nl80211_msg_put_channel(msg, chan))
 807                                 goto nla_put_failure;
 808
 809                         nla_nest_end(msg, nl_freq);
 810                 }
 811
 812                 nla_nest_end(msg, nl_freqs);
 813
 814                 /* add bitrates */
 815                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 816                 if (!nl_rates)
 817                         goto nla_put_failure;
 818
 819                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 820                         nl_rate = nla_nest_start(msg, i);
 821                         if (!nl_rate)
 822                                 goto nla_put_failure;
 823
 824                         rate = &dev->wiphy.bands[band]->bitrates[i];
 825                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 826                                     rate->bitrate);
 827                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 828                                 NLA_PUT_FLAG(msg,
 829                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 830
 831                         nla_nest_end(msg, nl_rate);
 832                 }
 833
 834                 nla_nest_end(msg, nl_rates);
 835
 836                 nla_nest_end(msg, nl_band);
 837         }
 838         nla_nest_end(msg, nl_bands);
 839
 840         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 841         if (!nl_cmds)
 842                 goto nla_put_failure;
 843
 844         i = 0;
 845 #define CMD(op, n)                                              \
 846          do {                                                   \
 847                 if (dev->ops->op) {                             \
 848                         i++;                                    \
 849                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 850                 }                                               \
 851         } while (0)
 852
 853         CMD(add_virtual_intf, NEW_INTERFACE);
 854         CMD(change_virtual_intf, SET_INTERFACE);
 855         CMD(add_key, NEW_KEY);
 856         CMD(add_beacon, NEW_BEACON);
 857         CMD(add_station, NEW_STATION);
 858         CMD(add_mpath, NEW_MPATH);
 859         CMD(update_mesh_config, SET_MESH_CONFIG);
 860         CMD(change_bss, SET_BSS);
 861         CMD(auth, AUTHENTICATE);
 862         CMD(assoc, ASSOCIATE);
 863         CMD(deauth, DEAUTHENTICATE);
 864         CMD(disassoc, DISASSOCIATE);
 865         CMD(join_ibss, JOIN_IBSS);
 866         CMD(join_mesh, JOIN_MESH);
 867         CMD(set_pmksa, SET_PMKSA);
 868         CMD(del_pmksa, DEL_PMKSA);
 869         CMD(flush_pmksa, FLUSH_PMKSA);
 870         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 871         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 872         CMD(mgmt_tx, FRAME);
 873         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 874         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 875                 i++;
 876                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 877         }
 878         CMD(set_channel, SET_CHANNEL);
 879         CMD(set_wds_peer, SET_WDS_PEER);
 880         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 881                 CMD(sched_scan_start, START_SCHED_SCAN);
 882
 883 #undef CMD
 884
 885         if (dev->ops->connect || dev->ops->auth) {
 886                 i++;
 887                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 888         }
 889
 890         if (dev->ops->disconnect || dev->ops->deauth) {
 891                 i++;
 892                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 893         }
 894
 895         nla_nest_end(msg, nl_cmds);
 896
 897         if (dev->ops->remain_on_channel)
 898                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 899                             dev->wiphy.max_remain_on_channel_duration);
 900
 901         if (dev->ops->mgmt_tx_cancel_wait)
 902                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 903
 904         if (mgmt_stypes) {
 905                 u16 stypes;
 906                 struct nlattr *nl_ftypes, *nl_ifs;
 907                 enum nl80211_iftype ift;
 908
 909                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 910                 if (!nl_ifs)
 911                         goto nla_put_failure;
 912
 913                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 914                         nl_ftypes = nla_nest_start(msg, ift);
 915                         if (!nl_ftypes)
 916                                 goto nla_put_failure;
 917                         i = 0;
 918                         stypes = mgmt_stypes[ift].tx;
 919                         while (stypes) {
 920                                 if (stypes & 1)
 921                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 922                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 923                                 stypes >>= 1;
 924                                 i++;
 925                         }
 926                         nla_nest_end(msg, nl_ftypes);
 927                 }
 928
 929                 nla_nest_end(msg, nl_ifs);
 930
 931                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 932                 if (!nl_ifs)
 933                         goto nla_put_failure;
 934
 935                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 936                         nl_ftypes = nla_nest_start(msg, ift);
 937                         if (!nl_ftypes)
 938                                 goto nla_put_failure;
 939                         i = 0;
 940                         stypes = mgmt_stypes[ift].rx;
 941                         while (stypes) {
 942                                 if (stypes & 1)
 943                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 944                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 945                                 stypes >>= 1;
 946                                 i++;
 947                         }
 948                         nla_nest_end(msg, nl_ftypes);
 949                 }
 950                 nla_nest_end(msg, nl_ifs);
 951         }
 952
 953         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 954                 struct nlattr *nl_wowlan;
 955
 956                 nl_wowlan = nla_nest_start(msg,
 957                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 958                 if (!nl_wowlan)
 959                         goto nla_put_failure;
 960
 961                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 962                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 963                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 964                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 965                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 966                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 967                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 968                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 969                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 970                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 971                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 972                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 973                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 974                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 975                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 976                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 977                 if (dev->wiphy.wowlan.n_patterns) {
 978                         struct nl80211_wowlan_pattern_support pat = {
 979                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 980                                 .min_pattern_len =
 981                                         dev->wiphy.wowlan.pattern_min_len,
 982                                 .max_pattern_len =
 983                                         dev->wiphy.wowlan.pattern_max_len,
 984                         };
 985                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 986                                 sizeof(pat), &pat);
 987                 }
 988
 989                 nla_nest_end(msg, nl_wowlan);
 990         }
 991
 992         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 993                                 dev->wiphy.software_iftypes))
 994                 goto nla_put_failure;
 995
 996         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 997                 goto nla_put_failure;
 998
 999         return genlmsg_end(msg, hdr);
1000
1001  nla_put_failure:
1002         genlmsg_cancel(msg, hdr);
1003         return -EMSGSIZE;
1004 }
1005
1006 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1007 {
1008         int idx = 0;
1009         int start = cb->args[0];
1010         struct cfg80211_registered_device *dev;
1011
1012         mutex_lock(&cfg80211_mutex);
1013         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1014                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1015                         continue;
1016                 if (++idx <= start)
1017                         continue;
1018                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1019                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1020                                        dev) < 0) {
1021                         idx--;
1022                         break;
1023                 }
1024         }
1025         mutex_unlock(&cfg80211_mutex);
1026
1027         cb->args[0] = idx;
1028
1029         return skb->len;
1030 }
1031
1032 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1033 {
1034         struct sk_buff *msg;
1035         struct cfg80211_registered_device *dev = info->user_ptr[0];
1036
1037         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1038         if (!msg)
1039                 return -ENOMEM;
1040
1041         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1042                 nlmsg_free(msg);
1043                 return -ENOBUFS;
1044         }
1045
1046         return genlmsg_reply(msg, info);
1047 }
1048
1049 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1050         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1051         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1052         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1053         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1054         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1055 };
1056
1057 static int parse_txq_params(struct nlattr *tb[],
1058                             struct ieee80211_txq_params *txq_params)
1059 {
1060         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1061             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1062             !tb[NL80211_TXQ_ATTR_AIFS])
1063                 return -EINVAL;
1064
1065         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1066         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1067         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1068         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1069         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1070
1071         return 0;
1072 }
1073
1074 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1075 {
1076         /*
1077          * You can only set the channel explicitly for AP, mesh
1078          * and WDS type interfaces; all others have their channel
1079          * managed via their respective "establish a connection"
1080          * command (connect, join, ...)
1081          *
1082          * Monitors are special as they are normally slaved to
1083          * whatever else is going on, so they behave as though
1084          * you tried setting the wiphy channel itself.
1085          */
1086         return !wdev ||
1087                 wdev->iftype == NL80211_IFTYPE_AP ||
1088                 wdev->iftype == NL80211_IFTYPE_WDS ||
1089                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1090                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1091                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1092 }
1093
1094 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1095                                  struct wireless_dev *wdev,
1096                                  struct genl_info *info)
1097 {
1098         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1099         u32 freq;
1100         int result;
1101
1102         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1103                 return -EINVAL;
1104
1105         if (!nl80211_can_set_dev_channel(wdev))
1106                 return -EOPNOTSUPP;
1107
1108         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1109                 channel_type = nla_get_u32(info->attrs[
1110                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1111                 if (channel_type != NL80211_CHAN_NO_HT &&
1112                     channel_type != NL80211_CHAN_HT20 &&
1113                     channel_type != NL80211_CHAN_HT40PLUS &&
1114                     channel_type != NL80211_CHAN_HT40MINUS)
1115                         return -EINVAL;
1116         }
1117
1118         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1119
1120         mutex_lock(&rdev->devlist_mtx);
1121         if (wdev) {
1122                 wdev_lock(wdev);
1123                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1124                 wdev_unlock(wdev);
1125         } else {
1126                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1127         }
1128         mutex_unlock(&rdev->devlist_mtx);
1129
1130         return result;
1131 }
1132
1133 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1134 {
1135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1136         struct net_device *netdev = info->user_ptr[1];
1137
1138         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1139 }
1140
1141 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1142 {
1143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1144         struct net_device *dev = info->user_ptr[1];
1145         struct wireless_dev *wdev = dev->ieee80211_ptr;
1146         const u8 *bssid;
1147
1148         if (!info->attrs[NL80211_ATTR_MAC])
1149                 return -EINVAL;
1150
1151         if (netif_running(dev))
1152                 return -EBUSY;
1153
1154         if (!rdev->ops->set_wds_peer)
1155                 return -EOPNOTSUPP;
1156
1157         if (wdev->iftype != NL80211_IFTYPE_WDS)
1158                 return -EOPNOTSUPP;
1159
1160         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1161         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1162 }
1163
1164
1165 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1166 {
1167         struct cfg80211_registered_device *rdev;
1168         struct net_device *netdev = NULL;
1169         struct wireless_dev *wdev;
1170         int result = 0, rem_txq_params = 0;
1171         struct nlattr *nl_txq_params;
1172         u32 changed;
1173         u8 retry_short = 0, retry_long = 0;
1174         u32 frag_threshold = 0, rts_threshold = 0;
1175         u8 coverage_class = 0;
1176
1177         /*
1178          * Try to find the wiphy and netdev. Normally this
1179          * function shouldn't need the netdev, but this is
1180          * done for backward compatibility -- previously
1181          * setting the channel was done per wiphy, but now
1182          * it is per netdev. Previous userland like hostapd
1183          * also passed a netdev to set_wiphy, so that it is
1184          * possible to let that go to the right netdev!
1185          */
1186         mutex_lock(&cfg80211_mutex);
1187
1188         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1189                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1190
1191                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1192                 if (netdev && netdev->ieee80211_ptr) {
1193                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1194                         mutex_lock(&rdev->mtx);
1195                 } else
1196                         netdev = NULL;
1197         }
1198
1199         if (!netdev) {
1200                 rdev = __cfg80211_rdev_from_info(info);
1201                 if (IS_ERR(rdev)) {
1202                         mutex_unlock(&cfg80211_mutex);
1203                         return PTR_ERR(rdev);
1204                 }
1205                 wdev = NULL;
1206                 netdev = NULL;
1207                 result = 0;
1208
1209                 mutex_lock(&rdev->mtx);
1210         } else if (netif_running(netdev) &&
1211                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1212                 wdev = netdev->ieee80211_ptr;
1213         else
1214                 wdev = NULL;
1215
1216         /*
1217          * end workaround code, by now the rdev is available
1218          * and locked, and wdev may or may not be NULL.
1219          */
1220
1221         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1222                 result = cfg80211_dev_rename(
1223                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1224
1225         mutex_unlock(&cfg80211_mutex);
1226
1227         if (result)
1228                 goto bad_res;
1229
1230         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1231                 struct ieee80211_txq_params txq_params;
1232                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1233
1234                 if (!rdev->ops->set_txq_params) {
1235                         result = -EOPNOTSUPP;
1236                         goto bad_res;
1237                 }
1238
1239                 if (!netdev) {
1240                         result = -EINVAL;
1241                         goto bad_res;
1242                 }
1243
1244                 nla_for_each_nested(nl_txq_params,
1245                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1246                                     rem_txq_params) {
1247                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1248                                   nla_data(nl_txq_params),
1249                                   nla_len(nl_txq_params),
1250                                   txq_params_policy);
1251                         result = parse_txq_params(tb, &txq_params);
1252                         if (result)
1253                                 goto bad_res;
1254
1255                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1256                                                            netdev,
1257                                                            &txq_params);
1258                         if (result)
1259                                 goto bad_res;
1260                 }
1261         }
1262
1263         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1264                 result = __nl80211_set_channel(rdev, wdev, info);
1265                 if (result)
1266                         goto bad_res;
1267         }
1268
1269         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1270                 enum nl80211_tx_power_setting type;
1271                 int idx, mbm = 0;
1272
1273                 if (!rdev->ops->set_tx_power) {
1274                         result = -EOPNOTSUPP;
1275                         goto bad_res;
1276                 }
1277
1278                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1279                 type = nla_get_u32(info->attrs[idx]);
1280
1281                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1282                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1283                         result = -EINVAL;
1284                         goto bad_res;
1285                 }
1286
1287                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1288                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1289                         mbm = nla_get_u32(info->attrs[idx]);
1290                 }
1291
1292                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1293                 if (result)
1294                         goto bad_res;
1295         }
1296
1297         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1298             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1299                 u32 tx_ant, rx_ant;
1300                 if ((!rdev->wiphy.available_antennas_tx &&
1301                      !rdev->wiphy.available_antennas_rx) ||
1302                     !rdev->ops->set_antenna) {
1303                         result = -EOPNOTSUPP;
1304                         goto bad_res;
1305                 }
1306
1307                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1308                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1309
1310                 /* reject antenna configurations which don't match the
1311                  * available antenna masks, except for the "all" mask */
1312                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1313                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1314                         result = -EINVAL;
1315                         goto bad_res;
1316                 }
1317
1318                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1319                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1320
1321                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1322                 if (result)
1323                         goto bad_res;
1324         }
1325
1326         changed = 0;
1327
1328         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1329                 retry_short = nla_get_u8(
1330                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1331                 if (retry_short == 0) {
1332                         result = -EINVAL;
1333                         goto bad_res;
1334                 }
1335                 changed |= WIPHY_PARAM_RETRY_SHORT;
1336         }
1337
1338         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1339                 retry_long = nla_get_u8(
1340                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1341                 if (retry_long == 0) {
1342                         result = -EINVAL;
1343                         goto bad_res;
1344                 }
1345                 changed |= WIPHY_PARAM_RETRY_LONG;
1346         }
1347
1348         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1349                 frag_threshold = nla_get_u32(
1350                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1351                 if (frag_threshold < 256) {
1352                         result = -EINVAL;
1353                         goto bad_res;
1354                 }
1355                 if (frag_threshold != (u32) -1) {
1356                         /*
1357                          * Fragments (apart from the last one) are required to
1358                          * have even length. Make the fragmentation code
1359                          * simpler by stripping LSB should someone try to use
1360                          * odd threshold value.
