net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 193 };
 194
 195 /* policy for the key attributes */
 196 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 197         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 198         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 199         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 200         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 201         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 202         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 203         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 204         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 205 };
 206
 207 /* policy for the key default flags */
 208 static const struct nla_policy
 209 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 210         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 211         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 212 };
 213
 214 /* policy for WoWLAN attributes */
 215 static const struct nla_policy
 216 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 217         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 218         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 219         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 220         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 221         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 222         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 223         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 224         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 225 };
 226
 227 /* policy for GTK rekey offload attributes */
 228 static const struct nla_policy
 229 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 230         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 231         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 232         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 233 };
 234
 235 /* ifidx get helper */
 236 static int nl80211_get_ifidx(struct netlink_callback *cb)
 237 {
 238         int res;
 239
 240         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 241                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 242                           nl80211_policy);
 243         if (res)
 244                 return res;
 245
 246         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 247                 return -EINVAL;
 248
 249         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 250         if (!res)
 251                 return -EINVAL;
 252         return res;
 253 }
 254
 255 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 256                                        struct netlink_callback *cb,
 257                                        struct cfg80211_registered_device **rdev,
 258                                        struct net_device **dev)
 259 {
 260         int ifidx = cb->args[0];
 261         int err;
 262
 263         if (!ifidx)
 264                 ifidx = nl80211_get_ifidx(cb);
 265         if (ifidx < 0)
 266                 return ifidx;
 267
 268         cb->args[0] = ifidx;
 269
 270         rtnl_lock();
 271
 272         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 273         if (!*dev) {
 274                 err = -ENODEV;
 275                 goto out_rtnl;
 276         }
 277
 278         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 279         if (IS_ERR(*rdev)) {
 280                 err = PTR_ERR(*rdev);
 281                 goto out_rtnl;
 282         }
 283
 284         return 0;
 285  out_rtnl:
 286         rtnl_unlock();
 287         return err;
 288 }
 289
 290 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 291 {
 292         cfg80211_unlock_rdev(rdev);
 293         rtnl_unlock();
 294 }
 295
 296 /* IE validation */
 297 static bool is_valid_ie_attr(const struct nlattr *attr)
 298 {
 299         const u8 *pos;
 300         int len;
 301
 302         if (!attr)
 303                 return true;
 304
 305         pos = nla_data(attr);
 306         len = nla_len(attr);
 307
 308         while (len) {
 309                 u8 elemlen;
 310
 311                 if (len < 2)
 312                         return false;
 313                 len -= 2;
 314
 315                 elemlen = pos[1];
 316                 if (elemlen > len)
 317                         return false;
 318
 319                 len -= elemlen;
 320                 pos += 2 + elemlen;
 321         }
 322
 323         return true;
 324 }
 325
 326 /* message building helper */
 327 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 328                                    int flags, u8 cmd)
 329 {
 330         /* since there is no private header just add the generic one */
 331         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 332 }
 333
 334 static int nl80211_msg_put_channel(struct sk_buff *msg,
 335                                    struct ieee80211_channel *chan)
 336 {
 337         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 338                     chan->center_freq);
 339
 340         if (chan->flags & IEEE80211_CHAN_DISABLED)
 341                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 342         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 343                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 344         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 345                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 346         if (chan->flags & IEEE80211_CHAN_RADAR)
 347                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 348
 349         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 350                     DBM_TO_MBM(chan->max_power));
 351
 352         return 0;
 353
 354  nla_put_failure:
 355         return -ENOBUFS;
 356 }
 357
 358 /* netlink command implementations */
 359
 360 struct key_parse {
 361         struct key_params p;
 362         int idx;
 363         int type;
 364         bool def, defmgmt;
 365         bool def_uni, def_multi;
 366 };
 367
 368 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 369 {
 370         struct nlattr *tb[NL80211_KEY_MAX + 1];
 371         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 372                                    nl80211_key_policy);
 373         if (err)
 374                 return err;
 375
 376         k->def = !!tb[NL80211_KEY_DEFAULT];
 377         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 378
 379         if (k->def) {
 380                 k->def_uni = true;
 381                 k->def_multi = true;
 382         }
 383         if (k->defmgmt)
 384                 k->def_multi = true;
 385
 386         if (tb[NL80211_KEY_IDX])
 387                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 388
 389         if (tb[NL80211_KEY_DATA]) {
 390                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 391                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 392         }
 393
 394         if (tb[NL80211_KEY_SEQ]) {
 395                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 396                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 397         }
 398
 399         if (tb[NL80211_KEY_CIPHER])
 400                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 401
 402         if (tb[NL80211_KEY_TYPE]) {
 403                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 404                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 405                         return -EINVAL;
 406         }
 407
 408         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 409                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 410                 int err = nla_parse_nested(kdt,
 411                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 412                                            tb[NL80211_KEY_DEFAULT_TYPES],
 413                                            nl80211_key_default_policy);
 414                 if (err)
 415                         return err;
 416
 417                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 418                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 419         }
 420
 421         return 0;
 422 }
 423
 424 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 425 {
 426         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 427                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 428                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 429         }
 430
 431         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 432                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 433                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 434         }
 435
 436         if (info->attrs[NL80211_ATTR_KEY_IDX])
 437                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 438
 439         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 440                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 441
 442         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 443         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 444
 445         if (k->def) {
 446                 k->def_uni = true;
 447                 k->def_multi = true;
 448         }
 449         if (k->defmgmt)
 450                 k->def_multi = true;
 451
 452         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 453                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 454                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 455                         return -EINVAL;
 456         }
 457
 458         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 459                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 460                 int err = nla_parse_nested(
 461                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 462                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 463                                 nl80211_key_default_policy);
 464                 if (err)
 465                         return err;
 466
 467                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 468                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 469         }
 470
 471         return 0;
 472 }
 473
 474 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 475 {
 476         int err;
 477
 478         memset(k, 0, sizeof(*k));
 479         k->idx = -1;
 480         k->type = -1;
 481
 482         if (info->attrs[NL80211_ATTR_KEY])
 483                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 484         else
 485                 err = nl80211_parse_key_old(info, k);
 486
 487         if (err)
 488                 return err;
 489
 490         if (k->def && k->defmgmt)
 491                 return -EINVAL;
 492
 493         if (k->defmgmt) {
 494                 if (k->def_uni || !k->def_multi)
 495                         return -EINVAL;
 496         }
 497
 498         if (k->idx != -1) {
 499                 if (k->defmgmt) {
 500                         if (k->idx < 4 || k->idx > 5)
 501                                 return -EINVAL;
 502                 } else if (k->def) {
 503                         if (k->idx < 0 || k->idx > 3)
 504                                 return -EINVAL;
 505                 } else {
 506                         if (k->idx < 0 || k->idx > 5)
 507                                 return -EINVAL;
 508                 }
 509         }
 510
 511         return 0;
 512 }
 513
 514 static struct cfg80211_cached_keys *
 515 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 516                        struct nlattr *keys)
 517 {
 518         struct key_parse parse;
 519         struct nlattr *key;
 520         struct cfg80211_cached_keys *result;
 521         int rem, err, def = 0;
 522
 523         result = kzalloc(sizeof(*result), GFP_KERNEL);
 524         if (!result)
 525                 return ERR_PTR(-ENOMEM);
 526
 527         result->def = -1;
 528         result->defmgmt = -1;
 529
 530         nla_for_each_nested(key, keys, rem) {
 531                 memset(&parse, 0, sizeof(parse));
 532                 parse.idx = -1;
 533
 534                 err = nl80211_parse_key_new(key, &parse);
 535                 if (err)
 536                         goto error;
 537                 err = -EINVAL;
 538                 if (!parse.p.key)
 539                         goto error;
 540                 if (parse.idx < 0 || parse.idx > 4)
 541                         goto error;
 542                 if (parse.def) {
 543                         if (def)
 544                                 goto error;
 545                         def = 1;
 546                         result->def = parse.idx;
 547                         if (!parse.def_uni || !parse.def_multi)
 548                                 goto error;
 549                 } else if (parse.defmgmt)
 550                         goto error;
 551                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 552                                                      parse.idx, false, NULL);
 553                 if (err)
 554                         goto error;
 555                 result->params[parse.idx].cipher = parse.p.cipher;
 556                 result->params[parse.idx].key_len = parse.p.key_len;
 557                 result->params[parse.idx].key = result->data[parse.idx];
 558                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 559         }
 560
 561         return result;
 562  error:
 563         kfree(result);
 564         return ERR_PTR(err);
 565 }
 566
 567 static int nl80211_key_allowed(struct wireless_dev *wdev)
 568 {
 569         ASSERT_WDEV_LOCK(wdev);
 570
 571         switch (wdev->iftype) {
 572         case NL80211_IFTYPE_AP:
 573         case NL80211_IFTYPE_AP_VLAN:
 574         case NL80211_IFTYPE_P2P_GO:
 575         case NL80211_IFTYPE_MESH_POINT:
 576                 break;
 577         case NL80211_IFTYPE_ADHOC:
 578                 if (!wdev->current_bss)
 579                         return -ENOLINK;
 580                 break;
 581         case NL80211_IFTYPE_STATION:
 582         case NL80211_IFTYPE_P2P_CLIENT:
 583                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 584                         return -ENOLINK;
 585                 break;
 586         default:
 587                 return -EINVAL;
 588         }
 589
 590         return 0;
 591 }
 592
 593 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 594 {
 595         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 596         int i;
 597
 598         if (!nl_modes)
 599                 goto nla_put_failure;
 600
 601         i = 0;
 602         while (ifmodes) {
 603                 if (ifmodes & 1)
 604                         NLA_PUT_FLAG(msg, i);
 605                 ifmodes >>= 1;
 606                 i++;
 607         }
 608
 609         nla_nest_end(msg, nl_modes);
 610         return 0;
 611
 612 nla_put_failure:
 613         return -ENOBUFS;
 614 }
 615
 616 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 617                                           struct sk_buff *msg)
 618 {
 619         struct nlattr *nl_combis;
 620         int i, j;
 621
 622         nl_combis = nla_nest_start(msg,
 623                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 624         if (!nl_combis)
 625                 goto nla_put_failure;
 626
 627         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 628                 const struct ieee80211_iface_combination *c;
 629                 struct nlattr *nl_combi, *nl_limits;
 630
 631                 c = &wiphy->iface_combinations[i];
 632
 633                 nl_combi = nla_nest_start(msg, i + 1);
 634                 if (!nl_combi)
 635                         goto nla_put_failure;
 636
 637                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 638                 if (!nl_limits)
 639                         goto nla_put_failure;
 640
 641                 for (j = 0; j < c->n_limits; j++) {
 642                         struct nlattr *nl_limit;
 643
 644                         nl_limit = nla_nest_start(msg, j + 1);
 645                         if (!nl_limit)
 646                                 goto nla_put_failure;
 647                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 648                                     c->limits[j].max);
 649                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 650                                                 c->limits[j].types))
 651                                 goto nla_put_failure;
 652                         nla_nest_end(msg, nl_limit);
 653                 }
 654
 655                 nla_nest_end(msg, nl_limits);
 656
 657                 if (c->beacon_int_infra_match)
 658                         NLA_PUT_FLAG(msg,
 659                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 660                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 661                             c->num_different_channels);
 662                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 663                             c->max_interfaces);
 664
 665                 nla_nest_end(msg, nl_combi);
 666         }
 667
 668         nla_nest_end(msg, nl_combis);
 669
 670         return 0;
 671 nla_put_failure:
 672         return -ENOBUFS;
 673 }
 674
 675 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 676                               struct cfg80211_registered_device *dev)
 677 {
 678         void *hdr;
 679         struct nlattr *nl_bands, *nl_band;
 680         struct nlattr *nl_freqs, *nl_freq;
 681         struct nlattr *nl_rates, *nl_rate;
 682         struct nlattr *nl_cmds;
 683         enum ieee80211_band band;
 684         struct ieee80211_channel *chan;
 685         struct ieee80211_rate *rate;
 686         int i;
 687         const struct ieee80211_txrx_stypes *mgmt_stypes =
 688                                 dev->wiphy.mgmt_stypes;
 689
 690         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 691         if (!hdr)
 692                 return -1;
 693
 694         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 695         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 696
 697         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 698                     cfg80211_rdev_list_generation);
 699
 700         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 701                    dev->wiphy.retry_short);
 702         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 703                    dev->wiphy.retry_long);
 704         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 705                     dev->wiphy.frag_threshold);
 706         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 707                     dev->wiphy.rts_threshold);
 708         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 709                     dev->wiphy.coverage_class);
 710         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 711                    dev->wiphy.max_scan_ssids);
 712         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 713                    dev->wiphy.max_sched_scan_ssids);
 714         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 715                     dev->wiphy.max_scan_ie_len);
 716         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 717                     dev->wiphy.max_sched_scan_ie_len);
 718
 719         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 720                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 721         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 722                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 723
 724         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 725                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 726
 727         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 728                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 729                 dev->wiphy.cipher_suites);
 730
 731         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 732                    dev->wiphy.max_num_pmkids);
 733
 734         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 735                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 736
 737         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 738                     dev->wiphy.available_antennas_tx);
 739         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 740                     dev->wiphy.available_antennas_rx);
 741
 742         if ((dev->wiphy.available_antennas_tx ||
 743              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 744                 u32 tx_ant = 0, rx_ant = 0;
 745                 int res;
 746                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 747                 if (!res) {
 748                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 749                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 750                 }
 751         }
 752
 753         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 754                                 dev->wiphy.interface_modes))
 755                 goto nla_put_failure;
 756
 757         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 758         if (!nl_bands)
 759                 goto nla_put_failure;
 760
 761         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 762                 if (!dev->wiphy.bands[band])
 763                         continue;
 764
 765                 nl_band = nla_nest_start(msg, band);
 766                 if (!nl_band)
 767                         goto nla_put_failure;
 768
 769                 /* add HT info */
 770                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 771                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 772                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 773                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 774                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 775                                 dev->wiphy.bands[band]->ht_cap.cap);
 776                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 777                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 778                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 779                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 780                 }
 781
 782                 /* add frequencies */
 783                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 784                 if (!nl_freqs)
 785                         goto nla_put_failure;
 786
 787                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 788                         nl_freq = nla_nest_start(msg, i);
 789                         if (!nl_freq)
 790                                 goto nla_put_failure;
 791
 792                         chan = &dev->wiphy.bands[band]->channels[i];
 793
 794                         if (nl80211_msg_put_channel(msg, chan))
 795                                 goto nla_put_failure;
 796
 797                         nla_nest_end(msg, nl_freq);
 798                 }
 799
 800                 nla_nest_end(msg, nl_freqs);
 801
 802                 /* add bitrates */
 803                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 804                 if (!nl_rates)
 805                         goto nla_put_failure;
 806
 807                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 808                         nl_rate = nla_nest_start(msg, i);
 809                         if (!nl_rate)
 810                                 goto nla_put_failure;
 811
 812                         rate = &dev->wiphy.bands[band]->bitrates[i];
 813                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 814                                     rate->bitrate);
 815                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 816                                 NLA_PUT_FLAG(msg,
 817                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 818
 819                         nla_nest_end(msg, nl_rate);
 820                 }
 821
 822                 nla_nest_end(msg, nl_rates);
 823
 824                 nla_nest_end(msg, nl_band);
 825         }
 826         nla_nest_end(msg, nl_bands);
 827
 828         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 829         if (!nl_cmds)
 830                 goto nla_put_failure;
 831
 832         i = 0;
 833 #define CMD(op, n)                                              \
 834          do {                                                   \
 835                 if (dev->ops->op) {                             \
 836                         i++;                                    \
 837                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 838                 }                                               \
 839         } while (0)
 840
 841         CMD(add_virtual_intf, NEW_INTERFACE);
 842         CMD(change_virtual_intf, SET_INTERFACE);
 843         CMD(add_key, NEW_KEY);
 844         CMD(add_beacon, NEW_BEACON);
 845         CMD(add_station, NEW_STATION);
 846         CMD(add_mpath, NEW_MPATH);
 847         CMD(update_mesh_config, SET_MESH_CONFIG);
 848         CMD(change_bss, SET_BSS);
 849         CMD(auth, AUTHENTICATE);
 850         CMD(assoc, ASSOCIATE);
 851         CMD(deauth, DEAUTHENTICATE);
 852         CMD(disassoc, DISASSOCIATE);
 853         CMD(join_ibss, JOIN_IBSS);
 854         CMD(join_mesh, JOIN_MESH);
 855         CMD(set_pmksa, SET_PMKSA);
 856         CMD(del_pmksa, DEL_PMKSA);
 857         CMD(flush_pmksa, FLUSH_PMKSA);
 858         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 859         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 860         CMD(mgmt_tx, FRAME);
 861         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 862         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 863                 i++;
 864                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 865         }
 866         CMD(set_channel, SET_CHANNEL);
 867         CMD(set_wds_peer, SET_WDS_PEER);
 868         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 869                 CMD(sched_scan_start, START_SCHED_SCAN);
 870
 871 #undef CMD
 872
 873         if (dev->ops->connect || dev->ops->auth) {
 874                 i++;
 875                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 876         }
 877
 878         if (dev->ops->disconnect || dev->ops->deauth) {
 879                 i++;
 880                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 881         }
 882
 883         nla_nest_end(msg, nl_cmds);
 884
 885         if (dev->ops->remain_on_channel)
 886                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 887                             dev->wiphy.max_remain_on_channel_duration);
 888
 889         if (dev->ops->mgmt_tx_cancel_wait)
 890                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 891
 892         if (mgmt_stypes) {
 893                 u16 stypes;
 894                 struct nlattr *nl_ftypes, *nl_ifs;
 895                 enum nl80211_iftype ift;
 896
 897                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 898                 if (!nl_ifs)
 899                         goto nla_put_failure;
 900
 901                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 902                         nl_ftypes = nla_nest_start(msg, ift);
 903                         if (!nl_ftypes)
 904                                 goto nla_put_failure;
 905                         i = 0;
 906                         stypes = mgmt_stypes[ift].tx;
 907                         while (stypes) {
 908                                 if (stypes & 1)
 909                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 910                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 911                                 stypes >>= 1;
 912                                 i++;
 913                         }
 914                         nla_nest_end(msg, nl_ftypes);
 915                 }
 916
 917                 nla_nest_end(msg, nl_ifs);
 918
 919                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 920                 if (!nl_ifs)
 921                         goto nla_put_failure;
 922
 923                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 924                         nl_ftypes = nla_nest_start(msg, ift);
 925                         if (!nl_ftypes)
 926                                 goto nla_put_failure;
 927                         i = 0;
 928                         stypes = mgmt_stypes[ift].rx;
 929                         while (stypes) {
 930                                 if (stypes & 1)
 931                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 932                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 933                                 stypes >>= 1;
 934                                 i++;
 935                         }
 936                         nla_nest_end(msg, nl_ftypes);
 937                 }
 938                 nla_nest_end(msg, nl_ifs);
 939         }
 940
 941         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 942                 struct nlattr *nl_wowlan;
 943
 944                 nl_wowlan = nla_nest_start(msg,
 945                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 946                 if (!nl_wowlan)
 947                         goto nla_put_failure;
 948
 949                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 950                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 951                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 952                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 953                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 954                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 955                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 956                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 957                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 958                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 959                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 960                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 961                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 962                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 963                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 964                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 965                 if (dev->wiphy.wowlan.n_patterns) {
 966                         struct nl80211_wowlan_pattern_support pat = {
 967                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 968                                 .min_pattern_len =
 969                                         dev->wiphy.wowlan.pattern_min_len,
 970                                 .max_pattern_len =
 971                                         dev->wiphy.wowlan.pattern_max_len,
 972                         };
 973                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 974                                 sizeof(pat), &pat);
 975                 }
 976
 977                 nla_nest_end(msg, nl_wowlan);
 978         }
 979
 980         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 981                                 dev->wiphy.software_iftypes))
 982                 goto nla_put_failure;
 983
 984         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 985                 goto nla_put_failure;
 986
 987         return genlmsg_end(msg, hdr);
 988
 989  nla_put_failure:
 990         genlmsg_cancel(msg, hdr);
 991         return -EMSGSIZE;
 992 }
 993
 994 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 995 {
 996         int idx = 0;
 997         int start = cb->args[0];
 998         struct cfg80211_registered_device *dev;
 999
1000         mutex_lock(&cfg80211_mutex);
1001         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1002                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1003                         continue;
1004                 if (++idx <= start)
1005                         continue;
1006                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1007                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1008                                        dev) < 0) {
1009                         idx--;
1010                         break;
1011                 }
1012         }
1013         mutex_unlock(&cfg80211_mutex);
1014
1015         cb->args[0] = idx;
1016
1017         return skb->len;
1018 }
1019
1020 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1021 {
1022         struct sk_buff *msg;
1023         struct cfg80211_registered_device *dev = info->user_ptr[0];
1024
1025         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1026         if (!msg)
1027                 return -ENOMEM;
1028
1029         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1030                 nlmsg_free(msg);
1031                 return -ENOBUFS;
1032         }
1033
1034         return genlmsg_reply(msg, info);
1035 }
1036
1037 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1038         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1039         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1040         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1041         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1042         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1043 };
1044
1045 static int parse_txq_params(struct nlattr *tb[],
1046                             struct ieee80211_txq_params *txq_params)
1047 {
1048         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1049             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1050             !tb[NL80211_TXQ_ATTR_AIFS])
1051                 return -EINVAL;
1052
1053         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1054         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1055         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1056         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1057         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1058
1059         return 0;
1060 }
1061
1062 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1063 {
1064         /*
1065          * You can only set the channel explicitly for AP, mesh
1066          * and WDS type interfaces; all others have their channel
1067          * managed via their respective "establish a connection"
1068          * command (connect, join, ...)
1069          *
1070          * Monitors are special as they are normally slaved to
1071          * whatever else is going on, so they behave as though
1072          * you tried setting the wiphy channel itself.
