net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192 };
 193
 194 /* policy for the key attributes */
 195 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 196         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 197         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 198         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 199         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 200         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 201         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 202         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 203         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 204 };
 205
 206 /* policy for the key default flags */
 207 static const struct nla_policy
 208 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 209         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 210         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 211 };
 212
 213 /* policy for WoWLAN attributes */
 214 static const struct nla_policy
 215 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 216         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 217         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 218         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 219         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 220         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 221         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 222         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 223         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 224 };
 225
 226 /* policy for GTK rekey offload attributes */
 227 static const struct nla_policy
 228 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 229         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 230         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 231         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 232 };
 233
 234 /* ifidx get helper */
 235 static int nl80211_get_ifidx(struct netlink_callback *cb)
 236 {
 237         int res;
 238
 239         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 240                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 241                           nl80211_policy);
 242         if (res)
 243                 return res;
 244
 245         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 246                 return -EINVAL;
 247
 248         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 249         if (!res)
 250                 return -EINVAL;
 251         return res;
 252 }
 253
 254 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 255                                        struct netlink_callback *cb,
 256                                        struct cfg80211_registered_device **rdev,
 257                                        struct net_device **dev)
 258 {
 259         int ifidx = cb->args[0];
 260         int err;
 261
 262         if (!ifidx)
 263                 ifidx = nl80211_get_ifidx(cb);
 264         if (ifidx < 0)
 265                 return ifidx;
 266
 267         cb->args[0] = ifidx;
 268
 269         rtnl_lock();
 270
 271         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 272         if (!*dev) {
 273                 err = -ENODEV;
 274                 goto out_rtnl;
 275         }
 276
 277         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 278         if (IS_ERR(*rdev)) {
 279                 err = PTR_ERR(*rdev);
 280                 goto out_rtnl;
 281         }
 282
 283         return 0;
 284  out_rtnl:
 285         rtnl_unlock();
 286         return err;
 287 }
 288
 289 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 290 {
 291         cfg80211_unlock_rdev(rdev);
 292         rtnl_unlock();
 293 }
 294
 295 /* IE validation */
 296 static bool is_valid_ie_attr(const struct nlattr *attr)
 297 {
 298         const u8 *pos;
 299         int len;
 300
 301         if (!attr)
 302                 return true;
 303
 304         pos = nla_data(attr);
 305         len = nla_len(attr);
 306
 307         while (len) {
 308                 u8 elemlen;
 309
 310                 if (len < 2)
 311                         return false;
 312                 len -= 2;
 313
 314                 elemlen = pos[1];
 315                 if (elemlen > len)
 316                         return false;
 317
 318                 len -= elemlen;
 319                 pos += 2 + elemlen;
 320         }
 321
 322         return true;
 323 }
 324
 325 /* message building helper */
 326 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 327                                    int flags, u8 cmd)
 328 {
 329         /* since there is no private header just add the generic one */
 330         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 331 }
 332
 333 static int nl80211_msg_put_channel(struct sk_buff *msg,
 334                                    struct ieee80211_channel *chan)
 335 {
 336         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 337                     chan->center_freq);
 338
 339         if (chan->flags & IEEE80211_CHAN_DISABLED)
 340                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 341         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 342                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 343         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 344                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 345         if (chan->flags & IEEE80211_CHAN_RADAR)
 346                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 347
 348         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 349                     DBM_TO_MBM(chan->max_power));
 350
 351         return 0;
 352
 353  nla_put_failure:
 354         return -ENOBUFS;
 355 }
 356
 357 /* netlink command implementations */
 358
 359 struct key_parse {
 360         struct key_params p;
 361         int idx;
 362         int type;
 363         bool def, defmgmt;
 364         bool def_uni, def_multi;
 365 };
 366
 367 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 368 {
 369         struct nlattr *tb[NL80211_KEY_MAX + 1];
 370         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 371                                    nl80211_key_policy);
 372         if (err)
 373                 return err;
 374
 375         k->def = !!tb[NL80211_KEY_DEFAULT];
 376         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 377
 378         if (k->def) {
 379                 k->def_uni = true;
 380                 k->def_multi = true;
 381         }
 382         if (k->defmgmt)
 383                 k->def_multi = true;
 384
 385         if (tb[NL80211_KEY_IDX])
 386                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 387
 388         if (tb[NL80211_KEY_DATA]) {
 389                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 390                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 391         }
 392
 393         if (tb[NL80211_KEY_SEQ]) {
 394                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 395                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 396         }
 397
 398         if (tb[NL80211_KEY_CIPHER])
 399                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 400
 401         if (tb[NL80211_KEY_TYPE]) {
 402                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 403                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 404                         return -EINVAL;
 405         }
 406
 407         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 408                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 409                 int err = nla_parse_nested(kdt,
 410                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 411                                            tb[NL80211_KEY_DEFAULT_TYPES],
 412                                            nl80211_key_default_policy);
 413                 if (err)
 414                         return err;
 415
 416                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 417                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 418         }
 419
 420         return 0;
 421 }
 422
 423 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 424 {
 425         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 426                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 427                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 428         }
 429
 430         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 431                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 432                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 433         }
 434
 435         if (info->attrs[NL80211_ATTR_KEY_IDX])
 436                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 437
 438         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 439                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 440
 441         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 442         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 443
 444         if (k->def) {
 445                 k->def_uni = true;
 446                 k->def_multi = true;
 447         }
 448         if (k->defmgmt)
 449                 k->def_multi = true;
 450
 451         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 452                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 453                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 454                         return -EINVAL;
 455         }
 456
 457         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 458                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 459                 int err = nla_parse_nested(
 460                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 461                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 462                                 nl80211_key_default_policy);
 463                 if (err)
 464                         return err;
 465
 466                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 467                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 468         }
 469
 470         return 0;
 471 }
 472
 473 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 474 {
 475         int err;
 476
 477         memset(k, 0, sizeof(*k));
 478         k->idx = -1;
 479         k->type = -1;
 480
 481         if (info->attrs[NL80211_ATTR_KEY])
 482                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 483         else
 484                 err = nl80211_parse_key_old(info, k);
 485
 486         if (err)
 487                 return err;
 488
 489         if (k->def && k->defmgmt)
 490                 return -EINVAL;
 491
 492         if (k->defmgmt) {
 493                 if (k->def_uni || !k->def_multi)
 494                         return -EINVAL;
 495         }
 496
 497         if (k->idx != -1) {
 498                 if (k->defmgmt) {
 499                         if (k->idx < 4 || k->idx > 5)
 500                                 return -EINVAL;
 501                 } else if (k->def) {
 502                         if (k->idx < 0 || k->idx > 3)
 503                                 return -EINVAL;
 504                 } else {
 505                         if (k->idx < 0 || k->idx > 5)
 506                                 return -EINVAL;
 507                 }
 508         }
 509
 510         return 0;
 511 }
 512
 513 static struct cfg80211_cached_keys *