1361                          */
1362                         frag_threshold &= ~0x1;
1363                 }
1364                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1365         }
1366
1367         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1368                 rts_threshold = nla_get_u32(
1369                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1370                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1371         }
1372
1373         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1374                 coverage_class = nla_get_u8(
1375                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1376                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1377         }
1378
1379         if (changed) {
1380                 u8 old_retry_short, old_retry_long;
1381                 u32 old_frag_threshold, old_rts_threshold;
1382                 u8 old_coverage_class;
1383
1384                 if (!rdev->ops->set_wiphy_params) {
1385                         result = -EOPNOTSUPP;
1386                         goto bad_res;
1387                 }
1388
1389                 old_retry_short = rdev->wiphy.retry_short;
1390                 old_retry_long = rdev->wiphy.retry_long;
1391                 old_frag_threshold = rdev->wiphy.frag_threshold;
1392                 old_rts_threshold = rdev->wiphy.rts_threshold;
1393                 old_coverage_class = rdev->wiphy.coverage_class;
1394
1395                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1396                         rdev->wiphy.retry_short = retry_short;
1397                 if (changed & WIPHY_PARAM_RETRY_LONG)
1398                         rdev->wiphy.retry_long = retry_long;
1399                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1400                         rdev->wiphy.frag_threshold = frag_threshold;
1401                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1402                         rdev->wiphy.rts_threshold = rts_threshold;
1403                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1404                         rdev->wiphy.coverage_class = coverage_class;
1405
1406                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1407                 if (result) {
1408                         rdev->wiphy.retry_short = old_retry_short;
1409                         rdev->wiphy.retry_long = old_retry_long;
1410                         rdev->wiphy.frag_threshold = old_frag_threshold;
1411                         rdev->wiphy.rts_threshold = old_rts_threshold;
1412                         rdev->wiphy.coverage_class = old_coverage_class;
1413                 }
1414         }
1415
1416  bad_res:
1417         mutex_unlock(&rdev->mtx);
1418         if (netdev)
1419                 dev_put(netdev);
1420         return result;
1421 }
1422
1423
1424 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1425                               struct cfg80211_registered_device *rdev,
1426                               struct net_device *dev)
1427 {
1428         void *hdr;
1429
1430         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1431         if (!hdr)
1432                 return -1;
1433
1434         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1435         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1436         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1437         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1438
1439         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1440                     rdev->devlist_generation ^
1441                         (cfg80211_rdev_list_generation << 2));
1442
1443         return genlmsg_end(msg, hdr);
1444
1445  nla_put_failure:
1446         genlmsg_cancel(msg, hdr);
1447         return -EMSGSIZE;
1448 }
1449
1450 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1451 {
1452         int wp_idx = 0;
1453         int if_idx = 0;
1454         int wp_start = cb->args[0];
1455         int if_start = cb->args[1];
1456         struct cfg80211_registered_device *rdev;
1457         struct wireless_dev *wdev;
1458
1459         mutex_lock(&cfg80211_mutex);
1460         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1461                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1462                         continue;
1463                 if (wp_idx < wp_start) {
1464                         wp_idx++;
1465                         continue;
1466                 }
1467                 if_idx = 0;
1468
1469                 mutex_lock(&rdev->devlist_mtx);
1470                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1471                         if (if_idx < if_start) {
1472                                 if_idx++;
1473                                 continue;
1474                         }
1475                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1476                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1477                                                rdev, wdev->netdev) < 0) {
1478                                 mutex_unlock(&rdev->devlist_mtx);
1479                                 goto out;
1480                         }
1481                         if_idx++;
1482                 }
1483                 mutex_unlock(&rdev->devlist_mtx);
1484
1485                 wp_idx++;
1486         }
1487  out:
1488         mutex_unlock(&cfg80211_mutex);
1489
1490         cb->args[0] = wp_idx;
1491         cb->args[1] = if_idx;
1492
1493         return skb->len;
1494 }
1495
1496 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1497 {
1498         struct sk_buff *msg;
1499         struct cfg80211_registered_device *dev = info->user_ptr[0];
1500         struct net_device *netdev = info->user_ptr[1];
1501
1502         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1503         if (!msg)
1504                 return -ENOMEM;
1505
1506         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1507                                dev, netdev) < 0) {
1508                 nlmsg_free(msg);
1509                 return -ENOBUFS;
1510         }
1511
1512         return genlmsg_reply(msg, info);
1513 }
1514
1515 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1516         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1517         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1518         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1519         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1520         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1521 };
1522
1523 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1524 {
1525         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1526         int flag;
1527
1528         *mntrflags = 0;
1529
1530         if (!nla)
1531                 return -EINVAL;
1532
1533         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1534                              nla, mntr_flags_policy))
1535                 return -EINVAL;
1536
1537         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1538                 if (flags[flag])
1539                         *mntrflags |= (1<<flag);
1540
1541         return 0;
1542 }
1543
1544 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1545                                struct net_device *netdev, u8 use_4addr,
1546                                enum nl80211_iftype iftype)
1547 {
1548         if (!use_4addr) {
1549                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1550                         return -EBUSY;
1551                 return 0;
1552         }
1553
1554         switch (iftype) {
1555         case NL80211_IFTYPE_AP_VLAN:
1556                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1557                         return 0;
1558                 break;
1559         case NL80211_IFTYPE_STATION:
1560                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1561                         return 0;
1562                 break;
1563         default:
1564                 break;
1565         }
1566
1567         return -EOPNOTSUPP;
1568 }
1569
1570 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1571 {
1572         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1573         struct vif_params params;
1574         int err;
1575         enum nl80211_iftype otype, ntype;
1576         struct net_device *dev = info->user_ptr[1];
1577         u32 _flags, *flags = NULL;
1578         bool change = false;
1579
1580         memset(&params, 0, sizeof(params));
1581
1582         otype = ntype = dev->ieee80211_ptr->iftype;
1583
1584         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1585                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1586                 if (otype != ntype)
1587                         change = true;
1588                 if (ntype > NL80211_IFTYPE_MAX)
1589                         return -EINVAL;
1590         }
1591
1592         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1593                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1594
1595                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1596                         return -EINVAL;
1597                 if (netif_running(dev))
1598                         return -EBUSY;
1599
1600                 wdev_lock(wdev);
1601                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1602                              IEEE80211_MAX_MESH_ID_LEN);
1603                 wdev->mesh_id_up_len =
1604                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1605                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1606                        wdev->mesh_id_up_len);
1607                 wdev_unlock(wdev);
1608         }
1609
1610         if (info->attrs[NL80211_ATTR_4ADDR]) {
1611                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1612                 change = true;
1613                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1614                 if (err)
1615                         return err;
1616         } else {
1617                 params.use_4addr = -1;
1618         }
1619
1620         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1621                 if (ntype != NL80211_IFTYPE_MONITOR)
1622                         return -EINVAL;
1623                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1624                                           &_flags);
1625                 if (err)
1626                         return err;
1627
1628                 flags = &_flags;
1629                 change = true;
1630         }
1631
1632         if (change)
1633                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1634         else
1635                 err = 0;
1636
1637         if (!err && params.use_4addr != -1)
1638                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1639
1640         return err;
1641 }
1642
1643 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1644 {
1645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1646         struct vif_params params;
1647         struct net_device *dev;
1648         int err;
1649         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1650         u32 flags;
1651
1652         memset(&params, 0, sizeof(params));
1653
1654         if (!info->attrs[NL80211_ATTR_IFNAME])
1655                 return -EINVAL;
1656
1657         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1658                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1659                 if (type > NL80211_IFTYPE_MAX)
1660                         return -EINVAL;
1661         }
1662
1663         if (!rdev->ops->add_virtual_intf ||
1664             !(rdev->wiphy.interface_modes & (1 << type)))
1665                 return -EOPNOTSUPP;
1666
1667         if (info->attrs[NL80211_ATTR_4ADDR]) {
1668                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1669                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1670                 if (err)
1671                         return err;
1672         }
1673
1674         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1675                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1676                                   &flags);
1677         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1678                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1679                 type, err ? NULL : &flags, &params);
1680         if (IS_ERR(dev))
1681                 return PTR_ERR(dev);
1682
1683         if (type == NL80211_IFTYPE_MESH_POINT &&
1684             info->attrs[NL80211_ATTR_MESH_ID]) {
1685                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1686
1687                 wdev_lock(wdev);
1688                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1689                              IEEE80211_MAX_MESH_ID_LEN);
1690                 wdev->mesh_id_up_len =
1691                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1692                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1693                        wdev->mesh_id_up_len);
1694                 wdev_unlock(wdev);
1695         }
1696
1697         return 0;
1698 }
1699
1700 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1701 {
1702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1703         struct net_device *dev = info->user_ptr[1];
1704
1705         if (!rdev->ops->del_virtual_intf)
1706                 return -EOPNOTSUPP;
1707
1708         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1709 }
1710
1711 struct get_key_cookie {
1712         struct sk_buff *msg;
1713         int error;
1714         int idx;
1715 };
1716
1717 static void get_key_callback(void *c, struct key_params *params)
1718 {
1719         struct nlattr *key;
1720         struct get_key_cookie *cookie = c;
1721
1722         if (params->key)
1723                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1724                         params->key_len, params->key);
1725
1726         if (params->seq)
1727                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1728                         params->seq_len, params->seq);
1729
1730         if (params->cipher)
1731                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1732                             params->cipher);
1733
1734         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1735         if (!key)
1736                 goto nla_put_failure;
1737
1738         if (params->key)
1739                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1740                         params->key_len, params->key);
1741
1742         if (params->seq)
1743                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1744                         params->seq_len, params->seq);
1745
1746         if (params->cipher)
1747                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1748                             params->cipher);
1749
1750         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1751
1752         nla_nest_end(cookie->msg, key);
1753
1754         return;
1755  nla_put_failure:
1756         cookie->error = 1;
1757 }
1758
1759 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1760 {
1761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1762         int err;
1763         struct net_device *dev = info->user_ptr[1];
1764         u8 key_idx = 0;
1765         const u8 *mac_addr = NULL;
1766         bool pairwise;
1767         struct get_key_cookie cookie = {
1768                 .error = 0,
1769         };
1770         void *hdr;
1771         struct sk_buff *msg;
1772
1773         if (info->attrs[NL80211_ATTR_KEY_IDX])
1774                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1775
1776         if (key_idx > 5)
1777                 return -EINVAL;
1778
1779         if (info->attrs[NL80211_ATTR_MAC])
1780                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1781
1782         pairwise = !!mac_addr;
1783         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1784                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1785                 if (kt >= NUM_NL80211_KEYTYPES)
1786                         return -EINVAL;
1787                 if (kt != NL80211_KEYTYPE_GROUP &&
1788                     kt != NL80211_KEYTYPE_PAIRWISE)
1789                         return -EINVAL;
1790                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1791         }
1792
1793         if (!rdev->ops->get_key)
1794                 return -EOPNOTSUPP;
1795
1796         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1797         if (!msg)
1798                 return -ENOMEM;
1799
1800         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1801                              NL80211_CMD_NEW_KEY);
1802         if (IS_ERR(hdr))
1803                 return PTR_ERR(hdr);
1804
1805         cookie.msg = msg;
1806         cookie.idx = key_idx;
1807
1808         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1809         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1810         if (mac_addr)
1811                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1812
1813         if (pairwise && mac_addr &&
1814             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1815                 return -ENOENT;
1816
1817         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1818                                  mac_addr, &cookie, get_key_callback);
1819
1820         if (err)
1821                 goto free_msg;
1822
1823         if (cookie.error)
1824                 goto nla_put_failure;
1825
1826         genlmsg_end(msg, hdr);
1827         return genlmsg_reply(msg, info);
1828
1829  nla_put_failure:
1830         err = -ENOBUFS;
1831  free_msg:
1832         nlmsg_free(msg);
1833         return err;
1834 }
1835
1836 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1837 {
1838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1839         struct key_parse key;
1840         int err;
1841         struct net_device *dev = info->user_ptr[1];
1842
1843         err = nl80211_parse_key(info, &key);
1844         if (err)
1845                 return err;
1846
1847         if (key.idx < 0)
1848                 return -EINVAL;
1849
1850         /* only support setting default key */
1851         if (!key.def && !key.defmgmt)
1852                 return -EINVAL;
1853
1854         wdev_lock(dev->ieee80211_ptr);
1855
1856         if (key.def) {
1857                 if (!rdev->ops->set_default_key) {
1858                         err = -EOPNOTSUPP;
1859                         goto out;
1860                 }
1861
1862                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1863                 if (err)
1864                         goto out;
1865
1866                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1867                                                  key.def_uni, key.def_multi);
1868
1869                 if (err)
1870                         goto out;
1871
1872 #ifdef CONFIG_CFG80211_WEXT
1873                 dev->ieee80211_ptr->wext.default_key = key.idx;
1874 #endif
1875         } else {
1876                 if (key.def_uni || !key.def_multi) {
1877                         err = -EINVAL;
1878                         goto out;
1879                 }
1880
1881                 if (!rdev->ops->set_default_mgmt_key) {
1882                         err = -EOPNOTSUPP;
1883                         goto out;
1884                 }
1885
1886                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1887                 if (err)
1888                         goto out;
1889
1890                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1891                                                       dev, key.idx);
1892                 if (err)
1893                         goto out;
1894
1895 #ifdef CONFIG_CFG80211_WEXT
1896                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1897 #endif
1898         }
1899
1900  out:
1901         wdev_unlock(dev->ieee80211_ptr);
1902
1903         return err;
1904 }
1905
1906 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1907 {
1908         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1909         int err;
1910         struct net_device *dev = info->user_ptr[1];
1911         struct key_parse key;
1912         const u8 *mac_addr = NULL;
1913
1914         err = nl80211_parse_key(info, &key);
1915         if (err)
1916                 return err;
1917
1918         if (!key.p.key)
1919                 return -EINVAL;
1920
1921         if (info->attrs[NL80211_ATTR_MAC])
1922                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1923
1924         if (key.type == -1) {
1925                 if (mac_addr)
1926                         key.type = NL80211_KEYTYPE_PAIRWISE;
1927                 else
1928                         key.type = NL80211_KEYTYPE_GROUP;
1929         }
1930
1931         /* for now */
1932         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1933             key.type != NL80211_KEYTYPE_GROUP)
1934                 return -EINVAL;
1935
1936         if (!rdev->ops->add_key)
1937                 return -EOPNOTSUPP;
1938
1939         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1940                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1941                                            mac_addr))
1942                 return -EINVAL;
1943
1944         wdev_lock(dev->ieee80211_ptr);
1945         err = nl80211_key_allowed(dev->ieee80211_ptr);
1946         if (!err)
1947                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1948                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1949                                          mac_addr, &key.p);
1950         wdev_unlock(dev->ieee80211_ptr);
1951
1952         return err;
1953 }
1954
1955 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1956 {
1957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1958         int err;
1959         struct net_device *dev = info->user_ptr[1];
1960         u8 *mac_addr = NULL;
1961         struct key_parse key;
1962
1963         err = nl80211_parse_key(info, &key);
1964         if (err)
1965                 return err;
1966
1967         if (info->attrs[NL80211_ATTR_MAC])
1968                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1969
1970         if (key.type == -1) {
1971                 if (mac_addr)
1972                         key.type = NL80211_KEYTYPE_PAIRWISE;
1973                 else
1974                         key.type = NL80211_KEYTYPE_GROUP;
1975         }
1976
1977         /* for now */
1978         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1979             key.type != NL80211_KEYTYPE_GROUP)
1980                 return -EINVAL;
1981
1982         if (!rdev->ops->del_key)
1983                 return -EOPNOTSUPP;
1984
1985         wdev_lock(dev->ieee80211_ptr);
1986         err = nl80211_key_allowed(dev->ieee80211_ptr);
1987
1988         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1989             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1990                 err = -ENOENT;
1991
1992         if (!err)
1993                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1994                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1995                                          mac_addr);
1996
1997 #ifdef CONFIG_CFG80211_WEXT
1998         if (!err) {
1999                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2000                         dev->ieee80211_ptr->wext.default_key = -1;
2001                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2002                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2003         }
2004 #endif
2005         wdev_unlock(dev->ieee80211_ptr);
2006
2007         return err;
2008 }
2009
2010 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2011 {
2012         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2013                     struct beacon_parameters *info);
2014         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2015         struct net_device *dev = info->user_ptr[1];
2016         struct wireless_dev *wdev = dev->ieee80211_ptr;
2017         struct beacon_parameters params;
2018         int haveinfo = 0, err;
2019
2020         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2021             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2022             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2023             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2024                 return -EINVAL;
2025
2026         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2027             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2028                 return -EOPNOTSUPP;
2029
2030         memset(&params, 0, sizeof(params));
2031
2032         switch (info->genlhdr->cmd) {
2033         case NL80211_CMD_NEW_BEACON:
2034                 /* these are required for NEW_BEACON */
2035                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2036                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2037                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2038                         return -EINVAL;
2039
2040                 params.interval =
2041                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2042                 params.dtim_period =
2043                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2044
2045                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2046                 if (err)
2047                         return err;
2048
2049                 /*
2050                  * In theory, some of these attributes could be required for
2051                  * NEW_BEACON, but since they were not used when the command was
2052                  * originally added, keep them optional for old user space
2053                  * programs to work with drivers that do not need the additional
2054                  * information.
2055                  */
2056                 if (info->attrs[NL80211_ATTR_SSID]) {
2057                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2058                         params.ssid_len =
2059                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2060                         if (params.ssid_len == 0 ||
2061                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2062                                 return -EINVAL;
2063                 }
2064
2065                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2066                         params.hidden_ssid = nla_get_u32(
2067                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2068                         if (params.hidden_ssid !=
2069                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2070                             params.hidden_ssid !=
2071                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2072                             params.hidden_ssid !=
2073                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2074                                 return -EINVAL;
2075                 }
2076
2077                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2078
2079                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2080                         params.auth_type = nla_get_u32(
2081                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2082                         if (!nl80211_valid_auth_type(params.auth_type))
2083                                 return -EINVAL;
2084                 } else
2085                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2086
2087                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2088                                               NL80211_MAX_NR_CIPHER_SUITES);
2089                 if (err)
2090                         return err;
2091
2092                 call = rdev->ops->add_beacon;
2093                 break;
2094         case NL80211_CMD_SET_BEACON:
2095                 call = rdev->ops->set_beacon;
2096                 break;
2097         default:
2098                 WARN_ON(1);
2099                 return -EOPNOTSUPP;
2100         }
2101
2102         if (!call)
2103                 return -EOPNOTSUPP;
2104
2105         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2106                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2107                 params.head_len =
2108                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2109                 haveinfo = 1;
2110         }
2111
2112         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2113                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2114                 params.tail_len =
2115                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2116                 haveinfo = 1;
2117         }
2118
2119         if (!haveinfo)
2120                 return -EINVAL;
2121
2122         if (info->attrs[NL80211_ATTR_IE]) {
2123                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2124                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2125         }
2126
2127         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2128                 params.proberesp_ies =
2129                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2130                 params.proberesp_ies_len =
2131                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2132         }
2133
2134         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2135                 params.assocresp_ies =
2136                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2137                 params.assocresp_ies_len =
2138                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2139         }
2140
2141         err = call(&rdev->wiphy, dev, &params);
2142         if (!err && params.interval)
2143                 wdev->beacon_interval = params.interval;
2144         return err;
2145 }
2146
2147 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2148 {
2149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2150         struct net_device *dev = info->user_ptr[1];
2151         struct wireless_dev *wdev = dev->ieee80211_ptr;
2152         int err;
2153
2154         if (!rdev->ops->del_beacon)
2155                 return -EOPNOTSUPP;
2156
2157         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2158             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2159                 return -EOPNOTSUPP;
2160
2161         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2162         if (!err)
2163                 wdev->beacon_interval = 0;
2164         return err;
2165 }
2166
2167 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2168         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2169         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2170         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2171         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2172         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2173 };
2174
2175 static int parse_station_flags(struct genl_info *info,
2176                                struct station_parameters *params)
2177 {
2178         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2179         struct nlattr *nla;
2180         int flag;
2181
2182         /*
2183          * Try parsing the new attribute first so userspace
2184          * can specify both for older kernels.
2185          */
2186         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2187         if (nla) {
2188                 struct nl80211_sta_flag_update *sta_flags;
2189
2190                 sta_flags = nla_data(nla);
2191                 params->sta_flags_mask = sta_flags->mask;
2192                 params->sta_flags_set = sta_flags->set;
2193                 if ((params->sta_flags_mask |
2194                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2195                         return -EINVAL;
2196                 return 0;
2197         }
2198
2199         /* if present, parse the old attribute */
2200
2201         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2202         if (!nla)
2203                 return 0;
2204
2205         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2206                              nla, sta_flags_policy))
2207                 return -EINVAL;
2208
2209         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2210         params->sta_flags_mask &= ~1;
2211
2212         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2213                 if (flags[flag])
2214                         params->sta_flags_set |= (1<<flag);
2215
2216         return 0;
2217 }
2218
2219 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2220                                  int attr)
2221 {
2222         struct nlattr *rate;
2223         u16 bitrate;
2224
2225         rate = nla_nest_start(msg, attr);
2226         if (!rate)
2227                 goto nla_put_failure;
2228
2229         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2230         bitrate = cfg80211_calculate_bitrate(info);
2231         if (bitrate > 0)
2232                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2233
2234         if (info->flags & RATE_INFO_FLAGS_MCS)
2235                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2236         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2237                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2238         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2239                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2240
2241         nla_nest_end(msg, rate);
2242         return true;
2243
2244 nla_put_failure:
2245         return false;
2246 }
2247
2248 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2249                                 int flags, struct net_device *dev,
2250                                 const u8 *mac_addr, struct station_info *sinfo)
2251 {
2252         void *hdr;
2253         struct nlattr *sinfoattr, *bss_param;
2254
2255         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2256         if (!hdr)
2257                 return -1;
2258
2259         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2260         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2261
2262         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2263
2264         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2265         if (!sinfoattr)
2266                 goto nla_put_failure;
2267         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2268                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2269                             sinfo->connected_time);
2270         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2271                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2272                             sinfo->inactive_time);
2273         if (sinfo->filled & STATION_INFO_RX_BYTES)
2274                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2275                             sinfo->rx_bytes);
2276         if (sinfo->filled & STATION_INFO_TX_BYTES)
2277                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2278                             sinfo->tx_bytes);
2279         if (sinfo->filled & STATION_INFO_LLID)
2280                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2281                             sinfo->llid);
2282         if (sinfo->filled & STATION_INFO_PLID)
2283                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2284                             sinfo->plid);
2285         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2286                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2287                             sinfo->plink_state);
2288         if (sinfo->filled & STATION_INFO_SIGNAL)
2289                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2290                            sinfo->signal);
2291         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2292                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2293                            sinfo->signal_avg);
2294         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2295                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2296                                           NL80211_STA_INFO_TX_BITRATE))
2297                         goto nla_put_failure;
2298         }
2299         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2300                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2301                                           NL80211_STA_INFO_RX_BITRATE))
2302                         goto nla_put_failure;
2303         }
2304         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2305                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2306                             sinfo->rx_packets);
2307         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2308                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2309                             sinfo->tx_packets);
2310         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2311                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2312                             sinfo->tx_retries);
2313         if (sinfo->filled & STATION_INFO_TX_FAILED)
2314                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2315                             sinfo->tx_failed);
2316         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2317                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2318                 if (!bss_param)
2319                         goto nla_put_failure;
2320
2321                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2322                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2323                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2324                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2325                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2326                         NLA_PUT_FLAG(msg,
2327                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2328                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2329                            sinfo->bss_param.dtim_period);
2330                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2331                             sinfo->bss_param.beacon_interval);
2332
2333                 nla_nest_end(msg, bss_param);
2334         }
2335         nla_nest_end(msg, sinfoattr);
2336
2337         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2338                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2339                         sinfo->assoc_req_ies);
2340
2341         return genlmsg_end(msg, hdr);
2342
2343  nla_put_failure:
2344         genlmsg_cancel(msg, hdr);
2345         return -EMSGSIZE;
2346 }
2347
2348 static int nl80211_dump_station(struct sk_buff *skb,
2349                                 struct netlink_callback *cb)
2350 {
2351         struct station_info sinfo;
2352         struct cfg80211_registered_device *dev;
2353         struct net_device *netdev;
2354         u8 mac_addr[ETH_ALEN];
2355         int sta_idx = cb->args[1];
2356         int err;
2357
2358         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2359         if (err)
2360                 return err;
2361
2362         if (!dev->ops->dump_station) {
2363                 err = -EOPNOTSUPP;
2364                 goto out_err;
2365         }
2366
2367         while (1) {
2368                 memset(&sinfo, 0, sizeof(sinfo));
2369                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2370                                              mac_addr, &sinfo);
2371                 if (err == -ENOENT)
2372                         break;
2373                 if (err)
2374                         goto out_err;
2375
2376                 if (nl80211_send_station(skb,
2377                                 NETLINK_CB(cb->skb).pid,
2378                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2379                                 netdev, mac_addr,
2380                                 &sinfo) < 0)
2381                         goto out;
2382
2383                 sta_idx++;
2384         }
2385
2386
2387  out:
2388         cb->args[1] = sta_idx;
2389         err = skb->len;
2390  out_err:
2391         nl80211_finish_netdev_dump(dev);
2392
2393         return err;
2394 }
2395
2396 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2397 {
2398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2399         struct net_device *dev = info->user_ptr[1];
2400         struct station_info sinfo;
2401         struct sk_buff *msg;
2402         u8 *mac_addr = NULL;
2403         int err;
2404
2405         memset(&sinfo, 0, sizeof(sinfo));
2406
2407         if (!info->attrs[NL80211_ATTR_MAC])
2408                 return -EINVAL;
2409
2410         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2411
2412         if (!rdev->ops->get_station)
2413                 return -EOPNOTSUPP;
2414
2415         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2416         if (err)
2417                 return err;
2418
2419         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2420         if (!msg)
2421                 return -ENOMEM;
2422
2423         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2424                                  dev, mac_addr, &sinfo) < 0) {
2425                 nlmsg_free(msg);
2426                 return -ENOBUFS;
2427         }
2428
2429         return genlmsg_reply(msg, info);
2430 }
2431
2432 /*
2433  * Get vlan interface making sure it is running and on the right wiphy.