1073          */
1074         return !wdev ||
1075                 wdev->iftype == NL80211_IFTYPE_AP ||
1076                 wdev->iftype == NL80211_IFTYPE_WDS ||
1077                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1078                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1079                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1080 }
1081
1082 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1083                                  struct wireless_dev *wdev,
1084                                  struct genl_info *info)
1085 {
1086         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1087         u32 freq;
1088         int result;
1089
1090         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1091                 return -EINVAL;
1092
1093         if (!nl80211_can_set_dev_channel(wdev))
1094                 return -EOPNOTSUPP;
1095
1096         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1097                 channel_type = nla_get_u32(info->attrs[
1098                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1099                 if (channel_type != NL80211_CHAN_NO_HT &&
1100                     channel_type != NL80211_CHAN_HT20 &&
1101                     channel_type != NL80211_CHAN_HT40PLUS &&
1102                     channel_type != NL80211_CHAN_HT40MINUS)
1103                         return -EINVAL;
1104         }
1105
1106         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1107
1108         mutex_lock(&rdev->devlist_mtx);
1109         if (wdev) {
1110                 wdev_lock(wdev);
1111                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1112                 wdev_unlock(wdev);
1113         } else {
1114                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1115         }
1116         mutex_unlock(&rdev->devlist_mtx);
1117
1118         return result;
1119 }
1120
1121 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1122 {
1123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1124         struct net_device *netdev = info->user_ptr[1];
1125
1126         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1127 }
1128
1129 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1130 {
1131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1132         struct net_device *dev = info->user_ptr[1];
1133         struct wireless_dev *wdev = dev->ieee80211_ptr;
1134         const u8 *bssid;
1135
1136         if (!info->attrs[NL80211_ATTR_MAC])
1137                 return -EINVAL;
1138
1139         if (netif_running(dev))
1140                 return -EBUSY;
1141
1142         if (!rdev->ops->set_wds_peer)
1143                 return -EOPNOTSUPP;
1144
1145         if (wdev->iftype != NL80211_IFTYPE_WDS)
1146                 return -EOPNOTSUPP;
1147
1148         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1149         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1150 }
1151
1152
1153 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1154 {
1155         struct cfg80211_registered_device *rdev;
1156         struct net_device *netdev = NULL;
1157         struct wireless_dev *wdev;
1158         int result = 0, rem_txq_params = 0;
1159         struct nlattr *nl_txq_params;
1160         u32 changed;
1161         u8 retry_short = 0, retry_long = 0;
1162         u32 frag_threshold = 0, rts_threshold = 0;
1163         u8 coverage_class = 0;
1164
1165         /*
1166          * Try to find the wiphy and netdev. Normally this
1167          * function shouldn't need the netdev, but this is
1168          * done for backward compatibility -- previously
1169          * setting the channel was done per wiphy, but now
1170          * it is per netdev. Previous userland like hostapd
1171          * also passed a netdev to set_wiphy, so that it is
1172          * possible to let that go to the right netdev!
1173          */
1174         mutex_lock(&cfg80211_mutex);
1175
1176         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1177                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1178
1179                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1180                 if (netdev && netdev->ieee80211_ptr) {
1181                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1182                         mutex_lock(&rdev->mtx);
1183                 } else
1184                         netdev = NULL;
1185         }
1186
1187         if (!netdev) {
1188                 rdev = __cfg80211_rdev_from_info(info);
1189                 if (IS_ERR(rdev)) {
1190                         mutex_unlock(&cfg80211_mutex);
1191                         return PTR_ERR(rdev);
1192                 }
1193                 wdev = NULL;
1194                 netdev = NULL;
1195                 result = 0;
1196
1197                 mutex_lock(&rdev->mtx);
1198         } else if (netif_running(netdev) &&
1199                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1200                 wdev = netdev->ieee80211_ptr;
1201         else
1202                 wdev = NULL;
1203
1204         /*
1205          * end workaround code, by now the rdev is available
1206          * and locked, and wdev may or may not be NULL.
1207          */
1208
1209         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1210                 result = cfg80211_dev_rename(
1211                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1212
1213         mutex_unlock(&cfg80211_mutex);
1214
1215         if (result)
1216                 goto bad_res;
1217
1218         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1219                 struct ieee80211_txq_params txq_params;
1220                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1221
1222                 if (!rdev->ops->set_txq_params) {
1223                         result = -EOPNOTSUPP;
1224                         goto bad_res;
1225                 }
1226
1227                 nla_for_each_nested(nl_txq_params,
1228                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1229                                     rem_txq_params) {
1230                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1231                                   nla_data(nl_txq_params),
1232                                   nla_len(nl_txq_params),
1233                                   txq_params_policy);
1234                         result = parse_txq_params(tb, &txq_params);
1235                         if (result)
1236                                 goto bad_res;
1237
1238                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1239                                                            &txq_params);
1240                         if (result)
1241                                 goto bad_res;
1242                 }
1243         }
1244
1245         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1246                 result = __nl80211_set_channel(rdev, wdev, info);
1247                 if (result)
1248                         goto bad_res;
1249         }
1250
1251         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1252                 enum nl80211_tx_power_setting type;
1253                 int idx, mbm = 0;
1254
1255                 if (!rdev->ops->set_tx_power) {
1256                         result = -EOPNOTSUPP;
1257                         goto bad_res;
1258                 }
1259
1260                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1261                 type = nla_get_u32(info->attrs[idx]);
1262
1263                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1264                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1265                         result = -EINVAL;
1266                         goto bad_res;
1267                 }
1268
1269                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1270                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1271                         mbm = nla_get_u32(info->attrs[idx]);
1272                 }
1273
1274                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1275                 if (result)
1276                         goto bad_res;
1277         }
1278
1279         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1280             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1281                 u32 tx_ant, rx_ant;
1282                 if ((!rdev->wiphy.available_antennas_tx &&
1283                      !rdev->wiphy.available_antennas_rx) ||
1284                     !rdev->ops->set_antenna) {
1285                         result = -EOPNOTSUPP;
1286                         goto bad_res;
1287                 }
1288
1289                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1290                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1291
1292                 /* reject antenna configurations which don't match the
1293                  * available antenna masks, except for the "all" mask */
1294                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1295                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1296                         result = -EINVAL;
1297                         goto bad_res;
1298                 }
1299
1300                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1301                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1302
1303                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1304                 if (result)
1305                         goto bad_res;
1306         }
1307
1308         changed = 0;
1309
1310         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1311                 retry_short = nla_get_u8(
1312                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1313                 if (retry_short == 0) {
1314                         result = -EINVAL;
1315                         goto bad_res;
1316                 }
1317                 changed |= WIPHY_PARAM_RETRY_SHORT;
1318         }
1319
1320         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1321                 retry_long = nla_get_u8(
1322                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1323                 if (retry_long == 0) {
1324                         result = -EINVAL;
1325                         goto bad_res;
1326                 }
1327                 changed |= WIPHY_PARAM_RETRY_LONG;
1328         }
1329
1330         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1331                 frag_threshold = nla_get_u32(
1332                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1333                 if (frag_threshold < 256) {
1334                         result = -EINVAL;
1335                         goto bad_res;
1336                 }
1337                 if (frag_threshold != (u32) -1) {
1338                         /*
1339                          * Fragments (apart from the last one) are required to
1340                          * have even length. Make the fragmentation code
1341                          * simpler by stripping LSB should someone try to use
1342                          * odd threshold value.
1343                          */
1344                         frag_threshold &= ~0x1;
1345                 }
1346                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1347         }
1348
1349         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1350                 rts_threshold = nla_get_u32(
1351                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1352                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1353         }
1354
1355         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1356                 coverage_class = nla_get_u8(
1357                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1358                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1359         }
1360
1361         if (changed) {
1362                 u8 old_retry_short, old_retry_long;
1363                 u32 old_frag_threshold, old_rts_threshold;
1364                 u8 old_coverage_class;
1365
1366                 if (!rdev->ops->set_wiphy_params) {
1367                         result = -EOPNOTSUPP;
1368                         goto bad_res;
1369                 }
1370
1371                 old_retry_short = rdev->wiphy.retry_short;
1372                 old_retry_long = rdev->wiphy.retry_long;
1373                 old_frag_threshold = rdev->wiphy.frag_threshold;
1374                 old_rts_threshold = rdev->wiphy.rts_threshold;
1375                 old_coverage_class = rdev->wiphy.coverage_class;
1376
1377                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1378                         rdev->wiphy.retry_short = retry_short;
1379                 if (changed & WIPHY_PARAM_RETRY_LONG)
1380                         rdev->wiphy.retry_long = retry_long;
1381                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1382                         rdev->wiphy.frag_threshold = frag_threshold;
1383                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1384                         rdev->wiphy.rts_threshold = rts_threshold;
1385                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1386                         rdev->wiphy.coverage_class = coverage_class;
1387
1388                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1389                 if (result) {
1390                         rdev->wiphy.retry_short = old_retry_short;
1391                         rdev->wiphy.retry_long = old_retry_long;
1392                         rdev->wiphy.frag_threshold = old_frag_threshold;
1393                         rdev->wiphy.rts_threshold = old_rts_threshold;
1394                         rdev->wiphy.coverage_class = old_coverage_class;
1395                 }
1396         }
1397
1398  bad_res:
1399         mutex_unlock(&rdev->mtx);
1400         if (netdev)
1401                 dev_put(netdev);
1402         return result;
1403 }
1404
1405
1406 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1407                               struct cfg80211_registered_device *rdev,
1408                               struct net_device *dev)
1409 {
1410         void *hdr;
1411
1412         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1413         if (!hdr)
1414                 return -1;
1415
1416         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1417         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1418         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1419         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1420
1421         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1422                     rdev->devlist_generation ^
1423                         (cfg80211_rdev_list_generation << 2));
1424
1425         return genlmsg_end(msg, hdr);
1426
1427  nla_put_failure:
1428         genlmsg_cancel(msg, hdr);
1429         return -EMSGSIZE;
1430 }
1431
1432 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1433 {
1434         int wp_idx = 0;
1435         int if_idx = 0;
1436         int wp_start = cb->args[0];
1437         int if_start = cb->args[1];
1438         struct cfg80211_registered_device *rdev;
1439         struct wireless_dev *wdev;
1440
1441         mutex_lock(&cfg80211_mutex);
1442         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1443                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1444                         continue;
1445                 if (wp_idx < wp_start) {
1446                         wp_idx++;
1447                         continue;
1448                 }
1449                 if_idx = 0;
1450
1451                 mutex_lock(&rdev->devlist_mtx);
1452                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1453                         if (if_idx < if_start) {
1454                                 if_idx++;
1455                                 continue;
1456                         }
1457                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1458                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1459                                                rdev, wdev->netdev) < 0) {
1460                                 mutex_unlock(&rdev->devlist_mtx);
1461                                 goto out;
1462                         }
1463                         if_idx++;
1464                 }
1465                 mutex_unlock(&rdev->devlist_mtx);
1466
1467                 wp_idx++;
1468         }
1469  out:
1470         mutex_unlock(&cfg80211_mutex);
1471
1472         cb->args[0] = wp_idx;
1473         cb->args[1] = if_idx;
1474
1475         return skb->len;
1476 }
1477
1478 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1479 {
1480         struct sk_buff *msg;
1481         struct cfg80211_registered_device *dev = info->user_ptr[0];
1482         struct net_device *netdev = info->user_ptr[1];
1483
1484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1485         if (!msg)
1486                 return -ENOMEM;
1487
1488         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1489                                dev, netdev) < 0) {
1490                 nlmsg_free(msg);
1491                 return -ENOBUFS;
1492         }
1493
1494         return genlmsg_reply(msg, info);
1495 }
1496
1497 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1498         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1499         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1500         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1501         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1502         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1503 };
1504
1505 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1506 {
1507         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1508         int flag;
1509
1510         *mntrflags = 0;
1511
1512         if (!nla)
1513                 return -EINVAL;
1514
1515         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1516                              nla, mntr_flags_policy))
1517                 return -EINVAL;
1518
1519         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1520                 if (flags[flag])
1521                         *mntrflags |= (1<<flag);
1522
1523         return 0;
1524 }
1525
1526 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1527                                struct net_device *netdev, u8 use_4addr,
1528                                enum nl80211_iftype iftype)
1529 {
1530         if (!use_4addr) {
1531                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1532                         return -EBUSY;
1533                 return 0;
1534         }
1535
1536         switch (iftype) {
1537         case NL80211_IFTYPE_AP_VLAN:
1538                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1539                         return 0;
1540                 break;
1541         case NL80211_IFTYPE_STATION:
1542                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1543                         return 0;
1544                 break;
1545         default:
1546                 break;
1547         }
1548
1549         return -EOPNOTSUPP;
1550 }
1551
1552 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1553 {
1554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1555         struct vif_params params;
1556         int err;
1557         enum nl80211_iftype otype, ntype;
1558         struct net_device *dev = info->user_ptr[1];
1559         u32 _flags, *flags = NULL;
1560         bool change = false;
1561
1562         memset(&params, 0, sizeof(params));
1563
1564         otype = ntype = dev->ieee80211_ptr->iftype;
1565
1566         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1567                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1568                 if (otype != ntype)
1569                         change = true;
1570                 if (ntype > NL80211_IFTYPE_MAX)
1571                         return -EINVAL;
1572         }
1573
1574         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1575                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1576
1577                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1578                         return -EINVAL;
1579                 if (netif_running(dev))
1580                         return -EBUSY;
1581
1582                 wdev_lock(wdev);
1583                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1584                              IEEE80211_MAX_MESH_ID_LEN);
1585                 wdev->mesh_id_up_len =
1586                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1587                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1588                        wdev->mesh_id_up_len);
1589                 wdev_unlock(wdev);
1590         }
1591
1592         if (info->attrs[NL80211_ATTR_4ADDR]) {
1593                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1594                 change = true;
1595                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1596                 if (err)
1597                         return err;
1598         } else {
1599                 params.use_4addr = -1;
1600         }
1601
1602         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1603                 if (ntype != NL80211_IFTYPE_MONITOR)
1604                         return -EINVAL;
1605                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1606                                           &_flags);
1607                 if (err)
1608                         return err;
1609
1610                 flags = &_flags;
1611                 change = true;
1612         }
1613
1614         if (change)
1615                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1616         else
1617                 err = 0;
1618
1619         if (!err && params.use_4addr != -1)
1620                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1621
1622         return err;
1623 }
1624
1625 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1626 {
1627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1628         struct vif_params params;
1629         struct net_device *dev;
1630         int err;
1631         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1632         u32 flags;
1633
1634         memset(&params, 0, sizeof(params));
1635
1636         if (!info->attrs[NL80211_ATTR_IFNAME])
1637                 return -EINVAL;
1638
1639         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1640                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1641                 if (type > NL80211_IFTYPE_MAX)
1642                         return -EINVAL;
1643         }
1644
1645         if (!rdev->ops->add_virtual_intf ||
1646             !(rdev->wiphy.interface_modes & (1 << type)))
1647                 return -EOPNOTSUPP;
1648
1649         if (info->attrs[NL80211_ATTR_4ADDR]) {
1650                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1651                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1652                 if (err)
1653                         return err;
1654         }
1655
1656         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1657                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1658                                   &flags);
1659         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1660                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1661                 type, err ? NULL : &flags, &params);
1662         if (IS_ERR(dev))
1663                 return PTR_ERR(dev);
1664
1665         if (type == NL80211_IFTYPE_MESH_POINT &&
1666             info->attrs[NL80211_ATTR_MESH_ID]) {
1667                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1668
1669                 wdev_lock(wdev);
1670                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1671                              IEEE80211_MAX_MESH_ID_LEN);
1672                 wdev->mesh_id_up_len =
1673                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1674                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1675                        wdev->mesh_id_up_len);
1676                 wdev_unlock(wdev);
1677         }
1678
1679         return 0;
1680 }
1681
1682 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1683 {
1684         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1685         struct net_device *dev = info->user_ptr[1];
1686
1687         if (!rdev->ops->del_virtual_intf)
1688                 return -EOPNOTSUPP;
1689
1690         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1691 }
1692
1693 struct get_key_cookie {
1694         struct sk_buff *msg;
1695         int error;
1696         int idx;
1697 };
1698
1699 static void get_key_callback(void *c, struct key_params *params)
1700 {
1701         struct nlattr *key;
1702         struct get_key_cookie *cookie = c;
1703
1704         if (params->key)
1705                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1706                         params->key_len, params->key);
1707
1708         if (params->seq)
1709                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1710                         params->seq_len, params->seq);
1711
1712         if (params->cipher)
1713                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1714                             params->cipher);
1715
1716         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1717         if (!key)
1718                 goto nla_put_failure;
1719
1720         if (params->key)
1721                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1722                         params->key_len, params->key);
1723
1724         if (params->seq)
1725                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1726                         params->seq_len, params->seq);
1727
1728         if (params->cipher)
1729                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1730                             params->cipher);
1731
1732         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1733
1734         nla_nest_end(cookie->msg, key);
1735
1736         return;
1737  nla_put_failure:
1738         cookie->error = 1;
1739 }
1740
1741 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1742 {
1743         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1744         int err;
1745         struct net_device *dev = info->user_ptr[1];
1746         u8 key_idx = 0;
1747         const u8 *mac_addr = NULL;
1748         bool pairwise;
1749         struct get_key_cookie cookie = {
1750                 .error = 0,
1751         };
1752         void *hdr;
1753         struct sk_buff *msg;
1754
1755         if (info->attrs[NL80211_ATTR_KEY_IDX])
1756                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1757
1758         if (key_idx > 5)
1759                 return -EINVAL;
1760
1761         if (info->attrs[NL80211_ATTR_MAC])
1762                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1763
1764         pairwise = !!mac_addr;
1765         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1766                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1767                 if (kt >= NUM_NL80211_KEYTYPES)
1768                         return -EINVAL;
1769                 if (kt != NL80211_KEYTYPE_GROUP &&
1770                     kt != NL80211_KEYTYPE_PAIRWISE)
1771                         return -EINVAL;
1772                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1773         }
1774
1775         if (!rdev->ops->get_key)
1776                 return -EOPNOTSUPP;
1777
1778         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1779         if (!msg)
1780                 return -ENOMEM;
1781
1782         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1783                              NL80211_CMD_NEW_KEY);
1784         if (IS_ERR(hdr))
1785                 return PTR_ERR(hdr);
1786
1787         cookie.msg = msg;
1788         cookie.idx = key_idx;
1789
1790         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1791         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1792         if (mac_addr)
1793                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1794
1795         if (pairwise && mac_addr &&
1796             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1797                 return -ENOENT;
1798
1799         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1800                                  mac_addr, &cookie, get_key_callback);
1801
1802         if (err)
1803                 goto free_msg;
1804
1805         if (cookie.error)
1806                 goto nla_put_failure;
1807
1808         genlmsg_end(msg, hdr);
1809         return genlmsg_reply(msg, info);
1810
1811  nla_put_failure:
1812         err = -ENOBUFS;
1813  free_msg:
1814         nlmsg_free(msg);
1815         return err;
1816 }
1817
1818 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1819 {
1820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1821         struct key_parse key;
1822         int err;
1823         struct net_device *dev = info->user_ptr[1];
1824
1825         err = nl80211_parse_key(info, &key);
1826         if (err)
1827                 return err;
1828
1829         if (key.idx < 0)
1830                 return -EINVAL;
1831
1832         /* only support setting default key */
1833         if (!key.def && !key.defmgmt)
1834                 return -EINVAL;
1835
1836         wdev_lock(dev->ieee80211_ptr);
1837
1838         if (key.def) {
1839                 if (!rdev->ops->set_default_key) {
1840                         err = -EOPNOTSUPP;
1841                         goto out;
1842                 }
1843
1844                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1845                 if (err)
1846                         goto out;
1847
1848                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1849                                                  key.def_uni, key.def_multi);
1850
1851                 if (err)
1852                         goto out;
1853
1854 #ifdef CONFIG_CFG80211_WEXT
1855                 dev->ieee80211_ptr->wext.default_key = key.idx;
1856 #endif
1857         } else {
1858                 if (key.def_uni || !key.def_multi) {
1859                         err = -EINVAL;
1860                         goto out;
1861                 }
1862
1863                 if (!rdev->ops->set_default_mgmt_key) {
1864                         err = -EOPNOTSUPP;
1865                         goto out;
1866                 }
1867
1868                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1869                 if (err)
1870                         goto out;
1871
1872                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1873                                                       dev, key.idx);
1874                 if (err)
1875                         goto out;
1876
1877 #ifdef CONFIG_CFG80211_WEXT
1878                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1879 #endif
1880         }
1881
1882  out:
1883         wdev_unlock(dev->ieee80211_ptr);
1884
1885         return err;
1886 }
1887
1888 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1889 {
1890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1891         int err;
1892         struct net_device *dev = info->user_ptr[1];
1893         struct key_parse key;
1894         const u8 *mac_addr = NULL;
1895
1896         err = nl80211_parse_key(info, &key);
1897         if (err)
1898                 return err;
1899
1900         if (!key.p.key)
1901                 return -EINVAL;
1902
1903         if (info->attrs[NL80211_ATTR_MAC])
1904                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1905
1906         if (key.type == -1) {
1907                 if (mac_addr)
1908                         key.type = NL80211_KEYTYPE_PAIRWISE;
1909                 else
1910                         key.type = NL80211_KEYTYPE_GROUP;
1911         }
1912
1913         /* for now */
1914         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1915             key.type != NL80211_KEYTYPE_GROUP)
1916                 return -EINVAL;
1917
1918         if (!rdev->ops->add_key)
1919                 return -EOPNOTSUPP;
1920
1921         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1922                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1923                                            mac_addr))
1924                 return -EINVAL;
1925
1926         wdev_lock(dev->ieee80211_ptr);
1927         err = nl80211_key_allowed(dev->ieee80211_ptr);
1928         if (!err)
1929                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1930                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1931                                          mac_addr, &key.p);
1932         wdev_unlock(dev->ieee80211_ptr);
1933
1934         return err;
1935 }
1936
1937 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1938 {
1939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1940         int err;
1941         struct net_device *dev = info->user_ptr[1];
1942         u8 *mac_addr = NULL;
1943         struct key_parse key;
1944
1945         err = nl80211_parse_key(info, &key);
1946         if (err)
1947                 return err;
1948
1949         if (info->attrs[NL80211_ATTR_MAC])
1950                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1951
1952         if (key.type == -1) {
1953                 if (mac_addr)
1954                         key.type = NL80211_KEYTYPE_PAIRWISE;
1955                 else
1956                         key.type = NL80211_KEYTYPE_GROUP;
1957         }
1958
1959         /* for now */
1960         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1961             key.type != NL80211_KEYTYPE_GROUP)
1962                 return -EINVAL;
1963
1964         if (!rdev->ops->del_key)
1965                 return -EOPNOTSUPP;
1966
1967         wdev_lock(dev->ieee80211_ptr);
1968         err = nl80211_key_allowed(dev->ieee80211_ptr);
1969
1970         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1971             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1972                 err = -ENOENT;
1973
1974         if (!err)
1975                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1976                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1977                                          mac_addr);
1978
1979 #ifdef CONFIG_CFG80211_WEXT
1980         if (!err) {
1981                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1982                         dev->ieee80211_ptr->wext.default_key = -1;
1983                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1984                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1985         }
1986 #endif
1987         wdev_unlock(dev->ieee80211_ptr);
1988
1989         return err;
1990 }
1991
1992 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1993 {
1994         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1995                     struct beacon_parameters *info);
1996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1997         struct net_device *dev = info->user_ptr[1];
1998         struct wireless_dev *wdev = dev->ieee80211_ptr;
1999         struct beacon_parameters params;
2000         int haveinfo = 0, err;
2001
2002         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2003             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2004             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2005             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2006                 return -EINVAL;
2007
2008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2009             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2010                 return -EOPNOTSUPP;
2011
2012         memset(&params, 0, sizeof(params));
2013
2014         switch (info->genlhdr->cmd) {
2015         case NL80211_CMD_NEW_BEACON:
2016                 /* these are required for NEW_BEACON */
2017                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2018                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2019                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2020                         return -EINVAL;
2021
2022                 params.interval =
2023                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2024                 params.dtim_period =
2025                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2026
2027                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2028                 if (err)
2029                         return err;
2030
2031                 /*
2032                  * In theory, some of these attributes could be required for
2033                  * NEW_BEACON, but since they were not used when the command was
2034                  * originally added, keep them optional for old user space
2035                  * programs to work with drivers that do not need the additional
2036                  * information.