 514 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 515                        struct nlattr *keys)
 516 {
 517         struct key_parse parse;
 518         struct nlattr *key;
 519         struct cfg80211_cached_keys *result;
 520         int rem, err, def = 0;
 521
 522         result = kzalloc(sizeof(*result), GFP_KERNEL);
 523         if (!result)
 524                 return ERR_PTR(-ENOMEM);
 525
 526         result->def = -1;
 527         result->defmgmt = -1;
 528
 529         nla_for_each_nested(key, keys, rem) {
 530                 memset(&parse, 0, sizeof(parse));
 531                 parse.idx = -1;
 532
 533                 err = nl80211_parse_key_new(key, &parse);
 534                 if (err)
 535                         goto error;
 536                 err = -EINVAL;
 537                 if (!parse.p.key)
 538                         goto error;
 539                 if (parse.idx < 0 || parse.idx > 4)
 540                         goto error;
 541                 if (parse.def) {
 542                         if (def)
 543                                 goto error;
 544                         def = 1;
 545                         result->def = parse.idx;
 546                         if (!parse.def_uni || !parse.def_multi)
 547                                 goto error;
 548                 } else if (parse.defmgmt)
 549                         goto error;
 550                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 551                                                      parse.idx, false, NULL);
 552                 if (err)
 553                         goto error;
 554                 result->params[parse.idx].cipher = parse.p.cipher;
 555                 result->params[parse.idx].key_len = parse.p.key_len;
 556                 result->params[parse.idx].key = result->data[parse.idx];
 557                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 558         }
 559
 560         return result;
 561  error:
 562         kfree(result);
 563         return ERR_PTR(err);
 564 }
 565
 566 static int nl80211_key_allowed(struct wireless_dev *wdev)
 567 {
 568         ASSERT_WDEV_LOCK(wdev);
 569
 570         switch (wdev->iftype) {
 571         case NL80211_IFTYPE_AP:
 572         case NL80211_IFTYPE_AP_VLAN:
 573         case NL80211_IFTYPE_P2P_GO:
 574         case NL80211_IFTYPE_MESH_POINT:
 575                 break;
 576         case NL80211_IFTYPE_ADHOC:
 577                 if (!wdev->current_bss)
 578                         return -ENOLINK;
 579                 break;
 580         case NL80211_IFTYPE_STATION:
 581         case NL80211_IFTYPE_P2P_CLIENT:
 582                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 583                         return -ENOLINK;
 584                 break;
 585         default:
 586                 return -EINVAL;
 587         }
 588
 589         return 0;
 590 }
 591
 592 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 593 {
 594         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 595         int i;
 596
 597         if (!nl_modes)
 598                 goto nla_put_failure;
 599
 600         i = 0;
 601         while (ifmodes) {
 602                 if (ifmodes & 1)
 603                         NLA_PUT_FLAG(msg, i);
 604                 ifmodes >>= 1;
 605                 i++;
 606         }
 607
 608         nla_nest_end(msg, nl_modes);
 609         return 0;
 610
 611 nla_put_failure:
 612         return -ENOBUFS;
 613 }
 614
 615 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 616                                           struct sk_buff *msg)
 617 {
 618         struct nlattr *nl_combis;
 619         int i, j;
 620
 621         nl_combis = nla_nest_start(msg,
 622                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 623         if (!nl_combis)
 624                 goto nla_put_failure;
 625
 626         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 627                 const struct ieee80211_iface_combination *c;
 628                 struct nlattr *nl_combi, *nl_limits;
 629
 630                 c = &wiphy->iface_combinations[i];
 631
 632                 nl_combi = nla_nest_start(msg, i + 1);
 633                 if (!nl_combi)
 634                         goto nla_put_failure;
 635
 636                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 637                 if (!nl_limits)
 638                         goto nla_put_failure;
 639
 640                 for (j = 0; j < c->n_limits; j++) {
 641                         struct nlattr *nl_limit;
 642
 643                         nl_limit = nla_nest_start(msg, j + 1);
 644                         if (!nl_limit)
 645                                 goto nla_put_failure;
 646                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 647                                     c->limits[j].max);
 648                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 649                                                 c->limits[j].types))
 650                                 goto nla_put_failure;
 651                         nla_nest_end(msg, nl_limit);
 652                 }
 653
 654                 nla_nest_end(msg, nl_limits);
 655
 656                 if (c->beacon_int_infra_match)
 657                         NLA_PUT_FLAG(msg,
 658                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 659                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 660                             c->num_different_channels);
 661                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 662                             c->max_interfaces);
 663
 664                 nla_nest_end(msg, nl_combi);
 665         }
 666
 667         nla_nest_end(msg, nl_combis);
 668
 669         return 0;
 670 nla_put_failure:
 671         return -ENOBUFS;
 672 }
 673
 674 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 675                               struct cfg80211_registered_device *dev)
 676 {
 677         void *hdr;
 678         struct nlattr *nl_bands, *nl_band;
 679         struct nlattr *nl_freqs, *nl_freq;
 680         struct nlattr *nl_rates, *nl_rate;
 681         struct nlattr *nl_cmds;
 682         enum ieee80211_band band;
 683         struct ieee80211_channel *chan;
 684         struct ieee80211_rate *rate;
 685         int i;
 686         const struct ieee80211_txrx_stypes *mgmt_stypes =
 687                                 dev->wiphy.mgmt_stypes;
 688
 689         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 690         if (!hdr)
 691                 return -1;
 692
 693         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 694         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 695
 696         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 697                     cfg80211_rdev_list_generation);
 698
 699         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 700                    dev->wiphy.retry_short);
 701         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 702                    dev->wiphy.retry_long);
 703         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 704                     dev->wiphy.frag_threshold);
 705         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 706                     dev->wiphy.rts_threshold);
 707         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 708                     dev->wiphy.coverage_class);
 709         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 710                    dev->wiphy.max_scan_ssids);
 711         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 712                    dev->wiphy.max_sched_scan_ssids);
 713         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 714                     dev->wiphy.max_scan_ie_len);
 715         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 716                     dev->wiphy.max_sched_scan_ie_len);
 717
 718         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 719                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 720         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 721                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 722
 723         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 724                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 725                 dev->wiphy.cipher_suites);
 726
 727         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 728                    dev->wiphy.max_num_pmkids);
 729
 730         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 731                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 732
 733         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 734                     dev->wiphy.available_antennas_tx);
 735         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 736                     dev->wiphy.available_antennas_rx);
 737
 738         if ((dev->wiphy.available_antennas_tx ||
 739              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 740                 u32 tx_ant = 0, rx_ant = 0;
 741                 int res;
 742                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 743                 if (!res) {
 744                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 745                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 746                 }
 747         }
 748
 749         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 750                                 dev->wiphy.interface_modes))
 751                 goto nla_put_failure;
 752
 753         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 754         if (!nl_bands)
 755                 goto nla_put_failure;
 756
 757         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 758                 if (!dev->wiphy.bands[band])
 759                         continue;
 760
 761                 nl_band = nla_nest_start(msg, band);
 762                 if (!nl_band)
 763                         goto nla_put_failure;
 764
 765                 /* add HT info */
 766                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 767                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 768                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 769                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 770                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 771                                 dev->wiphy.bands[band]->ht_cap.cap);
 772                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 773                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 774                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 775                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 776                 }
 777
 778                 /* add frequencies */
 779                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 780                 if (!nl_freqs)
 781                         goto nla_put_failure;
 782
 783                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 784                         nl_freq = nla_nest_start(msg, i);
 785                         if (!nl_freq)
 786                                 goto nla_put_failure;
 787
 788                         chan = &dev->wiphy.bands[band]->channels[i];
 789
 790                         if (nl80211_msg_put_channel(msg, chan))
 791                                 goto nla_put_failure;
 792
 793                         nla_nest_end(msg, nl_freq);
 794                 }
 795
 796                 nla_nest_end(msg, nl_freqs);
 797
 798                 /* add bitrates */