2434  */
2435 static int get_vlan(struct genl_info *info,
2436                     struct cfg80211_registered_device *rdev,
2437                     struct net_device **vlan)
2438 {
2439         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2440         *vlan = NULL;
2441
2442         if (vlanattr) {
2443                 *vlan = dev_get_by_index(genl_info_net(info),
2444                                          nla_get_u32(vlanattr));
2445                 if (!*vlan)
2446                         return -ENODEV;
2447                 if (!(*vlan)->ieee80211_ptr)
2448                         return -EINVAL;
2449                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2450                         return -EINVAL;
2451                 if (!netif_running(*vlan))
2452                         return -ENETDOWN;
2453         }
2454         return 0;
2455 }
2456
2457 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2458 {
2459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2460         int err;
2461         struct net_device *dev = info->user_ptr[1];
2462         struct station_parameters params;
2463         u8 *mac_addr = NULL;
2464
2465         memset(&params, 0, sizeof(params));
2466
2467         params.listen_interval = -1;
2468         params.plink_state = -1;
2469
2470         if (info->attrs[NL80211_ATTR_STA_AID])
2471                 return -EINVAL;
2472
2473         if (!info->attrs[NL80211_ATTR_MAC])
2474                 return -EINVAL;
2475
2476         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2477
2478         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2479                 params.supported_rates =
2480                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2481                 params.supported_rates_len =
2482                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2483         }
2484
2485         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2486                 params.listen_interval =
2487                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2488
2489         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2490                 params.ht_capa =
2491                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2492
2493         if (parse_station_flags(info, &params))
2494                 return -EINVAL;
2495
2496         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2497                 params.plink_action =
2498                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2499
2500         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2501                 params.plink_state =
2502                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2503
2504         err = get_vlan(info, rdev, &params.vlan);
2505         if (err)
2506                 goto out;
2507
2508         /* validate settings */
2509         err = 0;
2510
2511         switch (dev->ieee80211_ptr->iftype) {
2512         case NL80211_IFTYPE_AP:
2513         case NL80211_IFTYPE_AP_VLAN:
2514         case NL80211_IFTYPE_P2P_GO:
2515                 /* disallow mesh-specific things */
2516                 if (params.plink_action)
2517                         err = -EINVAL;
2518                 break;
2519         case NL80211_IFTYPE_P2P_CLIENT:
2520         case NL80211_IFTYPE_STATION:
2521                 /* disallow everything but AUTHORIZED flag */
2522                 if (params.plink_action)
2523                         err = -EINVAL;
2524                 if (params.vlan)
2525                         err = -EINVAL;
2526                 if (params.supported_rates)
2527                         err = -EINVAL;
2528                 if (params.ht_capa)
2529                         err = -EINVAL;
2530                 if (params.listen_interval >= 0)
2531                         err = -EINVAL;
2532                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2533                         err = -EINVAL;
2534                 break;
2535         case NL80211_IFTYPE_MESH_POINT:
2536                 /* disallow things mesh doesn't support */
2537                 if (params.vlan)
2538                         err = -EINVAL;
2539                 if (params.ht_capa)
2540                         err = -EINVAL;
2541                 if (params.listen_interval >= 0)
2542                         err = -EINVAL;
2543                 if (params.sta_flags_mask &
2544                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2545                                   BIT(NL80211_STA_FLAG_MFP) |
2546                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2547                         err = -EINVAL;
2548                 break;
2549         default:
2550                 err = -EINVAL;
2551         }
2552
2553         if (err)
2554                 goto out;
2555
2556         if (!rdev->ops->change_station) {
2557                 err = -EOPNOTSUPP;
2558                 goto out;
2559         }
2560
2561         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2562
2563  out:
2564         if (params.vlan)
2565                 dev_put(params.vlan);
2566
2567         return err;
2568 }
2569
2570 static struct nla_policy
2571 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2572         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2573         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2574 };
2575
2576 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2577 {
2578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2579         int err;
2580         struct net_device *dev = info->user_ptr[1];
2581         struct station_parameters params;
2582         u8 *mac_addr = NULL;
2583
2584         memset(&params, 0, sizeof(params));
2585
2586         if (!info->attrs[NL80211_ATTR_MAC])
2587                 return -EINVAL;
2588
2589         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2590                 return -EINVAL;
2591
2592         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2593                 return -EINVAL;
2594
2595         if (!info->attrs[NL80211_ATTR_STA_AID])
2596                 return -EINVAL;
2597
2598         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2599         params.supported_rates =
2600                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2601         params.supported_rates_len =
2602                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2603         params.listen_interval =
2604                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2605
2606         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2607         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2608                 return -EINVAL;
2609
2610         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2611                 params.ht_capa =
2612                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2613
2614         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2615                 params.plink_action =
2616                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2617
2618         if (parse_station_flags(info, &params))
2619                 return -EINVAL;
2620
2621         /* parse WME attributes if sta is WME capable */
2622         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2623             (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
2624             info->attrs[NL80211_ATTR_STA_WME]) {
2625                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2626                 struct nlattr *nla;
2627
2628                 nla = info->attrs[NL80211_ATTR_STA_WME];
2629                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2630                                        nl80211_sta_wme_policy);
2631                 if (err)
2632                         return err;
2633
2634                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2635                         params.uapsd_queues =
2636                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2637                 if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2638                         return -EINVAL;
2639
2640                 if (tb[NL80211_STA_WME_MAX_SP])
2641                         params.max_sp =
2642                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2643
2644                 if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2645                         return -EINVAL;
2646         }
2647
2648         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2649             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2650             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2651             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2652                 return -EINVAL;
2653
2654         err = get_vlan(info, rdev, &params.vlan);
2655         if (err)
2656                 goto out;
2657
2658         /* validate settings */
2659         err = 0;
2660
2661         if (!rdev->ops->add_station) {
2662                 err = -EOPNOTSUPP;
2663                 goto out;
2664         }
2665
2666         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2667
2668  out:
2669         if (params.vlan)
2670                 dev_put(params.vlan);
2671         return err;
2672 }
2673
2674 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2675 {
2676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2677         struct net_device *dev = info->user_ptr[1];
2678         u8 *mac_addr = NULL;
2679
2680         if (info->attrs[NL80211_ATTR_MAC])
2681                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2682
2683         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2684             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2685             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2686             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2687                 return -EINVAL;
2688
2689         if (!rdev->ops->del_station)
2690                 return -EOPNOTSUPP;
2691
2692         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2693 }
2694
2695 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2696                                 int flags, struct net_device *dev,
2697                                 u8 *dst, u8 *next_hop,
2698                                 struct mpath_info *pinfo)
2699 {
2700         void *hdr;
2701         struct nlattr *pinfoattr;
2702
2703         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2704         if (!hdr)
2705                 return -1;
2706
2707         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2708         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2709         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2710
2711         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2712
2713         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2714         if (!pinfoattr)
2715                 goto nla_put_failure;
2716         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2717                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2718                             pinfo->frame_qlen);
2719         if (pinfo->filled & MPATH_INFO_SN)
2720                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2721                             pinfo->sn);
2722         if (pinfo->filled & MPATH_INFO_METRIC)
2723                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2724                             pinfo->metric);
2725         if (pinfo->filled & MPATH_INFO_EXPTIME)
2726                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2727                             pinfo->exptime);
2728         if (pinfo->filled & MPATH_INFO_FLAGS)
2729                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2730                             pinfo->flags);
2731         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2732                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2733                             pinfo->discovery_timeout);
2734         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2735                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2736                             pinfo->discovery_retries);
2737
2738         nla_nest_end(msg, pinfoattr);
2739
2740         return genlmsg_end(msg, hdr);
2741
2742  nla_put_failure:
2743         genlmsg_cancel(msg, hdr);
2744         return -EMSGSIZE;
2745 }
2746
2747 static int nl80211_dump_mpath(struct sk_buff *skb,
2748                               struct netlink_callback *cb)
2749 {
2750         struct mpath_info pinfo;
2751         struct cfg80211_registered_device *dev;
2752         struct net_device *netdev;
2753         u8 dst[ETH_ALEN];
2754         u8 next_hop[ETH_ALEN];
2755         int path_idx = cb->args[1];
2756         int err;
2757
2758         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2759         if (err)
2760                 return err;
2761
2762         if (!dev->ops->dump_mpath) {
2763                 err = -EOPNOTSUPP;
2764                 goto out_err;
2765         }
2766
2767         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2768                 err = -EOPNOTSUPP;
2769                 goto out_err;
2770         }
2771
2772         while (1) {
2773                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2774                                            dst, next_hop, &pinfo);
2775                 if (err == -ENOENT)
2776                         break;
2777                 if (err)
2778                         goto out_err;
2779
2780                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2781                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2782                                        netdev, dst, next_hop,
2783                                        &pinfo) < 0)
2784                         goto out;
2785
2786                 path_idx++;
2787         }
2788
2789
2790  out:
2791         cb->args[1] = path_idx;
2792         err = skb->len;
2793  out_err:
2794         nl80211_finish_netdev_dump(dev);
2795         return err;
2796 }
2797
2798 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2799 {
2800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2801         int err;
2802         struct net_device *dev = info->user_ptr[1];
2803         struct mpath_info pinfo;
2804         struct sk_buff *msg;
2805         u8 *dst = NULL;
2806         u8 next_hop[ETH_ALEN];
2807
2808         memset(&pinfo, 0, sizeof(pinfo));
2809
2810         if (!info->attrs[NL80211_ATTR_MAC])
2811                 return -EINVAL;
2812
2813         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2814
2815         if (!rdev->ops->get_mpath)
2816                 return -EOPNOTSUPP;
2817
2818         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2819                 return -EOPNOTSUPP;
2820
2821         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2822         if (err)
2823                 return err;
2824
2825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2826         if (!msg)
2827                 return -ENOMEM;
2828
2829         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2830                                  dev, dst, next_hop, &pinfo) < 0) {
2831                 nlmsg_free(msg);
2832                 return -ENOBUFS;
2833         }
2834
2835         return genlmsg_reply(msg, info);
2836 }
2837
2838 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2839 {
2840         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2841         struct net_device *dev = info->user_ptr[1];
2842         u8 *dst = NULL;
2843         u8 *next_hop = NULL;
2844
2845         if (!info->attrs[NL80211_ATTR_MAC])
2846                 return -EINVAL;
2847
2848         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2849                 return -EINVAL;
2850
2851         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2852         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2853
2854         if (!rdev->ops->change_mpath)
2855                 return -EOPNOTSUPP;
2856
2857         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2858                 return -EOPNOTSUPP;
2859
2860         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2861 }
2862
2863 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2864 {
2865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2866         struct net_device *dev = info->user_ptr[1];
2867         u8 *dst = NULL;
2868         u8 *next_hop = NULL;
2869
2870         if (!info->attrs[NL80211_ATTR_MAC])
2871                 return -EINVAL;
2872
2873         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2874                 return -EINVAL;
2875
2876         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2877         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2878
2879         if (!rdev->ops->add_mpath)
2880                 return -EOPNOTSUPP;
2881
2882         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2883                 return -EOPNOTSUPP;
2884
2885         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2886 }
2887
2888 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2889 {
2890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2891         struct net_device *dev = info->user_ptr[1];
2892         u8 *dst = NULL;
2893
2894         if (info->attrs[NL80211_ATTR_MAC])
2895                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2896
2897         if (!rdev->ops->del_mpath)
2898                 return -EOPNOTSUPP;
2899
2900         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2901 }
2902
2903 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2904 {
2905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2906         struct net_device *dev = info->user_ptr[1];
2907         struct bss_parameters params;
2908
2909         memset(&params, 0, sizeof(params));
2910         /* default to not changing parameters */
2911         params.use_cts_prot = -1;
2912         params.use_short_preamble = -1;
2913         params.use_short_slot_time = -1;
2914         params.ap_isolate = -1;
2915         params.ht_opmode = -1;
2916
2917         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2918                 params.use_cts_prot =
2919                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2920         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2921                 params.use_short_preamble =
2922                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2923         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2924                 params.use_short_slot_time =
2925                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2926         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2927                 params.basic_rates =
2928                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2929                 params.basic_rates_len =
2930                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2931         }
2932         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2933                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2934         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2935                 params.ht_opmode =
2936                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2937
2938         if (!rdev->ops->change_bss)
2939                 return -EOPNOTSUPP;
2940
2941         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2942             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2943                 return -EOPNOTSUPP;
2944
2945         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2946 }
2947
2948 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2949         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2950         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2951         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2952         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2953         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2954         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2955 };
2956
2957 static int parse_reg_rule(struct nlattr *tb[],
2958         struct ieee80211_reg_rule *reg_rule)
2959 {
2960         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2961         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2962
2963         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2964                 return -EINVAL;
2965         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2966                 return -EINVAL;
2967         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2968                 return -EINVAL;
2969         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2970                 return -EINVAL;
2971         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2972                 return -EINVAL;
2973
2974         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2975
2976         freq_range->start_freq_khz =
2977                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2978         freq_range->end_freq_khz =
2979                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2980         freq_range->max_bandwidth_khz =
2981                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2982
2983         power_rule->max_eirp =
2984                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2985
2986         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2987                 power_rule->max_antenna_gain =
2988                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2989
2990         return 0;
2991 }
2992
2993 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2994 {
2995         int r;
2996         char *data = NULL;
2997
2998         /*
2999          * You should only get this when cfg80211 hasn't yet initialized
3000          * completely when built-in to the kernel right between the time
3001          * window between nl80211_init() and regulatory_init(), if that is
3002          * even possible.
3003          */
3004         mutex_lock(&cfg80211_mutex);
3005         if (unlikely(!cfg80211_regdomain)) {
3006                 mutex_unlock(&cfg80211_mutex);
3007                 return -EINPROGRESS;
3008         }
3009         mutex_unlock(&cfg80211_mutex);
3010
3011         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3012                 return -EINVAL;
3013
3014         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3015
3016         r = regulatory_hint_user(data);
3017
3018         return r;
3019 }
3020
3021 static int nl80211_get_mesh_config(struct sk_buff *skb,
3022                                    struct genl_info *info)
3023 {
3024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3025         struct net_device *dev = info->user_ptr[1];
3026         struct wireless_dev *wdev = dev->ieee80211_ptr;
3027         struct mesh_config cur_params;
3028         int err = 0;
3029         void *hdr;
3030         struct nlattr *pinfoattr;
3031         struct sk_buff *msg;
3032
3033         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3034                 return -EOPNOTSUPP;
3035
3036         if (!rdev->ops->get_mesh_config)
3037                 return -EOPNOTSUPP;
3038
3039         wdev_lock(wdev);
3040         /* If not connected, get default parameters */
3041         if (!wdev->mesh_id_len)
3042                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3043         else
3044                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3045                                                  &cur_params);
3046         wdev_unlock(wdev);
3047
3048         if (err)
3049                 return err;
3050
3051         /* Draw up a netlink message to send back */
3052         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3053         if (!msg)
3054                 return -ENOMEM;
3055         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3056                              NL80211_CMD_GET_MESH_CONFIG);
3057         if (!hdr)
3058                 goto out;
3059         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3060         if (!pinfoattr)
3061                 goto nla_put_failure;
3062         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3063         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3064                         cur_params.dot11MeshRetryTimeout);
3065         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3066                         cur_params.dot11MeshConfirmTimeout);
3067         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3068                         cur_params.dot11MeshHoldingTimeout);
3069         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3070                         cur_params.dot11MeshMaxPeerLinks);
3071         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3072                         cur_params.dot11MeshMaxRetries);
3073         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3074                         cur_params.dot11MeshTTL);
3075         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3076                         cur_params.element_ttl);
3077         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3078                         cur_params.auto_open_plinks);
3079         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3080                         cur_params.dot11MeshHWMPmaxPREQretries);
3081         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3082                         cur_params.path_refresh_time);
3083         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3084                         cur_params.min_discovery_timeout);
3085         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3086                         cur_params.dot11MeshHWMPactivePathTimeout);
3087         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3088                         cur_params.dot11MeshHWMPpreqMinInterval);
3089         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3090                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3091         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3092                         cur_params.dot11MeshHWMPRootMode);
3093         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3094                         cur_params.dot11MeshHWMPRannInterval);
3095         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3096                         cur_params.dot11MeshGateAnnouncementProtocol);
3097         nla_nest_end(msg, pinfoattr);
3098         genlmsg_end(msg, hdr);
3099         return genlmsg_reply(msg, info);
3100
3101  nla_put_failure:
3102         genlmsg_cancel(msg, hdr);
3103  out:
3104         nlmsg_free(msg);
3105         return -ENOBUFS;
3106 }
3107
3108 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3109         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3110         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3111         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3112         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3113         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3114         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3115         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3116         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3117
3118         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3119         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3120         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3121         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3122         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3123         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3124         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3125         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3126         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3127 };
3128
3129 static const struct nla_policy
3130         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3131         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3132         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3133         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3134         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3135                 .len = IEEE80211_MAX_DATA_LEN },
3136         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3137 };
3138
3139 static int nl80211_parse_mesh_config(struct genl_info *info,
3140                                      struct mesh_config *cfg,
3141                                      u32 *mask_out)
3142 {
3143         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3144         u32 mask = 0;
3145
3146 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3147 do {\
3148         if (table[attr_num]) {\
3149                 cfg->param = nla_fn(table[attr_num]); \
3150                 mask |= (1 << (attr_num - 1)); \
3151         } \
3152 } while (0);\
3153
3154
3155         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3156                 return -EINVAL;
3157         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3158                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3159                              nl80211_meshconf_params_policy))
3160                 return -EINVAL;
3161
3162         /* This makes sure that there aren't more than 32 mesh config
3163          * parameters (otherwise our bitfield scheme would not work.) */
3164         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3165
3166         /* Fill in the params struct */
3167         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3168                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3169         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3170                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3171         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3172                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3173         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3174                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3175         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3176                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3177         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3178                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3180                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3181         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3182                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3183         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3184                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3185                         nla_get_u8);
3186         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3187                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3188         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3189                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3190                         nla_get_u16);
3191         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3192                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3193                         nla_get_u32);
3194         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3195                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3196                         nla_get_u16);
3197         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3198                         dot11MeshHWMPnetDiameterTraversalTime,
3199                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3200                         nla_get_u16);
3201         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3202                         dot11MeshHWMPRootMode, mask,
3203                         NL80211_MESHCONF_HWMP_ROOTMODE,
3204                         nla_get_u8);
3205         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3206                         dot11MeshHWMPRannInterval, mask,
3207                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3208                         nla_get_u16);
3209         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3210                         dot11MeshGateAnnouncementProtocol, mask,
3211                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3212                         nla_get_u8);
3213         if (mask_out)
3214                 *mask_out = mask;
3215
3216         return 0;
3217
3218 #undef FILL_IN_MESH_PARAM_IF_SET
3219 }
3220
3221 static int nl80211_parse_mesh_setup(struct genl_info *info,
3222                                      struct mesh_setup *setup)
3223 {
3224         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3225
3226         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3227                 return -EINVAL;
3228         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3229                              info->attrs[NL80211_ATTR_MESH_SETUP],
3230                              nl80211_mesh_setup_params_policy))
3231                 return -EINVAL;
3232
3233         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3234                 setup->path_sel_proto =
3235                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3236                  IEEE80211_PATH_PROTOCOL_VENDOR :
3237                  IEEE80211_PATH_PROTOCOL_HWMP;
3238
3239         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3240                 setup->path_metric =
3241                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3242                  IEEE80211_PATH_METRIC_VENDOR :
3243                  IEEE80211_PATH_METRIC_AIRTIME;
3244
3245
3246         if (tb[NL80211_MESH_SETUP_IE]) {
3247                 struct nlattr *ieattr =
3248                         tb[NL80211_MESH_SETUP_IE];
3249                 if (!is_valid_ie_attr(ieattr))
3250                         return -EINVAL;
3251                 setup->ie = nla_data(ieattr);
3252                 setup->ie_len = nla_len(ieattr);
3253         }
3254         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3255         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3256
3257         return 0;
3258 }
3259
3260 static int nl80211_update_mesh_config(struct sk_buff *skb,
3261                                       struct genl_info *info)
3262 {
3263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3264         struct net_device *dev = info->user_ptr[1];
3265         struct wireless_dev *wdev = dev->ieee80211_ptr;
3266         struct mesh_config cfg;
3267         u32 mask;
3268         int err;
3269
3270         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3271                 return -EOPNOTSUPP;
3272
3273         if (!rdev->ops->update_mesh_config)
3274                 return -EOPNOTSUPP;
3275
3276         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3277         if (err)
3278                 return err;
3279
3280         wdev_lock(wdev);
3281         if (!wdev->mesh_id_len)
3282                 err = -ENOLINK;
3283
3284         if (!err)
3285                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3286                                                     mask, &cfg);
3287
3288         wdev_unlock(wdev);
3289
3290         return err;
3291 }
3292
3293 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3294 {
3295         struct sk_buff *msg;
3296         void *hdr = NULL;
3297         struct nlattr *nl_reg_rules;
3298         unsigned int i;
3299         int err = -EINVAL;
3300
3301         mutex_lock(&cfg80211_mutex);
3302
3303         if (!cfg80211_regdomain)
3304                 goto out;
3305
3306         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3307         if (!msg) {
3308                 err = -ENOBUFS;
3309                 goto out;
3310         }
3311
3312         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3313                              NL80211_CMD_GET_REG);
3314         if (!hdr)
3315                 goto put_failure;
3316
3317         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3318                 cfg80211_regdomain->alpha2);
3319
3320         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3321         if (!nl_reg_rules)
3322                 goto nla_put_failure;
3323
3324         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3325                 struct nlattr *nl_reg_rule;
3326                 const struct ieee80211_reg_rule *reg_rule;
3327                 const struct ieee80211_freq_range *freq_range;
3328                 const struct ieee80211_power_rule *power_rule;
3329
3330                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3331                 freq_range = &reg_rule->freq_range;
3332                 power_rule = &reg_rule->power_rule;
3333
3334                 nl_reg_rule = nla_nest_start(msg, i);
3335                 if (!nl_reg_rule)
3336                         goto nla_put_failure;
3337
3338                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3339                         reg_rule->flags);
3340                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3341                         freq_range->start_freq_khz);
3342                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3343                         freq_range->end_freq_khz);
3344                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3345                         freq_range->max_bandwidth_khz);
3346                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3347                         power_rule->max_antenna_gain);
3348                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3349                         power_rule->max_eirp);
3350
3351                 nla_nest_end(msg, nl_reg_rule);
3352         }
3353
3354         nla_nest_end(msg, nl_reg_rules);
3355
3356         genlmsg_end(msg, hdr);
3357         err = genlmsg_reply(msg, info);
3358         goto out;
3359
3360 nla_put_failure:
3361         genlmsg_cancel(msg, hdr);
3362 put_failure:
3363         nlmsg_free(msg);
3364         err = -EMSGSIZE;
3365 out:
3366         mutex_unlock(&cfg80211_mutex);
3367         return err;
3368 }
3369
3370 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3371 {
3372         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3373         struct nlattr *nl_reg_rule;
3374         char *alpha2 = NULL;
3375         int rem_reg_rules = 0, r = 0;
3376         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3377         struct ieee80211_regdomain *rd = NULL;
3378
3379         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3380                 return -EINVAL;
3381
3382         if (!info->attrs[NL80211_ATTR_REG_RULES])
3383                 return -EINVAL;
3384
3385         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3386
3387         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3388                         rem_reg_rules) {
3389                 num_rules++;
3390                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3391                         return -EINVAL;
3392         }
3393
3394         mutex_lock(&cfg80211_mutex);
3395
3396         if (!reg_is_valid_request(alpha2)) {
3397                 r = -EINVAL;
3398                 goto bad_reg;
3399         }
3400
3401         size_of_regd = sizeof(struct ieee80211_regdomain) +
3402                 (num_rules * sizeof(struct ieee80211_reg_rule));
3403
3404         rd = kzalloc(size_of_regd, GFP_KERNEL);
3405         if (!rd) {
3406                 r = -ENOMEM;
3407                 goto bad_reg;
3408         }
3409
3410         rd->n_reg_rules = num_rules;
3411         rd->alpha2[0] = alpha2[0];
3412         rd->alpha2[1] = alpha2[1];
3413
3414         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3415                         rem_reg_rules) {
3416                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3417                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3418                         reg_rule_policy);
3419                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3420                 if (r)
3421                         goto bad_reg;
3422
3423                 rule_idx++;
3424
3425                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3426                         r = -EINVAL;
3427                         goto bad_reg;
3428                 }
3429         }
3430
3431         BUG_ON(rule_idx != num_rules);
3432
3433         r = set_regdom(rd);
3434
3435         mutex_unlock(&cfg80211_mutex);
3436
3437         return r;
3438
3439  bad_reg:
3440         mutex_unlock(&cfg80211_mutex);
3441         kfree(rd);
3442         return r;
3443 }
3444
3445 static int validate_scan_freqs(struct nlattr *freqs)
3446 {
3447         struct nlattr *attr1, *attr2;
3448         int n_channels = 0, tmp1, tmp2;
3449
3450         nla_for_each_nested(attr1, freqs, tmp1) {
3451                 n_channels++;
3452                 /*
3453                  * Some hardware has a limited channel list for
3454                  * scanning, and it is pretty much nonsensical
3455                  * to scan for a channel twice, so disallow that
3456                  * and don't require drivers to check that the
3457                  * channel list they get isn't longer than what
3458                  * they can scan, as long as they can scan all
3459                  * the channels they registered at once.