2037                  */
2038                 if (info->attrs[NL80211_ATTR_SSID]) {
2039                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2040                         params.ssid_len =
2041                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2042                         if (params.ssid_len == 0 ||
2043                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2044                                 return -EINVAL;
2045                 }
2046
2047                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2048                         params.hidden_ssid = nla_get_u32(
2049                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2050                         if (params.hidden_ssid !=
2051                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2052                             params.hidden_ssid !=
2053                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2054                             params.hidden_ssid !=
2055                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2056                                 return -EINVAL;
2057                 }
2058
2059                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2060
2061                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2062                         params.auth_type = nla_get_u32(
2063                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2064                         if (!nl80211_valid_auth_type(params.auth_type))
2065                                 return -EINVAL;
2066                 } else
2067                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2068
2069                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2070                                               NL80211_MAX_NR_CIPHER_SUITES);
2071                 if (err)
2072                         return err;
2073
2074                 call = rdev->ops->add_beacon;
2075                 break;
2076         case NL80211_CMD_SET_BEACON:
2077                 call = rdev->ops->set_beacon;
2078                 break;
2079         default:
2080                 WARN_ON(1);
2081                 return -EOPNOTSUPP;
2082         }
2083
2084         if (!call)
2085                 return -EOPNOTSUPP;
2086
2087         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2088                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2089                 params.head_len =
2090                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2091                 haveinfo = 1;
2092         }
2093
2094         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2095                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2096                 params.tail_len =
2097                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2098                 haveinfo = 1;
2099         }
2100
2101         if (!haveinfo)
2102                 return -EINVAL;
2103
2104         if (info->attrs[NL80211_ATTR_IE]) {
2105                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2106                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2107         }
2108
2109         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2110                 params.proberesp_ies =
2111                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2112                 params.proberesp_ies_len =
2113                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2114         }
2115
2116         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2117                 params.assocresp_ies =
2118                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2119                 params.assocresp_ies_len =
2120                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2121         }
2122
2123         err = call(&rdev->wiphy, dev, &params);
2124         if (!err && params.interval)
2125                 wdev->beacon_interval = params.interval;
2126         return err;
2127 }
2128
2129 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2130 {
2131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2132         struct net_device *dev = info->user_ptr[1];
2133         struct wireless_dev *wdev = dev->ieee80211_ptr;
2134         int err;
2135
2136         if (!rdev->ops->del_beacon)
2137                 return -EOPNOTSUPP;
2138
2139         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2140             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2141                 return -EOPNOTSUPP;
2142
2143         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2144         if (!err)
2145                 wdev->beacon_interval = 0;
2146         return err;
2147 }
2148
2149 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2150         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2151         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2152         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2153         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2154         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2155 };
2156
2157 static int parse_station_flags(struct genl_info *info,
2158                                struct station_parameters *params)
2159 {
2160         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2161         struct nlattr *nla;
2162         int flag;
2163
2164         /*
2165          * Try parsing the new attribute first so userspace
2166          * can specify both for older kernels.
2167          */
2168         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2169         if (nla) {
2170                 struct nl80211_sta_flag_update *sta_flags;
2171
2172                 sta_flags = nla_data(nla);
2173                 params->sta_flags_mask = sta_flags->mask;
2174                 params->sta_flags_set = sta_flags->set;
2175                 if ((params->sta_flags_mask |
2176                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2177                         return -EINVAL;
2178                 return 0;
2179         }
2180
2181         /* if present, parse the old attribute */
2182
2183         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2184         if (!nla)
2185                 return 0;
2186
2187         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2188                              nla, sta_flags_policy))
2189                 return -EINVAL;
2190
2191         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2192         params->sta_flags_mask &= ~1;
2193
2194         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2195                 if (flags[flag])
2196                         params->sta_flags_set |= (1<<flag);
2197
2198         return 0;
2199 }
2200
2201 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2202                                  int attr)
2203 {
2204         struct nlattr *rate;
2205         u16 bitrate;
2206
2207         rate = nla_nest_start(msg, attr);
2208         if (!rate)
2209                 goto nla_put_failure;
2210
2211         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2212         bitrate = cfg80211_calculate_bitrate(info);
2213         if (bitrate > 0)
2214                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2215
2216         if (info->flags & RATE_INFO_FLAGS_MCS)
2217                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2218         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2219                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2220         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2221                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2222
2223         nla_nest_end(msg, rate);
2224         return true;
2225
2226 nla_put_failure:
2227         return false;
2228 }
2229
2230 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2231                                 int flags, struct net_device *dev,
2232                                 const u8 *mac_addr, struct station_info *sinfo)
2233 {
2234         void *hdr;
2235         struct nlattr *sinfoattr, *bss_param;
2236
2237         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2238         if (!hdr)
2239                 return -1;
2240
2241         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2242         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2243
2244         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2245
2246         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2247         if (!sinfoattr)
2248                 goto nla_put_failure;
2249         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2250                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2251                             sinfo->connected_time);
2252         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2253                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2254                             sinfo->inactive_time);
2255         if (sinfo->filled & STATION_INFO_RX_BYTES)
2256                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2257                             sinfo->rx_bytes);
2258         if (sinfo->filled & STATION_INFO_TX_BYTES)
2259                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2260                             sinfo->tx_bytes);
2261         if (sinfo->filled & STATION_INFO_LLID)
2262                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2263                             sinfo->llid);
2264         if (sinfo->filled & STATION_INFO_PLID)
2265                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2266                             sinfo->plid);
2267         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2268                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2269                             sinfo->plink_state);
2270         if (sinfo->filled & STATION_INFO_SIGNAL)
2271                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2272                            sinfo->signal);
2273         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2274                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2275                            sinfo->signal_avg);
2276         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2277                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2278                                           NL80211_STA_INFO_TX_BITRATE))
2279                         goto nla_put_failure;
2280         }
2281         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2282                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2283                                           NL80211_STA_INFO_RX_BITRATE))
2284                         goto nla_put_failure;
2285         }
2286         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2287                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2288                             sinfo->rx_packets);
2289         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2290                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2291                             sinfo->tx_packets);
2292         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2293                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2294                             sinfo->tx_retries);
2295         if (sinfo->filled & STATION_INFO_TX_FAILED)
2296                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2297                             sinfo->tx_failed);
2298         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2299                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2300                 if (!bss_param)
2301                         goto nla_put_failure;
2302
2303                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2304                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2305                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2306                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2307                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2308                         NLA_PUT_FLAG(msg,
2309                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2310                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2311                            sinfo->bss_param.dtim_period);
2312                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2313                             sinfo->bss_param.beacon_interval);
2314
2315                 nla_nest_end(msg, bss_param);
2316         }
2317         nla_nest_end(msg, sinfoattr);
2318
2319         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2320                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2321                         sinfo->assoc_req_ies);
2322
2323         return genlmsg_end(msg, hdr);
2324
2325  nla_put_failure:
2326         genlmsg_cancel(msg, hdr);
2327         return -EMSGSIZE;
2328 }
2329
2330 static int nl80211_dump_station(struct sk_buff *skb,
2331                                 struct netlink_callback *cb)
2332 {
2333         struct station_info sinfo;
2334         struct cfg80211_registered_device *dev;
2335         struct net_device *netdev;
2336         u8 mac_addr[ETH_ALEN];
2337         int sta_idx = cb->args[1];
2338         int err;
2339
2340         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2341         if (err)
2342                 return err;
2343
2344         if (!dev->ops->dump_station) {
2345                 err = -EOPNOTSUPP;
2346                 goto out_err;
2347         }
2348
2349         while (1) {
2350                 memset(&sinfo, 0, sizeof(sinfo));
2351                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2352                                              mac_addr, &sinfo);
2353                 if (err == -ENOENT)
2354                         break;
2355                 if (err)
2356                         goto out_err;
2357
2358                 if (nl80211_send_station(skb,
2359                                 NETLINK_CB(cb->skb).pid,
2360                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2361                                 netdev, mac_addr,
2362                                 &sinfo) < 0)
2363                         goto out;
2364
2365                 sta_idx++;
2366         }
2367
2368
2369  out:
2370         cb->args[1] = sta_idx;
2371         err = skb->len;
2372  out_err:
2373         nl80211_finish_netdev_dump(dev);
2374
2375         return err;
2376 }
2377
2378 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2379 {
2380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2381         struct net_device *dev = info->user_ptr[1];
2382         struct station_info sinfo;
2383         struct sk_buff *msg;
2384         u8 *mac_addr = NULL;
2385         int err;
2386
2387         memset(&sinfo, 0, sizeof(sinfo));
2388
2389         if (!info->attrs[NL80211_ATTR_MAC])
2390                 return -EINVAL;
2391
2392         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2393
2394         if (!rdev->ops->get_station)
2395                 return -EOPNOTSUPP;
2396
2397         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2398         if (err)
2399                 return err;
2400
2401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2402         if (!msg)
2403                 return -ENOMEM;
2404
2405         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2406                                  dev, mac_addr, &sinfo) < 0) {
2407                 nlmsg_free(msg);
2408                 return -ENOBUFS;
2409         }
2410
2411         return genlmsg_reply(msg, info);
2412 }
2413
2414 /*
2415  * Get vlan interface making sure it is running and on the right wiphy.
2416  */
2417 static int get_vlan(struct genl_info *info,
2418                     struct cfg80211_registered_device *rdev,
2419                     struct net_device **vlan)
2420 {
2421         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2422         *vlan = NULL;
2423
2424         if (vlanattr) {
2425                 *vlan = dev_get_by_index(genl_info_net(info),
2426                                          nla_get_u32(vlanattr));
2427                 if (!*vlan)
2428                         return -ENODEV;
2429                 if (!(*vlan)->ieee80211_ptr)
2430                         return -EINVAL;
2431                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2432                         return -EINVAL;
2433                 if (!netif_running(*vlan))
2434                         return -ENETDOWN;
2435         }
2436         return 0;
2437 }
2438
2439 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2440 {
2441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2442         int err;
2443         struct net_device *dev = info->user_ptr[1];
2444         struct station_parameters params;
2445         u8 *mac_addr = NULL;
2446
2447         memset(&params, 0, sizeof(params));
2448
2449         params.listen_interval = -1;
2450         params.plink_state = -1;
2451
2452         if (info->attrs[NL80211_ATTR_STA_AID])
2453                 return -EINVAL;
2454
2455         if (!info->attrs[NL80211_ATTR_MAC])
2456                 return -EINVAL;
2457
2458         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2459
2460         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2461                 params.supported_rates =
2462                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2463                 params.supported_rates_len =
2464                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2465         }
2466
2467         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2468                 params.listen_interval =
2469                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2470
2471         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2472                 params.ht_capa =
2473                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2474
2475         if (parse_station_flags(info, &params))
2476                 return -EINVAL;
2477
2478         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2479                 params.plink_action =
2480                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2481
2482         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2483                 params.plink_state =
2484                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2485
2486         err = get_vlan(info, rdev, &params.vlan);
2487         if (err)
2488                 goto out;
2489
2490         /* validate settings */
2491         err = 0;
2492
2493         switch (dev->ieee80211_ptr->iftype) {
2494         case NL80211_IFTYPE_AP:
2495         case NL80211_IFTYPE_AP_VLAN:
2496         case NL80211_IFTYPE_P2P_GO:
2497                 /* disallow mesh-specific things */
2498                 if (params.plink_action)
2499                         err = -EINVAL;
2500                 break;
2501         case NL80211_IFTYPE_P2P_CLIENT:
2502         case NL80211_IFTYPE_STATION:
2503                 /* disallow everything but AUTHORIZED flag */
2504                 if (params.plink_action)
2505                         err = -EINVAL;
2506                 if (params.vlan)
2507                         err = -EINVAL;
2508                 if (params.supported_rates)
2509                         err = -EINVAL;
2510                 if (params.ht_capa)
2511                         err = -EINVAL;
2512                 if (params.listen_interval >= 0)
2513                         err = -EINVAL;
2514                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2515                         err = -EINVAL;
2516                 break;
2517         case NL80211_IFTYPE_MESH_POINT:
2518                 /* disallow things mesh doesn't support */
2519                 if (params.vlan)
2520                         err = -EINVAL;
2521                 if (params.ht_capa)
2522                         err = -EINVAL;
2523                 if (params.listen_interval >= 0)
2524                         err = -EINVAL;
2525                 if (params.sta_flags_mask &
2526                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2527                                   BIT(NL80211_STA_FLAG_MFP) |
2528                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2529                         err = -EINVAL;
2530                 break;
2531         default:
2532                 err = -EINVAL;
2533         }
2534
2535         if (err)
2536                 goto out;
2537
2538         if (!rdev->ops->change_station) {
2539                 err = -EOPNOTSUPP;
2540                 goto out;
2541         }
2542
2543         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2544
2545  out:
2546         if (params.vlan)
2547                 dev_put(params.vlan);
2548
2549         return err;
2550 }
2551
2552 static struct nla_policy
2553 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2554         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2555         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2556 };
2557
2558 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2559 {
2560         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2561         int err;
2562         struct net_device *dev = info->user_ptr[1];
2563         struct station_parameters params;
2564         u8 *mac_addr = NULL;
2565
2566         memset(&params, 0, sizeof(params));
2567
2568         if (!info->attrs[NL80211_ATTR_MAC])
2569                 return -EINVAL;
2570
2571         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2572                 return -EINVAL;
2573
2574         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2575                 return -EINVAL;
2576
2577         if (!info->attrs[NL80211_ATTR_STA_AID])
2578                 return -EINVAL;
2579
2580         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2581         params.supported_rates =
2582                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2583         params.supported_rates_len =
2584                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2585         params.listen_interval =
2586                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2587
2588         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2589         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2590                 return -EINVAL;
2591
2592         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2593                 params.ht_capa =
2594                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2595
2596         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2597                 params.plink_action =
2598                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2599
2600         if (parse_station_flags(info, &params))
2601                 return -EINVAL;
2602
2603         /* parse WME attributes if sta is WME capable */
2604         if ((params.sta_flags_set & NL80211_STA_FLAG_WME) &&
2605             info->attrs[NL80211_ATTR_STA_WME]) {
2606                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2607                 struct nlattr *nla;
2608
2609                 nla = info->attrs[NL80211_ATTR_STA_WME];
2610                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2611                                        nl80211_sta_wme_policy);
2612                 if (err)
2613                         return err;
2614
2615                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2616                         params.uapsd_queues =
2617                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2618
2619                 if (tb[NL80211_STA_WME_MAX_SP])
2620                         params.max_sp =
2621                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2622         }
2623
2624         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2625             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2626             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2627             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2628                 return -EINVAL;
2629
2630         err = get_vlan(info, rdev, &params.vlan);
2631         if (err)
2632                 goto out;
2633
2634         /* validate settings */
2635         err = 0;
2636
2637         if (!rdev->ops->add_station) {
2638                 err = -EOPNOTSUPP;
2639                 goto out;
2640         }
2641
2642         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2643
2644  out:
2645         if (params.vlan)
2646                 dev_put(params.vlan);
2647         return err;
2648 }
2649
2650 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2651 {
2652         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2653         struct net_device *dev = info->user_ptr[1];
2654         u8 *mac_addr = NULL;
2655
2656         if (info->attrs[NL80211_ATTR_MAC])
2657                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2658
2659         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2660             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2661             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2662             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2663                 return -EINVAL;
2664
2665         if (!rdev->ops->del_station)
2666                 return -EOPNOTSUPP;
2667
2668         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2669 }
2670
2671 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2672                                 int flags, struct net_device *dev,
2673                                 u8 *dst, u8 *next_hop,
2674                                 struct mpath_info *pinfo)
2675 {
2676         void *hdr;
2677         struct nlattr *pinfoattr;
2678
2679         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2680         if (!hdr)
2681                 return -1;
2682
2683         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2684         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2685         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2686
2687         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2688
2689         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2690         if (!pinfoattr)
2691                 goto nla_put_failure;
2692         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2693                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2694                             pinfo->frame_qlen);
2695         if (pinfo->filled & MPATH_INFO_SN)
2696                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2697                             pinfo->sn);
2698         if (pinfo->filled & MPATH_INFO_METRIC)
2699                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2700                             pinfo->metric);
2701         if (pinfo->filled & MPATH_INFO_EXPTIME)
2702                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2703                             pinfo->exptime);
2704         if (pinfo->filled & MPATH_INFO_FLAGS)
2705                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2706                             pinfo->flags);
2707         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2708                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2709                             pinfo->discovery_timeout);
2710         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2711                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2712                             pinfo->discovery_retries);
2713
2714         nla_nest_end(msg, pinfoattr);
2715
2716         return genlmsg_end(msg, hdr);
2717
2718  nla_put_failure:
2719         genlmsg_cancel(msg, hdr);
2720         return -EMSGSIZE;
2721 }
2722
2723 static int nl80211_dump_mpath(struct sk_buff *skb,
2724                               struct netlink_callback *cb)
2725 {
2726         struct mpath_info pinfo;
2727         struct cfg80211_registered_device *dev;
2728         struct net_device *netdev;
2729         u8 dst[ETH_ALEN];
2730         u8 next_hop[ETH_ALEN];
2731         int path_idx = cb->args[1];
2732         int err;
2733
2734         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2735         if (err)
2736                 return err;
2737
2738         if (!dev->ops->dump_mpath) {
2739                 err = -EOPNOTSUPP;
2740                 goto out_err;
2741         }
2742
2743         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2744                 err = -EOPNOTSUPP;
2745                 goto out_err;
2746         }
2747
2748         while (1) {
2749                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2750                                            dst, next_hop, &pinfo);
2751                 if (err == -ENOENT)
2752                         break;
2753                 if (err)
2754                         goto out_err;
2755
2756                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2757                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2758                                        netdev, dst, next_hop,
2759                                        &pinfo) < 0)
2760                         goto out;
2761
2762                 path_idx++;
2763         }
2764
2765
2766  out:
2767         cb->args[1] = path_idx;
2768         err = skb->len;
2769  out_err:
2770         nl80211_finish_netdev_dump(dev);
2771         return err;
2772 }
2773
2774 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2775 {
2776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2777         int err;
2778         struct net_device *dev = info->user_ptr[1];
2779         struct mpath_info pinfo;
2780         struct sk_buff *msg;
2781         u8 *dst = NULL;
2782         u8 next_hop[ETH_ALEN];
2783
2784         memset(&pinfo, 0, sizeof(pinfo));
2785
2786         if (!info->attrs[NL80211_ATTR_MAC])
2787                 return -EINVAL;
2788
2789         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2790
2791         if (!rdev->ops->get_mpath)
2792                 return -EOPNOTSUPP;
2793
2794         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2795                 return -EOPNOTSUPP;
2796
2797         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2798         if (err)
2799                 return err;
2800
2801         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2802         if (!msg)
2803                 return -ENOMEM;
2804
2805         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2806                                  dev, dst, next_hop, &pinfo) < 0) {
2807                 nlmsg_free(msg);
2808                 return -ENOBUFS;
2809         }
2810
2811         return genlmsg_reply(msg, info);
2812 }
2813
2814 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2815 {
2816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2817         struct net_device *dev = info->user_ptr[1];
2818         u8 *dst = NULL;
2819         u8 *next_hop = NULL;
2820
2821         if (!info->attrs[NL80211_ATTR_MAC])
2822                 return -EINVAL;
2823
2824         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2825                 return -EINVAL;
2826
2827         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2828         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2829
2830         if (!rdev->ops->change_mpath)
2831                 return -EOPNOTSUPP;
2832
2833         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2834                 return -EOPNOTSUPP;
2835
2836         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2837 }
2838
2839 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2840 {
2841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2842         struct net_device *dev = info->user_ptr[1];
2843         u8 *dst = NULL;
2844         u8 *next_hop = NULL;
2845
2846         if (!info->attrs[NL80211_ATTR_MAC])
2847                 return -EINVAL;
2848
2849         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2850                 return -EINVAL;
2851
2852         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2853         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2854
2855         if (!rdev->ops->add_mpath)
2856                 return -EOPNOTSUPP;
2857
2858         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2859                 return -EOPNOTSUPP;
2860
2861         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2862 }
2863
2864 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2865 {
2866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2867         struct net_device *dev = info->user_ptr[1];
2868         u8 *dst = NULL;
2869
2870         if (info->attrs[NL80211_ATTR_MAC])
2871                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2872
2873         if (!rdev->ops->del_mpath)
2874                 return -EOPNOTSUPP;
2875
2876         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2877 }
2878
2879 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2880 {
2881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2882         struct net_device *dev = info->user_ptr[1];
2883         struct bss_parameters params;
2884
2885         memset(&params, 0, sizeof(params));
2886         /* default to not changing parameters */
2887         params.use_cts_prot = -1;
2888         params.use_short_preamble = -1;
2889         params.use_short_slot_time = -1;
2890         params.ap_isolate = -1;
2891         params.ht_opmode = -1;
2892
2893         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2894                 params.use_cts_prot =
2895                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2896         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2897                 params.use_short_preamble =
2898                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2899         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2900                 params.use_short_slot_time =
2901                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2902         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2903                 params.basic_rates =
2904                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2905                 params.basic_rates_len =
2906                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2907         }
2908         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2909                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2910         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2911                 params.ht_opmode =
2912                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2913
2914         if (!rdev->ops->change_bss)
2915                 return -EOPNOTSUPP;
2916
2917         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2918             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2919                 return -EOPNOTSUPP;
2920
2921         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2922 }
2923
2924 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2925         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2926         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2927         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2928         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2929         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2930         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2931 };
2932
2933 static int parse_reg_rule(struct nlattr *tb[],
2934         struct ieee80211_reg_rule *reg_rule)
2935 {
2936         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2937         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2938
2939         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2940                 return -EINVAL;
2941         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2942                 return -EINVAL;
2943         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2944                 return -EINVAL;
2945         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2946                 return -EINVAL;
2947         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2948                 return -EINVAL;
2949
2950         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2951
2952         freq_range->start_freq_khz =
2953                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2954         freq_range->end_freq_khz =
2955                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2956         freq_range->max_bandwidth_khz =
2957                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2958
2959         power_rule->max_eirp =
2960                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2961
2962         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2963                 power_rule->max_antenna_gain =
2964                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2965
2966         return 0;
2967 }
2968
2969 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2970 {
2971         int r;
2972         char *data = NULL;
2973
2974         /*
2975          * You should only get this when cfg80211 hasn't yet initialized
2976          * completely when built-in to the kernel right between the time
2977          * window between nl80211_init() and regulatory_init(), if that is
2978          * even possible.