 799                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 800                 if (!nl_rates)
 801                         goto nla_put_failure;
 802
 803                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 804                         nl_rate = nla_nest_start(msg, i);
 805                         if (!nl_rate)
 806                                 goto nla_put_failure;
 807
 808                         rate = &dev->wiphy.bands[band]->bitrates[i];
 809                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 810                                     rate->bitrate);
 811                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 812                                 NLA_PUT_FLAG(msg,
 813                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 814
 815                         nla_nest_end(msg, nl_rate);
 816                 }
 817
 818                 nla_nest_end(msg, nl_rates);
 819
 820                 nla_nest_end(msg, nl_band);
 821         }
 822         nla_nest_end(msg, nl_bands);
 823
 824         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 825         if (!nl_cmds)
 826                 goto nla_put_failure;
 827
 828         i = 0;
 829 #define CMD(op, n)                                              \
 830          do {                                                   \
 831                 if (dev->ops->op) {                             \
 832                         i++;                                    \
 833                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 834                 }                                               \
 835         } while (0)
 836
 837         CMD(add_virtual_intf, NEW_INTERFACE);
 838         CMD(change_virtual_intf, SET_INTERFACE);
 839         CMD(add_key, NEW_KEY);
 840         CMD(add_beacon, NEW_BEACON);
 841         CMD(add_station, NEW_STATION);
 842         CMD(add_mpath, NEW_MPATH);
 843         CMD(update_mesh_config, SET_MESH_CONFIG);
 844         CMD(change_bss, SET_BSS);
 845         CMD(auth, AUTHENTICATE);
 846         CMD(assoc, ASSOCIATE);
 847         CMD(deauth, DEAUTHENTICATE);
 848         CMD(disassoc, DISASSOCIATE);
 849         CMD(join_ibss, JOIN_IBSS);
 850         CMD(join_mesh, JOIN_MESH);
 851         CMD(set_pmksa, SET_PMKSA);
 852         CMD(del_pmksa, DEL_PMKSA);
 853         CMD(flush_pmksa, FLUSH_PMKSA);
 854         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 855         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 856         CMD(mgmt_tx, FRAME);
 857         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 858         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 859                 i++;
 860                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 861         }
 862         CMD(set_channel, SET_CHANNEL);
 863         CMD(set_wds_peer, SET_WDS_PEER);
 864         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 865                 CMD(sched_scan_start, START_SCHED_SCAN);
 866
 867 #undef CMD
 868
 869         if (dev->ops->connect || dev->ops->auth) {
 870                 i++;
 871                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 872         }
 873
 874         if (dev->ops->disconnect || dev->ops->deauth) {
 875                 i++;
 876                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 877         }
 878
 879         nla_nest_end(msg, nl_cmds);
 880
 881         if (dev->ops->remain_on_channel)
 882                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 883                             dev->wiphy.max_remain_on_channel_duration);
 884
 885         if (dev->ops->mgmt_tx_cancel_wait)
 886                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 887
 888         if (mgmt_stypes) {
 889                 u16 stypes;
 890                 struct nlattr *nl_ftypes, *nl_ifs;
 891                 enum nl80211_iftype ift;
 892
 893                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 894                 if (!nl_ifs)
 895                         goto nla_put_failure;
 896
 897                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 898                         nl_ftypes = nla_nest_start(msg, ift);
 899                         if (!nl_ftypes)
 900                                 goto nla_put_failure;
 901                         i = 0;
 902                         stypes = mgmt_stypes[ift].tx;
 903                         while (stypes) {
 904                                 if (stypes & 1)
 905                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 906                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 907                                 stypes >>= 1;
 908                                 i++;
 909                         }
 910                         nla_nest_end(msg, nl_ftypes);
 911                 }
 912
 913                 nla_nest_end(msg, nl_ifs);
 914
 915                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 916                 if (!nl_ifs)
 917                         goto nla_put_failure;
 918
 919                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 920                         nl_ftypes = nla_nest_start(msg, ift);
 921                         if (!nl_ftypes)
 922                                 goto nla_put_failure;
 923                         i = 0;
 924                         stypes = mgmt_stypes[ift].rx;
 925                         while (stypes) {
 926                                 if (stypes & 1)
 927                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 928                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 929                                 stypes >>= 1;
 930                                 i++;
 931                         }
 932                         nla_nest_end(msg, nl_ftypes);
 933                 }
 934                 nla_nest_end(msg, nl_ifs);
 935         }
 936
 937         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 938                 struct nlattr *nl_wowlan;
 939
 940                 nl_wowlan = nla_nest_start(msg,
 941                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 942                 if (!nl_wowlan)
 943                         goto nla_put_failure;
 944
 945                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 946                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 947                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 948                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 949                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 950                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 951                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 952                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 953                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 954                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 955                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 956                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 957                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 958                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 959                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 960                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 961                 if (dev->wiphy.wowlan.n_patterns) {
 962                         struct nl80211_wowlan_pattern_support pat = {
 963                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 964                                 .min_pattern_len =
 965                                         dev->wiphy.wowlan.pattern_min_len,
 966                                 .max_pattern_len =
 967                                         dev->wiphy.wowlan.pattern_max_len,
 968                         };
 969                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 970                                 sizeof(pat), &pat);
 971                 }
 972
 973                 nla_nest_end(msg, nl_wowlan);
 974         }
 975
 976         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 977                                 dev->wiphy.software_iftypes))
 978                 goto nla_put_failure;
 979
 980         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 981                 goto nla_put_failure;
 982
 983         return genlmsg_end(msg, hdr);
 984
 985  nla_put_failure:
 986         genlmsg_cancel(msg, hdr);
 987         return -EMSGSIZE;
 988 }
 989
 990 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 991 {
 992         int idx = 0;
 993         int start = cb->args[0];
 994         struct cfg80211_registered_device *dev;
 995
 996         mutex_lock(&cfg80211_mutex);
 997         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 998                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 999                         continue;
1000                 if (++idx <= start)
1001                         continue;
1002                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1003                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1004                                        dev) < 0) {
1005                         idx--;
1006                         break;
1007                 }
1008         }
1009         mutex_unlock(&cfg80211_mutex);
1010
1011         cb->args[0] = idx;
1012
1013         return skb->len;
1014 }
1015
1016 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1017 {
1018         struct sk_buff *msg;
1019         struct cfg80211_registered_device *dev = info->user_ptr[0];
1020
1021         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1022         if (!msg)
1023                 return -ENOMEM;
1024
1025         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1026                 nlmsg_free(msg);
1027                 return -ENOBUFS;
1028         }
1029
1030         return genlmsg_reply(msg, info);
1031 }
1032
1033 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1034         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1035         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1036         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1037         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1038         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1039 };
1040
1041 static int parse_txq_params(struct nlattr *tb[],
1042                             struct ieee80211_txq_params *txq_params)
1043 {
1044         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1045             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1046             !tb[NL80211_TXQ_ATTR_AIFS])
1047                 return -EINVAL;
1048
1049         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1050         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1051         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1052         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1053         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1054
1055         return 0;
1056 }
1057
1058 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1059 {
1060         /*
1061          * You can only set the channel explicitly for AP, mesh
1062          * and WDS type interfaces; all others have their channel
1063          * managed via their respective "establish a connection"
1064          * command (connect, join, ...)
1065          *
1066          * Monitors are special as they are normally slaved to
1067          * whatever else is going on, so they behave as though
1068          * you tried setting the wiphy channel itself.