3460                  */
3461                 nla_for_each_nested(attr2, freqs, tmp2)
3462                         if (attr1 != attr2 &&
3463                             nla_get_u32(attr1) == nla_get_u32(attr2))
3464                                 return 0;
3465         }
3466
3467         return n_channels;
3468 }
3469
3470 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3471 {
3472         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3473         struct net_device *dev = info->user_ptr[1];
3474         struct cfg80211_scan_request *request;
3475         struct nlattr *attr;
3476         struct wiphy *wiphy;
3477         int err, tmp, n_ssids = 0, n_channels, i;
3478         size_t ie_len;
3479
3480         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3481                 return -EINVAL;
3482
3483         wiphy = &rdev->wiphy;
3484
3485         if (!rdev->ops->scan)
3486                 return -EOPNOTSUPP;
3487
3488         if (rdev->scan_req)
3489                 return -EBUSY;
3490
3491         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3492                 n_channels = validate_scan_freqs(
3493                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3494                 if (!n_channels)
3495                         return -EINVAL;
3496         } else {
3497                 enum ieee80211_band band;
3498                 n_channels = 0;
3499
3500                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3501                         if (wiphy->bands[band])
3502                                 n_channels += wiphy->bands[band]->n_channels;
3503         }
3504
3505         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3506                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3507                         n_ssids++;
3508
3509         if (n_ssids > wiphy->max_scan_ssids)
3510                 return -EINVAL;
3511
3512         if (info->attrs[NL80211_ATTR_IE])
3513                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3514         else
3515                 ie_len = 0;
3516
3517         if (ie_len > wiphy->max_scan_ie_len)
3518                 return -EINVAL;
3519
3520         request = kzalloc(sizeof(*request)
3521                         + sizeof(*request->ssids) * n_ssids
3522                         + sizeof(*request->channels) * n_channels
3523                         + ie_len, GFP_KERNEL);
3524         if (!request)
3525                 return -ENOMEM;
3526
3527         if (n_ssids)
3528                 request->ssids = (void *)&request->channels[n_channels];
3529         request->n_ssids = n_ssids;
3530         if (ie_len) {
3531                 if (request->ssids)
3532                         request->ie = (void *)(request->ssids + n_ssids);
3533                 else
3534                         request->ie = (void *)(request->channels + n_channels);
3535         }
3536
3537         i = 0;
3538         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3539                 /* user specified, bail out if channel not found */
3540                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3541                         struct ieee80211_channel *chan;
3542
3543                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3544
3545                         if (!chan) {
3546                                 err = -EINVAL;
3547                                 goto out_free;
3548                         }
3549
3550                         /* ignore disabled channels */
3551                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3552                                 continue;
3553
3554                         request->channels[i] = chan;
3555                         i++;
3556                 }
3557         } else {
3558                 enum ieee80211_band band;
3559
3560                 /* all channels */
3561                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3562                         int j;
3563                         if (!wiphy->bands[band])
3564                                 continue;
3565                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3566                                 struct ieee80211_channel *chan;
3567
3568                                 chan = &wiphy->bands[band]->channels[j];
3569
3570                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3571                                         continue;
3572
3573                                 request->channels[i] = chan;
3574                                 i++;
3575                         }
3576                 }
3577         }
3578
3579         if (!i) {
3580                 err = -EINVAL;
3581                 goto out_free;
3582         }
3583
3584         request->n_channels = i;
3585
3586         i = 0;
3587         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3588                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3589                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3590                                 err = -EINVAL;
3591                                 goto out_free;
3592                         }
3593                         request->ssids[i].ssid_len = nla_len(attr);
3594                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3595                         i++;
3596                 }
3597         }
3598
3599         if (info->attrs[NL80211_ATTR_IE]) {
3600                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3601                 memcpy((void *)request->ie,
3602                        nla_data(info->attrs[NL80211_ATTR_IE]),
3603                        request->ie_len);
3604         }
3605
3606         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3607                 if (wiphy->bands[i])
3608                         request->rates[i] =
3609                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3610
3611         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3612                 nla_for_each_nested(attr,
3613                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3614                                     tmp) {
3615                         enum ieee80211_band band = nla_type(attr);
3616
3617                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3618                                 err = -EINVAL;
3619                                 goto out_free;
3620                         }
3621                         err = ieee80211_get_ratemask(wiphy->bands[band],
3622                                                      nla_data(attr),
3623                                                      nla_len(attr),
3624                                                      &request->rates[band]);
3625                         if (err)
3626                                 goto out_free;
3627                 }
3628         }
3629
3630         request->no_cck =
3631                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
3632
3633         request->dev = dev;
3634         request->wiphy = &rdev->wiphy;
3635
3636         rdev->scan_req = request;
3637         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3638
3639         if (!err) {
3640                 nl80211_send_scan_start(rdev, dev);
3641                 dev_hold(dev);
3642         } else {
3643  out_free:
3644                 rdev->scan_req = NULL;
3645                 kfree(request);
3646         }
3647
3648         return err;
3649 }
3650
3651 static int nl80211_start_sched_scan(struct sk_buff *skb,
3652                                     struct genl_info *info)
3653 {
3654         struct cfg80211_sched_scan_request *request;
3655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3656         struct net_device *dev = info->user_ptr[1];
3657         struct nlattr *attr;
3658         struct wiphy *wiphy;
3659         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
3660         u32 interval;
3661         enum ieee80211_band band;
3662         size_t ie_len;
3663         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
3664
3665         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3666             !rdev->ops->sched_scan_start)
3667                 return -EOPNOTSUPP;
3668
3669         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3670                 return -EINVAL;
3671
3672         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3673                 return -EINVAL;
3674
3675         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3676         if (interval == 0)
3677                 return -EINVAL;
3678
3679         wiphy = &rdev->wiphy;
3680
3681         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3682                 n_channels = validate_scan_freqs(
3683                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3684                 if (!n_channels)
3685                         return -EINVAL;
3686         } else {
3687                 n_channels = 0;
3688
3689                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3690                         if (wiphy->bands[band])
3691                                 n_channels += wiphy->bands[band]->n_channels;
3692         }
3693
3694         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3695                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3696                                     tmp)
3697                         n_ssids++;
3698
3699         if (n_ssids > wiphy->max_sched_scan_ssids)
3700                 return -EINVAL;
3701
3702         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
3703                 nla_for_each_nested(attr,
3704                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3705                                     tmp)
3706                         n_match_sets++;
3707
3708         if (n_match_sets > wiphy->max_match_sets)
3709                 return -EINVAL;
3710
3711         if (info->attrs[NL80211_ATTR_IE])
3712                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3713         else
3714                 ie_len = 0;
3715
3716         if (ie_len > wiphy->max_sched_scan_ie_len)
3717                 return -EINVAL;
3718
3719         mutex_lock(&rdev->sched_scan_mtx);
3720
3721         if (rdev->sched_scan_req) {
3722                 err = -EINPROGRESS;
3723                 goto out;
3724         }
3725
3726         request = kzalloc(sizeof(*request)
3727                         + sizeof(*request->ssids) * n_ssids
3728                         + sizeof(*request->match_sets) * n_match_sets
3729                         + sizeof(*request->channels) * n_channels
3730                         + ie_len, GFP_KERNEL);
3731         if (!request) {
3732                 err = -ENOMEM;
3733                 goto out;
3734         }
3735
3736         if (n_ssids)
3737                 request->ssids = (void *)&request->channels[n_channels];
3738         request->n_ssids = n_ssids;
3739         if (ie_len) {
3740                 if (request->ssids)
3741                         request->ie = (void *)(request->ssids + n_ssids);
3742                 else
3743                         request->ie = (void *)(request->channels + n_channels);
3744         }
3745
3746         if (n_match_sets) {
3747                 if (request->ie)
3748                         request->match_sets = (void *)(request->ie + ie_len);
3749                 else if (request->ssids)
3750                         request->match_sets =
3751                                 (void *)(request->ssids + n_ssids);
3752                 else
3753                         request->match_sets =
3754                                 (void *)(request->channels + n_channels);
3755         }
3756         request->n_match_sets = n_match_sets;
3757
3758         i = 0;
3759         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3760                 /* user specified, bail out if channel not found */
3761                 nla_for_each_nested(attr,
3762                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3763                                     tmp) {
3764                         struct ieee80211_channel *chan;
3765
3766                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3767
3768                         if (!chan) {
3769                                 err = -EINVAL;
3770                                 goto out_free;
3771                         }
3772
3773                         /* ignore disabled channels */
3774                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3775                                 continue;
3776
3777                         request->channels[i] = chan;
3778                         i++;
3779                 }
3780         } else {
3781                 /* all channels */
3782                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3783                         int j;
3784                         if (!wiphy->bands[band])
3785                                 continue;
3786                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3787                                 struct ieee80211_channel *chan;
3788
3789                                 chan = &wiphy->bands[band]->channels[j];
3790
3791                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3792                                         continue;
3793
3794                                 request->channels[i] = chan;
3795                                 i++;
3796                         }
3797                 }
3798         }
3799
3800         if (!i) {
3801                 err = -EINVAL;
3802                 goto out_free;
3803         }
3804
3805         request->n_channels = i;
3806
3807         i = 0;
3808         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3809                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3810                                     tmp) {
3811                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3812                                 err = -EINVAL;
3813                                 goto out_free;
3814                         }
3815                         request->ssids[i].ssid_len = nla_len(attr);
3816                         memcpy(request->ssids[i].ssid, nla_data(attr),
3817                                nla_len(attr));
3818                         i++;
3819                 }
3820         }
3821
3822         i = 0;
3823         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
3824                 nla_for_each_nested(attr,
3825                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3826                                     tmp) {
3827                         struct nlattr *ssid;
3828
3829                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
3830                                   nla_data(attr), nla_len(attr),
3831                                   nl80211_match_policy);
3832                         ssid = tb[NL80211_ATTR_SCHED_SCAN_MATCH_SSID];
3833                         if (ssid) {
3834                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
3835                                         err = -EINVAL;
3836                                         goto out_free;
3837                                 }
3838                                 memcpy(request->match_sets[i].ssid.ssid,
3839                                        nla_data(ssid), nla_len(ssid));
3840                                 request->match_sets[i].ssid.ssid_len =
3841                                         nla_len(ssid);
3842                         }
3843                         i++;
3844                 }
3845         }
3846
3847         if (info->attrs[NL80211_ATTR_IE]) {
3848                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3849                 memcpy((void *)request->ie,
3850                        nla_data(info->attrs[NL80211_ATTR_IE]),
3851                        request->ie_len);
3852         }
3853
3854         request->dev = dev;
3855         request->wiphy = &rdev->wiphy;
3856         request->interval = interval;
3857
3858         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3859         if (!err) {
3860                 rdev->sched_scan_req = request;
3861                 nl80211_send_sched_scan(rdev, dev,
3862                                         NL80211_CMD_START_SCHED_SCAN);
3863                 goto out;
3864         }
3865
3866 out_free:
3867         kfree(request);
3868 out:
3869         mutex_unlock(&rdev->sched_scan_mtx);
3870         return err;
3871 }
3872
3873 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3874                                    struct genl_info *info)
3875 {
3876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3877         int err;
3878
3879         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3880             !rdev->ops->sched_scan_stop)
3881                 return -EOPNOTSUPP;
3882
3883         mutex_lock(&rdev->sched_scan_mtx);
3884         err = __cfg80211_stop_sched_scan(rdev, false);
3885         mutex_unlock(&rdev->sched_scan_mtx);
3886
3887         return err;
3888 }
3889
3890 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3891                             u32 seq, int flags,
3892                             struct cfg80211_registered_device *rdev,
3893                             struct wireless_dev *wdev,
3894                             struct cfg80211_internal_bss *intbss)
3895 {
3896         struct cfg80211_bss *res = &intbss->pub;
3897         void *hdr;
3898         struct nlattr *bss;
3899         int i;
3900
3901         ASSERT_WDEV_LOCK(wdev);
3902
3903         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3904                              NL80211_CMD_NEW_SCAN_RESULTS);
3905         if (!hdr)
3906                 return -1;
3907
3908         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3909
3910         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3911         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3912
3913         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3914         if (!bss)
3915                 goto nla_put_failure;
3916         if (!is_zero_ether_addr(res->bssid))
3917                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3918         if (res->information_elements && res->len_information_elements)
3919                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3920                         res->len_information_elements,
3921                         res->information_elements);
3922         if (res->beacon_ies && res->len_beacon_ies &&
3923             res->beacon_ies != res->information_elements)
3924                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3925                         res->len_beacon_ies, res->beacon_ies);
3926         if (res->tsf)
3927                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3928         if (res->beacon_interval)
3929                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3930         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3931         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3932         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3933                 jiffies_to_msecs(jiffies - intbss->ts));
3934
3935         switch (rdev->wiphy.signal_type) {
3936         case CFG80211_SIGNAL_TYPE_MBM:
3937                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3938                 break;
3939         case CFG80211_SIGNAL_TYPE_UNSPEC:
3940                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3941                 break;
3942         default:
3943                 break;
3944         }
3945
3946         switch (wdev->iftype) {
3947         case NL80211_IFTYPE_P2P_CLIENT:
3948         case NL80211_IFTYPE_STATION:
3949                 if (intbss == wdev->current_bss)
3950                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3951                                     NL80211_BSS_STATUS_ASSOCIATED);
3952                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3953                         if (intbss != wdev->auth_bsses[i])
3954                                 continue;
3955                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3956                                     NL80211_BSS_STATUS_AUTHENTICATED);
3957                         break;
3958                 }
3959                 break;
3960         case NL80211_IFTYPE_ADHOC:
3961                 if (intbss == wdev->current_bss)
3962                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3963                                     NL80211_BSS_STATUS_IBSS_JOINED);
3964                 break;
3965         default:
3966                 break;
3967         }
3968
3969         nla_nest_end(msg, bss);
3970
3971         return genlmsg_end(msg, hdr);
3972
3973  nla_put_failure:
3974         genlmsg_cancel(msg, hdr);
3975         return -EMSGSIZE;
3976 }
3977
3978 static int nl80211_dump_scan(struct sk_buff *skb,
3979                              struct netlink_callback *cb)
3980 {
3981         struct cfg80211_registered_device *rdev;
3982         struct net_device *dev;
3983         struct cfg80211_internal_bss *scan;
3984         struct wireless_dev *wdev;
3985         int start = cb->args[1], idx = 0;
3986         int err;
3987
3988         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3989         if (err)
3990                 return err;
3991
3992         wdev = dev->ieee80211_ptr;
3993
3994         wdev_lock(wdev);
3995         spin_lock_bh(&rdev->bss_lock);
3996         cfg80211_bss_expire(rdev);
3997
3998         cb->seq = rdev->bss_generation;
3999
4000         list_for_each_entry(scan, &rdev->bss_list, list) {
4001                 if (++idx <= start)
4002                         continue;
4003                 if (nl80211_send_bss(skb, cb,
4004                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4005                                 rdev, wdev, scan) < 0) {
4006                         idx--;
4007                         break;
4008                 }
4009         }
4010
4011         spin_unlock_bh(&rdev->bss_lock);
4012         wdev_unlock(wdev);
4013
4014         cb->args[1] = idx;
4015         nl80211_finish_netdev_dump(rdev);
4016
4017         return skb->len;
4018 }
4019
4020 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4021                                 int flags, struct net_device *dev,
4022                                 struct survey_info *survey)
4023 {
4024         void *hdr;
4025         struct nlattr *infoattr;
4026
4027         hdr = nl80211hdr_put(msg, pid, seq, flags,
4028                              NL80211_CMD_NEW_SURVEY_RESULTS);
4029         if (!hdr)
4030                 return -ENOMEM;
4031
4032         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
4033
4034         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4035         if (!infoattr)
4036                 goto nla_put_failure;
4037
4038         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4039                     survey->channel->center_freq);
4040         if (survey->filled & SURVEY_INFO_NOISE_DBM)
4041                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
4042                             survey->noise);
4043         if (survey->filled & SURVEY_INFO_IN_USE)
4044                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
4045         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
4046                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4047                             survey->channel_time);
4048         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
4049                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4050                             survey->channel_time_busy);
4051         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
4052                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4053                             survey->channel_time_ext_busy);
4054         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
4055                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4056                             survey->channel_time_rx);
4057         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
4058                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4059                             survey->channel_time_tx);
4060
4061         nla_nest_end(msg, infoattr);
4062
4063         return genlmsg_end(msg, hdr);
4064
4065  nla_put_failure:
4066         genlmsg_cancel(msg, hdr);
4067         return -EMSGSIZE;
4068 }
4069
4070 static int nl80211_dump_survey(struct sk_buff *skb,
4071                         struct netlink_callback *cb)
4072 {
4073         struct survey_info survey;
4074         struct cfg80211_registered_device *dev;
4075         struct net_device *netdev;
4076         int survey_idx = cb->args[1];
4077         int res;
4078
4079         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4080         if (res)
4081                 return res;
4082
4083         if (!dev->ops->dump_survey) {
4084                 res = -EOPNOTSUPP;
4085                 goto out_err;
4086         }
4087
4088         while (1) {
4089                 struct ieee80211_channel *chan;
4090
4091                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4092                                             &survey);
4093                 if (res == -ENOENT)
4094                         break;
4095                 if (res)
4096                         goto out_err;
4097
4098                 /* Survey without a channel doesn't make sense */
4099                 if (!survey.channel) {
4100                         res = -EINVAL;
4101                         goto out;
4102                 }
4103
4104                 chan = ieee80211_get_channel(&dev->wiphy,
4105                                              survey.channel->center_freq);
4106                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4107                         survey_idx++;
4108                         continue;
4109                 }
4110
4111                 if (nl80211_send_survey(skb,
4112                                 NETLINK_CB(cb->skb).pid,
4113                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4114                                 netdev,
4115                                 &survey) < 0)
4116                         goto out;
4117                 survey_idx++;
4118         }
4119
4120  out:
4121         cb->args[1] = survey_idx;
4122         res = skb->len;
4123  out_err:
4124         nl80211_finish_netdev_dump(dev);
4125         return res;
4126 }
4127
4128 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4129 {
4130         return auth_type <= NL80211_AUTHTYPE_MAX;
4131 }
4132
4133 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4134 {
4135         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4136                                   NL80211_WPA_VERSION_2));
4137 }
4138
4139 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4140 {
4141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4142         struct net_device *dev = info->user_ptr[1];
4143         struct ieee80211_channel *chan;
4144         const u8 *bssid, *ssid, *ie = NULL;
4145         int err, ssid_len, ie_len = 0;
4146         enum nl80211_auth_type auth_type;
4147         struct key_parse key;
4148         bool local_state_change;
4149
4150         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4151                 return -EINVAL;
4152
4153         if (!info->attrs[NL80211_ATTR_MAC])
4154                 return -EINVAL;
4155
4156         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4157                 return -EINVAL;
4158
4159         if (!info->attrs[NL80211_ATTR_SSID])
4160                 return -EINVAL;
4161
4162         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4163                 return -EINVAL;
4164
4165         err = nl80211_parse_key(info, &key);
4166         if (err)
4167                 return err;
4168
4169         if (key.idx >= 0) {
4170                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4171                         return -EINVAL;
4172                 if (!key.p.key || !key.p.key_len)
4173                         return -EINVAL;
4174                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4175                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4176                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4177                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4178                         return -EINVAL;
4179                 if (key.idx > 4)
4180                         return -EINVAL;
4181         } else {
4182                 key.p.key_len = 0;
4183                 key.p.key = NULL;
4184         }
4185
4186         if (key.idx >= 0) {
4187                 int i;
4188                 bool ok = false;
4189                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4190                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4191                                 ok = true;
4192                                 break;
4193                         }
4194                 }
4195                 if (!ok)
4196                         return -EINVAL;
4197         }
4198
4199         if (!rdev->ops->auth)
4200                 return -EOPNOTSUPP;
4201
4202         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4203             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4204                 return -EOPNOTSUPP;
4205
4206         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4207         chan = ieee80211_get_channel(&rdev->wiphy,
4208                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4209         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4210                 return -EINVAL;