2979          */
2980         mutex_lock(&cfg80211_mutex);
2981         if (unlikely(!cfg80211_regdomain)) {
2982                 mutex_unlock(&cfg80211_mutex);
2983                 return -EINPROGRESS;
2984         }
2985         mutex_unlock(&cfg80211_mutex);
2986
2987         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2988                 return -EINVAL;
2989
2990         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2991
2992         r = regulatory_hint_user(data);
2993
2994         return r;
2995 }
2996
2997 static int nl80211_get_mesh_config(struct sk_buff *skb,
2998                                    struct genl_info *info)
2999 {
3000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3001         struct net_device *dev = info->user_ptr[1];
3002         struct wireless_dev *wdev = dev->ieee80211_ptr;
3003         struct mesh_config cur_params;
3004         int err = 0;
3005         void *hdr;
3006         struct nlattr *pinfoattr;
3007         struct sk_buff *msg;
3008
3009         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3010                 return -EOPNOTSUPP;
3011
3012         if (!rdev->ops->get_mesh_config)
3013                 return -EOPNOTSUPP;
3014
3015         wdev_lock(wdev);
3016         /* If not connected, get default parameters */
3017         if (!wdev->mesh_id_len)
3018                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3019         else
3020                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3021                                                  &cur_params);
3022         wdev_unlock(wdev);
3023
3024         if (err)
3025                 return err;
3026
3027         /* Draw up a netlink message to send back */
3028         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3029         if (!msg)
3030                 return -ENOMEM;
3031         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3032                              NL80211_CMD_GET_MESH_CONFIG);
3033         if (!hdr)
3034                 goto out;
3035         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3036         if (!pinfoattr)
3037                 goto nla_put_failure;
3038         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3039         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3040                         cur_params.dot11MeshRetryTimeout);
3041         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3042                         cur_params.dot11MeshConfirmTimeout);
3043         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3044                         cur_params.dot11MeshHoldingTimeout);
3045         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3046                         cur_params.dot11MeshMaxPeerLinks);
3047         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3048                         cur_params.dot11MeshMaxRetries);
3049         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3050                         cur_params.dot11MeshTTL);
3051         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3052                         cur_params.element_ttl);
3053         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3054                         cur_params.auto_open_plinks);
3055         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3056                         cur_params.dot11MeshHWMPmaxPREQretries);
3057         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3058                         cur_params.path_refresh_time);
3059         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3060                         cur_params.min_discovery_timeout);
3061         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3062                         cur_params.dot11MeshHWMPactivePathTimeout);
3063         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3064                         cur_params.dot11MeshHWMPpreqMinInterval);
3065         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3066                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3067         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3068                         cur_params.dot11MeshHWMPRootMode);
3069         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3070                         cur_params.dot11MeshHWMPRannInterval);
3071         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3072                         cur_params.dot11MeshGateAnnouncementProtocol);
3073         nla_nest_end(msg, pinfoattr);
3074         genlmsg_end(msg, hdr);
3075         return genlmsg_reply(msg, info);
3076
3077  nla_put_failure:
3078         genlmsg_cancel(msg, hdr);
3079  out:
3080         nlmsg_free(msg);
3081         return -ENOBUFS;
3082 }
3083
3084 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3085         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3086         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3087         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3088         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3089         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3090         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3091         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3092         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3093
3094         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3095         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3096         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3097         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3098         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3099         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3100         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3101         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3102         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3103 };
3104
3105 static const struct nla_policy
3106         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3107         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3108         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3109         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3110         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3111                 .len = IEEE80211_MAX_DATA_LEN },
3112         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3113 };
3114
3115 static int nl80211_parse_mesh_config(struct genl_info *info,
3116                                      struct mesh_config *cfg,
3117                                      u32 *mask_out)
3118 {
3119         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3120         u32 mask = 0;
3121
3122 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3123 do {\
3124         if (table[attr_num]) {\
3125                 cfg->param = nla_fn(table[attr_num]); \
3126                 mask |= (1 << (attr_num - 1)); \
3127         } \
3128 } while (0);\
3129
3130
3131         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3132                 return -EINVAL;
3133         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3134                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3135                              nl80211_meshconf_params_policy))
3136                 return -EINVAL;
3137
3138         /* This makes sure that there aren't more than 32 mesh config
3139          * parameters (otherwise our bitfield scheme would not work.) */
3140         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3141
3142         /* Fill in the params struct */
3143         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3144                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3145         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3146                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3147         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3148                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3149         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3150                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3151         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3152                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3153         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3154                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3155         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3156                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3157         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3158                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3159         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3160                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3161                         nla_get_u8);
3162         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3163                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3164         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3165                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3166                         nla_get_u16);
3167         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3168                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3169                         nla_get_u32);
3170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3171                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3172                         nla_get_u16);
3173         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3174                         dot11MeshHWMPnetDiameterTraversalTime,
3175                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3176                         nla_get_u16);
3177         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3178                         dot11MeshHWMPRootMode, mask,
3179                         NL80211_MESHCONF_HWMP_ROOTMODE,
3180                         nla_get_u8);
3181         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3182                         dot11MeshHWMPRannInterval, mask,
3183                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3184                         nla_get_u16);
3185         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3186                         dot11MeshGateAnnouncementProtocol, mask,
3187                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3188                         nla_get_u8);
3189         if (mask_out)
3190                 *mask_out = mask;
3191
3192         return 0;
3193
3194 #undef FILL_IN_MESH_PARAM_IF_SET
3195 }
3196
3197 static int nl80211_parse_mesh_setup(struct genl_info *info,
3198                                      struct mesh_setup *setup)
3199 {
3200         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3201
3202         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3203                 return -EINVAL;
3204         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3205                              info->attrs[NL80211_ATTR_MESH_SETUP],
3206                              nl80211_mesh_setup_params_policy))
3207                 return -EINVAL;
3208
3209         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3210                 setup->path_sel_proto =
3211                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3212                  IEEE80211_PATH_PROTOCOL_VENDOR :
3213                  IEEE80211_PATH_PROTOCOL_HWMP;
3214
3215         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3216                 setup->path_metric =
3217                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3218                  IEEE80211_PATH_METRIC_VENDOR :
3219                  IEEE80211_PATH_METRIC_AIRTIME;
3220
3221
3222         if (tb[NL80211_MESH_SETUP_IE]) {
3223                 struct nlattr *ieattr =
3224                         tb[NL80211_MESH_SETUP_IE];
3225                 if (!is_valid_ie_attr(ieattr))
3226                         return -EINVAL;
3227                 setup->ie = nla_data(ieattr);
3228                 setup->ie_len = nla_len(ieattr);
3229         }
3230         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3231         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3232
3233         return 0;
3234 }
3235
3236 static int nl80211_update_mesh_config(struct sk_buff *skb,
3237                                       struct genl_info *info)
3238 {
3239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3240         struct net_device *dev = info->user_ptr[1];
3241         struct wireless_dev *wdev = dev->ieee80211_ptr;
3242         struct mesh_config cfg;
3243         u32 mask;
3244         int err;
3245
3246         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3247                 return -EOPNOTSUPP;
3248
3249         if (!rdev->ops->update_mesh_config)
3250                 return -EOPNOTSUPP;
3251
3252         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3253         if (err)
3254                 return err;
3255
3256         wdev_lock(wdev);
3257         if (!wdev->mesh_id_len)
3258                 err = -ENOLINK;
3259
3260         if (!err)
3261                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3262                                                     mask, &cfg);
3263
3264         wdev_unlock(wdev);
3265
3266         return err;
3267 }
3268
3269 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3270 {
3271         struct sk_buff *msg;
3272         void *hdr = NULL;
3273         struct nlattr *nl_reg_rules;
3274         unsigned int i;
3275         int err = -EINVAL;
3276
3277         mutex_lock(&cfg80211_mutex);
3278
3279         if (!cfg80211_regdomain)
3280                 goto out;
3281
3282         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3283         if (!msg) {
3284                 err = -ENOBUFS;
3285                 goto out;
3286         }
3287
3288         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3289                              NL80211_CMD_GET_REG);
3290         if (!hdr)
3291                 goto put_failure;
3292
3293         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3294                 cfg80211_regdomain->alpha2);
3295
3296         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3297         if (!nl_reg_rules)
3298                 goto nla_put_failure;
3299
3300         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3301                 struct nlattr *nl_reg_rule;
3302                 const struct ieee80211_reg_rule *reg_rule;
3303                 const struct ieee80211_freq_range *freq_range;
3304                 const struct ieee80211_power_rule *power_rule;
3305
3306                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3307                 freq_range = &reg_rule->freq_range;
3308                 power_rule = &reg_rule->power_rule;
3309
3310                 nl_reg_rule = nla_nest_start(msg, i);
3311                 if (!nl_reg_rule)
3312                         goto nla_put_failure;
3313
3314                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3315                         reg_rule->flags);
3316                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3317                         freq_range->start_freq_khz);
3318                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3319                         freq_range->end_freq_khz);
3320                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3321                         freq_range->max_bandwidth_khz);
3322                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3323                         power_rule->max_antenna_gain);
3324                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3325                         power_rule->max_eirp);
3326
3327                 nla_nest_end(msg, nl_reg_rule);
3328         }
3329
3330         nla_nest_end(msg, nl_reg_rules);
3331
3332         genlmsg_end(msg, hdr);
3333         err = genlmsg_reply(msg, info);
3334         goto out;
3335
3336 nla_put_failure:
3337         genlmsg_cancel(msg, hdr);
3338 put_failure:
3339         nlmsg_free(msg);
3340         err = -EMSGSIZE;
3341 out:
3342         mutex_unlock(&cfg80211_mutex);
3343         return err;
3344 }
3345
3346 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3347 {
3348         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3349         struct nlattr *nl_reg_rule;
3350         char *alpha2 = NULL;
3351         int rem_reg_rules = 0, r = 0;
3352         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3353         struct ieee80211_regdomain *rd = NULL;
3354
3355         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3356                 return -EINVAL;
3357
3358         if (!info->attrs[NL80211_ATTR_REG_RULES])
3359                 return -EINVAL;
3360
3361         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3362
3363         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3364                         rem_reg_rules) {
3365                 num_rules++;
3366                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3367                         return -EINVAL;
3368         }
3369
3370         mutex_lock(&cfg80211_mutex);
3371
3372         if (!reg_is_valid_request(alpha2)) {
3373                 r = -EINVAL;
3374                 goto bad_reg;
3375         }
3376
3377         size_of_regd = sizeof(struct ieee80211_regdomain) +
3378                 (num_rules * sizeof(struct ieee80211_reg_rule));
3379
3380         rd = kzalloc(size_of_regd, GFP_KERNEL);
3381         if (!rd) {
3382                 r = -ENOMEM;
3383                 goto bad_reg;
3384         }
3385
3386         rd->n_reg_rules = num_rules;
3387         rd->alpha2[0] = alpha2[0];
3388         rd->alpha2[1] = alpha2[1];
3389
3390         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3391                         rem_reg_rules) {
3392                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3393                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3394                         reg_rule_policy);
3395                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3396                 if (r)
3397                         goto bad_reg;
3398
3399                 rule_idx++;
3400
3401                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3402                         r = -EINVAL;
3403                         goto bad_reg;
3404                 }
3405         }
3406
3407         BUG_ON(rule_idx != num_rules);
3408
3409         r = set_regdom(rd);
3410
3411         mutex_unlock(&cfg80211_mutex);
3412
3413         return r;
3414
3415  bad_reg:
3416         mutex_unlock(&cfg80211_mutex);
3417         kfree(rd);
3418         return r;
3419 }
3420
3421 static int validate_scan_freqs(struct nlattr *freqs)
3422 {
3423         struct nlattr *attr1, *attr2;
3424         int n_channels = 0, tmp1, tmp2;
3425
3426         nla_for_each_nested(attr1, freqs, tmp1) {
3427                 n_channels++;
3428                 /*
3429                  * Some hardware has a limited channel list for
3430                  * scanning, and it is pretty much nonsensical
3431                  * to scan for a channel twice, so disallow that
3432                  * and don't require drivers to check that the
3433                  * channel list they get isn't longer than what
3434                  * they can scan, as long as they can scan all
3435                  * the channels they registered at once.
3436                  */
3437                 nla_for_each_nested(attr2, freqs, tmp2)
3438                         if (attr1 != attr2 &&
3439                             nla_get_u32(attr1) == nla_get_u32(attr2))
3440                                 return 0;
3441         }
3442
3443         return n_channels;
3444 }
3445
3446 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3447 {
3448         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3449         struct net_device *dev = info->user_ptr[1];
3450         struct cfg80211_scan_request *request;
3451         struct nlattr *attr;
3452         struct wiphy *wiphy;
3453         int err, tmp, n_ssids = 0, n_channels, i;
3454         size_t ie_len;
3455
3456         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3457                 return -EINVAL;
3458
3459         wiphy = &rdev->wiphy;
3460
3461         if (!rdev->ops->scan)
3462                 return -EOPNOTSUPP;
3463
3464         if (rdev->scan_req)
3465                 return -EBUSY;
3466
3467         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3468                 n_channels = validate_scan_freqs(
3469                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3470                 if (!n_channels)
3471                         return -EINVAL;
3472         } else {
3473                 enum ieee80211_band band;
3474                 n_channels = 0;
3475
3476                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3477                         if (wiphy->bands[band])
3478                                 n_channels += wiphy->bands[band]->n_channels;
3479         }
3480
3481         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3482                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3483                         n_ssids++;
3484
3485         if (n_ssids > wiphy->max_scan_ssids)
3486                 return -EINVAL;
3487
3488         if (info->attrs[NL80211_ATTR_IE])
3489                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3490         else
3491                 ie_len = 0;
3492
3493         if (ie_len > wiphy->max_scan_ie_len)
3494                 return -EINVAL;
3495
3496         request = kzalloc(sizeof(*request)
3497                         + sizeof(*request->ssids) * n_ssids
3498                         + sizeof(*request->channels) * n_channels
3499                         + ie_len, GFP_KERNEL);
3500         if (!request)
3501                 return -ENOMEM;
3502
3503         if (n_ssids)
3504                 request->ssids = (void *)&request->channels[n_channels];
3505         request->n_ssids = n_ssids;
3506         if (ie_len) {
3507                 if (request->ssids)
3508                         request->ie = (void *)(request->ssids + n_ssids);
3509                 else
3510                         request->ie = (void *)(request->channels + n_channels);
3511         }
3512
3513         i = 0;
3514         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3515                 /* user specified, bail out if channel not found */
3516                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3517                         struct ieee80211_channel *chan;
3518
3519                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3520
3521                         if (!chan) {
3522                                 err = -EINVAL;
3523                                 goto out_free;
3524                         }
3525
3526                         /* ignore disabled channels */
3527                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3528                                 continue;
3529
3530                         request->channels[i] = chan;
3531                         i++;
3532                 }
3533         } else {
3534                 enum ieee80211_band band;
3535
3536                 /* all channels */
3537                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3538                         int j;
3539                         if (!wiphy->bands[band])
3540                                 continue;
3541                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3542                                 struct ieee80211_channel *chan;
3543
3544                                 chan = &wiphy->bands[band]->channels[j];
3545
3546                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3547                                         continue;
3548
3549                                 request->channels[i] = chan;
3550                                 i++;
3551                         }
3552                 }
3553         }
3554
3555         if (!i) {
3556                 err = -EINVAL;
3557                 goto out_free;
3558         }
3559
3560         request->n_channels = i;
3561
3562         i = 0;
3563         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3564                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3565                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3566                                 err = -EINVAL;
3567                                 goto out_free;
3568                         }
3569                         request->ssids[i].ssid_len = nla_len(attr);
3570                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3571                         i++;
3572                 }
3573         }
3574
3575         if (info->attrs[NL80211_ATTR_IE]) {
3576                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3577                 memcpy((void *)request->ie,
3578                        nla_data(info->attrs[NL80211_ATTR_IE]),
3579                        request->ie_len);
3580         }
3581
3582         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3583                 if (wiphy->bands[i])
3584                         request->rates[i] =
3585                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3586
3587         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3588                 nla_for_each_nested(attr,
3589                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3590                                     tmp) {
3591                         enum ieee80211_band band = nla_type(attr);
3592
3593                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3594                                 err = -EINVAL;
3595                                 goto out_free;
3596                         }
3597                         err = ieee80211_get_ratemask(wiphy->bands[band],
3598                                                      nla_data(attr),
3599                                                      nla_len(attr),
3600                                                      &request->rates[band]);
3601                         if (err)
3602                                 goto out_free;
3603                 }
3604         }
3605
3606         request->dev = dev;
3607         request->wiphy = &rdev->wiphy;
3608
3609         rdev->scan_req = request;
3610         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3611
3612         if (!err) {
3613                 nl80211_send_scan_start(rdev, dev);
3614                 dev_hold(dev);
3615         } else {
3616  out_free:
3617                 rdev->scan_req = NULL;
3618                 kfree(request);
3619         }
3620
3621         return err;
3622 }
3623
3624 static int nl80211_start_sched_scan(struct sk_buff *skb,
3625                                     struct genl_info *info)
3626 {
3627         struct cfg80211_sched_scan_request *request;
3628         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3629         struct net_device *dev = info->user_ptr[1];
3630         struct nlattr *attr;
3631         struct wiphy *wiphy;
3632         int err, tmp, n_ssids = 0, n_channels, i;
3633         u32 interval;
3634         enum ieee80211_band band;
3635         size_t ie_len;
3636
3637         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3638             !rdev->ops->sched_scan_start)
3639                 return -EOPNOTSUPP;
3640
3641         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3642                 return -EINVAL;
3643
3644         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3645                 return -EINVAL;
3646
3647         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3648         if (interval == 0)
3649                 return -EINVAL;
3650
3651         wiphy = &rdev->wiphy;
3652
3653         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3654                 n_channels = validate_scan_freqs(
3655                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3656                 if (!n_channels)
3657                         return -EINVAL;
3658         } else {
3659                 n_channels = 0;
3660
3661                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3662                         if (wiphy->bands[band])
3663                                 n_channels += wiphy->bands[band]->n_channels;
3664         }
3665
3666         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3667                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3668                                     tmp)
3669                         n_ssids++;
3670
3671         if (n_ssids > wiphy->max_sched_scan_ssids)
3672                 return -EINVAL;
3673
3674         if (info->attrs[NL80211_ATTR_IE])
3675                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3676         else
3677                 ie_len = 0;
3678
3679         if (ie_len > wiphy->max_sched_scan_ie_len)
3680                 return -EINVAL;
3681
3682         mutex_lock(&rdev->sched_scan_mtx);
3683
3684         if (rdev->sched_scan_req) {
3685                 err = -EINPROGRESS;
3686                 goto out;
3687         }
3688
3689         request = kzalloc(sizeof(*request)
3690                         + sizeof(*request->ssids) * n_ssids
3691                         + sizeof(*request->channels) * n_channels
3692                         + ie_len, GFP_KERNEL);
3693         if (!request) {
3694                 err = -ENOMEM;
3695                 goto out;
3696         }
3697
3698         if (n_ssids)
3699                 request->ssids = (void *)&request->channels[n_channels];
3700         request->n_ssids = n_ssids;
3701         if (ie_len) {
3702                 if (request->ssids)
3703                         request->ie = (void *)(request->ssids + n_ssids);
3704                 else
3705                         request->ie = (void *)(request->channels + n_channels);
3706         }
3707
3708         i = 0;
3709         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3710                 /* user specified, bail out if channel not found */
3711                 nla_for_each_nested(attr,
3712                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3713                                     tmp) {
3714                         struct ieee80211_channel *chan;
3715
3716                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3717
3718                         if (!chan) {
3719                                 err = -EINVAL;
3720                                 goto out_free;
3721                         }
3722
3723                         /* ignore disabled channels */
3724                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3725                                 continue;
3726
3727                         request->channels[i] = chan;
3728                         i++;
3729                 }
3730         } else {
3731                 /* all channels */
3732                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3733                         int j;
3734                         if (!wiphy->bands[band])
3735                                 continue;
3736                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3737                                 struct ieee80211_channel *chan;
3738
3739                                 chan = &wiphy->bands[band]->channels[j];
3740
3741                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3742                                         continue;
3743
3744                                 request->channels[i] = chan;
3745                                 i++;
3746                         }
3747                 }
3748         }
3749
3750         if (!i) {
3751                 err = -EINVAL;
3752                 goto out_free;
3753         }
3754