1069          */
1070         return !wdev ||
1071                 wdev->iftype == NL80211_IFTYPE_AP ||
1072                 wdev->iftype == NL80211_IFTYPE_WDS ||
1073                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1074                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1075                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1076 }
1077
1078 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1079                                  struct wireless_dev *wdev,
1080                                  struct genl_info *info)
1081 {
1082         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1083         u32 freq;
1084         int result;
1085
1086         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1087                 return -EINVAL;
1088
1089         if (!nl80211_can_set_dev_channel(wdev))
1090                 return -EOPNOTSUPP;
1091
1092         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1093                 channel_type = nla_get_u32(info->attrs[
1094                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1095                 if (channel_type != NL80211_CHAN_NO_HT &&
1096                     channel_type != NL80211_CHAN_HT20 &&
1097                     channel_type != NL80211_CHAN_HT40PLUS &&
1098                     channel_type != NL80211_CHAN_HT40MINUS)
1099                         return -EINVAL;
1100         }
1101
1102         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1103
1104         mutex_lock(&rdev->devlist_mtx);
1105         if (wdev) {
1106                 wdev_lock(wdev);
1107                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1108                 wdev_unlock(wdev);
1109         } else {
1110                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1111         }
1112         mutex_unlock(&rdev->devlist_mtx);
1113
1114         return result;
1115 }
1116
1117 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1118 {
1119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1120         struct net_device *netdev = info->user_ptr[1];
1121
1122         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1123 }
1124
1125 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1126 {
1127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1128         struct net_device *dev = info->user_ptr[1];
1129         struct wireless_dev *wdev = dev->ieee80211_ptr;
1130         const u8 *bssid;
1131
1132         if (!info->attrs[NL80211_ATTR_MAC])
1133                 return -EINVAL;
1134
1135         if (netif_running(dev))
1136                 return -EBUSY;
1137
1138         if (!rdev->ops->set_wds_peer)
1139                 return -EOPNOTSUPP;
1140
1141         if (wdev->iftype != NL80211_IFTYPE_WDS)
1142                 return -EOPNOTSUPP;
1143
1144         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1145         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1146 }
1147
1148
1149 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1150 {
1151         struct cfg80211_registered_device *rdev;
1152         struct net_device *netdev = NULL;
1153         struct wireless_dev *wdev;
1154         int result = 0, rem_txq_params = 0;
1155         struct nlattr *nl_txq_params;
1156         u32 changed;
1157         u8 retry_short = 0, retry_long = 0;
1158         u32 frag_threshold = 0, rts_threshold = 0;
1159         u8 coverage_class = 0;
1160
1161         /*
1162          * Try to find the wiphy and netdev. Normally this
1163          * function shouldn't need the netdev, but this is
1164          * done for backward compatibility -- previously
1165          * setting the channel was done per wiphy, but now
1166          * it is per netdev. Previous userland like hostapd
1167          * also passed a netdev to set_wiphy, so that it is
1168          * possible to let that go to the right netdev!
1169          */
1170         mutex_lock(&cfg80211_mutex);
1171
1172         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1173                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1174
1175                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1176                 if (netdev && netdev->ieee80211_ptr) {
1177                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1178                         mutex_lock(&rdev->mtx);
1179                 } else
1180                         netdev = NULL;
1181         }
1182
1183         if (!netdev) {
1184                 rdev = __cfg80211_rdev_from_info(info);
1185                 if (IS_ERR(rdev)) {
1186                         mutex_unlock(&cfg80211_mutex);
1187                         return PTR_ERR(rdev);
1188                 }
1189                 wdev = NULL;
1190                 netdev = NULL;
1191                 result = 0;
1192
1193                 mutex_lock(&rdev->mtx);
1194         } else if (netif_running(netdev) &&
1195                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1196                 wdev = netdev->ieee80211_ptr;
1197         else
1198                 wdev = NULL;
1199
1200         /*
1201          * end workaround code, by now the rdev is available
1202          * and locked, and wdev may or may not be NULL.
1203          */
1204
1205         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1206                 result = cfg80211_dev_rename(
1207                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1208
1209         mutex_unlock(&cfg80211_mutex);
1210
1211         if (result)
1212                 goto bad_res;
1213
1214         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1215                 struct ieee80211_txq_params txq_params;
1216                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1217
1218                 if (!rdev->ops->set_txq_params) {
1219                         result = -EOPNOTSUPP;
1220                         goto bad_res;
1221                 }
1222
1223                 nla_for_each_nested(nl_txq_params,
1224                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1225                                     rem_txq_params) {
1226                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1227                                   nla_data(nl_txq_params),
1228                                   nla_len(nl_txq_params),
1229                                   txq_params_policy);
1230                         result = parse_txq_params(tb, &txq_params);
1231                         if (result)
1232                                 goto bad_res;
1233
1234                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1235                                                            &txq_params);
1236                         if (result)
1237                                 goto bad_res;
1238                 }
1239         }
1240
1241         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1242                 result = __nl80211_set_channel(rdev, wdev, info);
1243                 if (result)
1244                         goto bad_res;
1245         }
1246
1247         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1248                 enum nl80211_tx_power_setting type;
1249                 int idx, mbm = 0;
1250
1251                 if (!rdev->ops->set_tx_power) {
1252                         result = -EOPNOTSUPP;
1253                         goto bad_res;
1254                 }
1255
1256                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1257                 type = nla_get_u32(info->attrs[idx]);
1258
1259                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1260                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1261                         result = -EINVAL;
1262                         goto bad_res;
1263                 }
1264
1265                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1266                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1267                         mbm = nla_get_u32(info->attrs[idx]);
1268                 }
1269
1270                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1271                 if (result)
1272                         goto bad_res;
1273         }
1274
1275         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1276             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1277                 u32 tx_ant, rx_ant;
1278                 if ((!rdev->wiphy.available_antennas_tx &&
1279                      !rdev->wiphy.available_antennas_rx) ||
1280                     !rdev->ops->set_antenna) {
1281                         result = -EOPNOTSUPP;
1282                         goto bad_res;
1283                 }
1284
1285                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1286                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1287
1288                 /* reject antenna configurations which don't match the
1289                  * available antenna masks, except for the "all" mask */
1290                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1291                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1292                         result = -EINVAL;
1293                         goto bad_res;
1294                 }
1295
1296                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1297                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1298
1299                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1300                 if (result)
1301                         goto bad_res;
1302         }
1303
1304         changed = 0;
1305
1306         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1307                 retry_short = nla_get_u8(
1308                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1309                 if (retry_short == 0) {
1310                         result = -EINVAL;
1311                         goto bad_res;
1312                 }
1313                 changed |= WIPHY_PARAM_RETRY_SHORT;
1314         }
1315
1316         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1317                 retry_long = nla_get_u8(
1318                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1319                 if (retry_long == 0) {
1320                         result = -EINVAL;
1321                         goto bad_res;
1322                 }
1323                 changed |= WIPHY_PARAM_RETRY_LONG;
1324         }
1325
1326         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1327                 frag_threshold = nla_get_u32(
1328                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1329                 if (frag_threshold < 256) {
1330                         result = -EINVAL;
1331                         goto bad_res;
1332                 }
1333                 if (frag_threshold != (u32) -1) {
1334                         /*
1335                          * Fragments (apart from the last one) are required to
1336                          * have even length. Make the fragmentation code
1337                          * simpler by stripping LSB should someone try to use
1338                          * odd threshold value.