4211
4212         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4213         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4214
4215         if (info->attrs[NL80211_ATTR_IE]) {
4216                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4217                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4218         }
4219
4220         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4221         if (!nl80211_valid_auth_type(auth_type))
4222                 return -EINVAL;
4223
4224         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4225
4226         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4227                                   ssid, ssid_len, ie, ie_len,
4228                                   key.p.key, key.p.key_len, key.idx,
4229                                   local_state_change);
4230 }
4231
4232 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4233                                    struct genl_info *info,
4234                                    struct cfg80211_crypto_settings *settings,
4235                                    int cipher_limit)
4236 {
4237         memset(settings, 0, sizeof(*settings));
4238
4239         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4240
4241         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4242                 u16 proto;
4243                 proto = nla_get_u16(
4244                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4245                 settings->control_port_ethertype = cpu_to_be16(proto);
4246                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4247                     proto != ETH_P_PAE)
4248                         return -EINVAL;
4249                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4250                         settings->control_port_no_encrypt = true;
4251         } else
4252                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4253
4254         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4255                 void *data;
4256                 int len, i;
4257
4258                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4259                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4260                 settings->n_ciphers_pairwise = len / sizeof(u32);
4261
4262                 if (len % sizeof(u32))
4263                         return -EINVAL;
4264
4265                 if (settings->n_ciphers_pairwise > cipher_limit)
4266                         return -EINVAL;
4267
4268                 memcpy(settings->ciphers_pairwise, data, len);
4269
4270                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4271                         if (!cfg80211_supported_cipher_suite(
4272                                         &rdev->wiphy,
4273                                         settings->ciphers_pairwise[i]))
4274                                 return -EINVAL;
4275         }
4276
4277         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4278                 settings->cipher_group =
4279                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4280                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
4281                                                      settings->cipher_group))
4282                         return -EINVAL;
4283         }
4284
4285         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4286                 settings->wpa_versions =
4287                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4288                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4289                         return -EINVAL;
4290         }
4291
4292         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4293                 void *data;
4294                 int len;
4295
4296                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4297                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4298                 settings->n_akm_suites = len / sizeof(u32);
4299
4300                 if (len % sizeof(u32))
4301                         return -EINVAL;
4302
4303                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
4304                         return -EINVAL;
4305
4306                 memcpy(settings->akm_suites, data, len);
4307         }
4308
4309         return 0;
4310 }
4311
4312 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4313 {
4314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4315         struct net_device *dev = info->user_ptr[1];
4316         struct cfg80211_crypto_settings crypto;
4317         struct ieee80211_channel *chan;
4318         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4319         int err, ssid_len, ie_len = 0;
4320         bool use_mfp = false;
4321
4322         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4323                 return -EINVAL;
4324
4325         if (!info->attrs[NL80211_ATTR_MAC] ||
4326             !info->attrs[NL80211_ATTR_SSID] ||
4327             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4328                 return -EINVAL;
4329
4330         if (!rdev->ops->assoc)
4331                 return -EOPNOTSUPP;
4332
4333         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4334             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4335                 return -EOPNOTSUPP;
4336
4337         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4338
4339         chan = ieee80211_get_channel(&rdev->wiphy,
4340                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4341         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4342                 return -EINVAL;
4343
4344         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4345         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4346
4347         if (info->attrs[NL80211_ATTR_IE]) {
4348                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4349                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4350         }
4351
4352         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4353                 enum nl80211_mfp mfp =
4354                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4355                 if (mfp == NL80211_MFP_REQUIRED)
4356                         use_mfp = true;
4357                 else if (mfp != NL80211_MFP_NO)
4358                         return -EINVAL;
4359         }
4360
4361         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4362                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4363
4364         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4365         if (!err)
4366                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4367                                           ssid, ssid_len, ie, ie_len, use_mfp,
4368                                           &crypto);
4369
4370         return err;
4371 }
4372
4373 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4374 {
4375         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4376         struct net_device *dev = info->user_ptr[1];
4377         const u8 *ie = NULL, *bssid;
4378         int ie_len = 0;
4379         u16 reason_code;
4380         bool local_state_change;
4381
4382         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4383                 return -EINVAL;
4384
4385         if (!info->attrs[NL80211_ATTR_MAC])
4386                 return -EINVAL;
4387
4388         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4389                 return -EINVAL;
4390
4391         if (!rdev->ops->deauth)
4392                 return -EOPNOTSUPP;
4393
4394         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4395             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4396                 return -EOPNOTSUPP;
4397
4398         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4399
4400         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4401         if (reason_code == 0) {
4402                 /* Reason Code 0 is reserved */
4403                 return -EINVAL;
4404         }
4405
4406         if (info->attrs[NL80211_ATTR_IE]) {
4407                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4408                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4409         }
4410
4411         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4412
4413         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4414                                     local_state_change);
4415 }
4416
4417 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4418 {
4419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4420         struct net_device *dev = info->user_ptr[1];
4421         const u8 *ie = NULL, *bssid;
4422         int ie_len = 0;
4423         u16 reason_code;
4424         bool local_state_change;
4425
4426         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4427                 return -EINVAL;
4428
4429         if (!info->attrs[NL80211_ATTR_MAC])
4430                 return -EINVAL;
4431
4432         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4433                 return -EINVAL;
4434
4435         if (!rdev->ops->disassoc)
4436                 return -EOPNOTSUPP;
4437
4438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4439             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4440                 return -EOPNOTSUPP;
4441
4442         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4443
4444         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4445         if (reason_code == 0) {
4446                 /* Reason Code 0 is reserved */
4447                 return -EINVAL;
4448         }
4449
4450         if (info->attrs[NL80211_ATTR_IE]) {
4451                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4452                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4453         }
4454
4455         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4456
4457         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4458                                       local_state_change);
4459 }
4460
4461 static bool
4462 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4463                          int mcast_rate[IEEE80211_NUM_BANDS],
4464                          int rateval)
4465 {
4466         struct wiphy *wiphy = &rdev->wiphy;
4467         bool found = false;
4468         int band, i;
4469
4470         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4471                 struct ieee80211_supported_band *sband;
4472
4473                 sband = wiphy->bands[band];
4474                 if (!sband)
4475                         continue;
4476
4477                 for (i = 0; i < sband->n_bitrates; i++) {
4478                         if (sband->bitrates[i].bitrate == rateval) {
4479                                 mcast_rate[band] = i + 1;
4480                                 found = true;
4481                                 break;
4482                         }
4483                 }
4484         }
4485
4486         return found;
4487 }
4488
4489 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4490 {
4491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4492         struct net_device *dev = info->user_ptr[1];
4493         struct cfg80211_ibss_params ibss;
4494         struct wiphy *wiphy;
4495         struct cfg80211_cached_keys *connkeys = NULL;
4496         int err;
4497
4498         memset(&ibss, 0, sizeof(ibss));
4499
4500         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4501                 return -EINVAL;
4502
4503         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4504             !info->attrs[NL80211_ATTR_SSID] ||
4505             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4506                 return -EINVAL;
4507
4508         ibss.beacon_interval = 100;
4509
4510         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4511                 ibss.beacon_interval =
4512                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4513                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4514                         return -EINVAL;
4515         }
4516
4517         if (!rdev->ops->join_ibss)
4518                 return -EOPNOTSUPP;
4519
4520         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4521                 return -EOPNOTSUPP;
4522
4523         wiphy = &rdev->wiphy;
4524
4525         if (info->attrs[NL80211_ATTR_MAC]) {
4526                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4527
4528                 if (!is_valid_ether_addr(ibss.bssid))
4529                         return -EINVAL;
4530         }
4531         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4532         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4533
4534         if (info->attrs[NL80211_ATTR_IE]) {
4535                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4536                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4537         }
4538
4539         ibss.channel = ieee80211_get_channel(wiphy,
4540                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4541         if (!ibss.channel ||
4542             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4543             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4544                 return -EINVAL;
4545
4546         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4547         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4548
4549         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4550                 u8 *rates =
4551                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4552                 int n_rates =
4553                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4554                 struct ieee80211_supported_band *sband =
4555                         wiphy->bands[ibss.channel->band];
4556                 int err;
4557
4558                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4559                                              &ibss.basic_rates);
4560                 if (err)
4561                         return err;
4562         }
4563
4564         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4565             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4566                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4567                 return -EINVAL;
4568
4569         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4570                 connkeys = nl80211_parse_connkeys(rdev,
4571                                         info->attrs[NL80211_ATTR_KEYS]);
4572                 if (IS_ERR(connkeys))
4573                         return PTR_ERR(connkeys);
4574         }
4575
4576         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4577         if (err)
4578                 kfree(connkeys);
4579         return err;
4580 }
4581
4582 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4583 {
4584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4585         struct net_device *dev = info->user_ptr[1];
4586
4587         if (!rdev->ops->leave_ibss)
4588                 return -EOPNOTSUPP;
4589
4590         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4591                 return -EOPNOTSUPP;
4592
4593         return cfg80211_leave_ibss(rdev, dev, false);
4594 }
4595
4596 #ifdef CONFIG_NL80211_TESTMODE
4597 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4598         .name = "testmode",
4599 };
4600
4601 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4602 {
4603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4604         int err;
4605
4606         if (!info->attrs[NL80211_ATTR_TESTDATA])
4607                 return -EINVAL;
4608
4609         err = -EOPNOTSUPP;
4610         if (rdev->ops->testmode_cmd) {
4611                 rdev->testmode_info = info;
4612                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4613                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4614                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4615                 rdev->testmode_info = NULL;
4616         }
4617
4618         return err;
4619 }
4620
4621 static int nl80211_testmode_dump(struct sk_buff *skb,
4622                                  struct netlink_callback *cb)
4623 {
4624         struct cfg80211_registered_device *dev;
4625         int err;
4626         long phy_idx;
4627         void *data = NULL;
4628         int data_len = 0;
4629
4630         if (cb->args[0]) {
4631                 /*
4632                  * 0 is a valid index, but not valid for args[0],
4633                  * so we need to offset by 1.
4634                  */
4635                 phy_idx = cb->args[0] - 1;
4636         } else {
4637                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4638                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4639                                   nl80211_policy);
4640                 if (err)
4641                         return err;
4642                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4643                         return -EINVAL;
4644                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4645                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4646                         cb->args[1] =
4647                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4648         }
4649
4650         if (cb->args[1]) {
4651                 data = nla_data((void *)cb->args[1]);
4652                 data_len = nla_len((void *)cb->args[1]);
4653         }
4654
4655         mutex_lock(&cfg80211_mutex);
4656         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4657         if (!dev) {
4658                 mutex_unlock(&cfg80211_mutex);
4659                 return -ENOENT;
4660         }
4661         cfg80211_lock_rdev(dev);
4662         mutex_unlock(&cfg80211_mutex);
4663
4664         if (!dev->ops->testmode_dump) {
4665                 err = -EOPNOTSUPP;
4666                 goto out_err;
4667         }
4668
4669         while (1) {
4670                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4671                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4672                                            NL80211_CMD_TESTMODE);
4673                 struct nlattr *tmdata;
4674
4675                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4676                         genlmsg_cancel(skb, hdr);
4677                         break;
4678                 }
4679
4680                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4681                 if (!tmdata) {
4682                         genlmsg_cancel(skb, hdr);
4683                         break;
4684                 }
4685                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4686                                               data, data_len);
4687                 nla_nest_end(skb, tmdata);
4688
4689                 if (err == -ENOBUFS || err == -ENOENT) {
4690                         genlmsg_cancel(skb, hdr);
4691                         break;
4692                 } else if (err) {
4693                         genlmsg_cancel(skb, hdr);
4694                         goto out_err;
4695                 }
4696
4697                 genlmsg_end(skb, hdr);
4698         }
4699
4700         err = skb->len;
4701         /* see above */
4702         cb->args[0] = phy_idx + 1;
4703  out_err:
4704         cfg80211_unlock_rdev(dev);
4705         return err;
4706 }
4707
4708 static struct sk_buff *
4709 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4710                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4711 {
4712         struct sk_buff *skb;
4713         void *hdr;
4714         struct nlattr *data;
4715
4716         skb = nlmsg_new(approxlen + 100, gfp);
4717         if (!skb)
4718                 return NULL;
4719
4720         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4721         if (!hdr) {
4722                 kfree_skb(skb);
4723                 return NULL;
4724         }
4725
4726         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4727         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4728
4729         ((void **)skb->cb)[0] = rdev;
4730         ((void **)skb->cb)[1] = hdr;
4731         ((void **)skb->cb)[2] = data;
4732
4733         return skb;
4734
4735  nla_put_failure:
4736         kfree_skb(skb);
4737         return NULL;
4738 }
4739
4740 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4741                                                   int approxlen)
4742 {
4743         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4744
4745         if (WARN_ON(!rdev->testmode_info))
4746                 return NULL;
4747
4748         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4749                                 rdev->testmode_info->snd_pid,
4750                                 rdev->testmode_info->snd_seq,
4751                                 GFP_KERNEL);
4752 }
4753 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4754
4755 int cfg80211_testmode_reply(struct sk_buff *skb)
4756 {
4757         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4758         void *hdr = ((void **)skb->cb)[1];
4759         struct nlattr *data = ((void **)skb->cb)[2];
4760
4761         if (WARN_ON(!rdev->testmode_info)) {
4762                 kfree_skb(skb);
4763                 return -EINVAL;
4764         }
4765
4766         nla_nest_end(skb, data);
4767         genlmsg_end(skb, hdr);
4768         return genlmsg_reply(skb, rdev->testmode_info);
4769 }
4770 EXPORT_SYMBOL(cfg80211_testmode_reply);
4771
4772 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4773                                                   int approxlen, gfp_t gfp)
4774 {
4775         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4776
4777         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4778 }
4779 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4780
4781 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4782 {
4783         void *hdr = ((void **)skb->cb)[1];
4784         struct nlattr *data = ((void **)skb->cb)[2];
4785
4786         nla_nest_end(skb, data);
4787         genlmsg_end(skb, hdr);
4788         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4789 }
4790 EXPORT_SYMBOL(cfg80211_testmode_event);
4791 #endif
4792
4793 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4794 {
4795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4796         struct net_device *dev = info->user_ptr[1];
4797         struct cfg80211_connect_params connect;
4798         struct wiphy *wiphy;
4799         struct cfg80211_cached_keys *connkeys = NULL;
4800         int err;
4801
4802         memset(&connect, 0, sizeof(connect));
4803
4804         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4805                 return -EINVAL;
4806
4807         if (!info->attrs[NL80211_ATTR_SSID] ||
4808             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4809                 return -EINVAL;
4810
4811         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4812                 connect.auth_type =
4813                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4814                 if (!nl80211_valid_auth_type(connect.auth_type))
4815                         return -EINVAL;
4816         } else
4817                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4818
4819         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4820
4821         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4822                                       NL80211_MAX_NR_CIPHER_SUITES);
4823         if (err)
4824                 return err;
4825
4826         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4827             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4828                 return -EOPNOTSUPP;
4829
4830         wiphy = &rdev->wiphy;
4831
4832         if (info->attrs[NL80211_ATTR_MAC])
4833                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4834         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4835         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4836
4837         if (info->attrs[NL80211_ATTR_IE]) {
4838                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4839                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4840         }
4841
4842         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4843                 connect.channel =
4844                         ieee80211_get_channel(wiphy,
4845                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4846                 if (!connect.channel ||
4847                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4848                         return -EINVAL;
4849         }
4850
4851         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4852                 connkeys = nl80211_parse_connkeys(rdev,
4853                                         info->attrs[NL80211_ATTR_KEYS]);
4854                 if (IS_ERR(connkeys))
4855                         return PTR_ERR(connkeys);
4856         }
4857
4858         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4859         if (err)
4860                 kfree(connkeys);
4861         return err;
4862 }
4863
4864 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4865 {
4866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4867         struct net_device *dev = info->user_ptr[1];
4868         u16 reason;
4869
4870         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4871                 reason = WLAN_REASON_DEAUTH_LEAVING;
4872         else
4873                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4874
4875         if (reason == 0)
4876                 return -EINVAL;
4877
4878         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4879             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4880                 return -EOPNOTSUPP;
4881
4882         return cfg80211_disconnect(rdev, dev, reason, true);
4883 }
4884
4885 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4886 {
4887         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4888         struct net *net;
4889         int err;
4890         u32 pid;
4891
4892         if (!info->attrs[NL80211_ATTR_PID])
4893                 return -EINVAL;
4894
4895         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4896
4897         net = get_net_ns_by_pid(pid);
4898         if (IS_ERR(net))
4899                 return PTR_ERR(net);
4900
4901         err = 0;
4902
4903         /* check if anything to do */
4904         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4905                 err = cfg80211_switch_netns(rdev, net);
4906
4907         put_net(net);
4908         return err;
4909 }
4910
4911 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4912 {
4913         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4914         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4915                         struct cfg80211_pmksa *pmksa) = NULL;
4916         struct net_device *dev = info->user_ptr[1];
4917         struct cfg80211_pmksa pmksa;
4918
4919         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4920
4921         if (!info->attrs[NL80211_ATTR_MAC])
4922                 return -EINVAL;
4923
4924         if (!info->attrs[NL80211_ATTR_PMKID])
4925                 return -EINVAL;
4926
4927         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4928         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4929
4930         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4931             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4932                 return -EOPNOTSUPP;
4933
4934         switch (info->genlhdr->cmd) {
4935         case NL80211_CMD_SET_PMKSA:
4936                 rdev_ops = rdev->ops->set_pmksa;
4937                 break;
4938         case NL80211_CMD_DEL_PMKSA:
4939                 rdev_ops = rdev->ops->del_pmksa;
4940                 break;
4941         default:
4942                 WARN_ON(1);
4943                 break;
4944         }
4945
4946         if (!rdev_ops)
4947                 return -EOPNOTSUPP;
4948
4949         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4950 }
4951
4952 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4953 {
4954         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4955         struct net_device *dev = info->user_ptr[1];
4956
4957         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4958             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4959                 return -EOPNOTSUPP;
4960
4961         if (!rdev->ops->flush_pmksa)
4962                 return -EOPNOTSUPP;
4963
4964         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4965 }
4966
4967 static int nl80211_remain_on_channel(struct sk_buff *skb,
4968                                      struct genl_info *info)
4969 {
4970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4971         struct net_device *dev = info->user_ptr[1];
4972         struct ieee80211_channel *chan;
4973         struct sk_buff *msg;
4974         void *hdr;
4975         u64 cookie;
4976         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4977         u32 freq, duration;
4978         int err;
4979
4980         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4981             !info->attrs[NL80211_ATTR_DURATION])
4982                 return -EINVAL;
4983
4984         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4985
4986         /*
4987          * We should be on that channel for at least one jiffie,
4988          * and more than 5 seconds seems excessive.