3755         request->n_channels = i;
3756
3757         i = 0;
3758         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3759                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3760                                     tmp) {
3761                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3762                                 err = -EINVAL;
3763                                 goto out_free;
3764                         }
3765                         request->ssids[i].ssid_len = nla_len(attr);
3766                         memcpy(request->ssids[i].ssid, nla_data(attr),
3767                                nla_len(attr));
3768                         i++;
3769                 }
3770         }
3771
3772         if (info->attrs[NL80211_ATTR_IE]) {
3773                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3774                 memcpy((void *)request->ie,
3775                        nla_data(info->attrs[NL80211_ATTR_IE]),
3776                        request->ie_len);
3777         }
3778
3779         request->dev = dev;
3780         request->wiphy = &rdev->wiphy;
3781         request->interval = interval;
3782
3783         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3784         if (!err) {
3785                 rdev->sched_scan_req = request;
3786                 nl80211_send_sched_scan(rdev, dev,
3787                                         NL80211_CMD_START_SCHED_SCAN);
3788                 goto out;
3789         }
3790
3791 out_free:
3792         kfree(request);
3793 out:
3794         mutex_unlock(&rdev->sched_scan_mtx);
3795         return err;
3796 }
3797
3798 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3799                                    struct genl_info *info)
3800 {
3801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3802         int err;
3803
3804         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3805             !rdev->ops->sched_scan_stop)
3806                 return -EOPNOTSUPP;
3807
3808         mutex_lock(&rdev->sched_scan_mtx);
3809         err = __cfg80211_stop_sched_scan(rdev, false);
3810         mutex_unlock(&rdev->sched_scan_mtx);
3811
3812         return err;
3813 }
3814
3815 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3816                             u32 seq, int flags,
3817                             struct cfg80211_registered_device *rdev,
3818                             struct wireless_dev *wdev,
3819                             struct cfg80211_internal_bss *intbss)
3820 {
3821         struct cfg80211_bss *res = &intbss->pub;
3822         void *hdr;
3823         struct nlattr *bss;
3824         int i;
3825
3826         ASSERT_WDEV_LOCK(wdev);
3827
3828         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3829                              NL80211_CMD_NEW_SCAN_RESULTS);
3830         if (!hdr)
3831                 return -1;
3832
3833         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3834
3835         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3836         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3837
3838         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3839         if (!bss)
3840                 goto nla_put_failure;
3841         if (!is_zero_ether_addr(res->bssid))
3842                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3843         if (res->information_elements && res->len_information_elements)
3844                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3845                         res->len_information_elements,
3846                         res->information_elements);
3847         if (res->beacon_ies && res->len_beacon_ies &&
3848             res->beacon_ies != res->information_elements)
3849                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3850                         res->len_beacon_ies, res->beacon_ies);
3851         if (res->tsf)
3852                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3853         if (res->beacon_interval)
3854                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3855         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3856         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3857         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3858                 jiffies_to_msecs(jiffies - intbss->ts));
3859
3860         switch (rdev->wiphy.signal_type) {
3861         case CFG80211_SIGNAL_TYPE_MBM:
3862                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3863                 break;
3864         case CFG80211_SIGNAL_TYPE_UNSPEC:
3865                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3866                 break;
3867         default:
3868                 break;
3869         }
3870
3871         switch (wdev->iftype) {
3872         case NL80211_IFTYPE_P2P_CLIENT:
3873         case NL80211_IFTYPE_STATION:
3874                 if (intbss == wdev->current_bss)
3875                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3876                                     NL80211_BSS_STATUS_ASSOCIATED);
3877                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3878                         if (intbss != wdev->auth_bsses[i])
3879                                 continue;
3880                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3881                                     NL80211_BSS_STATUS_AUTHENTICATED);
3882                         break;
3883                 }
3884                 break;
3885         case NL80211_IFTYPE_ADHOC:
3886                 if (intbss == wdev->current_bss)
3887                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3888                                     NL80211_BSS_STATUS_IBSS_JOINED);
3889                 break;
3890         default:
3891                 break;
3892         }
3893
3894         nla_nest_end(msg, bss);
3895
3896         return genlmsg_end(msg, hdr);
3897
3898  nla_put_failure:
3899         genlmsg_cancel(msg, hdr);
3900         return -EMSGSIZE;
3901 }
3902
3903 static int nl80211_dump_scan(struct sk_buff *skb,
3904                              struct netlink_callback *cb)
3905 {
3906         struct cfg80211_registered_device *rdev;
3907         struct net_device *dev;
3908         struct cfg80211_internal_bss *scan;
3909         struct wireless_dev *wdev;
3910         int start = cb->args[1], idx = 0;
3911         int err;
3912
3913         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3914         if (err)
3915                 return err;
3916
3917         wdev = dev->ieee80211_ptr;
3918
3919         wdev_lock(wdev);
3920         spin_lock_bh(&rdev->bss_lock);
3921         cfg80211_bss_expire(rdev);
3922
3923         cb->seq = rdev->bss_generation;
3924
3925         list_for_each_entry(scan, &rdev->bss_list, list) {
3926                 if (++idx <= start)
3927                         continue;
3928                 if (nl80211_send_bss(skb, cb,
3929                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3930                                 rdev, wdev, scan) < 0) {
3931                         idx--;
3932                         break;
3933                 }
3934         }
3935
3936         spin_unlock_bh(&rdev->bss_lock);
3937         wdev_unlock(wdev);
3938
3939         cb->args[1] = idx;
3940         nl80211_finish_netdev_dump(rdev);
3941
3942         return skb->len;
3943 }
3944
3945 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3946                                 int flags, struct net_device *dev,
3947                                 struct survey_info *survey)
3948 {
3949         void *hdr;
3950         struct nlattr *infoattr;
3951
3952         hdr = nl80211hdr_put(msg, pid, seq, flags,
3953                              NL80211_CMD_NEW_SURVEY_RESULTS);
3954         if (!hdr)
3955                 return -ENOMEM;
3956
3957         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3958
3959         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3960         if (!infoattr)
3961                 goto nla_put_failure;
3962
3963         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3964                     survey->channel->center_freq);
3965         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3966                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3967                             survey->noise);
3968         if (survey->filled & SURVEY_INFO_IN_USE)
3969                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3970         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3971                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3972                             survey->channel_time);
3973         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3974                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3975                             survey->channel_time_busy);
3976         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3977                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3978                             survey->channel_time_ext_busy);
3979         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3980                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3981                             survey->channel_time_rx);
3982         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3983                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3984                             survey->channel_time_tx);
3985
3986         nla_nest_end(msg, infoattr);
3987
3988         return genlmsg_end(msg, hdr);
3989
3990  nla_put_failure:
3991         genlmsg_cancel(msg, hdr);
3992         return -EMSGSIZE;
3993 }
3994
3995 static int nl80211_dump_survey(struct sk_buff *skb,
3996                         struct netlink_callback *cb)
3997 {
3998         struct survey_info survey;
3999         struct cfg80211_registered_device *dev;
4000         struct net_device *netdev;
4001         int survey_idx = cb->args[1];
4002         int res;
4003
4004         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4005         if (res)
4006                 return res;
4007
4008         if (!dev->ops->dump_survey) {
4009                 res = -EOPNOTSUPP;
4010                 goto out_err;
4011         }
4012
4013         while (1) {
4014                 struct ieee80211_channel *chan;
4015
4016                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4017                                             &survey);
4018                 if (res == -ENOENT)
4019                         break;
4020                 if (res)
4021                         goto out_err;
4022
4023                 /* Survey without a channel doesn't make sense */
4024                 if (!survey.channel) {
4025                         res = -EINVAL;
4026                         goto out;
4027                 }
4028
4029                 chan = ieee80211_get_channel(&dev->wiphy,
4030                                              survey.channel->center_freq);
4031                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4032                         survey_idx++;
4033                         continue;
4034                 }
4035
4036                 if (nl80211_send_survey(skb,
4037                                 NETLINK_CB(cb->skb).pid,
4038                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4039                                 netdev,
4040                                 &survey) < 0)
4041                         goto out;
4042                 survey_idx++;
4043         }
4044
4045  out:
4046         cb->args[1] = survey_idx;
4047         res = skb->len;
4048  out_err:
4049         nl80211_finish_netdev_dump(dev);
4050         return res;
4051 }
4052
4053 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4054 {
4055         return auth_type <= NL80211_AUTHTYPE_MAX;
4056 }
4057
4058 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4059 {
4060         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4061                                   NL80211_WPA_VERSION_2));
4062 }
4063
4064 static bool nl80211_valid_akm_suite(u32 akm)
4065 {
4066         return akm == WLAN_AKM_SUITE_8021X ||
4067                 akm == WLAN_AKM_SUITE_PSK;
4068 }
4069
4070 static bool nl80211_valid_cipher_suite(u32 cipher)
4071 {
4072         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
4073                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
4074                 cipher == WLAN_CIPHER_SUITE_TKIP ||
4075                 cipher == WLAN_CIPHER_SUITE_CCMP ||
4076                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
4077 }
4078
4079
4080 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4081 {
4082         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4083         struct net_device *dev = info->user_ptr[1];
4084         struct ieee80211_channel *chan;
4085         const u8 *bssid, *ssid, *ie = NULL;
4086         int err, ssid_len, ie_len = 0;
4087         enum nl80211_auth_type auth_type;
4088         struct key_parse key;
4089         bool local_state_change;
4090
4091         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4092                 return -EINVAL;
4093
4094         if (!info->attrs[NL80211_ATTR_MAC])
4095                 return -EINVAL;
4096
4097         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4098                 return -EINVAL;
4099
4100         if (!info->attrs[NL80211_ATTR_SSID])
4101                 return -EINVAL;
4102
4103         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4104                 return -EINVAL;
4105
4106         err = nl80211_parse_key(info, &key);
4107         if (err)
4108                 return err;
4109
4110         if (key.idx >= 0) {
4111                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4112                         return -EINVAL;
4113                 if (!key.p.key || !key.p.key_len)
4114                         return -EINVAL;
4115                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4116                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4117                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4118                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4119                         return -EINVAL;
4120                 if (key.idx > 4)
4121                         return -EINVAL;
4122         } else {
4123                 key.p.key_len = 0;
4124                 key.p.key = NULL;
4125         }
4126
4127         if (key.idx >= 0) {
4128                 int i;
4129                 bool ok = false;
4130                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4131                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4132                                 ok = true;
4133                                 break;
4134                         }
4135                 }
4136                 if (!ok)
4137                         return -EINVAL;
4138         }
4139
4140         if (!rdev->ops->auth)
4141                 return -EOPNOTSUPP;
4142
4143         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4144             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4145                 return -EOPNOTSUPP;
4146
4147         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4148         chan = ieee80211_get_channel(&rdev->wiphy,
4149                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4150         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4151                 return -EINVAL;
4152
4153         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4154         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4155
4156         if (info->attrs[NL80211_ATTR_IE]) {
4157                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4158                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4159         }
4160
4161         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4162         if (!nl80211_valid_auth_type(auth_type))
4163                 return -EINVAL;
4164
4165         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4166
4167         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4168                                   ssid, ssid_len, ie, ie_len,
4169                                   key.p.key, key.p.key_len, key.idx,
4170                                   local_state_change);
4171 }
4172
4173 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4174                                    struct genl_info *info,
4175                                    struct cfg80211_crypto_settings *settings,
4176                                    int cipher_limit)
4177 {
4178         memset(settings, 0, sizeof(*settings));
4179
4180         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4181
4182         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4183                 u16 proto;
4184                 proto = nla_get_u16(
4185                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4186                 settings->control_port_ethertype = cpu_to_be16(proto);
4187                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4188                     proto != ETH_P_PAE)
4189                         return -EINVAL;
4190                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4191                         settings->control_port_no_encrypt = true;
4192         } else
4193                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4194
4195         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4196                 void *data;
4197                 int len, i;
4198
4199                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4200                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4201                 settings->n_ciphers_pairwise = len / sizeof(u32);
4202
4203                 if (len % sizeof(u32))
4204                         return -EINVAL;
4205
4206                 if (settings->n_ciphers_pairwise > cipher_limit)
4207                         return -EINVAL;
4208
4209                 memcpy(settings->ciphers_pairwise, data, len);
4210
4211                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4212                         if (!nl80211_valid_cipher_suite(
4213                                         settings->ciphers_pairwise[i]))
4214                                 return -EINVAL;
4215         }
4216
4217         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4218                 settings->cipher_group =
4219                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4220                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4221                         return -EINVAL;
4222         }
4223
4224         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4225                 settings->wpa_versions =
4226                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4227                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4228                         return -EINVAL;
4229         }
4230
4231         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4232                 void *data;
4233                 int len, i;
4234
4235                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4236                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4237                 settings->n_akm_suites = len / sizeof(u32);
4238
4239                 if (len % sizeof(u32))
4240                         return -EINVAL;
4241
4242                 memcpy(settings->akm_suites, data, len);
4243
4244                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4245                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4246                                 return -EINVAL;
4247         }
4248
4249         return 0;
4250 }
4251
4252 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4253 {
4254         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4255         struct net_device *dev = info->user_ptr[1];
4256         struct cfg80211_crypto_settings crypto;
4257         struct ieee80211_channel *chan;
4258         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4259         int err, ssid_len, ie_len = 0;
4260         bool use_mfp = false;
4261
4262         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4263                 return -EINVAL;
4264
4265         if (!info->attrs[NL80211_ATTR_MAC] ||
4266             !info->attrs[NL80211_ATTR_SSID] ||
4267             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4268                 return -EINVAL;
4269
4270         if (!rdev->ops->assoc)
4271                 return -EOPNOTSUPP;
4272
4273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4274             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4275                 return -EOPNOTSUPP;
4276
4277         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4278
4279         chan = ieee80211_get_channel(&rdev->wiphy,
4280                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4281         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4282                 return -EINVAL;
4283
4284         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4285         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4286
4287         if (info->attrs[NL80211_ATTR_IE]) {
4288                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4289                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4290         }
4291
4292         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4293                 enum nl80211_mfp mfp =
4294                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4295                 if (mfp == NL80211_MFP_REQUIRED)
4296                         use_mfp = true;
4297                 else if (mfp != NL80211_MFP_NO)
4298                         return -EINVAL;
4299         }
4300
4301         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4302                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4303
4304         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4305         if (!err)
4306                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4307                                           ssid, ssid_len, ie, ie_len, use_mfp,
4308                                           &crypto);
4309
4310         return err;
4311 }
4312
4313 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4314 {
4315         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4316         struct net_device *dev = info->user_ptr[1];
4317         const u8 *ie = NULL, *bssid;
4318         int ie_len = 0;
4319         u16 reason_code;
4320         bool local_state_change;
4321
4322         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4323                 return -EINVAL;
4324
4325         if (!info->attrs[NL80211_ATTR_MAC])
4326                 return -EINVAL;
4327
4328         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4329                 return -EINVAL;
4330
4331         if (!rdev->ops->deauth)
4332                 return -EOPNOTSUPP;
4333
4334         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4335             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4336                 return -EOPNOTSUPP;
4337
4338         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4339
4340         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4341         if (reason_code == 0) {
4342                 /* Reason Code 0 is reserved */
4343                 return -EINVAL;
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_IE]) {
4347                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4348                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4349         }
4350
4351         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4352
4353         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4354                                     local_state_change);
4355 }
4356
4357 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4358 {
4359         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4360         struct net_device *dev = info->user_ptr[1];
4361         const u8 *ie = NULL, *bssid;
4362         int ie_len = 0;
4363         u16 reason_code;
4364         bool local_state_change;
4365
4366         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4367                 return -EINVAL;
4368
4369         if (!info->attrs[NL80211_ATTR_MAC])
4370                 return -EINVAL;
4371
4372         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4373                 return -EINVAL;
4374
4375         if (!rdev->ops->disassoc)
4376                 return -EOPNOTSUPP;
4377
4378         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4379             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4380                 return -EOPNOTSUPP;
4381
4382         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4383
4384         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4385         if (reason_code == 0) {
4386                 /* Reason Code 0 is reserved */
4387                 return -EINVAL;
4388         }
4389
4390         if (info->attrs[NL80211_ATTR_IE]) {
4391                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4392                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4393         }
4394
4395         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4396
4397         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4398                                       local_state_change);
4399 }
4400
4401 static bool
4402 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4403                          int mcast_rate[IEEE80211_NUM_BANDS],
4404                          int rateval)
4405 {
4406         struct wiphy *wiphy = &rdev->wiphy;
4407         bool found = false;
4408         int band, i;
4409
4410         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4411                 struct ieee80211_supported_band *sband;
4412
4413                 sband = wiphy->bands[band];
4414                 if (!sband)
4415                         continue;
4416
4417                 for (i = 0; i < sband->n_bitrates; i++) {
4418                         if (sband->bitrates[i].bitrate == rateval) {
4419                                 mcast_rate[band] = i + 1;
4420                                 found = true;
4421                                 break;
4422                         }
4423                 }
4424         }
4425
4426         return found;
4427 }
4428
4429 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4430 {
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         struct net_device *dev = info->user_ptr[1];
4433         struct cfg80211_ibss_params ibss;
4434         struct wiphy *wiphy;
4435         struct cfg80211_cached_keys *connkeys = NULL;
4436         int err;
4437
4438         memset(&ibss, 0, sizeof(ibss));
4439
4440         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4441                 return -EINVAL;
4442
4443         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4444             !info->attrs[NL80211_ATTR_SSID] ||
4445             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4446                 return -EINVAL;
4447
4448         ibss.beacon_interval = 100;
4449
4450         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4451                 ibss.beacon_interval =
4452                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4453                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4454                         return -EINVAL;
4455         }
4456
4457         if (!rdev->ops->join_ibss)
4458                 return -EOPNOTSUPP;
4459
4460         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4461                 return -EOPNOTSUPP;
4462
4463         wiphy = &rdev->wiphy;
4464
4465         if (info->attrs[NL80211_ATTR_MAC])
4466                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4467         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4468         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4469
4470         if (info->attrs[NL80211_ATTR_IE]) {
4471                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4472                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4473         }
4474
4475         ibss.channel = ieee80211_get_channel(wiphy,
4476                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4477         if (!ibss.channel ||
4478             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4479             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4480                 return -EINVAL;
4481
4482         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4483         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4484
4485         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4486                 u8 *rates =
4487                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4488                 int n_rates =
4489                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4490                 struct ieee80211_supported_band *sband =
4491                         wiphy->bands[ibss.channel->band];
4492                 int err;
4493
4494                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4495                                              &ibss.basic_rates);
4496                 if (err)
4497                         return err;
4498         }
4499
4500         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4501             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4502                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4503                 return -EINVAL;
4504
4505         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4506                 connkeys = nl80211_parse_connkeys(rdev,
4507                                         info->attrs[NL80211_ATTR_KEYS]);
4508                 if (IS_ERR(connkeys))
4509                         return PTR_ERR(connkeys);
4510         }
4511
4512         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4513         if (err)
4514                 kfree(connkeys);
4515         return err;
4516 }
4517
4518 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4519 {
4520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4521         struct net_device *dev = info->user_ptr[1];
4522
4523         if (!rdev->ops->leave_ibss)
4524                 return -EOPNOTSUPP;
4525
4526         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4527                 return -EOPNOTSUPP;
4528
4529         return cfg80211_leave_ibss(rdev, dev, false);
4530 }
4531
4532 #ifdef CONFIG_NL80211_TESTMODE
4533 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4534         .name = "testmode",
4535 };
4536
4537 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4538 {
4539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4540         int err;
4541
4542         if (!info->attrs[NL80211_ATTR_TESTDATA])
4543                 return -EINVAL;
4544
4545         err = -EOPNOTSUPP;
4546         if (rdev->ops->testmode_cmd) {
4547                 rdev->testmode_info = info;
4548                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4549                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4550                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4551                 rdev->testmode_info = NULL;
4552         }
4553
4554         return err;
4555 }
4556
4557 static int nl80211_testmode_dump(struct sk_buff *skb,
4558                                  struct netlink_callback *cb)
4559 {
4560         struct cfg80211_registered_device *dev;
4561         int err;
4562         long phy_idx;
4563         void *data = NULL;
4564         int data_len = 0;
4565
4566         if (cb->args[0]) {
4567                 /*
4568                  * 0 is a valid index, but not valid for args[0],
4569                  * so we need to offset by 1.