1339                          */
1340                         frag_threshold &= ~0x1;
1341                 }
1342                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1343         }
1344
1345         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1346                 rts_threshold = nla_get_u32(
1347                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1348                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1349         }
1350
1351         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1352                 coverage_class = nla_get_u8(
1353                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1354                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1355         }
1356
1357         if (changed) {
1358                 u8 old_retry_short, old_retry_long;
1359                 u32 old_frag_threshold, old_rts_threshold;
1360                 u8 old_coverage_class;
1361
1362                 if (!rdev->ops->set_wiphy_params) {
1363                         result = -EOPNOTSUPP;
1364                         goto bad_res;
1365                 }
1366
1367                 old_retry_short = rdev->wiphy.retry_short;
1368                 old_retry_long = rdev->wiphy.retry_long;
1369                 old_frag_threshold = rdev->wiphy.frag_threshold;
1370                 old_rts_threshold = rdev->wiphy.rts_threshold;
1371                 old_coverage_class = rdev->wiphy.coverage_class;
1372
1373                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1374                         rdev->wiphy.retry_short = retry_short;
1375                 if (changed & WIPHY_PARAM_RETRY_LONG)
1376                         rdev->wiphy.retry_long = retry_long;
1377                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1378                         rdev->wiphy.frag_threshold = frag_threshold;
1379                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1380                         rdev->wiphy.rts_threshold = rts_threshold;
1381                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1382                         rdev->wiphy.coverage_class = coverage_class;
1383
1384                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1385                 if (result) {
1386                         rdev->wiphy.retry_short = old_retry_short;
1387                         rdev->wiphy.retry_long = old_retry_long;
1388                         rdev->wiphy.frag_threshold = old_frag_threshold;
1389                         rdev->wiphy.rts_threshold = old_rts_threshold;
1390                         rdev->wiphy.coverage_class = old_coverage_class;
1391                 }
1392         }
1393
1394  bad_res:
1395         mutex_unlock(&rdev->mtx);
1396         if (netdev)
1397                 dev_put(netdev);
1398         return result;
1399 }
1400
1401
1402 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1403                               struct cfg80211_registered_device *rdev,
1404                               struct net_device *dev)
1405 {
1406         void *hdr;
1407
1408         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1409         if (!hdr)
1410                 return -1;
1411
1412         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1413         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1414         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1415         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1416
1417         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1418                     rdev->devlist_generation ^
1419                         (cfg80211_rdev_list_generation << 2));
1420
1421         return genlmsg_end(msg, hdr);
1422
1423  nla_put_failure:
1424         genlmsg_cancel(msg, hdr);
1425         return -EMSGSIZE;
1426 }
1427
1428 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1429 {
1430         int wp_idx = 0;
1431         int if_idx = 0;
1432         int wp_start = cb->args[0];
1433         int if_start = cb->args[1];
1434         struct cfg80211_registered_device *rdev;
1435         struct wireless_dev *wdev;
1436
1437         mutex_lock(&cfg80211_mutex);
1438         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1439                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1440                         continue;
1441                 if (wp_idx < wp_start) {
1442                         wp_idx++;
1443                         continue;
1444                 }
1445                 if_idx = 0;
1446
1447                 mutex_lock(&rdev->devlist_mtx);
1448                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1449                         if (if_idx < if_start) {
1450                                 if_idx++;
1451                                 continue;
1452                         }
1453                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1454                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1455                                                rdev, wdev->netdev) < 0) {
1456                                 mutex_unlock(&rdev->devlist_mtx);
1457                                 goto out;
1458                         }
1459                         if_idx++;
1460                 }
1461                 mutex_unlock(&rdev->devlist_mtx);
1462
1463                 wp_idx++;
1464         }
1465  out:
1466         mutex_unlock(&cfg80211_mutex);
1467
1468         cb->args[0] = wp_idx;
1469         cb->args[1] = if_idx;
1470
1471         return skb->len;
1472 }
1473
1474 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1475 {
1476         struct sk_buff *msg;
1477         struct cfg80211_registered_device *dev = info->user_ptr[0];
1478         struct net_device *netdev = info->user_ptr[1];
1479
1480         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1481         if (!msg)
1482                 return -ENOMEM;
1483
1484         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1485                                dev, netdev) < 0) {
1486                 nlmsg_free(msg);
1487                 return -ENOBUFS;
1488         }
1489
1490         return genlmsg_reply(msg, info);
1491 }
1492
1493 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1494         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1495         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1496         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1497         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1498         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1499 };
1500
1501 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1502 {
1503         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1504         int flag;
1505
1506         *mntrflags = 0;
1507
1508         if (!nla)
1509                 return -EINVAL;
1510
1511         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1512                              nla, mntr_flags_policy))
1513                 return -EINVAL;
1514
1515         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1516                 if (flags[flag])
1517                         *mntrflags |= (1<<flag);
1518
1519         return 0;
1520 }
1521
1522 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1523                                struct net_device *netdev, u8 use_4addr,
1524                                enum nl80211_iftype iftype)
1525 {
1526         if (!use_4addr) {
1527                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1528                         return -EBUSY;
1529                 return 0;
1530         }
1531
1532         switch (iftype) {
1533         case NL80211_IFTYPE_AP_VLAN:
1534                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1535                         return 0;
1536                 break;
1537         case NL80211_IFTYPE_STATION:
1538                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1539                         return 0;
1540                 break;
1541         default:
1542                 break;
1543         }
1544
1545         return -EOPNOTSUPP;
1546 }
1547
1548 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1549 {
1550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1551         struct vif_params params;
1552         int err;
1553         enum nl80211_iftype otype, ntype;
1554         struct net_device *dev = info->user_ptr[1];
1555         u32 _flags, *flags = NULL;
1556         bool change = false;
1557
1558         memset(&params, 0, sizeof(params));
1559
1560         otype = ntype = dev->ieee80211_ptr->iftype;
1561
1562         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1563                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1564                 if (otype != ntype)
1565                         change = true;
1566                 if (ntype > NL80211_IFTYPE_MAX)
1567                         return -EINVAL;
1568         }
1569
1570         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1571                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1572
1573                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1574                         return -EINVAL;
1575                 if (netif_running(dev))
1576                         return -EBUSY;
1577
1578                 wdev_lock(wdev);
1579                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1580                              IEEE80211_MAX_MESH_ID_LEN);
1581                 wdev->mesh_id_up_len =
1582                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1583                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1584                        wdev->mesh_id_up_len);
1585                 wdev_unlock(wdev);
1586         }
1587
1588         if (info->attrs[NL80211_ATTR_4ADDR]) {
1589                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1590                 change = true;
1591                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1592                 if (err)
1593                         return err;
1594         } else {
1595                 params.use_4addr = -1;
1596         }
1597
1598         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1599                 if (ntype != NL80211_IFTYPE_MONITOR)
1600                         return -EINVAL;
1601                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1602                                           &_flags);
1603                 if (err)
1604                         return err;
1605
1606                 flags = &_flags;
1607                 change = true;
1608         }
1609
1610         if (change)
1611                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1612         else
1613                 err = 0;
1614
1615         if (!err && params.use_4addr != -1)
1616                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1617
1618         return err;
1619 }
1620
1621 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1622 {
1623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1624         struct vif_params params;
1625         struct net_device *dev;
1626         int err;
1627         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1628         u32 flags;
1629
1630         memset(&params, 0, sizeof(params));
1631
1632         if (!info->attrs[NL80211_ATTR_IFNAME])
1633                 return -EINVAL;
1634
1635         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1636                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1637                 if (type > NL80211_IFTYPE_MAX)
1638                         return -EINVAL;
1639         }
1640
1641         if (!rdev->ops->add_virtual_intf ||
1642             !(rdev->wiphy.interface_modes & (1 << type)))
1643                 return -EOPNOTSUPP;
1644
1645         if (info->attrs[NL80211_ATTR_4ADDR]) {
1646                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1647                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1648                 if (err)
1649                         return err;
1650         }
1651
1652         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1653                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1654                                   &flags);
1655         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1656                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1657                 type, err ? NULL : &flags, &params);
1658         if (IS_ERR(dev))
1659                 return PTR_ERR(dev);
1660
1661         if (type == NL80211_IFTYPE_MESH_POINT &&
1662             info->attrs[NL80211_ATTR_MESH_ID]) {
1663                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1664
1665                 wdev_lock(wdev);
1666                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1667                              IEEE80211_MAX_MESH_ID_LEN);
1668                 wdev->mesh_id_up_len =