4989          */
4990         if (!duration || !msecs_to_jiffies(duration) ||
4991             duration > rdev->wiphy.max_remain_on_channel_duration)
4992                 return -EINVAL;
4993
4994         if (!rdev->ops->remain_on_channel)
4995                 return -EOPNOTSUPP;
4996
4997         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4998                 channel_type = nla_get_u32(
4999                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5000                 if (channel_type != NL80211_CHAN_NO_HT &&
5001                     channel_type != NL80211_CHAN_HT20 &&
5002                     channel_type != NL80211_CHAN_HT40PLUS &&
5003                     channel_type != NL80211_CHAN_HT40MINUS)
5004                         return -EINVAL;
5005         }
5006
5007         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5008         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5009         if (chan == NULL)
5010                 return -EINVAL;
5011
5012         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5013         if (!msg)
5014                 return -ENOMEM;
5015
5016         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5017                              NL80211_CMD_REMAIN_ON_CHANNEL);
5018
5019         if (IS_ERR(hdr)) {
5020                 err = PTR_ERR(hdr);
5021                 goto free_msg;
5022         }
5023
5024         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5025                                            channel_type, duration, &cookie);
5026
5027         if (err)
5028                 goto free_msg;
5029
5030         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5031
5032         genlmsg_end(msg, hdr);
5033
5034         return genlmsg_reply(msg, info);
5035
5036  nla_put_failure:
5037         err = -ENOBUFS;
5038  free_msg:
5039         nlmsg_free(msg);
5040         return err;
5041 }
5042
5043 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5044                                             struct genl_info *info)
5045 {
5046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5047         struct net_device *dev = info->user_ptr[1];
5048         u64 cookie;
5049
5050         if (!info->attrs[NL80211_ATTR_COOKIE])
5051                 return -EINVAL;
5052
5053         if (!rdev->ops->cancel_remain_on_channel)
5054                 return -EOPNOTSUPP;
5055
5056         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5057
5058         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5059 }
5060
5061 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5062                            u8 *rates, u8 rates_len)
5063 {
5064         u8 i;
5065         u32 mask = 0;
5066
5067         for (i = 0; i < rates_len; i++) {
5068                 int rate = (rates[i] & 0x7f) * 5;
5069                 int ridx;
5070                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5071                         struct ieee80211_rate *srate =
5072                                 &sband->bitrates[ridx];
5073                         if (rate == srate->bitrate) {
5074                                 mask |= 1 << ridx;
5075                                 break;
5076                         }
5077                 }
5078                 if (ridx == sband->n_bitrates)
5079                         return 0; /* rate not found */
5080         }
5081
5082         return mask;
5083 }
5084
5085 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5086         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5087                                     .len = NL80211_MAX_SUPP_RATES },
5088 };
5089
5090 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5091                                        struct genl_info *info)
5092 {
5093         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5095         struct cfg80211_bitrate_mask mask;
5096         int rem, i;
5097         struct net_device *dev = info->user_ptr[1];
5098         struct nlattr *tx_rates;
5099         struct ieee80211_supported_band *sband;
5100
5101         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5102                 return -EINVAL;
5103
5104         if (!rdev->ops->set_bitrate_mask)
5105                 return -EOPNOTSUPP;
5106
5107         memset(&mask, 0, sizeof(mask));
5108         /* Default to all rates enabled */
5109         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5110                 sband = rdev->wiphy.bands[i];
5111                 mask.control[i].legacy =
5112                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5113         }
5114
5115         /*
5116          * The nested attribute uses enum nl80211_band as the index. This maps
5117          * directly to the enum ieee80211_band values used in cfg80211.
5118          */
5119         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5120         {
5121                 enum ieee80211_band band = nla_type(tx_rates);
5122                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5123                         return -EINVAL;
5124                 sband = rdev->wiphy.bands[band];
5125                 if (sband == NULL)
5126                         return -EINVAL;
5127                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5128                           nla_len(tx_rates), nl80211_txattr_policy);
5129                 if (tb[NL80211_TXRATE_LEGACY]) {
5130                         mask.control[band].legacy = rateset_to_mask(
5131                                 sband,
5132                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5133                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5134                         if (mask.control[band].legacy == 0)
5135                                 return -EINVAL;
5136                 }
5137         }
5138
5139         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5140 }
5141
5142 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5143 {
5144         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5145         struct net_device *dev = info->user_ptr[1];
5146         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5147
5148         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5149                 return -EINVAL;
5150
5151         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5152                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5153
5154         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5155             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5156             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5157             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5158             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5159             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5160             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5161                 return -EOPNOTSUPP;
5162
5163         /* not much point in registering if we can't reply */
5164         if (!rdev->ops->mgmt_tx)
5165                 return -EOPNOTSUPP;
5166
5167         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5168                         frame_type,
5169                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5170                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5171 }
5172
5173 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5174 {
5175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5176         struct net_device *dev = info->user_ptr[1];
5177         struct ieee80211_channel *chan;
5178         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5179         bool channel_type_valid = false;
5180         u32 freq;
5181         int err;
5182         void *hdr;
5183         u64 cookie;
5184         struct sk_buff *msg;
5185         unsigned int wait = 0;
5186         bool offchan;
5187         bool no_cck;
5188
5189         if (!info->attrs[NL80211_ATTR_FRAME] ||
5190             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5191                 return -EINVAL;
5192
5193         if (!rdev->ops->mgmt_tx)
5194                 return -EOPNOTSUPP;
5195
5196         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5197             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5198             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5199             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5200             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5201             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5202             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5203                 return -EOPNOTSUPP;
5204
5205         if (info->attrs[NL80211_ATTR_DURATION]) {
5206                 if (!rdev->ops->mgmt_tx_cancel_wait)
5207                         return -EINVAL;
5208                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5209         }
5210
5211         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5212                 channel_type = nla_get_u32(
5213                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5214                 if (channel_type != NL80211_CHAN_NO_HT &&
5215                     channel_type != NL80211_CHAN_HT20 &&
5216                     channel_type != NL80211_CHAN_HT40PLUS &&
5217                     channel_type != NL80211_CHAN_HT40MINUS)
5218                         return -EINVAL;
5219                 channel_type_valid = true;
5220         }
5221
5222         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5223
5224         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5225
5226         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5227         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5228         if (chan == NULL)
5229                 return -EINVAL;
5230
5231         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5232         if (!msg)
5233                 return -ENOMEM;
5234
5235         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5236                              NL80211_CMD_FRAME);
5237
5238         if (IS_ERR(hdr)) {
5239                 err = PTR_ERR(hdr);
5240                 goto free_msg;
5241         }
5242         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5243                                     channel_type_valid, wait,
5244                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5245                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5246                                     no_cck, &cookie);
5247         if (err)
5248                 goto free_msg;
5249
5250         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5251
5252         genlmsg_end(msg, hdr);
5253         return genlmsg_reply(msg, info);
5254
5255  nla_put_failure:
5256         err = -ENOBUFS;
5257  free_msg:
5258         nlmsg_free(msg);
5259         return err;
5260 }
5261
5262 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5263 {
5264         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5265         struct net_device *dev = info->user_ptr[1];
5266         u64 cookie;
5267
5268         if (!info->attrs[NL80211_ATTR_COOKIE])
5269                 return -EINVAL;
5270
5271         if (!rdev->ops->mgmt_tx_cancel_wait)
5272                 return -EOPNOTSUPP;
5273
5274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5275             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5276             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5277             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5278             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5279             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5280                 return -EOPNOTSUPP;
5281
5282         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5283
5284         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5285 }
5286
5287 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5288 {
5289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5290         struct wireless_dev *wdev;
5291         struct net_device *dev = info->user_ptr[1];
5292         u8 ps_state;
5293         bool state;
5294         int err;
5295
5296         if (!info->attrs[NL80211_ATTR_PS_STATE])
5297                 return -EINVAL;
5298
5299         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5300
5301         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5302                 return -EINVAL;
5303
5304         wdev = dev->ieee80211_ptr;
5305
5306         if (!rdev->ops->set_power_mgmt)
5307                 return -EOPNOTSUPP;
5308
5309         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5310
5311         if (state == wdev->ps)
5312                 return 0;
5313
5314         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5315                                         wdev->ps_timeout);
5316         if (!err)
5317                 wdev->ps = state;
5318         return err;
5319 }
5320
5321 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5322 {
5323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5324         enum nl80211_ps_state ps_state;
5325         struct wireless_dev *wdev;
5326         struct net_device *dev = info->user_ptr[1];
5327         struct sk_buff *msg;
5328         void *hdr;
5329         int err;
5330
5331         wdev = dev->ieee80211_ptr;
5332
5333         if (!rdev->ops->set_power_mgmt)
5334                 return -EOPNOTSUPP;
5335
5336         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5337         if (!msg)
5338                 return -ENOMEM;
5339
5340         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5341                              NL80211_CMD_GET_POWER_SAVE);
5342         if (!hdr) {
5343                 err = -ENOBUFS;
5344                 goto free_msg;
5345         }
5346
5347         if (wdev->ps)
5348                 ps_state = NL80211_PS_ENABLED;
5349         else
5350                 ps_state = NL80211_PS_DISABLED;
5351
5352         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5353
5354         genlmsg_end(msg, hdr);
5355         return genlmsg_reply(msg, info);
5356
5357  nla_put_failure:
5358         err = -ENOBUFS;
5359  free_msg:
5360         nlmsg_free(msg);
5361         return err;
5362 }
5363
5364 static struct nla_policy
5365 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5366         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5367         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5368         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5369 };
5370
5371 static int nl80211_set_cqm_rssi(struct genl_info *info,
5372                                 s32 threshold, u32 hysteresis)
5373 {
5374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5375         struct wireless_dev *wdev;
5376         struct net_device *dev = info->user_ptr[1];
5377
5378         if (threshold > 0)
5379                 return -EINVAL;
5380
5381         wdev = dev->ieee80211_ptr;
5382
5383         if (!rdev->ops->set_cqm_rssi_config)
5384                 return -EOPNOTSUPP;
5385
5386         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5387             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5388                 return -EOPNOTSUPP;
5389
5390         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5391                                               threshold, hysteresis);
5392 }
5393
5394 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5395 {
5396         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5397         struct nlattr *cqm;
5398         int err;
5399
5400         cqm = info->attrs[NL80211_ATTR_CQM];
5401         if (!cqm) {
5402                 err = -EINVAL;
5403                 goto out;
5404         }
5405
5406         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5407                                nl80211_attr_cqm_policy);
5408         if (err)
5409                 goto out;
5410
5411         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5412             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5413                 s32 threshold;
5414                 u32 hysteresis;
5415                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5416                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5417                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5418         } else
5419                 err = -EINVAL;
5420
5421 out:
5422         return err;
5423 }
5424
5425 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5426 {
5427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5428         struct net_device *dev = info->user_ptr[1];
5429         struct mesh_config cfg;
5430         struct mesh_setup setup;
5431         int err;
5432
5433         /* start with default */
5434         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5435         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5436
5437         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5438                 /* and parse parameters if given */
5439                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5440                 if (err)
5441                         return err;
5442         }
5443
5444         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5445             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5446                 return -EINVAL;
5447
5448         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5449         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5450
5451         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5452                 /* parse additional setup parameters if given */
5453                 err = nl80211_parse_mesh_setup(info, &setup);
5454                 if (err)
5455                         return err;
5456         }
5457
5458         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5459 }
5460
5461 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5462 {
5463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5464         struct net_device *dev = info->user_ptr[1];
5465
5466         return cfg80211_leave_mesh(rdev, dev);
5467 }
5468
5469 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5470 {
5471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5472         struct sk_buff *msg;
5473         void *hdr;
5474
5475         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5476                 return -EOPNOTSUPP;
5477
5478         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5479         if (!msg)
5480                 return -ENOMEM;
5481
5482         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5483                              NL80211_CMD_GET_WOWLAN);
5484         if (!hdr)
5485                 goto nla_put_failure;
5486
5487         if (rdev->wowlan) {
5488                 struct nlattr *nl_wowlan;
5489
5490                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5491                 if (!nl_wowlan)
5492                         goto nla_put_failure;
5493
5494                 if (rdev->wowlan->any)
5495                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5496                 if (rdev->wowlan->disconnect)
5497                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5498                 if (rdev->wowlan->magic_pkt)
5499                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5500                 if (rdev->wowlan->gtk_rekey_failure)
5501                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5502                 if (rdev->wowlan->eap_identity_req)
5503                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5504                 if (rdev->wowlan->four_way_handshake)
5505                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5506                 if (rdev->wowlan->rfkill_release)
5507                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5508                 if (rdev->wowlan->n_patterns) {
5509                         struct nlattr *nl_pats, *nl_pat;
5510                         int i, pat_len;
5511
5512                         nl_pats = nla_nest_start(msg,
5513                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5514                         if (!nl_pats)
5515                                 goto nla_put_failure;
5516
5517                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5518                                 nl_pat = nla_nest_start(msg, i + 1);
5519                                 if (!nl_pat)
5520                                         goto nla_put_failure;
5521                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5522                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5523                                         DIV_ROUND_UP(pat_len, 8),
5524                                         rdev->wowlan->patterns[i].mask);
5525                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5526                                         pat_len,
5527                                         rdev->wowlan->patterns[i].pattern);
5528                                 nla_nest_end(msg, nl_pat);
5529                         }
5530                         nla_nest_end(msg, nl_pats);
5531                 }
5532
5533                 nla_nest_end(msg, nl_wowlan);
5534         }
5535
5536         genlmsg_end(msg, hdr);
5537         return genlmsg_reply(msg, info);
5538
5539 nla_put_failure:
5540         nlmsg_free(msg);
5541         return -ENOBUFS;
5542 }
5543
5544 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5545 {
5546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5547         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5548         struct cfg80211_wowlan no_triggers = {};
5549         struct cfg80211_wowlan new_triggers = {};
5550         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5551         int err, i;
5552
5553         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5554                 return -EOPNOTSUPP;
5555
5556         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5557                 goto no_triggers;
5558
5559         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5560                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5561                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5562                         nl80211_wowlan_policy);
5563         if (err)
5564                 return err;
5565
5566         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5567                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5568                         return -EINVAL;
5569                 new_triggers.any = true;
5570         }
5571
5572         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5573                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5574                         return -EINVAL;
5575                 new_triggers.disconnect = true;
5576         }
5577
5578         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5579                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5580                         return -EINVAL;
5581                 new_triggers.magic_pkt = true;
5582         }
5583
5584         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5585                 return -EINVAL;
5586
5587         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5588                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5589                         return -EINVAL;
5590                 new_triggers.gtk_rekey_failure = true;
5591         }
5592
5593         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5594                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5595                         return -EINVAL;
5596                 new_triggers.eap_identity_req = true;
5597         }
5598
5599         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5600                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5601                         return -EINVAL;
5602                 new_triggers.four_way_handshake = true;
5603         }
5604
5605         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5606                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5607                         return -EINVAL;
5608                 new_triggers.rfkill_release = true;
5609         }
5610
5611         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5612                 struct nlattr *pat;
5613                 int n_patterns = 0;
5614                 int rem, pat_len, mask_len;
5615                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5616
5617                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5618                                     rem)
5619                         n_patterns++;
5620                 if (n_patterns > wowlan->n_patterns)
5621                         return -EINVAL;
5622
5623                 new_triggers.patterns = kcalloc(n_patterns,
5624                                                 sizeof(new_triggers.patterns[0]),
5625                                                 GFP_KERNEL);
5626                 if (!new_triggers.patterns)
5627                         return -ENOMEM;
5628
5629                 new_triggers.n_patterns = n_patterns;
5630                 i = 0;
5631
5632                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5633                                     rem) {
5634                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5635                                   nla_data(pat), nla_len(pat), NULL);
5636                         err = -EINVAL;
5637                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5638                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5639                                 goto error;
5640                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5641                         mask_len = DIV_ROUND_UP(pat_len, 8);
5642                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5643                             mask_len)
5644                                 goto error;
5645                         if (pat_len > wowlan->pattern_max_len ||
5646                             pat_len < wowlan->pattern_min_len)
5647                                 goto error;
5648
5649                         new_triggers.patterns[i].mask =
5650                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5651                         if (!new_triggers.patterns[i].mask) {
5652                                 err = -ENOMEM;
5653                                 goto error;
5654                         }
5655                         new_triggers.patterns[i].pattern =
5656                                 new_triggers.patterns[i].mask + mask_len;
5657                         memcpy(new_triggers.patterns[i].mask,
5658                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5659                                mask_len);
5660                         new_triggers.patterns[i].pattern_len = pat_len;
5661                         memcpy(new_triggers.patterns[i].pattern,
5662                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5663                                pat_len);
5664                         i++;
5665                 }
5666         }
5667
5668         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5669                 struct cfg80211_wowlan *ntrig;
5670                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5671                                 GFP_KERNEL);
5672                 if (!ntrig) {
5673                         err = -ENOMEM;
5674                         goto error;
5675                 }
5676                 cfg80211_rdev_free_wowlan(rdev);
5677                 rdev->wowlan = ntrig;
5678         } else {
5679  no_triggers:
5680                 cfg80211_rdev_free_wowlan(rdev);
5681                 rdev->wowlan = NULL;
5682         }
5683
5684         return 0;
5685  error:
5686         for (i = 0; i < new_triggers.n_patterns; i++)
5687                 kfree(new_triggers.patterns[i].mask);
5688         kfree(new_triggers.patterns);
5689         return err;
5690 }
5691
5692 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5693 {
5694         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5695         struct net_device *dev = info->user_ptr[1];
5696         struct wireless_dev *wdev = dev->ieee80211_ptr;
5697         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5698         struct cfg80211_gtk_rekey_data rekey_data;
5699         int err;
5700
5701         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5702                 return -EINVAL;
5703
5704         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5705                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5706                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5707                         nl80211_rekey_policy);
5708         if (err)
5709                 return err;
5710
5711         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5712                 return -ERANGE;
5713         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5714                 return -ERANGE;
5715         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5716                 return -ERANGE;
5717
5718         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5719                NL80211_KEK_LEN);
5720         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5721                NL80211_KCK_LEN);
5722         memcpy(rekey_data.replay_ctr,
5723                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5724                NL80211_REPLAY_CTR_LEN);
5725
5726         wdev_lock(wdev);
5727         if (!wdev->current_bss) {
5728                 err = -ENOTCONN;
5729                 goto out;
5730         }
5731
5732         if (!rdev->ops->set_rekey_data) {
5733                 err = -EOPNOTSUPP;
5734                 goto out;
5735         }
5736
5737         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5738  out:
5739         wdev_unlock(wdev);
5740         return err;
5741 }
5742
5743 #define NL80211_FLAG_NEED_WIPHY         0x01
5744 #define NL80211_FLAG_NEED_NETDEV        0x02
5745 #define NL80211_FLAG_NEED_RTNL          0x04
5746 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5747 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5748                                          NL80211_FLAG_CHECK_NETDEV_UP)
5749
5750 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5751                             struct genl_info *info)
5752 {
5753         struct cfg80211_registered_device *rdev;
5754         struct net_device *dev;
5755         int err;