4570                  */
4571                 phy_idx = cb->args[0] - 1;
4572         } else {
4573                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4574                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4575                                   nl80211_policy);
4576                 if (err)
4577                         return err;
4578                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4579                         return -EINVAL;
4580                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4581                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4582                         cb->args[1] =
4583                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4584         }
4585
4586         if (cb->args[1]) {
4587                 data = nla_data((void *)cb->args[1]);
4588                 data_len = nla_len((void *)cb->args[1]);
4589         }
4590
4591         mutex_lock(&cfg80211_mutex);
4592         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4593         if (!dev) {
4594                 mutex_unlock(&cfg80211_mutex);
4595                 return -ENOENT;
4596         }
4597         cfg80211_lock_rdev(dev);
4598         mutex_unlock(&cfg80211_mutex);
4599
4600         if (!dev->ops->testmode_dump) {
4601                 err = -EOPNOTSUPP;
4602                 goto out_err;
4603         }
4604
4605         while (1) {
4606                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4607                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4608                                            NL80211_CMD_TESTMODE);
4609                 struct nlattr *tmdata;
4610
4611                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4612                         genlmsg_cancel(skb, hdr);
4613                         break;
4614                 }
4615
4616                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4617                 if (!tmdata) {
4618                         genlmsg_cancel(skb, hdr);
4619                         break;
4620                 }
4621                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4622                                               data, data_len);
4623                 nla_nest_end(skb, tmdata);
4624
4625                 if (err == -ENOBUFS || err == -ENOENT) {
4626                         genlmsg_cancel(skb, hdr);
4627                         break;
4628                 } else if (err) {
4629                         genlmsg_cancel(skb, hdr);
4630                         goto out_err;
4631                 }
4632
4633                 genlmsg_end(skb, hdr);
4634         }
4635
4636         err = skb->len;
4637         /* see above */
4638         cb->args[0] = phy_idx + 1;
4639  out_err:
4640         cfg80211_unlock_rdev(dev);
4641         return err;
4642 }
4643
4644 static struct sk_buff *
4645 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4646                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4647 {
4648         struct sk_buff *skb;
4649         void *hdr;
4650         struct nlattr *data;
4651
4652         skb = nlmsg_new(approxlen + 100, gfp);
4653         if (!skb)
4654                 return NULL;
4655
4656         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4657         if (!hdr) {
4658                 kfree_skb(skb);
4659                 return NULL;
4660         }
4661
4662         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4663         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4664
4665         ((void **)skb->cb)[0] = rdev;
4666         ((void **)skb->cb)[1] = hdr;
4667         ((void **)skb->cb)[2] = data;
4668
4669         return skb;
4670
4671  nla_put_failure:
4672         kfree_skb(skb);
4673         return NULL;
4674 }
4675
4676 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4677                                                   int approxlen)
4678 {
4679         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4680
4681         if (WARN_ON(!rdev->testmode_info))
4682                 return NULL;
4683
4684         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4685                                 rdev->testmode_info->snd_pid,
4686                                 rdev->testmode_info->snd_seq,
4687                                 GFP_KERNEL);
4688 }
4689 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4690
4691 int cfg80211_testmode_reply(struct sk_buff *skb)
4692 {
4693         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4694         void *hdr = ((void **)skb->cb)[1];
4695         struct nlattr *data = ((void **)skb->cb)[2];
4696
4697         if (WARN_ON(!rdev->testmode_info)) {
4698                 kfree_skb(skb);
4699                 return -EINVAL;
4700         }
4701
4702         nla_nest_end(skb, data);
4703         genlmsg_end(skb, hdr);
4704         return genlmsg_reply(skb, rdev->testmode_info);
4705 }
4706 EXPORT_SYMBOL(cfg80211_testmode_reply);
4707
4708 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4709                                                   int approxlen, gfp_t gfp)
4710 {
4711         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4712
4713         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4714 }
4715 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4716
4717 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4718 {
4719         void *hdr = ((void **)skb->cb)[1];
4720         struct nlattr *data = ((void **)skb->cb)[2];
4721
4722         nla_nest_end(skb, data);
4723         genlmsg_end(skb, hdr);
4724         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4725 }
4726 EXPORT_SYMBOL(cfg80211_testmode_event);
4727 #endif
4728
4729 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4730 {
4731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4732         struct net_device *dev = info->user_ptr[1];
4733         struct cfg80211_connect_params connect;
4734         struct wiphy *wiphy;
4735         struct cfg80211_cached_keys *connkeys = NULL;
4736         int err;
4737
4738         memset(&connect, 0, sizeof(connect));
4739
4740         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4741                 return -EINVAL;
4742
4743         if (!info->attrs[NL80211_ATTR_SSID] ||
4744             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4745                 return -EINVAL;
4746
4747         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4748                 connect.auth_type =
4749                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4750                 if (!nl80211_valid_auth_type(connect.auth_type))
4751                         return -EINVAL;
4752         } else
4753                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4754
4755         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4756
4757         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4758                                       NL80211_MAX_NR_CIPHER_SUITES);
4759         if (err)
4760                 return err;
4761
4762         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4763             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4764                 return -EOPNOTSUPP;
4765
4766         wiphy = &rdev->wiphy;
4767
4768         if (info->attrs[NL80211_ATTR_MAC])
4769                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4770         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4771         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4772
4773         if (info->attrs[NL80211_ATTR_IE]) {
4774                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4775                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4776         }
4777
4778         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4779                 connect.channel =
4780                         ieee80211_get_channel(wiphy,
4781                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4782                 if (!connect.channel ||
4783                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4784                         return -EINVAL;
4785         }
4786
4787         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4788                 connkeys = nl80211_parse_connkeys(rdev,
4789                                         info->attrs[NL80211_ATTR_KEYS]);
4790                 if (IS_ERR(connkeys))
4791                         return PTR_ERR(connkeys);
4792         }
4793
4794         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4795         if (err)
4796                 kfree(connkeys);
4797         return err;
4798 }
4799
4800 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4801 {
4802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4803         struct net_device *dev = info->user_ptr[1];
4804         u16 reason;
4805
4806         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4807                 reason = WLAN_REASON_DEAUTH_LEAVING;
4808         else
4809                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4810
4811         if (reason == 0)
4812                 return -EINVAL;
4813
4814         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4815             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4816                 return -EOPNOTSUPP;
4817
4818         return cfg80211_disconnect(rdev, dev, reason, true);
4819 }
4820
4821 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4822 {
4823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4824         struct net *net;
4825         int err;
4826         u32 pid;
4827
4828         if (!info->attrs[NL80211_ATTR_PID])
4829                 return -EINVAL;
4830
4831         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4832
4833         net = get_net_ns_by_pid(pid);
4834         if (IS_ERR(net))
4835                 return PTR_ERR(net);
4836
4837         err = 0;
4838
4839         /* check if anything to do */
4840         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4841                 err = cfg80211_switch_netns(rdev, net);
4842
4843         put_net(net);
4844         return err;
4845 }
4846
4847 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4848 {
4849         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4850         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4851                         struct cfg80211_pmksa *pmksa) = NULL;
4852         struct net_device *dev = info->user_ptr[1];
4853         struct cfg80211_pmksa pmksa;
4854
4855         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4856
4857         if (!info->attrs[NL80211_ATTR_MAC])
4858                 return -EINVAL;
4859
4860         if (!info->attrs[NL80211_ATTR_PMKID])
4861                 return -EINVAL;
4862
4863         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4864         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4865
4866         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4867             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4868                 return -EOPNOTSUPP;
4869
4870         switch (info->genlhdr->cmd) {
4871         case NL80211_CMD_SET_PMKSA:
4872                 rdev_ops = rdev->ops->set_pmksa;
4873                 break;
4874         case NL80211_CMD_DEL_PMKSA:
4875                 rdev_ops = rdev->ops->del_pmksa;
4876                 break;
4877         default:
4878                 WARN_ON(1);
4879                 break;
4880         }
4881
4882         if (!rdev_ops)
4883                 return -EOPNOTSUPP;
4884
4885         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4886 }
4887
4888 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4889 {
4890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4891         struct net_device *dev = info->user_ptr[1];
4892
4893         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4894             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4895                 return -EOPNOTSUPP;
4896
4897         if (!rdev->ops->flush_pmksa)
4898                 return -EOPNOTSUPP;
4899
4900         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4901 }
4902
4903 static int nl80211_remain_on_channel(struct sk_buff *skb,
4904                                      struct genl_info *info)
4905 {
4906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4907         struct net_device *dev = info->user_ptr[1];
4908         struct ieee80211_channel *chan;
4909         struct sk_buff *msg;
4910         void *hdr;
4911         u64 cookie;
4912         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4913         u32 freq, duration;
4914         int err;
4915
4916         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4917             !info->attrs[NL80211_ATTR_DURATION])
4918                 return -EINVAL;
4919
4920         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4921
4922         /*
4923          * We should be on that channel for at least one jiffie,
4924          * and more than 5 seconds seems excessive.
4925          */
4926         if (!duration || !msecs_to_jiffies(duration) ||
4927             duration > rdev->wiphy.max_remain_on_channel_duration)
4928                 return -EINVAL;
4929
4930         if (!rdev->ops->remain_on_channel)
4931                 return -EOPNOTSUPP;
4932
4933         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4934                 channel_type = nla_get_u32(
4935                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4936                 if (channel_type != NL80211_CHAN_NO_HT &&
4937                     channel_type != NL80211_CHAN_HT20 &&
4938                     channel_type != NL80211_CHAN_HT40PLUS &&
4939                     channel_type != NL80211_CHAN_HT40MINUS)
4940                         return -EINVAL;
4941         }
4942
4943         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4944         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4945         if (chan == NULL)
4946                 return -EINVAL;
4947
4948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4949         if (!msg)
4950                 return -ENOMEM;
4951
4952         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4953                              NL80211_CMD_REMAIN_ON_CHANNEL);
4954
4955         if (IS_ERR(hdr)) {
4956                 err = PTR_ERR(hdr);
4957                 goto free_msg;
4958         }
4959
4960         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4961                                            channel_type, duration, &cookie);
4962
4963         if (err)
4964                 goto free_msg;
4965
4966         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4967
4968         genlmsg_end(msg, hdr);
4969
4970         return genlmsg_reply(msg, info);
4971
4972  nla_put_failure:
4973         err = -ENOBUFS;
4974  free_msg:
4975         nlmsg_free(msg);
4976         return err;
4977 }
4978
4979 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4980                                             struct genl_info *info)
4981 {
4982         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4983         struct net_device *dev = info->user_ptr[1];
4984         u64 cookie;
4985
4986         if (!info->attrs[NL80211_ATTR_COOKIE])
4987                 return -EINVAL;
4988
4989         if (!rdev->ops->cancel_remain_on_channel)
4990                 return -EOPNOTSUPP;
4991
4992         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4993
4994         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4995 }
4996
4997 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4998                            u8 *rates, u8 rates_len)
4999 {
5000         u8 i;
5001         u32 mask = 0;
5002
5003         for (i = 0; i < rates_len; i++) {
5004                 int rate = (rates[i] & 0x7f) * 5;
5005                 int ridx;
5006                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5007                         struct ieee80211_rate *srate =
5008                                 &sband->bitrates[ridx];
5009                         if (rate == srate->bitrate) {
5010                                 mask |= 1 << ridx;
5011                                 break;
5012                         }
5013                 }
5014                 if (ridx == sband->n_bitrates)
5015                         return 0; /* rate not found */
5016         }
5017
5018         return mask;
5019 }
5020
5021 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5022         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5023                                     .len = NL80211_MAX_SUPP_RATES },
5024 };
5025
5026 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5027                                        struct genl_info *info)
5028 {
5029         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5031         struct cfg80211_bitrate_mask mask;
5032         int rem, i;
5033         struct net_device *dev = info->user_ptr[1];
5034         struct nlattr *tx_rates;
5035         struct ieee80211_supported_band *sband;
5036
5037         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5038                 return -EINVAL;
5039
5040         if (!rdev->ops->set_bitrate_mask)
5041                 return -EOPNOTSUPP;
5042
5043         memset(&mask, 0, sizeof(mask));
5044         /* Default to all rates enabled */
5045         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5046                 sband = rdev->wiphy.bands[i];
5047                 mask.control[i].legacy =
5048                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5049         }
5050
5051         /*
5052          * The nested attribute uses enum nl80211_band as the index. This maps
5053          * directly to the enum ieee80211_band values used in cfg80211.
5054          */
5055         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5056         {
5057                 enum ieee80211_band band = nla_type(tx_rates);
5058                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5059                         return -EINVAL;
5060                 sband = rdev->wiphy.bands[band];
5061                 if (sband == NULL)
5062                         return -EINVAL;
5063                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5064                           nla_len(tx_rates), nl80211_txattr_policy);
5065                 if (tb[NL80211_TXRATE_LEGACY]) {
5066                         mask.control[band].legacy = rateset_to_mask(
5067                                 sband,
5068                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5069                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5070                         if (mask.control[band].legacy == 0)
5071                                 return -EINVAL;
5072                 }
5073         }
5074
5075         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5076 }
5077
5078 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5079 {
5080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5081         struct net_device *dev = info->user_ptr[1];
5082         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5083
5084         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5085                 return -EINVAL;
5086
5087         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5088                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5089
5090         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5091             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5092             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5093             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5094             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5095             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5097                 return -EOPNOTSUPP;
5098
5099         /* not much point in registering if we can't reply */
5100         if (!rdev->ops->mgmt_tx)
5101                 return -EOPNOTSUPP;
5102
5103         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5104                         frame_type,
5105                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5106                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5107 }
5108
5109 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5110 {
5111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5112         struct net_device *dev = info->user_ptr[1];
5113         struct ieee80211_channel *chan;
5114         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5115         bool channel_type_valid = false;
5116         u32 freq;
5117         int err;
5118         void *hdr;
5119         u64 cookie;
5120         struct sk_buff *msg;
5121         unsigned int wait = 0;
5122         bool offchan;
5123
5124         if (!info->attrs[NL80211_ATTR_FRAME] ||
5125             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5126                 return -EINVAL;
5127
5128         if (!rdev->ops->mgmt_tx)
5129                 return -EOPNOTSUPP;
5130
5131         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5132             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5133             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5134             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5135             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5136             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5137             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5138                 return -EOPNOTSUPP;
5139
5140         if (info->attrs[NL80211_ATTR_DURATION]) {
5141                 if (!rdev->ops->mgmt_tx_cancel_wait)
5142                         return -EINVAL;
5143                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5144         }
5145
5146         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5147                 channel_type = nla_get_u32(
5148                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5149                 if (channel_type != NL80211_CHAN_NO_HT &&
5150                     channel_type != NL80211_CHAN_HT20 &&
5151                     channel_type != NL80211_CHAN_HT40PLUS &&
5152                     channel_type != NL80211_CHAN_HT40MINUS)
5153                         return -EINVAL;
5154                 channel_type_valid = true;
5155         }
5156
5157         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5158
5159         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5160         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5161         if (chan == NULL)
5162                 return -EINVAL;
5163
5164         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5165         if (!msg)
5166                 return -ENOMEM;
5167
5168         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5169                              NL80211_CMD_FRAME);
5170
5171         if (IS_ERR(hdr)) {
5172                 err = PTR_ERR(hdr);
5173                 goto free_msg;
5174         }
5175         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5176                                     channel_type_valid, wait,
5177                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5178                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5179                                     &cookie);
5180         if (err)
5181                 goto free_msg;
5182
5183         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5184
5185         genlmsg_end(msg, hdr);
5186         return genlmsg_reply(msg, info);
5187
5188  nla_put_failure:
5189         err = -ENOBUFS;
5190  free_msg:
5191         nlmsg_free(msg);
5192         return err;
5193 }
5194
5195 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5196 {
5197         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5198         struct net_device *dev = info->user_ptr[1];
5199         u64 cookie;
5200
5201         if (!info->attrs[NL80211_ATTR_COOKIE])
5202                 return -EINVAL;
5203
5204         if (!rdev->ops->mgmt_tx_cancel_wait)
5205                 return -EOPNOTSUPP;
5206
5207         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5208             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5209             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5210             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5211             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5212             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5213                 return -EOPNOTSUPP;
5214
5215         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5216
5217         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5218 }
5219
5220 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5221 {
5222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5223         struct wireless_dev *wdev;
5224         struct net_device *dev = info->user_ptr[1];
5225         u8 ps_state;
5226         bool state;
5227         int err;
5228
5229         if (!info->attrs[NL80211_ATTR_PS_STATE])
5230                 return -EINVAL;
5231
5232         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5233
5234         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5235                 return -EINVAL;
5236
5237         wdev = dev->ieee80211_ptr;
5238
5239         if (!rdev->ops->set_power_mgmt)
5240                 return -EOPNOTSUPP;
5241
5242         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5243
5244         if (state == wdev->ps)
5245                 return 0;
5246
5247         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5248                                         wdev->ps_timeout);
5249         if (!err)
5250                 wdev->ps = state;
5251         return err;
5252 }
5253
5254 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5255 {
5256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5257         enum nl80211_ps_state ps_state;
5258         struct wireless_dev *wdev;
5259         struct net_device *dev = info->user_ptr[1];
5260         struct sk_buff *msg;
5261         void *hdr;
5262         int err;
5263
5264         wdev = dev->ieee80211_ptr;
5265
5266         if (!rdev->ops->set_power_mgmt)
5267                 return -EOPNOTSUPP;
5268
5269         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5270         if (!msg)
5271                 return -ENOMEM;
5272
5273         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5274                              NL80211_CMD_GET_POWER_SAVE);
5275         if (!hdr) {
5276                 err = -ENOBUFS;
5277                 goto free_msg;
5278         }
5279
5280         if (wdev->ps)
5281                 ps_state = NL80211_PS_ENABLED;
5282         else
5283                 ps_state = NL80211_PS_DISABLED;
5284
5285         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5286
5287         genlmsg_end(msg, hdr);
5288         return genlmsg_reply(msg, info);
5289
5290  nla_put_failure:
5291         err = -ENOBUFS;
5292  free_msg:
5293         nlmsg_free(msg);
5294         return err;
5295 }
5296
5297 static struct nla_policy
5298 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5299         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5300         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5301         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5302 };
5303
5304 static int nl80211_set_cqm_rssi(struct genl_info *info,
5305                                 s32 threshold, u32 hysteresis)
5306 {
5307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5308         struct wireless_dev *wdev;
5309         struct net_device *dev = info->user_ptr[1];
5310
5311         if (threshold > 0)
5312                 return -EINVAL;
5313
5314         wdev = dev->ieee80211_ptr;
5315
5316         if (!rdev->ops->set_cqm_rssi_config)
5317                 return -EOPNOTSUPP;
5318
5319         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5320             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5321                 return -EOPNOTSUPP;
5322
5323         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5324                                               threshold, hysteresis);
5325 }
5326
5327 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5328 {
5329         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5330         struct nlattr *cqm;
5331         int err;
5332
5333         cqm = info->attrs[NL80211_ATTR_CQM];
5334         if (!cqm) {
5335                 err = -EINVAL;
5336                 goto out;
5337         }
5338
5339         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5340                                nl80211_attr_cqm_policy);
5341         if (err)
5342                 goto out;
5343
5344         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5345             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5346                 s32 threshold;
5347                 u32 hysteresis;
5348                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5349                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5350                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5351         } else
5352                 err = -EINVAL;
5353
5354 out:
5355         return err;
5356 }
5357
5358 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5359 {
5360         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5361         struct net_device *dev = info->user_ptr[1];
5362         struct mesh_config cfg;
5363         struct mesh_setup setup;
5364         int err;
5365
5366         /* start with default */
5367         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5368         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5369
5370         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5371                 /* and parse parameters if given */
5372                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5373                 if (err)
5374                         return err;
5375         }
5376
5377         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5378             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5379                 return -EINVAL;
5380
5381         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5382         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5383
5384         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5385                 /* parse additional setup parameters if given */
5386                 err = nl80211_parse_mesh_setup(info, &setup);
5387                 if (err)
5388                         return err;
5389         }
5390
5391         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5392 }
5393
5394 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5395 {
5396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5397         struct net_device *dev = info->user_ptr[1];
5398
5399         return cfg80211_leave_mesh(rdev, dev);
5400 }
5401
5402 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5403 {
5404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5405         struct sk_buff *msg;
5406         void *hdr;
5407
5408         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5409                 return -EOPNOTSUPP;
5410
5411         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5412         if (!msg)
5413                 return -ENOMEM;
5414
5415         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5416                              NL80211_CMD_GET_WOWLAN);
5417         if (!hdr)
5418                 goto nla_put_failure;
5419
5420         if (rdev->wowlan) {
5421                 struct nlattr *nl_wowlan;
5422
5423                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5424                 if (!nl_wowlan)
5425                         goto nla_put_failure;
5426
5427                 if (rdev->wowlan->any)
5428                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5429                 if (rdev->wowlan->disconnect)
5430                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5431                 if (rdev->wowlan->magic_pkt)
5432                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5433                 if (rdev->wowlan->gtk_rekey_failure)
5434                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5435                 if (rdev->wowlan->eap_identity_req)
5436                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5437                 if (rdev->wowlan->four_way_handshake)
5438                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5439                 if (rdev->wowlan->rfkill_release)
5440                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5441                 if (rdev->wowlan->n_patterns) {
5442                         struct nlattr *nl_pats, *nl_pat;
5443                         int i, pat_len;
5444
5445                         nl_pats = nla_nest_start(msg,
5446                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5447                         if (!nl_pats)
5448                                 goto nla_put_failure;
5449
5450                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5451                                 nl_pat = nla_nest_start(msg, i + 1);
5452                                 if (!nl_pat)
5453                                         goto nla_put_failure;
5454                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5455                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5456                                         DIV_ROUND_UP(pat_len, 8),
5457                                         rdev->wowlan->patterns[i].mask);
5458                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5459                                         pat_len,
5460                                         rdev->wowlan->patterns[i].pattern);
5461                                 nla_nest_end(msg, nl_pat);
5462                         }
5463                         nla_nest_end(msg, nl_pats);
5464                 }
5465
5466                 nla_nest_end(msg, nl_wowlan);
5467         }
5468
5469         genlmsg_end(msg, hdr);
5470         return genlmsg_reply(msg, info);
5471
5472 nla_put_failure:
5473         nlmsg_free(msg);
5474         return -ENOBUFS;
5475 }
5476
5477 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5478 {
5479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5480         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5481         struct cfg80211_wowlan no_triggers = {};
5482         struct cfg80211_wowlan new_triggers = {};
5483         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5484         int err, i;
5485
5486         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5487                 return -EOPNOTSUPP;
5488
5489         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5490                 goto no_triggers;
5491
5492         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5493                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5494                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5495                         nl80211_wowlan_policy);
5496         if (err)
5497                 return err;
5498
5499         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5500                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5501                         return -EINVAL;
5502                 new_triggers.any = true;
5503         }
5504
5505         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5506                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5507                         return -EINVAL;
5508                 new_triggers.disconnect = true;
5509         }
5510
5511         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5512                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5513                         return -EINVAL;
5514                 new_triggers.magic_pkt = true;
5515         }
5516
5517         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5518                 return -EINVAL;
5519
5520         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5521                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5522                         return -EINVAL;
5523                 new_triggers.gtk_rekey_failure = true;
5524         }
5525
5526         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5527                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5528                         return -EINVAL;
5529                 new_triggers.eap_identity_req = true;
5530         }
5531
5532         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5533                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5534                         return -EINVAL;
5535                 new_triggers.four_way_handshake = true;
5536         }
5537
5538         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5539                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5540                         return -EINVAL;