1669                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1670                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1671                        wdev->mesh_id_up_len);
1672                 wdev_unlock(wdev);
1673         }
1674
1675         return 0;
1676 }
1677
1678 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1679 {
1680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1681         struct net_device *dev = info->user_ptr[1];
1682
1683         if (!rdev->ops->del_virtual_intf)
1684                 return -EOPNOTSUPP;
1685
1686         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1687 }
1688
1689 struct get_key_cookie {
1690         struct sk_buff *msg;
1691         int error;
1692         int idx;
1693 };
1694
1695 static void get_key_callback(void *c, struct key_params *params)
1696 {
1697         struct nlattr *key;
1698         struct get_key_cookie *cookie = c;
1699
1700         if (params->key)
1701                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1702                         params->key_len, params->key);
1703
1704         if (params->seq)
1705                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1706                         params->seq_len, params->seq);
1707
1708         if (params->cipher)
1709                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1710                             params->cipher);
1711
1712         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1713         if (!key)
1714                 goto nla_put_failure;
1715
1716         if (params->key)
1717                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1718                         params->key_len, params->key);
1719
1720         if (params->seq)
1721                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1722                         params->seq_len, params->seq);
1723
1724         if (params->cipher)
1725                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1726                             params->cipher);
1727
1728         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1729
1730         nla_nest_end(cookie->msg, key);
1731
1732         return;
1733  nla_put_failure:
1734         cookie->error = 1;
1735 }
1736
1737 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1738 {
1739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1740         int err;
1741         struct net_device *dev = info->user_ptr[1];
1742         u8 key_idx = 0;
1743         const u8 *mac_addr = NULL;
1744         bool pairwise;
1745         struct get_key_cookie cookie = {
1746                 .error = 0,
1747         };
1748         void *hdr;
1749         struct sk_buff *msg;
1750
1751         if (info->attrs[NL80211_ATTR_KEY_IDX])
1752                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1753
1754         if (key_idx > 5)
1755                 return -EINVAL;
1756
1757         if (info->attrs[NL80211_ATTR_MAC])
1758                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1759
1760         pairwise = !!mac_addr;
1761         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1762                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1763                 if (kt >= NUM_NL80211_KEYTYPES)
1764                         return -EINVAL;
1765                 if (kt != NL80211_KEYTYPE_GROUP &&
1766                     kt != NL80211_KEYTYPE_PAIRWISE)
1767                         return -EINVAL;
1768                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1769         }
1770
1771         if (!rdev->ops->get_key)
1772                 return -EOPNOTSUPP;
1773
1774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1775         if (!msg)
1776                 return -ENOMEM;
1777
1778         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1779                              NL80211_CMD_NEW_KEY);
1780         if (IS_ERR(hdr))
1781                 return PTR_ERR(hdr);
1782
1783         cookie.msg = msg;
1784         cookie.idx = key_idx;
1785
1786         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1787         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1788         if (mac_addr)
1789                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1790
1791         if (pairwise && mac_addr &&
1792             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1793                 return -ENOENT;
1794
1795         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1796                                  mac_addr, &cookie, get_key_callback);
1797
1798         if (err)
1799                 goto free_msg;
1800
1801         if (cookie.error)
1802                 goto nla_put_failure;
1803
1804         genlmsg_end(msg, hdr);
1805         return genlmsg_reply(msg, info);
1806
1807  nla_put_failure:
1808         err = -ENOBUFS;
1809  free_msg:
1810         nlmsg_free(msg);
1811         return err;
1812 }
1813
1814 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1815 {
1816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1817         struct key_parse key;
1818         int err;
1819         struct net_device *dev = info->user_ptr[1];
1820
1821         err = nl80211_parse_key(info, &key);
1822         if (err)
1823                 return err;
1824
1825         if (key.idx < 0)
1826                 return -EINVAL;
1827
1828         /* only support setting default key */
1829         if (!key.def && !key.defmgmt)
1830                 return -EINVAL;
1831
1832         wdev_lock(dev->ieee80211_ptr);
1833
1834         if (key.def) {
1835                 if (!rdev->ops->set_default_key) {
1836                         err = -EOPNOTSUPP;
1837                         goto out;
1838                 }
1839
1840                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1841                 if (err)
1842                         goto out;
1843
1844                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1845                                                  key.def_uni, key.def_multi);
1846
1847                 if (err)
1848                         goto out;
1849
1850 #ifdef CONFIG_CFG80211_WEXT
1851                 dev->ieee80211_ptr->wext.default_key = key.idx;
1852 #endif
1853         } else {
1854                 if (key.def_uni || !key.def_multi) {
1855                         err = -EINVAL;
1856                         goto out;
1857                 }
1858
1859                 if (!rdev->ops->set_default_mgmt_key) {
1860                         err = -EOPNOTSUPP;
1861                         goto out;
1862                 }
1863
1864                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1865                 if (err)
1866                         goto out;
1867
1868                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1869                                                       dev, key.idx);
1870                 if (err)
1871                         goto out;
1872
1873 #ifdef CONFIG_CFG80211_WEXT
1874                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1875 #endif
1876         }
1877
1878  out:
1879         wdev_unlock(dev->ieee80211_ptr);
1880
1881         return err;
1882 }
1883
1884 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1885 {
1886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1887         int err;
1888         struct net_device *dev = info->user_ptr[1];
1889         struct key_parse key;
1890         const u8 *mac_addr = NULL;
1891
1892         err = nl80211_parse_key(info, &key);
1893         if (err)
1894                 return err;
1895
1896         if (!key.p.key)
1897                 return -EINVAL;
1898
1899         if (info->attrs[NL80211_ATTR_MAC])
1900                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1901
1902         if (key.type == -1) {
1903                 if (mac_addr)
1904                         key.type = NL80211_KEYTYPE_PAIRWISE;
1905                 else
1906                         key.type = NL80211_KEYTYPE_GROUP;
1907         }
1908
1909         /* for now */
1910         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1911             key.type != NL80211_KEYTYPE_GROUP)
1912                 return -EINVAL;
1913
1914         if (!rdev->ops->add_key)
1915                 return -EOPNOTSUPP;
1916
1917         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1918                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1919                                            mac_addr))
1920                 return -EINVAL;
1921
1922         wdev_lock(dev->ieee80211_ptr);
1923         err = nl80211_key_allowed(dev->ieee80211_ptr);
1924         if (!err)
1925                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1926                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1927                                          mac_addr, &key.p);
1928         wdev_unlock(dev->ieee80211_ptr);
1929
1930         return err;
1931 }
1932
1933 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1934 {
1935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1936         int err;
1937         struct net_device *dev = info->user_ptr[1];
1938         u8 *mac_addr = NULL;
1939         struct key_parse key;
1940
1941         err = nl80211_parse_key(info, &key);
1942         if (err)
1943                 return err;
1944
1945         if (info->attrs[NL80211_ATTR_MAC])
1946                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1947
1948         if (key.type == -1) {
1949                 if (mac_addr)
1950                         key.type = NL80211_KEYTYPE_PAIRWISE;
1951                 else
1952                         key.type = NL80211_KEYTYPE_GROUP;
1953         }
1954
1955         /* for now */
1956         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1957             key.type != NL80211_KEYTYPE_GROUP)
1958                 return -EINVAL;
1959
1960         if (!rdev->ops->del_key)
1961                 return -EOPNOTSUPP;
1962
1963         wdev_lock(dev->ieee80211_ptr);
1964         err = nl80211_key_allowed(dev->ieee80211_ptr);
1965
1966         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1967             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1968                 err = -ENOENT;
1969
1970         if (!err)
1971                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1972                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1973                                          mac_addr);
1974
1975 #ifdef CONFIG_CFG80211_WEXT
1976         if (!err) {
1977                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1978                         dev->ieee80211_ptr->wext.default_key = -1;
1979                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1980                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1981         }
1982 #endif
1983         wdev_unlock(dev->ieee80211_ptr);
1984
1985         return err;
1986 }
1987
1988 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1989 {
1990         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1991                     struct beacon_parameters *info);
1992         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1993         struct net_device *dev = info->user_ptr[1];
1994         struct wireless_dev *wdev = dev->ieee80211_ptr;
1995         struct beacon_parameters params;
1996         int haveinfo = 0, err;
1997
1998         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
1999             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2000             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2001             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2002                 return -EINVAL;
2003
2004         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2005             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2006                 return -EOPNOTSUPP;
2007
2008         memset(&params, 0, sizeof(params));
2009
2010         switch (info->genlhdr->cmd) {
2011         case NL80211_CMD_NEW_BEACON:
2012                 /* these are required for NEW_BEACON */
2013                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2014                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2015                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2016                         return -EINVAL;
2017
2018                 params.interval =
2019                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2020                 params.dtim_period =
2021                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2022
2023                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2024                 if (err)
2025                         return err;
2026
2027                 /*
2028                  * In theory, some of these attributes could be required for
2029                  * NEW_BEACON, but since they were not used when the command was
2030                  * originally added, keep them optional for old user space
2031                  * programs to work with drivers that do not need the additional
2032                  * information.