5756         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5757
5758         if (rtnl)
5759                 rtnl_lock();
5760
5761         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5762                 rdev = cfg80211_get_dev_from_info(info);
5763                 if (IS_ERR(rdev)) {
5764                         if (rtnl)
5765                                 rtnl_unlock();
5766                         return PTR_ERR(rdev);
5767                 }
5768                 info->user_ptr[0] = rdev;
5769         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5770                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5771                 if (err) {
5772                         if (rtnl)
5773                                 rtnl_unlock();
5774                         return err;
5775                 }
5776                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5777                     !netif_running(dev)) {
5778                         cfg80211_unlock_rdev(rdev);
5779                         dev_put(dev);
5780                         if (rtnl)
5781                                 rtnl_unlock();
5782                         return -ENETDOWN;
5783                 }
5784                 info->user_ptr[0] = rdev;
5785                 info->user_ptr[1] = dev;
5786         }
5787
5788         return 0;
5789 }
5790
5791 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5792                               struct genl_info *info)
5793 {
5794         if (info->user_ptr[0])
5795                 cfg80211_unlock_rdev(info->user_ptr[0]);
5796         if (info->user_ptr[1])
5797                 dev_put(info->user_ptr[1]);
5798         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5799                 rtnl_unlock();
5800 }
5801
5802 static struct genl_ops nl80211_ops[] = {
5803         {
5804                 .cmd = NL80211_CMD_GET_WIPHY,
5805                 .doit = nl80211_get_wiphy,
5806                 .dumpit = nl80211_dump_wiphy,
5807                 .policy = nl80211_policy,
5808                 /* can be retrieved by unprivileged users */
5809                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5810         },
5811         {
5812                 .cmd = NL80211_CMD_SET_WIPHY,
5813                 .doit = nl80211_set_wiphy,
5814                 .policy = nl80211_policy,
5815                 .flags = GENL_ADMIN_PERM,
5816                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5817         },
5818         {
5819                 .cmd = NL80211_CMD_GET_INTERFACE,
5820                 .doit = nl80211_get_interface,
5821                 .dumpit = nl80211_dump_interface,
5822                 .policy = nl80211_policy,
5823                 /* can be retrieved by unprivileged users */
5824                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5825         },
5826         {
5827                 .cmd = NL80211_CMD_SET_INTERFACE,
5828                 .doit = nl80211_set_interface,
5829                 .policy = nl80211_policy,
5830                 .flags = GENL_ADMIN_PERM,
5831                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5832                                   NL80211_FLAG_NEED_RTNL,
5833         },
5834         {
5835                 .cmd = NL80211_CMD_NEW_INTERFACE,
5836                 .doit = nl80211_new_interface,
5837                 .policy = nl80211_policy,
5838                 .flags = GENL_ADMIN_PERM,
5839                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5840                                   NL80211_FLAG_NEED_RTNL,
5841         },
5842         {
5843                 .cmd = NL80211_CMD_DEL_INTERFACE,
5844                 .doit = nl80211_del_interface,
5845                 .policy = nl80211_policy,
5846                 .flags = GENL_ADMIN_PERM,
5847                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5848                                   NL80211_FLAG_NEED_RTNL,
5849         },
5850         {
5851                 .cmd = NL80211_CMD_GET_KEY,
5852                 .doit = nl80211_get_key,
5853                 .policy = nl80211_policy,
5854                 .flags = GENL_ADMIN_PERM,
5855                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5856                                   NL80211_FLAG_NEED_RTNL,
5857         },
5858         {
5859                 .cmd = NL80211_CMD_SET_KEY,
5860                 .doit = nl80211_set_key,
5861                 .policy = nl80211_policy,
5862                 .flags = GENL_ADMIN_PERM,
5863                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5864                                   NL80211_FLAG_NEED_RTNL,
5865         },
5866         {
5867                 .cmd = NL80211_CMD_NEW_KEY,
5868                 .doit = nl80211_new_key,
5869                 .policy = nl80211_policy,
5870                 .flags = GENL_ADMIN_PERM,
5871                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5872                                   NL80211_FLAG_NEED_RTNL,
5873         },
5874         {
5875                 .cmd = NL80211_CMD_DEL_KEY,
5876                 .doit = nl80211_del_key,
5877                 .policy = nl80211_policy,
5878                 .flags = GENL_ADMIN_PERM,
5879                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5880                                   NL80211_FLAG_NEED_RTNL,
5881         },
5882         {
5883                 .cmd = NL80211_CMD_SET_BEACON,
5884                 .policy = nl80211_policy,
5885                 .flags = GENL_ADMIN_PERM,
5886                 .doit = nl80211_addset_beacon,
5887                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5888                                   NL80211_FLAG_NEED_RTNL,
5889         },
5890         {
5891                 .cmd = NL80211_CMD_NEW_BEACON,
5892                 .policy = nl80211_policy,
5893                 .flags = GENL_ADMIN_PERM,
5894                 .doit = nl80211_addset_beacon,
5895                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5896                                   NL80211_FLAG_NEED_RTNL,
5897         },
5898         {
5899                 .cmd = NL80211_CMD_DEL_BEACON,
5900                 .policy = nl80211_policy,
5901                 .flags = GENL_ADMIN_PERM,
5902                 .doit = nl80211_del_beacon,
5903                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5904                                   NL80211_FLAG_NEED_RTNL,
5905         },
5906         {
5907                 .cmd = NL80211_CMD_GET_STATION,
5908                 .doit = nl80211_get_station,
5909                 .dumpit = nl80211_dump_station,
5910                 .policy = nl80211_policy,
5911                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5912                                   NL80211_FLAG_NEED_RTNL,
5913         },
5914         {
5915                 .cmd = NL80211_CMD_SET_STATION,
5916                 .doit = nl80211_set_station,
5917                 .policy = nl80211_policy,
5918                 .flags = GENL_ADMIN_PERM,
5919                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5920                                   NL80211_FLAG_NEED_RTNL,
5921         },
5922         {
5923                 .cmd = NL80211_CMD_NEW_STATION,
5924                 .doit = nl80211_new_station,
5925                 .policy = nl80211_policy,
5926                 .flags = GENL_ADMIN_PERM,
5927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5928                                   NL80211_FLAG_NEED_RTNL,
5929         },
5930         {
5931                 .cmd = NL80211_CMD_DEL_STATION,
5932                 .doit = nl80211_del_station,
5933                 .policy = nl80211_policy,
5934                 .flags = GENL_ADMIN_PERM,
5935                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5936                                   NL80211_FLAG_NEED_RTNL,
5937         },
5938         {
5939                 .cmd = NL80211_CMD_GET_MPATH,
5940                 .doit = nl80211_get_mpath,
5941                 .dumpit = nl80211_dump_mpath,
5942                 .policy = nl80211_policy,
5943                 .flags = GENL_ADMIN_PERM,
5944                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5945                                   NL80211_FLAG_NEED_RTNL,
5946         },
5947         {
5948                 .cmd = NL80211_CMD_SET_MPATH,
5949                 .doit = nl80211_set_mpath,
5950                 .policy = nl80211_policy,
5951                 .flags = GENL_ADMIN_PERM,
5952                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5953                                   NL80211_FLAG_NEED_RTNL,
5954         },
5955         {
5956                 .cmd = NL80211_CMD_NEW_MPATH,
5957                 .doit = nl80211_new_mpath,
5958                 .policy = nl80211_policy,
5959                 .flags = GENL_ADMIN_PERM,
5960                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5961                                   NL80211_FLAG_NEED_RTNL,
5962         },
5963         {
5964                 .cmd = NL80211_CMD_DEL_MPATH,
5965                 .doit = nl80211_del_mpath,
5966                 .policy = nl80211_policy,
5967                 .flags = GENL_ADMIN_PERM,
5968                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5969                                   NL80211_FLAG_NEED_RTNL,
5970         },
5971         {
5972                 .cmd = NL80211_CMD_SET_BSS,
5973                 .doit = nl80211_set_bss,
5974                 .policy = nl80211_policy,
5975                 .flags = GENL_ADMIN_PERM,
5976                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5977                                   NL80211_FLAG_NEED_RTNL,
5978         },
5979         {
5980                 .cmd = NL80211_CMD_GET_REG,
5981                 .doit = nl80211_get_reg,
5982                 .policy = nl80211_policy,
5983                 /* can be retrieved by unprivileged users */
5984         },
5985         {
5986                 .cmd = NL80211_CMD_SET_REG,
5987                 .doit = nl80211_set_reg,
5988                 .policy = nl80211_policy,
5989                 .flags = GENL_ADMIN_PERM,
5990         },
5991         {
5992                 .cmd = NL80211_CMD_REQ_SET_REG,
5993                 .doit = nl80211_req_set_reg,
5994                 .policy = nl80211_policy,
5995                 .flags = GENL_ADMIN_PERM,
5996         },
5997         {
5998                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5999                 .doit = nl80211_get_mesh_config,
6000                 .policy = nl80211_policy,
6001                 /* can be retrieved by unprivileged users */
6002                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6003                                   NL80211_FLAG_NEED_RTNL,
6004         },
6005         {
6006                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
6007                 .doit = nl80211_update_mesh_config,
6008                 .policy = nl80211_policy,
6009                 .flags = GENL_ADMIN_PERM,
6010                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6011                                   NL80211_FLAG_NEED_RTNL,
6012         },
6013         {
6014                 .cmd = NL80211_CMD_TRIGGER_SCAN,
6015                 .doit = nl80211_trigger_scan,
6016                 .policy = nl80211_policy,
6017                 .flags = GENL_ADMIN_PERM,
6018                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6019                                   NL80211_FLAG_NEED_RTNL,
6020         },
6021         {
6022                 .cmd = NL80211_CMD_GET_SCAN,
6023                 .policy = nl80211_policy,
6024                 .dumpit = nl80211_dump_scan,
6025         },
6026         {
6027                 .cmd = NL80211_CMD_START_SCHED_SCAN,
6028                 .doit = nl80211_start_sched_scan,
6029                 .policy = nl80211_policy,
6030                 .flags = GENL_ADMIN_PERM,
6031                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6032                                   NL80211_FLAG_NEED_RTNL,
6033         },
6034         {
6035                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
6036                 .doit = nl80211_stop_sched_scan,
6037                 .policy = nl80211_policy,
6038                 .flags = GENL_ADMIN_PERM,
6039                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6040                                   NL80211_FLAG_NEED_RTNL,
6041         },
6042         {
6043                 .cmd = NL80211_CMD_AUTHENTICATE,
6044                 .doit = nl80211_authenticate,
6045                 .policy = nl80211_policy,
6046                 .flags = GENL_ADMIN_PERM,
6047                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6048                                   NL80211_FLAG_NEED_RTNL,
6049         },
6050         {
6051                 .cmd = NL80211_CMD_ASSOCIATE,
6052                 .doit = nl80211_associate,
6053                 .policy = nl80211_policy,
6054                 .flags = GENL_ADMIN_PERM,
6055                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6056                                   NL80211_FLAG_NEED_RTNL,
6057         },
6058         {
6059                 .cmd = NL80211_CMD_DEAUTHENTICATE,
6060                 .doit = nl80211_deauthenticate,
6061                 .policy = nl80211_policy,
6062                 .flags = GENL_ADMIN_PERM,
6063                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6064                                   NL80211_FLAG_NEED_RTNL,
6065         },
6066         {
6067                 .cmd = NL80211_CMD_DISASSOCIATE,
6068                 .doit = nl80211_disassociate,
6069                 .policy = nl80211_policy,
6070                 .flags = GENL_ADMIN_PERM,
6071                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6072                                   NL80211_FLAG_NEED_RTNL,
6073         },
6074         {
6075                 .cmd = NL80211_CMD_JOIN_IBSS,
6076                 .doit = nl80211_join_ibss,
6077                 .policy = nl80211_policy,
6078                 .flags = GENL_ADMIN_PERM,
6079                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6080                                   NL80211_FLAG_NEED_RTNL,
6081         },
6082         {
6083                 .cmd = NL80211_CMD_LEAVE_IBSS,
6084                 .doit = nl80211_leave_ibss,
6085                 .policy = nl80211_policy,
6086                 .flags = GENL_ADMIN_PERM,
6087                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6088                                   NL80211_FLAG_NEED_RTNL,
6089         },
6090 #ifdef CONFIG_NL80211_TESTMODE
6091         {
6092                 .cmd = NL80211_CMD_TESTMODE,
6093                 .doit = nl80211_testmode_do,
6094                 .dumpit = nl80211_testmode_dump,
6095                 .policy = nl80211_policy,
6096                 .flags = GENL_ADMIN_PERM,
6097                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6098                                   NL80211_FLAG_NEED_RTNL,
6099         },
6100 #endif
6101         {
6102                 .cmd = NL80211_CMD_CONNECT,
6103                 .doit = nl80211_connect,
6104                 .policy = nl80211_policy,
6105                 .flags = GENL_ADMIN_PERM,
6106                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6107                                   NL80211_FLAG_NEED_RTNL,
6108         },
6109         {
6110                 .cmd = NL80211_CMD_DISCONNECT,
6111                 .doit = nl80211_disconnect,
6112                 .policy = nl80211_policy,
6113                 .flags = GENL_ADMIN_PERM,
6114                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6115                                   NL80211_FLAG_NEED_RTNL,
6116         },
6117         {
6118                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6119                 .doit = nl80211_wiphy_netns,
6120                 .policy = nl80211_policy,
6121                 .flags = GENL_ADMIN_PERM,
6122                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6123                                   NL80211_FLAG_NEED_RTNL,
6124         },
6125         {
6126                 .cmd = NL80211_CMD_GET_SURVEY,
6127                 .policy = nl80211_policy,
6128                 .dumpit = nl80211_dump_survey,
6129         },
6130         {
6131                 .cmd = NL80211_CMD_SET_PMKSA,
6132                 .doit = nl80211_setdel_pmksa,
6133                 .policy = nl80211_policy,
6134                 .flags = GENL_ADMIN_PERM,
6135                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6136                                   NL80211_FLAG_NEED_RTNL,
6137         },
6138         {
6139                 .cmd = NL80211_CMD_DEL_PMKSA,
6140                 .doit = nl80211_setdel_pmksa,
6141                 .policy = nl80211_policy,
6142                 .flags = GENL_ADMIN_PERM,
6143                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6144                                   NL80211_FLAG_NEED_RTNL,
6145         },
6146         {
6147                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6148                 .doit = nl80211_flush_pmksa,
6149                 .policy = nl80211_policy,
6150                 .flags = GENL_ADMIN_PERM,
6151                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6152                                   NL80211_FLAG_NEED_RTNL,
6153         },
6154         {
6155                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6156                 .doit = nl80211_remain_on_channel,
6157                 .policy = nl80211_policy,
6158                 .flags = GENL_ADMIN_PERM,
6159                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6160                                   NL80211_FLAG_NEED_RTNL,
6161         },
6162         {
6163                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6164                 .doit = nl80211_cancel_remain_on_channel,
6165                 .policy = nl80211_policy,
6166                 .flags = GENL_ADMIN_PERM,
6167                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6168                                   NL80211_FLAG_NEED_RTNL,
6169         },
6170         {
6171                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6172                 .doit = nl80211_set_tx_bitrate_mask,
6173                 .policy = nl80211_policy,
6174                 .flags = GENL_ADMIN_PERM,
6175                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6176                                   NL80211_FLAG_NEED_RTNL,
6177         },
6178         {
6179                 .cmd = NL80211_CMD_REGISTER_FRAME,
6180                 .doit = nl80211_register_mgmt,
6181                 .policy = nl80211_policy,
6182                 .flags = GENL_ADMIN_PERM,
6183                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6184                                   NL80211_FLAG_NEED_RTNL,
6185         },
6186         {
6187                 .cmd = NL80211_CMD_FRAME,
6188                 .doit = nl80211_tx_mgmt,
6189                 .policy = nl80211_policy,
6190                 .flags = GENL_ADMIN_PERM,
6191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6192                                   NL80211_FLAG_NEED_RTNL,
6193         },
6194         {
6195                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6196                 .doit = nl80211_tx_mgmt_cancel_wait,
6197                 .policy = nl80211_policy,
6198                 .flags = GENL_ADMIN_PERM,
6199                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6200                                   NL80211_FLAG_NEED_RTNL,
6201         },
6202         {
6203                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6204                 .doit = nl80211_set_power_save,
6205                 .policy = nl80211_policy,
6206                 .flags = GENL_ADMIN_PERM,
6207                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6208                                   NL80211_FLAG_NEED_RTNL,
6209         },
6210         {
6211                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6212                 .doit = nl80211_get_power_save,
6213                 .policy = nl80211_policy,
6214                 /* can be retrieved by unprivileged users */
6215                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6216                                   NL80211_FLAG_NEED_RTNL,
6217         },
6218         {
6219                 .cmd = NL80211_CMD_SET_CQM,
6220                 .doit = nl80211_set_cqm,
6221                 .policy = nl80211_policy,
6222                 .flags = GENL_ADMIN_PERM,
6223                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6224                                   NL80211_FLAG_NEED_RTNL,
6225         },
6226         {
6227                 .cmd = NL80211_CMD_SET_CHANNEL,
6228                 .doit = nl80211_set_channel,
6229                 .policy = nl80211_policy,
6230                 .flags = GENL_ADMIN_PERM,
6231                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6232                                   NL80211_FLAG_NEED_RTNL,
6233         },
6234         {
6235                 .cmd = NL80211_CMD_SET_WDS_PEER,
6236                 .doit = nl80211_set_wds_peer,
6237                 .policy = nl80211_policy,
6238                 .flags = GENL_ADMIN_PERM,
6239                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6240                                   NL80211_FLAG_NEED_RTNL,
6241         },
6242         {
6243                 .cmd = NL80211_CMD_JOIN_MESH,
6244                 .doit = nl80211_join_mesh,
6245                 .policy = nl80211_policy,
6246                 .flags = GENL_ADMIN_PERM,
6247                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6248                                   NL80211_FLAG_NEED_RTNL,
6249         },
6250         {
6251                 .cmd = NL80211_CMD_LEAVE_MESH,
6252                 .doit = nl80211_leave_mesh,
6253                 .policy = nl80211_policy,
6254                 .flags = GENL_ADMIN_PERM,
6255                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6256                                   NL80211_FLAG_NEED_RTNL,
6257         },
6258         {
6259                 .cmd = NL80211_CMD_GET_WOWLAN,
6260                 .doit = nl80211_get_wowlan,
6261                 .policy = nl80211_policy,
6262                 /* can be retrieved by unprivileged users */
6263                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6264                                   NL80211_FLAG_NEED_RTNL,
6265         },
6266         {
6267                 .cmd = NL80211_CMD_SET_WOWLAN,
6268                 .doit = nl80211_set_wowlan,
6269                 .policy = nl80211_policy,
6270                 .flags = GENL_ADMIN_PERM,
6271                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6272                                   NL80211_FLAG_NEED_RTNL,
6273         },
6274         {
6275                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6276                 .doit = nl80211_set_rekey_data,
6277                 .policy = nl80211_policy,
6278                 .flags = GENL_ADMIN_PERM,
6279                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6280                                   NL80211_FLAG_NEED_RTNL,
6281         },
6282 };
6283
6284 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6285         .name = "mlme",
6286 };
6287
6288 /* multicast groups */
6289 static struct genl_multicast_group nl80211_config_mcgrp = {
6290         .name = "config",
6291 };
6292 static struct genl_multicast_group nl80211_scan_mcgrp = {
6293         .name = "scan",
6294 };
6295 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6296         .name = "regulatory",
6297 };
6298
6299 /* notification functions */
6300
6301 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6302 {
6303         struct sk_buff *msg;
6304
6305         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6306         if (!msg)
6307                 return;
6308
6309         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6310                 nlmsg_free(msg);
6311                 return;
6312         }
6313
6314         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6315                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6316 }
6317
6318 static int nl80211_add_scan_req(struct sk_buff *msg,
6319                                 struct cfg80211_registered_device *rdev)
6320 {
6321         struct cfg80211_scan_request *req = rdev->scan_req;
6322         struct nlattr *nest;
6323         int i;
6324
6325         ASSERT_RDEV_LOCK(rdev);
6326
6327         if (WARN_ON(!req))
6328                 return 0;
6329
6330         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6331         if (!nest)
6332                 goto nla_put_failure;
6333         for (i = 0; i < req->n_ssids; i++)
6334                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6335         nla_nest_end(msg, nest);
6336
6337         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6338         if (!nest)
6339                 goto nla_put_failure;
6340         for (i = 0; i < req->n_channels; i++)
6341                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6342         nla_nest_end(msg, nest);
6343
6344         if (req->ie)
6345                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6346
6347         return 0;
6348  nla_put_failure:
6349         return -ENOBUFS;
6350 }
6351
6352 static int nl80211_send_scan_msg(struct sk_buff *msg,
6353                                  struct cfg80211_registered_device *rdev,
6354                                  struct net_device *netdev,
6355                                  u32 pid, u32 seq, int flags,
6356                                  u32 cmd)
6357 {
6358         void *hdr;
6359
6360         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6361         if (!hdr)
6362                 return -1;
6363
6364         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6365         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6366
6367         /* ignore errors and send incomplete event anyway */
6368         nl80211_add_scan_req(msg, rdev);
6369
6370         return genlmsg_end(msg, hdr);
6371
6372  nla_put_failure:
6373         genlmsg_cancel(msg, hdr);
6374         return -EMSGSIZE;
6375 }
6376
6377 static int
6378 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6379                             struct cfg80211_registered_device *rdev,
6380                             struct net_device *netdev,
6381                             u32 pid, u32 seq, int flags, u32 cmd)
6382 {
6383         void *hdr;
6384
6385         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6386         if (!hdr)
6387                 return -1;
6388
6389         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6390         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6391
6392         return genlmsg_end(msg, hdr);
6393
6394  nla_put_failure:
6395         genlmsg_cancel(msg, hdr);
6396         return -EMSGSIZE;
6397 }
6398
6399 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6400                              struct net_device *netdev)
6401 {
6402         struct sk_buff *msg;
6403
6404         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6405         if (!msg)
6406                 return;
6407
6408         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6409                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6410                 nlmsg_free(msg);
6411                 return;
6412         }
6413
6414         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6415                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6416 }
6417
6418 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6419                             struct net_device *netdev)
6420 {
6421         struct sk_buff *msg;
6422
6423         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6424         if (!msg)
6425                 return;
6426
6427         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6428                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6429                 nlmsg_free(msg);
6430                 return;
6431         }
6432
6433         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6434                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6435 }
6436
6437 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6438                                struct net_device *netdev)
6439 {
6440         struct sk_buff *msg;
6441
6442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6443         if (!msg)
6444                 return;
6445
6446         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6447                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6448                 nlmsg_free(msg);
6449                 return;
6450         }
6451
6452         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6453                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6454 }
6455
6456 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6457                                      struct net_device *netdev)
6458 {
6459         struct sk_buff *msg;
6460
6461         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6462         if (!msg)
6463                 return;
6464
6465         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6466                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6467                 nlmsg_free(msg);
6468                 return;
6469         }
6470
6471         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6472                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6473 }
6474
6475 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6476                              struct net_device *netdev, u32 cmd)
6477 {
6478         struct sk_buff *msg;
6479
6480         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6481         if (!msg)
6482                 return;
6483
6484         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6485                 nlmsg_free(msg);
6486                 return;
6487         }
6488
6489         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6490                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6491 }
6492
6493 /*
6494  * This can happen on global regulatory changes or device specific settings
6495  * based on custom world regulatory domains.