5541                 new_triggers.rfkill_release = true;
5542         }
5543
5544         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5545                 struct nlattr *pat;
5546                 int n_patterns = 0;
5547                 int rem, pat_len, mask_len;
5548                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5549
5550                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5551                                     rem)
5552                         n_patterns++;
5553                 if (n_patterns > wowlan->n_patterns)
5554                         return -EINVAL;
5555
5556                 new_triggers.patterns = kcalloc(n_patterns,
5557                                                 sizeof(new_triggers.patterns[0]),
5558                                                 GFP_KERNEL);
5559                 if (!new_triggers.patterns)
5560                         return -ENOMEM;
5561
5562                 new_triggers.n_patterns = n_patterns;
5563                 i = 0;
5564
5565                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5566                                     rem) {
5567                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5568                                   nla_data(pat), nla_len(pat), NULL);
5569                         err = -EINVAL;
5570                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5571                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5572                                 goto error;
5573                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5574                         mask_len = DIV_ROUND_UP(pat_len, 8);
5575                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5576                             mask_len)
5577                                 goto error;
5578                         if (pat_len > wowlan->pattern_max_len ||
5579                             pat_len < wowlan->pattern_min_len)
5580                                 goto error;
5581
5582                         new_triggers.patterns[i].mask =
5583                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5584                         if (!new_triggers.patterns[i].mask) {
5585                                 err = -ENOMEM;
5586                                 goto error;
5587                         }
5588                         new_triggers.patterns[i].pattern =
5589                                 new_triggers.patterns[i].mask + mask_len;
5590                         memcpy(new_triggers.patterns[i].mask,
5591                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5592                                mask_len);
5593                         new_triggers.patterns[i].pattern_len = pat_len;
5594                         memcpy(new_triggers.patterns[i].pattern,
5595                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5596                                pat_len);
5597                         i++;
5598                 }
5599         }
5600
5601         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5602                 struct cfg80211_wowlan *ntrig;
5603                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5604                                 GFP_KERNEL);
5605                 if (!ntrig) {
5606                         err = -ENOMEM;
5607                         goto error;
5608                 }
5609                 cfg80211_rdev_free_wowlan(rdev);
5610                 rdev->wowlan = ntrig;
5611         } else {
5612  no_triggers:
5613                 cfg80211_rdev_free_wowlan(rdev);
5614                 rdev->wowlan = NULL;
5615         }
5616
5617         return 0;
5618  error:
5619         for (i = 0; i < new_triggers.n_patterns; i++)
5620                 kfree(new_triggers.patterns[i].mask);
5621         kfree(new_triggers.patterns);
5622         return err;
5623 }
5624
5625 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5626 {
5627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5628         struct net_device *dev = info->user_ptr[1];
5629         struct wireless_dev *wdev = dev->ieee80211_ptr;
5630         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5631         struct cfg80211_gtk_rekey_data rekey_data;
5632         int err;
5633
5634         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5635                 return -EINVAL;
5636
5637         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5638                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5639                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5640                         nl80211_rekey_policy);
5641         if (err)
5642                 return err;
5643
5644         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5645                 return -ERANGE;
5646         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5647                 return -ERANGE;
5648         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5649                 return -ERANGE;
5650
5651         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5652                NL80211_KEK_LEN);
5653         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5654                NL80211_KCK_LEN);
5655         memcpy(rekey_data.replay_ctr,
5656                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5657                NL80211_REPLAY_CTR_LEN);
5658
5659         wdev_lock(wdev);
5660         if (!wdev->current_bss) {
5661                 err = -ENOTCONN;
5662                 goto out;
5663         }
5664
5665         if (!rdev->ops->set_rekey_data) {
5666                 err = -EOPNOTSUPP;
5667                 goto out;
5668         }
5669
5670         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5671  out:
5672         wdev_unlock(wdev);
5673         return err;
5674 }
5675
5676 #define NL80211_FLAG_NEED_WIPHY         0x01
5677 #define NL80211_FLAG_NEED_NETDEV        0x02
5678 #define NL80211_FLAG_NEED_RTNL          0x04
5679 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5680 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5681                                          NL80211_FLAG_CHECK_NETDEV_UP)
5682
5683 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5684                             struct genl_info *info)
5685 {
5686         struct cfg80211_registered_device *rdev;
5687         struct net_device *dev;
5688         int err;
5689         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5690
5691         if (rtnl)
5692                 rtnl_lock();
5693
5694         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5695                 rdev = cfg80211_get_dev_from_info(info);
5696                 if (IS_ERR(rdev)) {
5697                         if (rtnl)
5698                                 rtnl_unlock();
5699                         return PTR_ERR(rdev);
5700                 }
5701                 info->user_ptr[0] = rdev;
5702         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5703                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5704                 if (err) {
5705                         if (rtnl)
5706                                 rtnl_unlock();
5707                         return err;
5708                 }
5709                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5710                     !netif_running(dev)) {
5711                         cfg80211_unlock_rdev(rdev);
5712                         dev_put(dev);
5713                         if (rtnl)
5714                                 rtnl_unlock();
5715                         return -ENETDOWN;
5716                 }
5717                 info->user_ptr[0] = rdev;
5718                 info->user_ptr[1] = dev;
5719         }
5720
5721         return 0;
5722 }
5723
5724 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5725                               struct genl_info *info)
5726 {
5727         if (info->user_ptr[0])
5728                 cfg80211_unlock_rdev(info->user_ptr[0]);
5729         if (info->user_ptr[1])
5730                 dev_put(info->user_ptr[1]);
5731         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5732                 rtnl_unlock();
5733 }
5734
5735 static struct genl_ops nl80211_ops[] = {
5736         {
5737                 .cmd = NL80211_CMD_GET_WIPHY,
5738                 .doit = nl80211_get_wiphy,
5739                 .dumpit = nl80211_dump_wiphy,
5740                 .policy = nl80211_policy,
5741                 /* can be retrieved by unprivileged users */
5742                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5743         },
5744         {
5745                 .cmd = NL80211_CMD_SET_WIPHY,
5746                 .doit = nl80211_set_wiphy,
5747                 .policy = nl80211_policy,
5748                 .flags = GENL_ADMIN_PERM,
5749                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5750         },
5751         {
5752                 .cmd = NL80211_CMD_GET_INTERFACE,
5753                 .doit = nl80211_get_interface,
5754                 .dumpit = nl80211_dump_interface,
5755                 .policy = nl80211_policy,
5756                 /* can be retrieved by unprivileged users */
5757                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5758         },
5759         {
5760                 .cmd = NL80211_CMD_SET_INTERFACE,
5761                 .doit = nl80211_set_interface,
5762                 .policy = nl80211_policy,
5763                 .flags = GENL_ADMIN_PERM,
5764                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5765                                   NL80211_FLAG_NEED_RTNL,
5766         },
5767         {
5768                 .cmd = NL80211_CMD_NEW_INTERFACE,
5769                 .doit = nl80211_new_interface,
5770                 .policy = nl80211_policy,
5771                 .flags = GENL_ADMIN_PERM,
5772                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5773                                   NL80211_FLAG_NEED_RTNL,
5774         },
5775         {
5776                 .cmd = NL80211_CMD_DEL_INTERFACE,
5777                 .doit = nl80211_del_interface,
5778                 .policy = nl80211_policy,
5779                 .flags = GENL_ADMIN_PERM,
5780                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5781                                   NL80211_FLAG_NEED_RTNL,
5782         },
5783         {
5784                 .cmd = NL80211_CMD_GET_KEY,
5785                 .doit = nl80211_get_key,
5786                 .policy = nl80211_policy,
5787                 .flags = GENL_ADMIN_PERM,
5788                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5789                                   NL80211_FLAG_NEED_RTNL,
5790         },
5791         {
5792                 .cmd = NL80211_CMD_SET_KEY,
5793                 .doit = nl80211_set_key,
5794                 .policy = nl80211_policy,
5795                 .flags = GENL_ADMIN_PERM,
5796                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5797                                   NL80211_FLAG_NEED_RTNL,
5798         },
5799         {
5800                 .cmd = NL80211_CMD_NEW_KEY,
5801                 .doit = nl80211_new_key,
5802                 .policy = nl80211_policy,
5803                 .flags = GENL_ADMIN_PERM,
5804                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5805                                   NL80211_FLAG_NEED_RTNL,
5806         },
5807         {
5808                 .cmd = NL80211_CMD_DEL_KEY,
5809                 .doit = nl80211_del_key,
5810                 .policy = nl80211_policy,
5811                 .flags = GENL_ADMIN_PERM,
5812                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5813                                   NL80211_FLAG_NEED_RTNL,
5814         },
5815         {
5816                 .cmd = NL80211_CMD_SET_BEACON,
5817                 .policy = nl80211_policy,
5818                 .flags = GENL_ADMIN_PERM,
5819                 .doit = nl80211_addset_beacon,
5820                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5821                                   NL80211_FLAG_NEED_RTNL,
5822         },
5823         {
5824                 .cmd = NL80211_CMD_NEW_BEACON,
5825                 .policy = nl80211_policy,
5826                 .flags = GENL_ADMIN_PERM,
5827                 .doit = nl80211_addset_beacon,
5828                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5829                                   NL80211_FLAG_NEED_RTNL,
5830         },
5831         {
5832                 .cmd = NL80211_CMD_DEL_BEACON,
5833                 .policy = nl80211_policy,
5834                 .flags = GENL_ADMIN_PERM,
5835                 .doit = nl80211_del_beacon,
5836                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5837                                   NL80211_FLAG_NEED_RTNL,
5838         },
5839         {
5840                 .cmd = NL80211_CMD_GET_STATION,
5841                 .doit = nl80211_get_station,
5842                 .dumpit = nl80211_dump_station,
5843                 .policy = nl80211_policy,
5844                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5845                                   NL80211_FLAG_NEED_RTNL,
5846         },
5847         {
5848                 .cmd = NL80211_CMD_SET_STATION,
5849                 .doit = nl80211_set_station,
5850                 .policy = nl80211_policy,
5851                 .flags = GENL_ADMIN_PERM,
5852                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5853                                   NL80211_FLAG_NEED_RTNL,
5854         },
5855         {
5856                 .cmd = NL80211_CMD_NEW_STATION,
5857                 .doit = nl80211_new_station,
5858                 .policy = nl80211_policy,
5859                 .flags = GENL_ADMIN_PERM,
5860                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5861                                   NL80211_FLAG_NEED_RTNL,
5862         },
5863         {
5864                 .cmd = NL80211_CMD_DEL_STATION,
5865                 .doit = nl80211_del_station,
5866                 .policy = nl80211_policy,
5867                 .flags = GENL_ADMIN_PERM,
5868                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5869                                   NL80211_FLAG_NEED_RTNL,
5870         },
5871         {
5872                 .cmd = NL80211_CMD_GET_MPATH,
5873                 .doit = nl80211_get_mpath,
5874                 .dumpit = nl80211_dump_mpath,
5875                 .policy = nl80211_policy,
5876                 .flags = GENL_ADMIN_PERM,
5877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5878                                   NL80211_FLAG_NEED_RTNL,
5879         },
5880         {
5881                 .cmd = NL80211_CMD_SET_MPATH,
5882                 .doit = nl80211_set_mpath,
5883                 .policy = nl80211_policy,
5884                 .flags = GENL_ADMIN_PERM,
5885                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5886                                   NL80211_FLAG_NEED_RTNL,
5887         },
5888         {
5889                 .cmd = NL80211_CMD_NEW_MPATH,
5890                 .doit = nl80211_new_mpath,
5891                 .policy = nl80211_policy,
5892                 .flags = GENL_ADMIN_PERM,
5893                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5894                                   NL80211_FLAG_NEED_RTNL,
5895         },
5896         {
5897                 .cmd = NL80211_CMD_DEL_MPATH,
5898                 .doit = nl80211_del_mpath,
5899                 .policy = nl80211_policy,
5900                 .flags = GENL_ADMIN_PERM,
5901                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5902                                   NL80211_FLAG_NEED_RTNL,
5903         },
5904         {
5905                 .cmd = NL80211_CMD_SET_BSS,
5906                 .doit = nl80211_set_bss,
5907                 .policy = nl80211_policy,
5908                 .flags = GENL_ADMIN_PERM,
5909                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5910                                   NL80211_FLAG_NEED_RTNL,
5911         },
5912         {
5913                 .cmd = NL80211_CMD_GET_REG,
5914                 .doit = nl80211_get_reg,
5915                 .policy = nl80211_policy,
5916                 /* can be retrieved by unprivileged users */
5917         },
5918         {
5919                 .cmd = NL80211_CMD_SET_REG,
5920                 .doit = nl80211_set_reg,
5921                 .policy = nl80211_policy,
5922                 .flags = GENL_ADMIN_PERM,
5923         },
5924         {
5925                 .cmd = NL80211_CMD_REQ_SET_REG,
5926                 .doit = nl80211_req_set_reg,
5927                 .policy = nl80211_policy,
5928                 .flags = GENL_ADMIN_PERM,
5929         },
5930         {
5931                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5932                 .doit = nl80211_get_mesh_config,
5933                 .policy = nl80211_policy,
5934                 /* can be retrieved by unprivileged users */
5935                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5936                                   NL80211_FLAG_NEED_RTNL,
5937         },
5938         {
5939                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5940                 .doit = nl80211_update_mesh_config,
5941                 .policy = nl80211_policy,
5942                 .flags = GENL_ADMIN_PERM,
5943                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5944                                   NL80211_FLAG_NEED_RTNL,
5945         },
5946         {
5947                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5948                 .doit = nl80211_trigger_scan,
5949                 .policy = nl80211_policy,
5950                 .flags = GENL_ADMIN_PERM,
5951                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5952                                   NL80211_FLAG_NEED_RTNL,
5953         },
5954         {
5955                 .cmd = NL80211_CMD_GET_SCAN,
5956                 .policy = nl80211_policy,
5957                 .dumpit = nl80211_dump_scan,
5958         },
5959         {
5960                 .cmd = NL80211_CMD_START_SCHED_SCAN,
5961                 .doit = nl80211_start_sched_scan,
5962                 .policy = nl80211_policy,
5963                 .flags = GENL_ADMIN_PERM,
5964                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5965                                   NL80211_FLAG_NEED_RTNL,
5966         },
5967         {
5968                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
5969                 .doit = nl80211_stop_sched_scan,
5970                 .policy = nl80211_policy,
5971                 .flags = GENL_ADMIN_PERM,
5972                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5973                                   NL80211_FLAG_NEED_RTNL,
5974         },
5975         {
5976                 .cmd = NL80211_CMD_AUTHENTICATE,
5977                 .doit = nl80211_authenticate,
5978                 .policy = nl80211_policy,
5979                 .flags = GENL_ADMIN_PERM,
5980                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5981                                   NL80211_FLAG_NEED_RTNL,
5982         },
5983         {
5984                 .cmd = NL80211_CMD_ASSOCIATE,
5985                 .doit = nl80211_associate,
5986                 .policy = nl80211_policy,
5987                 .flags = GENL_ADMIN_PERM,
5988                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5989                                   NL80211_FLAG_NEED_RTNL,
5990         },
5991         {
5992                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5993                 .doit = nl80211_deauthenticate,
5994                 .policy = nl80211_policy,
5995                 .flags = GENL_ADMIN_PERM,
5996                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5997                                   NL80211_FLAG_NEED_RTNL,
5998         },
5999         {
6000                 .cmd = NL80211_CMD_DISASSOCIATE,
6001                 .doit = nl80211_disassociate,
6002                 .policy = nl80211_policy,
6003                 .flags = GENL_ADMIN_PERM,
6004                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6005                                   NL80211_FLAG_NEED_RTNL,
6006         },
6007         {
6008                 .cmd = NL80211_CMD_JOIN_IBSS,
6009                 .doit = nl80211_join_ibss,
6010                 .policy = nl80211_policy,
6011                 .flags = GENL_ADMIN_PERM,
6012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6013                                   NL80211_FLAG_NEED_RTNL,
6014         },
6015         {
6016                 .cmd = NL80211_CMD_LEAVE_IBSS,
6017                 .doit = nl80211_leave_ibss,
6018                 .policy = nl80211_policy,
6019                 .flags = GENL_ADMIN_PERM,
6020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6021                                   NL80211_FLAG_NEED_RTNL,
6022         },
6023 #ifdef CONFIG_NL80211_TESTMODE
6024         {
6025                 .cmd = NL80211_CMD_TESTMODE,
6026                 .doit = nl80211_testmode_do,
6027                 .dumpit = nl80211_testmode_dump,
6028                 .policy = nl80211_policy,
6029                 .flags = GENL_ADMIN_PERM,
6030                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6031                                   NL80211_FLAG_NEED_RTNL,
6032         },
6033 #endif
6034         {
6035                 .cmd = NL80211_CMD_CONNECT,
6036                 .doit = nl80211_connect,
6037                 .policy = nl80211_policy,
6038                 .flags = GENL_ADMIN_PERM,
6039                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6040                                   NL80211_FLAG_NEED_RTNL,
6041         },
6042         {
6043                 .cmd = NL80211_CMD_DISCONNECT,
6044                 .doit = nl80211_disconnect,
6045                 .policy = nl80211_policy,
6046                 .flags = GENL_ADMIN_PERM,
6047                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6048                                   NL80211_FLAG_NEED_RTNL,
6049         },
6050         {
6051                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6052                 .doit = nl80211_wiphy_netns,
6053                 .policy = nl80211_policy,
6054                 .flags = GENL_ADMIN_PERM,
6055                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6056                                   NL80211_FLAG_NEED_RTNL,
6057         },
6058         {
6059                 .cmd = NL80211_CMD_GET_SURVEY,
6060                 .policy = nl80211_policy,
6061                 .dumpit = nl80211_dump_survey,
6062         },
6063         {
6064                 .cmd = NL80211_CMD_SET_PMKSA,
6065                 .doit = nl80211_setdel_pmksa,
6066                 .policy = nl80211_policy,
6067                 .flags = GENL_ADMIN_PERM,
6068                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6069                                   NL80211_FLAG_NEED_RTNL,
6070         },
6071         {
6072                 .cmd = NL80211_CMD_DEL_PMKSA,
6073                 .doit = nl80211_setdel_pmksa,
6074                 .policy = nl80211_policy,
6075                 .flags = GENL_ADMIN_PERM,
6076                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6077                                   NL80211_FLAG_NEED_RTNL,
6078         },
6079         {
6080                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6081                 .doit = nl80211_flush_pmksa,
6082                 .policy = nl80211_policy,
6083                 .flags = GENL_ADMIN_PERM,
6084                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6085                                   NL80211_FLAG_NEED_RTNL,
6086         },
6087         {
6088                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6089                 .doit = nl80211_remain_on_channel,
6090                 .policy = nl80211_policy,
6091                 .flags = GENL_ADMIN_PERM,
6092                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6093                                   NL80211_FLAG_NEED_RTNL,
6094         },
6095         {
6096                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6097                 .doit = nl80211_cancel_remain_on_channel,
6098                 .policy = nl80211_policy,
6099                 .flags = GENL_ADMIN_PERM,
6100                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6101                                   NL80211_FLAG_NEED_RTNL,
6102         },
6103         {
6104                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6105                 .doit = nl80211_set_tx_bitrate_mask,
6106                 .policy = nl80211_policy,
6107                 .flags = GENL_ADMIN_PERM,
6108                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6109                                   NL80211_FLAG_NEED_RTNL,
6110         },
6111         {
6112                 .cmd = NL80211_CMD_REGISTER_FRAME,
6113                 .doit = nl80211_register_mgmt,
6114                 .policy = nl80211_policy,
6115                 .flags = GENL_ADMIN_PERM,
6116                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6117                                   NL80211_FLAG_NEED_RTNL,
6118         },
6119         {
6120                 .cmd = NL80211_CMD_FRAME,
6121                 .doit = nl80211_tx_mgmt,
6122                 .policy = nl80211_policy,
6123                 .flags = GENL_ADMIN_PERM,
6124                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6125                                   NL80211_FLAG_NEED_RTNL,
6126         },
6127         {
6128                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6129                 .doit = nl80211_tx_mgmt_cancel_wait,
6130                 .policy = nl80211_policy,
6131                 .flags = GENL_ADMIN_PERM,
6132                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6133                                   NL80211_FLAG_NEED_RTNL,
6134         },
6135         {
6136                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6137                 .doit = nl80211_set_power_save,
6138                 .policy = nl80211_policy,
6139                 .flags = GENL_ADMIN_PERM,
6140                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6141                                   NL80211_FLAG_NEED_RTNL,
6142         },
6143         {
6144                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6145                 .doit = nl80211_get_power_save,
6146                 .policy = nl80211_policy,
6147                 /* can be retrieved by unprivileged users */
6148                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6149                                   NL80211_FLAG_NEED_RTNL,
6150         },
6151         {
6152                 .cmd = NL80211_CMD_SET_CQM,
6153                 .doit = nl80211_set_cqm,
6154                 .policy = nl80211_policy,
6155                 .flags = GENL_ADMIN_PERM,
6156                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6157                                   NL80211_FLAG_NEED_RTNL,
6158         },
6159         {
6160                 .cmd = NL80211_CMD_SET_CHANNEL,
6161                 .doit = nl80211_set_channel,
6162                 .policy = nl80211_policy,
6163                 .flags = GENL_ADMIN_PERM,
6164                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6165                                   NL80211_FLAG_NEED_RTNL,
6166         },
6167         {
6168                 .cmd = NL80211_CMD_SET_WDS_PEER,
6169                 .doit = nl80211_set_wds_peer,
6170                 .policy = nl80211_policy,
6171                 .flags = GENL_ADMIN_PERM,
6172                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6173                                   NL80211_FLAG_NEED_RTNL,
6174         },
6175         {
6176                 .cmd = NL80211_CMD_JOIN_MESH,
6177                 .doit = nl80211_join_mesh,
6178                 .policy = nl80211_policy,
6179                 .flags = GENL_ADMIN_PERM,
6180                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6181                                   NL80211_FLAG_NEED_RTNL,
6182         },
6183         {
6184                 .cmd = NL80211_CMD_LEAVE_MESH,
6185                 .doit = nl80211_leave_mesh,
6186                 .policy = nl80211_policy,
6187                 .flags = GENL_ADMIN_PERM,
6188                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6189                                   NL80211_FLAG_NEED_RTNL,
6190         },
6191         {
6192                 .cmd = NL80211_CMD_GET_WOWLAN,
6193                 .doit = nl80211_get_wowlan,
6194                 .policy = nl80211_policy,
6195                 /* can be retrieved by unprivileged users */
6196                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6197                                   NL80211_FLAG_NEED_RTNL,
6198         },
6199         {
6200                 .cmd = NL80211_CMD_SET_WOWLAN,
6201                 .doit = nl80211_set_wowlan,
6202                 .policy = nl80211_policy,
6203                 .flags = GENL_ADMIN_PERM,
6204                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6205                                   NL80211_FLAG_NEED_RTNL,
6206         },
6207         {
6208                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6209                 .doit = nl80211_set_rekey_data,
6210                 .policy = nl80211_policy,
6211                 .flags = GENL_ADMIN_PERM,
6212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6213                                   NL80211_FLAG_NEED_RTNL,
6214         },
6215 };
6216
6217 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6218         .name = "mlme",
6219 };
6220
6221 /* multicast groups */
6222 static struct genl_multicast_group nl80211_config_mcgrp = {
6223         .name = "config",
6224 };
6225 static struct genl_multicast_group nl80211_scan_mcgrp = {
6226         .name = "scan",
6227 };
6228 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6229         .name = "regulatory",
6230 };
6231
6232 /* notification functions */
6233
6234 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6235 {
6236         struct sk_buff *msg;
6237
6238         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6239         if (!msg)
6240                 return;
6241
6242         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6243                 nlmsg_free(msg);
6244                 return;
6245         }
6246
6247         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6248                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6249 }
6250
6251 static int nl80211_add_scan_req(struct sk_buff *msg,
6252                                 struct cfg80211_registered_device *rdev)
6253 {
6254         struct cfg80211_scan_request *req = rdev->scan_req;
6255         struct nlattr *nest;
6256         int i;
6257
6258         ASSERT_RDEV_LOCK(rdev);
6259
6260         if (WARN_ON(!req))
6261                 return 0;
6262
6263         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6264         if (!nest)
6265                 goto nla_put_failure;
6266         for (i = 0; i < req->n_ssids; i++)
6267                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6268         nla_nest_end(msg, nest);
6269
6270         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6271         if (!nest)
6272                 goto nla_put_failure;
6273         for (i = 0; i < req->n_channels; i++)
6274                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6275         nla_nest_end(msg, nest);
6276
6277         if (req->ie)
6278                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6279
6280         return 0;
6281  nla_put_failure:
6282         return -ENOBUFS;
6283 }
6284
6285 static int nl80211_send_scan_msg(struct sk_buff *msg,
6286                                  struct cfg80211_registered_device *rdev,
6287                                  struct net_device *netdev,
6288                                  u32 pid, u32 seq, int flags,
6289                                  u32 cmd)
6290 {
6291         void *hdr;
6292
6293         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6294         if (!hdr)
6295                 return -1;
6296
6297         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6298         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6299
6300         /* ignore errors and send incomplete event anyway */
6301         nl80211_add_scan_req(msg, rdev);
6302
6303         return genlmsg_end(msg, hdr);
6304
6305  nla_put_failure:
6306         genlmsg_cancel(msg, hdr);
6307         return -EMSGSIZE;
6308 }
6309
6310 static int
6311 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6312                             struct cfg80211_registered_device *rdev,
6313                             struct net_device *netdev,
6314                             u32 pid, u32 seq, int flags, u32 cmd)
6315 {
6316         void *hdr;
6317
6318         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6319         if (!hdr)
6320                 return -1;
6321
6322         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6323         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6324
6325         return genlmsg_end(msg, hdr);
6326
6327  nla_put_failure:
6328         genlmsg_cancel(msg, hdr);
6329         return -EMSGSIZE;
6330 }
6331
6332 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6333                              struct net_device *netdev)
6334 {
6335         struct sk_buff *msg;
6336
6337         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6338         if (!msg)
6339                 return;
6340
6341         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6342                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6343                 nlmsg_free(msg);
6344                 return;
6345         }
6346
6347         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6348                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6349 }
6350
6351 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6352                             struct net_device *netdev)
6353 {
6354         struct sk_buff *msg;
6355
6356         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6357         if (!msg)
6358                 return;
6359
6360         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6361                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6362                 nlmsg_free(msg);
6363                 return;
6364         }
6365
6366         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6367                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6368 }
6369
6370 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6371                                struct net_device *netdev)
6372 {
6373         struct sk_buff *msg;
6374
6375         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6376         if (!msg)
6377                 return;
6378
6379         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6380                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6381                 nlmsg_free(msg);
6382                 return;
6383         }
6384
6385         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6386                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6387 }
6388
6389 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6390                                      struct net_device *netdev)
6391 {
6392         struct sk_buff *msg;
6393
6394         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6395         if (!msg)
6396                 return;
6397
6398         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6399                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6400                 nlmsg_free(msg);
6401                 return;
6402         }
6403
6404         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6405                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6406 }
6407
6408 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6409                              struct net_device *netdev, u32 cmd)
6410 {
6411         struct sk_buff *msg;
6412
6413         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6414         if (!msg)
6415                 return;
6416
6417         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6418                 nlmsg_free(msg);
6419                 return;
6420         }
6421
6422         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6423                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6424 }
6425
6426 /*
6427  * This can happen on global regulatory changes or device specific settings
6428  * based on custom world regulatory domains.