2033                  */
2034                 if (info->attrs[NL80211_ATTR_SSID]) {
2035                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2036                         params.ssid_len =
2037                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2038                         if (params.ssid_len == 0 ||
2039                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2040                                 return -EINVAL;
2041                 }
2042
2043                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2044                         params.hidden_ssid = nla_get_u32(
2045                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2046                         if (params.hidden_ssid !=
2047                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2048                             params.hidden_ssid !=
2049                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2050                             params.hidden_ssid !=
2051                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2052                                 return -EINVAL;
2053                 }
2054
2055                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2056
2057                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2058                         params.auth_type = nla_get_u32(
2059                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2060                         if (!nl80211_valid_auth_type(params.auth_type))
2061                                 return -EINVAL;
2062                 } else
2063                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2064
2065                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2066                                               NL80211_MAX_NR_CIPHER_SUITES);
2067                 if (err)
2068                         return err;
2069
2070                 call = rdev->ops->add_beacon;
2071                 break;
2072         case NL80211_CMD_SET_BEACON:
2073                 call = rdev->ops->set_beacon;
2074                 break;
2075         default:
2076                 WARN_ON(1);
2077                 return -EOPNOTSUPP;
2078         }
2079
2080         if (!call)
2081                 return -EOPNOTSUPP;
2082
2083         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2084                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2085                 params.head_len =
2086                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2087                 haveinfo = 1;
2088         }
2089
2090         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2091                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2092                 params.tail_len =
2093                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2094                 haveinfo = 1;
2095         }
2096
2097         if (!haveinfo)
2098                 return -EINVAL;
2099
2100         if (info->attrs[NL80211_ATTR_IE]) {
2101                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2102                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2103         }
2104
2105         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2106                 params.proberesp_ies =
2107                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2108                 params.proberesp_ies_len =
2109                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2110         }
2111
2112         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2113                 params.assocresp_ies =
2114                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2115                 params.assocresp_ies_len =
2116                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2117         }
2118
2119         err = call(&rdev->wiphy, dev, &params);
2120         if (!err && params.interval)
2121                 wdev->beacon_interval = params.interval;
2122         return err;
2123 }
2124
2125 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2126 {
2127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2128         struct net_device *dev = info->user_ptr[1];
2129         struct wireless_dev *wdev = dev->ieee80211_ptr;
2130         int err;
2131
2132         if (!rdev->ops->del_beacon)
2133                 return -EOPNOTSUPP;
2134
2135         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2136             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2137                 return -EOPNOTSUPP;
2138
2139         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2140         if (!err)
2141                 wdev->beacon_interval = 0;
2142         return err;
2143 }
2144
2145 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2146         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2147         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2148         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2149         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2150         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2151 };
2152
2153 static int parse_station_flags(struct genl_info *info,
2154                                struct station_parameters *params)
2155 {
2156         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2157         struct nlattr *nla;
2158         int flag;
2159
2160         /*
2161          * Try parsing the new attribute first so userspace
2162          * can specify both for older kernels.
2163          */
2164         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2165         if (nla) {
2166                 struct nl80211_sta_flag_update *sta_flags;
2167
2168                 sta_flags = nla_data(nla);
2169                 params->sta_flags_mask = sta_flags->mask;
2170                 params->sta_flags_set = sta_flags->set;
2171                 if ((params->sta_flags_mask |
2172                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2173                         return -EINVAL;
2174                 return 0;
2175         }
2176
2177         /* if present, parse the old attribute */
2178
2179         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2180         if (!nla)
2181                 return 0;
2182
2183         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2184                              nla, sta_flags_policy))
2185                 return -EINVAL;
2186
2187         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2188         params->sta_flags_mask &= ~1;
2189
2190         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2191                 if (flags[flag])
2192                         params->sta_flags_set |= (1<<flag);
2193
2194         return 0;
2195 }
2196
2197 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2198                                  int attr)
2199 {
2200         struct nlattr *rate;
2201         u16 bitrate;
2202
2203         rate = nla_nest_start(msg, attr);
2204         if (!rate)
2205                 goto nla_put_failure;
2206
2207         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2208         bitrate = cfg80211_calculate_bitrate(info);
2209         if (bitrate > 0)
2210                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2211
2212         if (info->flags & RATE_INFO_FLAGS_MCS)
2213                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2214         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2215                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2216         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2217                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2218
2219         nla_nest_end(msg, rate);
2220         return true;
2221
2222 nla_put_failure:
2223         return false;
2224 }
2225
2226 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2227                                 int flags, struct net_device *dev,
2228                                 const u8 *mac_addr, struct station_info *sinfo)
2229 {
2230         void *hdr;
2231         struct nlattr *sinfoattr, *bss_param;
2232
2233         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2234         if (!hdr)
2235                 return -1;
2236
2237         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2238         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2239
2240         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2241
2242         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2243         if (!sinfoattr)
2244                 goto nla_put_failure;
2245         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2246                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2247                             sinfo->connected_time);
2248         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2249                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2250                             sinfo->inactive_time);
2251         if (sinfo->filled & STATION_INFO_RX_BYTES)
2252                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2253                             sinfo->rx_bytes);
2254         if (sinfo->filled & STATION_INFO_TX_BYTES)
2255                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2256                             sinfo->tx_bytes);
2257         if (sinfo->filled & STATION_INFO_LLID)
2258                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2259                             sinfo->llid);
2260         if (sinfo->filled & STATION_INFO_PLID)
2261                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2262                             sinfo->plid);
2263         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2264                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2265                             sinfo->plink_state);
2266         if (sinfo->filled & STATION_INFO_SIGNAL)
2267                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2268                            sinfo->signal);
2269         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2270                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2271                            sinfo->signal_avg);
2272         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2273                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2274                                           NL80211_STA_INFO_TX_BITRATE))
2275                         goto nla_put_failure;
2276         }
2277         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2278                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2279                                           NL80211_STA_INFO_RX_BITRATE))
2280                         goto nla_put_failure;