6496  */
6497 void nl80211_send_reg_change_event(struct regulatory_request *request)
6498 {
6499         struct sk_buff *msg;
6500         void *hdr;
6501
6502         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6503         if (!msg)
6504                 return;
6505
6506         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6507         if (!hdr) {
6508                 nlmsg_free(msg);
6509                 return;
6510         }
6511
6512         /* Userspace can always count this one always being set */
6513         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6514
6515         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6516                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6517                            NL80211_REGDOM_TYPE_WORLD);
6518         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6519                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6520                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6521         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6522                  request->intersect)
6523                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6524                            NL80211_REGDOM_TYPE_INTERSECTION);
6525         else {
6526                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6527                            NL80211_REGDOM_TYPE_COUNTRY);
6528                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6529         }
6530
6531         if (wiphy_idx_valid(request->wiphy_idx))
6532                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6533
6534         if (genlmsg_end(msg, hdr) < 0) {
6535                 nlmsg_free(msg);
6536                 return;
6537         }
6538
6539         rcu_read_lock();
6540         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6541                                 GFP_ATOMIC);
6542         rcu_read_unlock();
6543
6544         return;
6545
6546 nla_put_failure:
6547         genlmsg_cancel(msg, hdr);
6548         nlmsg_free(msg);
6549 }
6550
6551 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6552                                     struct net_device *netdev,
6553                                     const u8 *buf, size_t len,
6554                                     enum nl80211_commands cmd, gfp_t gfp)
6555 {
6556         struct sk_buff *msg;
6557         void *hdr;
6558
6559         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6560         if (!msg)
6561                 return;
6562
6563         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6564         if (!hdr) {
6565                 nlmsg_free(msg);
6566                 return;
6567         }
6568
6569         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6570         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6571         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6572
6573         if (genlmsg_end(msg, hdr) < 0) {
6574                 nlmsg_free(msg);
6575                 return;
6576         }
6577
6578         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6579                                 nl80211_mlme_mcgrp.id, gfp);
6580         return;
6581
6582  nla_put_failure:
6583         genlmsg_cancel(msg, hdr);
6584         nlmsg_free(msg);
6585 }
6586
6587 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6588                           struct net_device *netdev, const u8 *buf,
6589                           size_t len, gfp_t gfp)
6590 {
6591         nl80211_send_mlme_event(rdev, netdev, buf, len,
6592                                 NL80211_CMD_AUTHENTICATE, gfp);
6593 }
6594
6595 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6596                            struct net_device *netdev, const u8 *buf,
6597                            size_t len, gfp_t gfp)
6598 {
6599         nl80211_send_mlme_event(rdev, netdev, buf, len,
6600                                 NL80211_CMD_ASSOCIATE, gfp);
6601 }
6602
6603 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6604                          struct net_device *netdev, const u8 *buf,
6605                          size_t len, gfp_t gfp)
6606 {
6607         nl80211_send_mlme_event(rdev, netdev, buf, len,
6608                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6609 }
6610
6611 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6612                            struct net_device *netdev, const u8 *buf,
6613                            size_t len, gfp_t gfp)
6614 {
6615         nl80211_send_mlme_event(rdev, netdev, buf, len,
6616                                 NL80211_CMD_DISASSOCIATE, gfp);
6617 }
6618
6619 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6620                                 struct net_device *netdev, const u8 *buf,
6621                                 size_t len, gfp_t gfp)
6622 {
6623         nl80211_send_mlme_event(rdev, netdev, buf, len,
6624                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6625 }
6626
6627 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6628                                   struct net_device *netdev, const u8 *buf,
6629                                   size_t len, gfp_t gfp)
6630 {
6631         nl80211_send_mlme_event(rdev, netdev, buf, len,
6632                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6633 }
6634
6635 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6636                                       struct net_device *netdev, int cmd,
6637                                       const u8 *addr, gfp_t gfp)
6638 {
6639         struct sk_buff *msg;
6640         void *hdr;
6641
6642         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6643         if (!msg)
6644                 return;
6645
6646         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6647         if (!hdr) {
6648                 nlmsg_free(msg);
6649                 return;
6650         }
6651
6652         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6653         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6654         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6655         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6656
6657         if (genlmsg_end(msg, hdr) < 0) {
6658                 nlmsg_free(msg);
6659                 return;
6660         }
6661
6662         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6663                                 nl80211_mlme_mcgrp.id, gfp);
6664         return;
6665
6666  nla_put_failure:
6667         genlmsg_cancel(msg, hdr);
6668         nlmsg_free(msg);
6669 }
6670
6671 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6672                                struct net_device *netdev, const u8 *addr,
6673                                gfp_t gfp)
6674 {
6675         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6676                                   addr, gfp);
6677 }
6678
6679 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6680                                 struct net_device *netdev, const u8 *addr,
6681                                 gfp_t gfp)
6682 {
6683         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6684                                   addr, gfp);
6685 }
6686
6687 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6688                                  struct net_device *netdev, const u8 *bssid,
6689                                  const u8 *req_ie, size_t req_ie_len,
6690                                  const u8 *resp_ie, size_t resp_ie_len,
6691                                  u16 status, gfp_t gfp)
6692 {
6693         struct sk_buff *msg;
6694         void *hdr;
6695
6696         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6697         if (!msg)
6698                 return;
6699
6700         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6701         if (!hdr) {
6702                 nlmsg_free(msg);
6703                 return;
6704         }
6705
6706         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6707         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6708         if (bssid)
6709                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6710         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6711         if (req_ie)
6712                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6713         if (resp_ie)
6714                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6715
6716         if (genlmsg_end(msg, hdr) < 0) {
6717                 nlmsg_free(msg);
6718                 return;
6719         }
6720
6721         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6722                                 nl80211_mlme_mcgrp.id, gfp);
6723         return;
6724
6725  nla_put_failure:
6726         genlmsg_cancel(msg, hdr);
6727         nlmsg_free(msg);
6728
6729 }
6730
6731 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6732                          struct net_device *netdev, const u8 *bssid,
6733                          const u8 *req_ie, size_t req_ie_len,
6734                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6735 {
6736         struct sk_buff *msg;
6737         void *hdr;
6738
6739         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6740         if (!msg)
6741                 return;
6742
6743         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6744         if (!hdr) {
6745                 nlmsg_free(msg);
6746                 return;
6747         }
6748
6749         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6750         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6751         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6752         if (req_ie)
6753                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6754         if (resp_ie)
6755                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6756
6757         if (genlmsg_end(msg, hdr) < 0) {
6758                 nlmsg_free(msg);
6759                 return;
6760         }
6761
6762         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6763                                 nl80211_mlme_mcgrp.id, gfp);
6764         return;
6765
6766  nla_put_failure:
6767         genlmsg_cancel(msg, hdr);
6768         nlmsg_free(msg);
6769
6770 }
6771
6772 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6773                                struct net_device *netdev, u16 reason,
6774                                const u8 *ie, size_t ie_len, bool from_ap)
6775 {
6776         struct sk_buff *msg;
6777         void *hdr;
6778
6779         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6780         if (!msg)
6781                 return;
6782
6783         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6784         if (!hdr) {
6785                 nlmsg_free(msg);
6786                 return;
6787         }
6788
6789         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6790         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6791         if (from_ap && reason)
6792                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6793         if (from_ap)
6794                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6795         if (ie)
6796                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6797
6798         if (genlmsg_end(msg, hdr) < 0) {
6799                 nlmsg_free(msg);
6800                 return;
6801         }
6802
6803         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6804                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6805         return;
6806
6807  nla_put_failure:
6808         genlmsg_cancel(msg, hdr);
6809         nlmsg_free(msg);
6810
6811 }
6812
6813 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6814                              struct net_device *netdev, const u8 *bssid,
6815                              gfp_t gfp)
6816 {
6817         struct sk_buff *msg;
6818         void *hdr;
6819
6820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6821         if (!msg)
6822                 return;
6823
6824         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6825         if (!hdr) {
6826                 nlmsg_free(msg);
6827                 return;
6828         }
6829
6830         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6831         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6832         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6833
6834         if (genlmsg_end(msg, hdr) < 0) {
6835                 nlmsg_free(msg);
6836                 return;
6837         }
6838
6839         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6840                                 nl80211_mlme_mcgrp.id, gfp);
6841         return;
6842
6843  nla_put_failure:
6844         genlmsg_cancel(msg, hdr);
6845         nlmsg_free(msg);
6846 }
6847
6848 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6849                 struct net_device *netdev,
6850                 const u8 *macaddr, const u8* ie, u8 ie_len,
6851                 gfp_t gfp)
6852 {
6853         struct sk_buff *msg;
6854         void *hdr;
6855
6856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6857         if (!msg)
6858                 return;
6859
6860         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6861         if (!hdr) {
6862                 nlmsg_free(msg);
6863                 return;
6864         }
6865
6866         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6867         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6868         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6869         if (ie_len && ie)
6870                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6871
6872         if (genlmsg_end(msg, hdr) < 0) {
6873                 nlmsg_free(msg);
6874                 return;
6875         }
6876
6877         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6878                                 nl80211_mlme_mcgrp.id, gfp);
6879         return;
6880
6881  nla_put_failure:
6882         genlmsg_cancel(msg, hdr);
6883         nlmsg_free(msg);
6884 }
6885
6886 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6887                                  struct net_device *netdev, const u8 *addr,
6888                                  enum nl80211_key_type key_type, int key_id,
6889                                  const u8 *tsc, gfp_t gfp)
6890 {
6891         struct sk_buff *msg;
6892         void *hdr;
6893
6894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6895         if (!msg)
6896                 return;
6897
6898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6899         if (!hdr) {
6900                 nlmsg_free(msg);
6901                 return;
6902         }
6903
6904         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6905         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6906         if (addr)
6907                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6908         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6909         if (key_id != -1)
6910                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6911         if (tsc)
6912                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6913
6914         if (genlmsg_end(msg, hdr) < 0) {
6915                 nlmsg_free(msg);
6916                 return;
6917         }
6918
6919         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6920                                 nl80211_mlme_mcgrp.id, gfp);
6921         return;
6922
6923  nla_put_failure:
6924         genlmsg_cancel(msg, hdr);
6925         nlmsg_free(msg);
6926 }
6927
6928 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6929                                     struct ieee80211_channel *channel_before,
6930                                     struct ieee80211_channel *channel_after)
6931 {
6932         struct sk_buff *msg;
6933         void *hdr;
6934         struct nlattr *nl_freq;
6935
6936         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6937         if (!msg)
6938                 return;
6939
6940         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6941         if (!hdr) {
6942                 nlmsg_free(msg);
6943                 return;
6944         }
6945
6946         /*
6947          * Since we are applying the beacon hint to a wiphy we know its
6948          * wiphy_idx is valid
6949          */
6950         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6951
6952         /* Before */
6953         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6954         if (!nl_freq)
6955                 goto nla_put_failure;
6956         if (nl80211_msg_put_channel(msg, channel_before))
6957                 goto nla_put_failure;
6958         nla_nest_end(msg, nl_freq);
6959
6960         /* After */
6961         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6962         if (!nl_freq)
6963                 goto nla_put_failure;
6964         if (nl80211_msg_put_channel(msg, channel_after))
6965                 goto nla_put_failure;
6966         nla_nest_end(msg, nl_freq);
6967
6968         if (genlmsg_end(msg, hdr) < 0) {
6969                 nlmsg_free(msg);
6970                 return;
6971         }
6972
6973         rcu_read_lock();
6974         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6975                                 GFP_ATOMIC);
6976         rcu_read_unlock();
6977
6978         return;
6979
6980 nla_put_failure:
6981         genlmsg_cancel(msg, hdr);
6982         nlmsg_free(msg);
6983 }
6984
6985 static void nl80211_send_remain_on_chan_event(
6986         int cmd, struct cfg80211_registered_device *rdev,
6987         struct net_device *netdev, u64 cookie,
6988         struct ieee80211_channel *chan,
6989         enum nl80211_channel_type channel_type,
6990         unsigned int duration, gfp_t gfp)
6991 {
6992         struct sk_buff *msg;
6993         void *hdr;
6994
6995         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6996         if (!msg)
6997                 return;
6998
6999         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7000         if (!hdr) {
7001                 nlmsg_free(msg);
7002                 return;
7003         }
7004
7005         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7006         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7007         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
7008         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
7009         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7010
7011         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
7012                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
7013
7014         if (genlmsg_end(msg, hdr) < 0) {
7015                 nlmsg_free(msg);
7016                 return;
7017         }
7018
7019         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7020                                 nl80211_mlme_mcgrp.id, gfp);
7021         return;
7022
7023  nla_put_failure:
7024         genlmsg_cancel(msg, hdr);
7025         nlmsg_free(msg);
7026 }
7027
7028 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
7029                                     struct net_device *netdev, u64 cookie,
7030                                     struct ieee80211_channel *chan,
7031                                     enum nl80211_channel_type channel_type,
7032                                     unsigned int duration, gfp_t gfp)
7033 {
7034         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
7035                                           rdev, netdev, cookie, chan,
7036                                           channel_type, duration, gfp);
7037 }
7038
7039 void nl80211_send_remain_on_channel_cancel(
7040         struct cfg80211_registered_device *rdev, struct net_device *netdev,
7041         u64 cookie, struct ieee80211_channel *chan,
7042         enum nl80211_channel_type channel_type, gfp_t gfp)
7043 {
7044         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7045                                           rdev, netdev, cookie, chan,
7046                                           channel_type, 0, gfp);
7047 }
7048
7049 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
7050                             struct net_device *dev, const u8 *mac_addr,
7051                             struct station_info *sinfo, gfp_t gfp)
7052 {
7053         struct sk_buff *msg;
7054
7055         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7056         if (!msg)
7057                 return;
7058
7059         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
7060                 nlmsg_free(msg);
7061                 return;
7062         }
7063
7064         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7065                                 nl80211_mlme_mcgrp.id, gfp);
7066 }
7067
7068 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7069                                 struct net_device *dev, const u8 *mac_addr,
7070                                 gfp_t gfp)
7071 {
7072         struct sk_buff *msg;
7073         void *hdr;
7074
7075         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7076         if (!msg)
7077                 return;
7078
7079         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7080         if (!hdr) {
7081                 nlmsg_free(msg);
7082                 return;
7083         }
7084
7085         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7086         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7087
7088         if (genlmsg_end(msg, hdr) < 0) {
7089                 nlmsg_free(msg);
7090                 return;
7091         }
7092
7093         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7094                                 nl80211_mlme_mcgrp.id, gfp);
7095         return;
7096
7097  nla_put_failure:
7098         genlmsg_cancel(msg, hdr);
7099         nlmsg_free(msg);
7100 }
7101
7102 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7103                       struct net_device *netdev, u32 nlpid,
7104                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7105 {
7106         struct sk_buff *msg;
7107         void *hdr;
7108         int err;
7109
7110         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7111         if (!msg)
7112                 return -ENOMEM;
7113
7114         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7115         if (!hdr) {
7116                 nlmsg_free(msg);
7117                 return -ENOMEM;
7118         }
7119
7120         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7121         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7122         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7123         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7124
7125         err = genlmsg_end(msg, hdr);
7126         if (err < 0) {
7127                 nlmsg_free(msg);
7128                 return err;
7129         }
7130
7131         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7132         if (err < 0)
7133                 return err;
7134         return 0;
7135
7136  nla_put_failure:
7137         genlmsg_cancel(msg, hdr);
7138         nlmsg_free(msg);
7139         return -ENOBUFS;
7140 }
7141
7142 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7143                                  struct net_device *netdev, u64 cookie,
7144                                  const u8 *buf, size_t len, bool ack,
7145                                  gfp_t gfp)
7146 {
7147         struct sk_buff *msg;
7148         void *hdr;
7149
7150         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7151         if (!msg)
7152                 return;
7153
7154         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7155         if (!hdr) {
7156                 nlmsg_free(msg);
7157                 return;
7158         }
7159
7160         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7161         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7162         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7163         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7164         if (ack)
7165                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7166
7167         if (genlmsg_end(msg, hdr) < 0) {
7168                 nlmsg_free(msg);
7169                 return;
7170         }
7171
7172         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7173         return;
7174
7175  nla_put_failure:
7176         genlmsg_cancel(msg, hdr);
7177         nlmsg_free(msg);
7178 }
7179
7180 void
7181 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7182                              struct net_device *netdev,
7183                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7184                              gfp_t gfp)
7185 {
7186         struct sk_buff *msg;
7187         struct nlattr *pinfoattr;
7188         void *hdr;
7189
7190         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7191         if (!msg)
7192                 return;
7193
7194         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7195         if (!hdr) {
7196                 nlmsg_free(msg);
7197                 return;
7198         }
7199
7200         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7201         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7202
7203         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7204         if (!pinfoattr)
7205                 goto nla_put_failure;
7206
7207         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7208                     rssi_event);
7209
7210         nla_nest_end(msg, pinfoattr);
7211
7212         if (genlmsg_end(msg, hdr) < 0) {
7213                 nlmsg_free(msg);
7214                 return;
7215         }
7216
7217         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7218                                 nl80211_mlme_mcgrp.id, gfp);
7219         return;
7220
7221  nla_put_failure:
7222         genlmsg_cancel(msg, hdr);
7223         nlmsg_free(msg);
7224 }
7225
7226 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7227                               struct net_device *netdev, const u8 *bssid,
7228                               const u8 *replay_ctr, gfp_t gfp)
7229 {
7230         struct sk_buff *msg;
7231         struct nlattr *rekey_attr;
7232         void *hdr;
7233
7234         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7235         if (!msg)
7236                 return;
7237
7238         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7239         if (!hdr) {
7240                 nlmsg_free(msg);
7241                 return;
7242         }
7243
7244         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7245         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7246         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7247
7248         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7249         if (!rekey_attr)
7250                 goto nla_put_failure;
7251
7252         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7253                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7254
7255         nla_nest_end(msg, rekey_attr);
7256
7257         if (genlmsg_end(msg, hdr) < 0) {
7258                 nlmsg_free(msg);
7259                 return;
7260         }
7261
7262         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7263                                 nl80211_mlme_mcgrp.id, gfp);
7264         return;
7265
7266  nla_put_failure:
7267         genlmsg_cancel(msg, hdr);
7268         nlmsg_free(msg);
7269 }
7270
7271 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
7272                                     struct net_device *netdev, int index,
7273                                     const u8 *bssid, bool preauth, gfp_t gfp)
7274 {
7275         struct sk_buff *msg;
7276         struct nlattr *attr;
7277         void *hdr;
7278
7279         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7280         if (!msg)
7281                 return;
7282
7283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
7284         if (!hdr) {
7285                 nlmsg_free(msg);
7286                 return;
7287         }
7288
7289         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7290         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7291
7292         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
7293         if (!attr)
7294                 goto nla_put_failure;
7295
7296         NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
7297         NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
7298         if (preauth)
7299                 NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
7300
7301         nla_nest_end(msg, attr);
7302
7303         if (genlmsg_end(msg, hdr) < 0) {
7304                 nlmsg_free(msg);
7305                 return;
7306         }
7307
7308         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7309                                 nl80211_mlme_mcgrp.id, gfp);
7310         return;
7311
7312  nla_put_failure:
7313         genlmsg_cancel(msg, hdr);
7314         nlmsg_free(msg);
7315 }
7316
7317 void
7318 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7319                                 struct net_device *netdev, const u8 *peer,
7320                                 u32 num_packets, gfp_t gfp)
7321 {
7322         struct sk_buff *msg;
7323         struct nlattr *pinfoattr;
7324         void *hdr;
7325
7326         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7327         if (!msg)
7328                 return;
7329
7330         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7331         if (!hdr) {
7332                 nlmsg_free(msg);
7333                 return;
7334         }
7335
7336         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7337         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7338         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7339
7340         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7341         if (!pinfoattr)
7342                 goto nla_put_failure;
7343
7344         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7345
7346         nla_nest_end(msg, pinfoattr);
7347
7348         if (genlmsg_end(msg, hdr) < 0) {
7349                 nlmsg_free(msg);
7350                 return;
7351         }
7352
7353         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7354                                 nl80211_mlme_mcgrp.id, gfp);
7355         return;
7356
7357  nla_put_failure:
7358         genlmsg_cancel(msg, hdr);
7359         nlmsg_free(msg);
7360 }
7361
7362 static int nl80211_netlink_notify(struct notifier_block * nb,
7363                                   unsigned long state,
7364                                   void *_notify)
7365 {
7366         struct netlink_notify *notify = _notify;
7367         struct cfg80211_registered_device *rdev;
7368         struct wireless_dev *wdev;
7369
7370         if (state != NETLINK_URELEASE)
7371                 return NOTIFY_DONE;
7372
7373         rcu_read_lock();
7374
7375         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7376                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7377                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7378
7379         rcu_read_unlock();
7380
7381         return NOTIFY_DONE;
7382 }
7383
7384 static struct notifier_block nl80211_netlink_notifier = {
7385         .notifier_call = nl80211_netlink_notify,
7386 };
7387
7388 /* initialisation/exit functions */
7389
7390 int nl80211_init(void)
7391 {
7392         int err;
7393
7394         err = genl_register_family_with_ops(&nl80211_fam,
7395                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7396         if (err)
7397                 return err;
7398
7399         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7400         if (err)
7401                 goto err_out;
7402
7403         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7404         if (err)
7405                 goto err_out;
7406
7407         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7408         if (err)
7409                 goto err_out;
7410
7411         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7412         if (err)
7413                 goto err_out;
7414
7415 #ifdef CONFIG_NL80211_TESTMODE
7416         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7417         if (err)
7418                 goto err_out;
7419 #endif
7420
7421         err = netlink_register_notifier(&nl80211_netlink_notifier);
7422         if (err)
7423                 goto err_out;
7424
7425         return 0;
7426  err_out:
7427         genl_unregister_family(&nl80211_fam);
7428         return err;
7429 }
7430
7431 void nl80211_exit(void)
7432 {
7433         netlink_unregister_notifier(&nl80211_netlink_notifier);
7434         genl_unregister_family(&nl80211_fam);
7435 }