6429  */
6430 void nl80211_send_reg_change_event(struct regulatory_request *request)
6431 {
6432         struct sk_buff *msg;
6433         void *hdr;
6434
6435         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6436         if (!msg)
6437                 return;
6438
6439         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6440         if (!hdr) {
6441                 nlmsg_free(msg);
6442                 return;
6443         }
6444
6445         /* Userspace can always count this one always being set */
6446         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6447
6448         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6449                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6450                            NL80211_REGDOM_TYPE_WORLD);
6451         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6452                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6453                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6454         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6455                  request->intersect)
6456                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6457                            NL80211_REGDOM_TYPE_INTERSECTION);
6458         else {
6459                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6460                            NL80211_REGDOM_TYPE_COUNTRY);
6461                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6462         }
6463
6464         if (wiphy_idx_valid(request->wiphy_idx))
6465                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6466
6467         if (genlmsg_end(msg, hdr) < 0) {
6468                 nlmsg_free(msg);
6469                 return;
6470         }
6471
6472         rcu_read_lock();
6473         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6474                                 GFP_ATOMIC);
6475         rcu_read_unlock();
6476
6477         return;
6478
6479 nla_put_failure:
6480         genlmsg_cancel(msg, hdr);
6481         nlmsg_free(msg);
6482 }
6483
6484 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6485                                     struct net_device *netdev,
6486                                     const u8 *buf, size_t len,
6487                                     enum nl80211_commands cmd, gfp_t gfp)
6488 {
6489         struct sk_buff *msg;
6490         void *hdr;
6491
6492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6493         if (!msg)
6494                 return;
6495
6496         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6497         if (!hdr) {
6498                 nlmsg_free(msg);
6499                 return;
6500         }
6501
6502         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6503         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6504         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6505
6506         if (genlmsg_end(msg, hdr) < 0) {
6507                 nlmsg_free(msg);
6508                 return;
6509         }
6510
6511         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6512                                 nl80211_mlme_mcgrp.id, gfp);
6513         return;
6514
6515  nla_put_failure:
6516         genlmsg_cancel(msg, hdr);
6517         nlmsg_free(msg);
6518 }
6519
6520 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6521                           struct net_device *netdev, const u8 *buf,
6522                           size_t len, gfp_t gfp)
6523 {
6524         nl80211_send_mlme_event(rdev, netdev, buf, len,
6525                                 NL80211_CMD_AUTHENTICATE, gfp);
6526 }
6527
6528 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6529                            struct net_device *netdev, const u8 *buf,
6530                            size_t len, gfp_t gfp)
6531 {
6532         nl80211_send_mlme_event(rdev, netdev, buf, len,
6533                                 NL80211_CMD_ASSOCIATE, gfp);
6534 }
6535
6536 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6537                          struct net_device *netdev, const u8 *buf,
6538                          size_t len, gfp_t gfp)
6539 {
6540         nl80211_send_mlme_event(rdev, netdev, buf, len,
6541                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6542 }
6543
6544 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6545                            struct net_device *netdev, const u8 *buf,
6546                            size_t len, gfp_t gfp)
6547 {
6548         nl80211_send_mlme_event(rdev, netdev, buf, len,
6549                                 NL80211_CMD_DISASSOCIATE, gfp);
6550 }
6551
6552 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6553                                 struct net_device *netdev, const u8 *buf,
6554                                 size_t len, gfp_t gfp)
6555 {
6556         nl80211_send_mlme_event(rdev, netdev, buf, len,
6557                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6558 }
6559
6560 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6561                                   struct net_device *netdev, const u8 *buf,
6562                                   size_t len, gfp_t gfp)
6563 {
6564         nl80211_send_mlme_event(rdev, netdev, buf, len,
6565                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6566 }
6567
6568 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6569                                       struct net_device *netdev, int cmd,
6570                                       const u8 *addr, gfp_t gfp)
6571 {
6572         struct sk_buff *msg;
6573         void *hdr;
6574
6575         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6576         if (!msg)
6577                 return;
6578
6579         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6580         if (!hdr) {
6581                 nlmsg_free(msg);
6582                 return;
6583         }
6584
6585         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6586         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6587         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6588         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6589
6590         if (genlmsg_end(msg, hdr) < 0) {
6591                 nlmsg_free(msg);
6592                 return;
6593         }
6594
6595         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6596                                 nl80211_mlme_mcgrp.id, gfp);
6597         return;
6598
6599  nla_put_failure:
6600         genlmsg_cancel(msg, hdr);
6601         nlmsg_free(msg);
6602 }
6603
6604 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6605                                struct net_device *netdev, const u8 *addr,
6606                                gfp_t gfp)
6607 {
6608         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6609                                   addr, gfp);
6610 }
6611
6612 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6613                                 struct net_device *netdev, const u8 *addr,
6614                                 gfp_t gfp)
6615 {
6616         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6617                                   addr, gfp);
6618 }
6619
6620 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6621                                  struct net_device *netdev, const u8 *bssid,
6622                                  const u8 *req_ie, size_t req_ie_len,
6623                                  const u8 *resp_ie, size_t resp_ie_len,
6624                                  u16 status, gfp_t gfp)
6625 {
6626         struct sk_buff *msg;
6627         void *hdr;
6628
6629         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6630         if (!msg)
6631                 return;
6632
6633         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6634         if (!hdr) {
6635                 nlmsg_free(msg);
6636                 return;
6637         }
6638
6639         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6640         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6641         if (bssid)
6642                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6643         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6644         if (req_ie)
6645                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6646         if (resp_ie)
6647                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6648
6649         if (genlmsg_end(msg, hdr) < 0) {
6650                 nlmsg_free(msg);
6651                 return;
6652         }
6653
6654         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6655                                 nl80211_mlme_mcgrp.id, gfp);
6656         return;
6657
6658  nla_put_failure:
6659         genlmsg_cancel(msg, hdr);
6660         nlmsg_free(msg);
6661
6662 }
6663
6664 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6665                          struct net_device *netdev, const u8 *bssid,
6666                          const u8 *req_ie, size_t req_ie_len,
6667                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6668 {
6669         struct sk_buff *msg;
6670         void *hdr;
6671
6672         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6673         if (!msg)
6674                 return;
6675
6676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6677         if (!hdr) {
6678                 nlmsg_free(msg);
6679                 return;
6680         }
6681
6682         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6683         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6684         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6685         if (req_ie)
6686                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6687         if (resp_ie)
6688                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6689
6690         if (genlmsg_end(msg, hdr) < 0) {
6691                 nlmsg_free(msg);
6692                 return;
6693         }
6694
6695         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6696                                 nl80211_mlme_mcgrp.id, gfp);
6697         return;
6698
6699  nla_put_failure:
6700         genlmsg_cancel(msg, hdr);
6701         nlmsg_free(msg);
6702
6703 }
6704
6705 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6706                                struct net_device *netdev, u16 reason,
6707                                const u8 *ie, size_t ie_len, bool from_ap)
6708 {
6709         struct sk_buff *msg;
6710         void *hdr;
6711
6712         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6713         if (!msg)
6714                 return;
6715
6716         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6717         if (!hdr) {
6718                 nlmsg_free(msg);
6719                 return;
6720         }
6721
6722         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6723         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6724         if (from_ap && reason)
6725                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6726         if (from_ap)
6727                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6728         if (ie)
6729                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6730
6731         if (genlmsg_end(msg, hdr) < 0) {
6732                 nlmsg_free(msg);
6733                 return;
6734         }
6735
6736         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6737                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6738         return;
6739
6740  nla_put_failure:
6741         genlmsg_cancel(msg, hdr);
6742         nlmsg_free(msg);
6743
6744 }
6745
6746 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6747                              struct net_device *netdev, const u8 *bssid,
6748                              gfp_t gfp)
6749 {
6750         struct sk_buff *msg;
6751         void *hdr;
6752
6753         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6754         if (!msg)
6755                 return;
6756
6757         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6758         if (!hdr) {
6759                 nlmsg_free(msg);
6760                 return;
6761         }
6762
6763         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6764         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6765         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6766
6767         if (genlmsg_end(msg, hdr) < 0) {
6768                 nlmsg_free(msg);
6769                 return;
6770         }
6771
6772         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6773                                 nl80211_mlme_mcgrp.id, gfp);
6774         return;
6775
6776  nla_put_failure:
6777         genlmsg_cancel(msg, hdr);
6778         nlmsg_free(msg);
6779 }
6780
6781 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6782                 struct net_device *netdev,
6783                 const u8 *macaddr, const u8* ie, u8 ie_len,
6784                 gfp_t gfp)
6785 {
6786         struct sk_buff *msg;
6787         void *hdr;
6788
6789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6790         if (!msg)
6791                 return;
6792
6793         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6794         if (!hdr) {
6795                 nlmsg_free(msg);
6796                 return;
6797         }
6798
6799         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6800         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6801         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6802         if (ie_len && ie)
6803                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6804
6805         if (genlmsg_end(msg, hdr) < 0) {
6806                 nlmsg_free(msg);
6807                 return;
6808         }
6809
6810         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6811                                 nl80211_mlme_mcgrp.id, gfp);
6812         return;
6813
6814  nla_put_failure:
6815         genlmsg_cancel(msg, hdr);
6816         nlmsg_free(msg);
6817 }
6818
6819 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6820                                  struct net_device *netdev, const u8 *addr,
6821                                  enum nl80211_key_type key_type, int key_id,
6822                                  const u8 *tsc, gfp_t gfp)
6823 {
6824         struct sk_buff *msg;
6825         void *hdr;
6826
6827         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6828         if (!msg)
6829                 return;
6830
6831         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6832         if (!hdr) {
6833                 nlmsg_free(msg);
6834                 return;
6835         }
6836
6837         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6838         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6839         if (addr)
6840                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6841         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6842         if (key_id != -1)
6843                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6844         if (tsc)
6845                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6846
6847         if (genlmsg_end(msg, hdr) < 0) {
6848                 nlmsg_free(msg);
6849                 return;
6850         }
6851
6852         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6853                                 nl80211_mlme_mcgrp.id, gfp);
6854         return;
6855
6856  nla_put_failure:
6857         genlmsg_cancel(msg, hdr);
6858         nlmsg_free(msg);
6859 }
6860
6861 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6862                                     struct ieee80211_channel *channel_before,
6863                                     struct ieee80211_channel *channel_after)
6864 {
6865         struct sk_buff *msg;
6866         void *hdr;
6867         struct nlattr *nl_freq;
6868
6869         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6870         if (!msg)
6871                 return;
6872
6873         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6874         if (!hdr) {
6875                 nlmsg_free(msg);
6876                 return;
6877         }
6878
6879         /*
6880          * Since we are applying the beacon hint to a wiphy we know its
6881          * wiphy_idx is valid
6882          */
6883         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6884
6885         /* Before */
6886         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6887         if (!nl_freq)
6888                 goto nla_put_failure;
6889         if (nl80211_msg_put_channel(msg, channel_before))
6890                 goto nla_put_failure;
6891         nla_nest_end(msg, nl_freq);
6892
6893         /* After */
6894         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6895         if (!nl_freq)
6896                 goto nla_put_failure;
6897         if (nl80211_msg_put_channel(msg, channel_after))
6898                 goto nla_put_failure;
6899         nla_nest_end(msg, nl_freq);
6900
6901         if (genlmsg_end(msg, hdr) < 0) {
6902                 nlmsg_free(msg);
6903                 return;
6904         }
6905
6906         rcu_read_lock();
6907         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6908                                 GFP_ATOMIC);
6909         rcu_read_unlock();
6910
6911         return;
6912
6913 nla_put_failure:
6914         genlmsg_cancel(msg, hdr);
6915         nlmsg_free(msg);
6916 }
6917
6918 static void nl80211_send_remain_on_chan_event(
6919         int cmd, struct cfg80211_registered_device *rdev,
6920         struct net_device *netdev, u64 cookie,
6921         struct ieee80211_channel *chan,
6922         enum nl80211_channel_type channel_type,
6923         unsigned int duration, gfp_t gfp)
6924 {
6925         struct sk_buff *msg;
6926         void *hdr;
6927
6928         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6929         if (!msg)
6930                 return;
6931
6932         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6933         if (!hdr) {
6934                 nlmsg_free(msg);
6935                 return;
6936         }
6937
6938         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6939         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6940         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
6941         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
6942         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6943
6944         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
6945                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
6946
6947         if (genlmsg_end(msg, hdr) < 0) {
6948                 nlmsg_free(msg);
6949                 return;
6950         }
6951
6952         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6953                                 nl80211_mlme_mcgrp.id, gfp);
6954         return;
6955
6956  nla_put_failure:
6957         genlmsg_cancel(msg, hdr);
6958         nlmsg_free(msg);
6959 }
6960
6961 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
6962                                     struct net_device *netdev, u64 cookie,
6963                                     struct ieee80211_channel *chan,
6964                                     enum nl80211_channel_type channel_type,
6965                                     unsigned int duration, gfp_t gfp)
6966 {
6967         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
6968                                           rdev, netdev, cookie, chan,
6969                                           channel_type, duration, gfp);
6970 }
6971
6972 void nl80211_send_remain_on_channel_cancel(
6973         struct cfg80211_registered_device *rdev, struct net_device *netdev,
6974         u64 cookie, struct ieee80211_channel *chan,
6975         enum nl80211_channel_type channel_type, gfp_t gfp)
6976 {
6977         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6978                                           rdev, netdev, cookie, chan,
6979                                           channel_type, 0, gfp);
6980 }
6981
6982 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
6983                             struct net_device *dev, const u8 *mac_addr,
6984                             struct station_info *sinfo, gfp_t gfp)
6985 {
6986         struct sk_buff *msg;
6987
6988         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6989         if (!msg)
6990                 return;
6991
6992         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
6993                 nlmsg_free(msg);
6994                 return;
6995         }
6996
6997         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6998                                 nl80211_mlme_mcgrp.id, gfp);
6999 }
7000
7001 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7002                                 struct net_device *dev, const u8 *mac_addr,
7003                                 gfp_t gfp)
7004 {
7005         struct sk_buff *msg;
7006         void *hdr;
7007
7008         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7009         if (!msg)
7010                 return;
7011
7012         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7013         if (!hdr) {
7014                 nlmsg_free(msg);
7015                 return;
7016         }
7017
7018         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7019         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7020
7021         if (genlmsg_end(msg, hdr) < 0) {
7022                 nlmsg_free(msg);
7023                 return;
7024         }
7025
7026         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7027                                 nl80211_mlme_mcgrp.id, gfp);
7028         return;
7029
7030  nla_put_failure:
7031         genlmsg_cancel(msg, hdr);
7032         nlmsg_free(msg);
7033 }
7034
7035 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7036                       struct net_device *netdev, u32 nlpid,
7037                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7038 {
7039         struct sk_buff *msg;
7040         void *hdr;
7041         int err;
7042
7043         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7044         if (!msg)
7045                 return -ENOMEM;
7046
7047         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7048         if (!hdr) {
7049                 nlmsg_free(msg);
7050                 return -ENOMEM;
7051         }
7052
7053         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7054         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7055         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7056         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7057
7058         err = genlmsg_end(msg, hdr);
7059         if (err < 0) {
7060                 nlmsg_free(msg);
7061                 return err;
7062         }
7063
7064         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7065         if (err < 0)
7066                 return err;
7067         return 0;
7068
7069  nla_put_failure:
7070         genlmsg_cancel(msg, hdr);
7071         nlmsg_free(msg);
7072         return -ENOBUFS;
7073 }
7074
7075 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7076                                  struct net_device *netdev, u64 cookie,
7077                                  const u8 *buf, size_t len, bool ack,
7078                                  gfp_t gfp)
7079 {
7080         struct sk_buff *msg;
7081         void *hdr;
7082
7083         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7084         if (!msg)
7085                 return;
7086
7087         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7088         if (!hdr) {
7089                 nlmsg_free(msg);
7090                 return;
7091         }
7092
7093         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7094         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7095         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7096         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7097         if (ack)
7098                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7099
7100         if (genlmsg_end(msg, hdr) < 0) {
7101                 nlmsg_free(msg);
7102                 return;
7103         }
7104
7105         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7106         return;
7107
7108  nla_put_failure:
7109         genlmsg_cancel(msg, hdr);
7110         nlmsg_free(msg);
7111 }
7112
7113 void
7114 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7115                              struct net_device *netdev,
7116                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7117                              gfp_t gfp)
7118 {
7119         struct sk_buff *msg;
7120         struct nlattr *pinfoattr;
7121         void *hdr;
7122
7123         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7124         if (!msg)
7125                 return;
7126
7127         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7128         if (!hdr) {
7129                 nlmsg_free(msg);
7130                 return;
7131         }
7132
7133         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7134         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7135
7136         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7137         if (!pinfoattr)
7138                 goto nla_put_failure;
7139
7140         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7141                     rssi_event);
7142
7143         nla_nest_end(msg, pinfoattr);
7144
7145         if (genlmsg_end(msg, hdr) < 0) {
7146                 nlmsg_free(msg);
7147                 return;
7148         }
7149
7150         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7151                                 nl80211_mlme_mcgrp.id, gfp);
7152         return;
7153
7154  nla_put_failure:
7155         genlmsg_cancel(msg, hdr);
7156         nlmsg_free(msg);
7157 }
7158
7159 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7160                               struct net_device *netdev, const u8 *bssid,
7161                               const u8 *replay_ctr, gfp_t gfp)
7162 {
7163         struct sk_buff *msg;
7164         struct nlattr *rekey_attr;
7165         void *hdr;
7166
7167         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7168         if (!msg)
7169                 return;
7170
7171         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7172         if (!hdr) {
7173                 nlmsg_free(msg);
7174                 return;
7175         }
7176
7177         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7178         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7179         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7180
7181         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7182         if (!rekey_attr)
7183                 goto nla_put_failure;
7184
7185         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7186                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7187
7188         nla_nest_end(msg, rekey_attr);
7189
7190         if (genlmsg_end(msg, hdr) < 0) {
7191                 nlmsg_free(msg);
7192                 return;
7193         }
7194
7195         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7196                                 nl80211_mlme_mcgrp.id, gfp);
7197         return;
7198
7199  nla_put_failure:
7200         genlmsg_cancel(msg, hdr);
7201         nlmsg_free(msg);
7202 }
7203
7204 void
7205 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7206                                 struct net_device *netdev, const u8 *peer,
7207                                 u32 num_packets, gfp_t gfp)
7208 {
7209         struct sk_buff *msg;
7210         struct nlattr *pinfoattr;
7211         void *hdr;
7212
7213         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7214         if (!msg)
7215                 return;
7216
7217         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7218         if (!hdr) {
7219                 nlmsg_free(msg);
7220                 return;
7221         }
7222
7223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7224         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7225         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7226
7227         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7228         if (!pinfoattr)
7229                 goto nla_put_failure;
7230
7231         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7232
7233         nla_nest_end(msg, pinfoattr);
7234
7235         if (genlmsg_end(msg, hdr) < 0) {
7236                 nlmsg_free(msg);
7237                 return;
7238         }
7239
7240         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7241                                 nl80211_mlme_mcgrp.id, gfp);
7242         return;
7243
7244  nla_put_failure:
7245         genlmsg_cancel(msg, hdr);
7246         nlmsg_free(msg);
7247 }
7248
7249 static int nl80211_netlink_notify(struct notifier_block * nb,
7250                                   unsigned long state,
7251                                   void *_notify)
7252 {
7253         struct netlink_notify *notify = _notify;
7254         struct cfg80211_registered_device *rdev;
7255         struct wireless_dev *wdev;
7256
7257         if (state != NETLINK_URELEASE)
7258                 return NOTIFY_DONE;
7259
7260         rcu_read_lock();
7261
7262         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7263                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7264                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7265
7266         rcu_read_unlock();
7267
7268         return NOTIFY_DONE;
7269 }
7270
7271 static struct notifier_block nl80211_netlink_notifier = {
7272         .notifier_call = nl80211_netlink_notify,
7273 };
7274
7275 /* initialisation/exit functions */
7276
7277 int nl80211_init(void)
7278 {
7279         int err;
7280
7281         err = genl_register_family_with_ops(&nl80211_fam,
7282                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7283         if (err)
7284                 return err;
7285
7286         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7287         if (err)
7288                 goto err_out;
7289
7290         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7291         if (err)
7292                 goto err_out;
7293
7294         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7295         if (err)
7296                 goto err_out;
7297
7298         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7299         if (err)
7300                 goto err_out;
7301
7302 #ifdef CONFIG_NL80211_TESTMODE
7303         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7304         if (err)
7305                 goto err_out;
7306 #endif
7307
7308         err = netlink_register_notifier(&nl80211_netlink_notifier);
7309         if (err)
7310                 goto err_out;
7311
7312         return 0;
7313  err_out:
7314         genl_unregister_family(&nl80211_fam);
7315         return err;
7316 }
7317
7318 void nl80211_exit(void)
7319 {
7320         netlink_unregister_notifier(&nl80211_netlink_notifier);
7321         genl_unregister_family(&nl80211_fam);
7322 }