2281         }
2282         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2283                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2284                             sinfo->rx_packets);
2285         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2286                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2287                             sinfo->tx_packets);
2288         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2289                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2290                             sinfo->tx_retries);
2291         if (sinfo->filled & STATION_INFO_TX_FAILED)
2292                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2293                             sinfo->tx_failed);
2294         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2295                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2296                 if (!bss_param)
2297                         goto nla_put_failure;
2298
2299                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2300                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2301                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2302                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2303                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2304                         NLA_PUT_FLAG(msg,
2305                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2306                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2307                            sinfo->bss_param.dtim_period);
2308                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2309                             sinfo->bss_param.beacon_interval);
2310
2311                 nla_nest_end(msg, bss_param);
2312         }
2313         nla_nest_end(msg, sinfoattr);
2314
2315         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2316                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2317                         sinfo->assoc_req_ies);
2318
2319         return genlmsg_end(msg, hdr);
2320
2321  nla_put_failure:
2322         genlmsg_cancel(msg, hdr);
2323         return -EMSGSIZE;
2324 }
2325
2326 static int nl80211_dump_station(struct sk_buff *skb,
2327                                 struct netlink_callback *cb)
2328 {
2329         struct station_info sinfo;
2330         struct cfg80211_registered_device *dev;
2331         struct net_device *netdev;
2332         u8 mac_addr[ETH_ALEN];
2333         int sta_idx = cb->args[1];
2334         int err;
2335
2336         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2337         if (err)
2338                 return err;
2339
2340         if (!dev->ops->dump_station) {
2341                 err = -EOPNOTSUPP;
2342                 goto out_err;
2343         }
2344
2345         while (1) {
2346                 memset(&sinfo, 0, sizeof(sinfo));
2347                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2348                                              mac_addr, &sinfo);
2349                 if (err == -ENOENT)
2350                         break;
2351                 if (err)
2352                         goto out_err;
2353
2354                 if (nl80211_send_station(skb,
2355                                 NETLINK_CB(cb->skb).pid,
2356                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2357                                 netdev, mac_addr,
2358                                 &sinfo) < 0)
2359                         goto out;
2360
2361                 sta_idx++;
2362         }
2363
2364
2365  out:
2366         cb->args[1] = sta_idx;
2367         err = skb->len;
2368  out_err:
2369         nl80211_finish_netdev_dump(dev);
2370
2371         return err;
2372 }
2373
2374 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2375 {
2376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2377         struct net_device *dev = info->user_ptr[1];
2378         struct station_info sinfo;
2379         struct sk_buff *msg;
2380         u8 *mac_addr = NULL;
2381         int err;
2382
2383         memset(&sinfo, 0, sizeof(sinfo));
2384
2385         if (!info->attrs[NL80211_ATTR_MAC])
2386                 return -EINVAL;
2387
2388         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2389
2390         if (!rdev->ops->get_station)
2391                 return -EOPNOTSUPP;
2392
2393         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2394         if (err)
2395                 return err;
2396
2397         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2398         if (!msg)
2399                 return -ENOMEM;
2400
2401         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2402                                  dev, mac_addr, &sinfo) < 0) {
2403                 nlmsg_free(msg);
2404                 return -ENOBUFS;
2405         }
2406
2407         return genlmsg_reply(msg, info);
2408 }
2409
2410 /*
2411  * Get vlan interface making sure it is running and on the right wiphy.
2412  */
2413 static int get_vlan(struct genl_info *info,
2414                     struct cfg80211_registered_device *rdev,
2415                     struct net_device **vlan)
2416 {
2417         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2418         *vlan = NULL;
2419
2420         if (vlanattr) {
2421                 *vlan = dev_get_by_index(genl_info_net(info),
2422                                          nla_get_u32(vlanattr));
2423                 if (!*vlan)
2424                         return -ENODEV;
2425                 if (!(*vlan)->ieee80211_ptr)
2426                         return -EINVAL;
2427                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2428                         return -EINVAL;
2429                 if (!netif_running(*vlan))
2430                         return -ENETDOWN;
2431         }
2432         return 0;
2433 }
2434
2435 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2436 {
2437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2438         int err;
2439         struct net_device *dev = info->user_ptr[1];
2440         struct station_parameters params;
2441         u8 *mac_addr = NULL;
2442
2443         memset(&params, 0, sizeof(params));
2444
2445         params.listen_interval = -1;
2446         params.plink_state = -1;
2447
2448         if (info->attrs[NL80211_ATTR_STA_AID])
2449                 return -EINVAL;
2450
2451         if (!info->attrs[NL80211_ATTR_MAC])
2452                 return -EINVAL;
2453
2454         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2455
2456         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2457                 params.supported_rates =
2458                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2459                 params.supported_rates_len =
2460                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2461         }
2462
2463         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2464                 params.listen_interval =
2465                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2466
2467         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2468                 params.ht_capa =
2469                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2470
2471         if (parse_station_flags(info, &params))
2472                 return -EINVAL;
2473
2474         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2475                 params.plink_action =
2476                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2477
2478         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2479                 params.plink_state =
2480                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2481
2482         err = get_vlan(info, rdev, &params.vlan);
2483         if (err)
2484                 goto out;
2485
2486         /* validate settings */
2487         err = 0;
2488
2489         switch (dev->ieee80211_ptr->iftype) {
2490         case NL80211_IFTYPE_AP:
2491         case NL80211_IFTYPE_AP_VLAN:
2492         case NL80211_IFTYPE_P2P_GO:
2493                 /* disallow mesh-specific things */
2494                 if (params.plink_action)
2495                         err = -EINVAL;
2496                 break;
2497         case NL80211_IFTYPE_P2P_CLIENT:
2498         case NL80211_IFTYPE_STATION:
2499                 /* disallow everything but AUTHORIZED flag */
2500                 if (params.plink_action)
2501                         err = -EINVAL;
2502                 if (params.vlan)
2503                         err = -EINVAL;
2504                 if (params.supported_rates)
2505                         err = -EINVAL;
2506                 if (params.ht_capa)
2507                         err = -EINVAL;
2508                 if (params.listen_interval >= 0)
2509                         err = -EINVAL;
2510                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2511                         err = -EINVAL;
2512                 break;
2513         case NL80211_IFTYPE_MESH_POINT:
2514                 /* disallow things mesh doesn't support */
2515                 if (params.vlan)
2516                         err = -EINVAL;
2517                 if (params.ht_capa)
2518                         err = -EINVAL;
2519                 if (params.listen_interval >= 0)
2520                         err = -EINVAL;
2521                 if (params.sta_flags_mask &
2522                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2523                                   BIT(NL80211_STA_FLAG_MFP) |
2524                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2525                         err = -EINVAL;
2526                 break;
2527         default:
2528                 err = -EINVAL;
2529         }
2530
2531         if (err)
2532                 goto out;
2533
2534         if (!rdev->ops->change_station) {
2535                 err = -EOPNOTSUPP;
2536                 goto out;
2537         }
2538
2539         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2540
2541  out:
2542         if (params.vlan)
2543                 dev_put(params.vlan);
2544
2545         return err;
2546 }
2547
2548 static struct nla_policy
2549 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2550         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2551         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2552 };
2553
2554 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2555 {
2556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2557         int err;
2558         struct net_device *dev = info->user_ptr[1];
2559         struct station_parameters params;
2560         u8 *mac_addr = NULL;
2561
2562         memset(&params, 0, sizeof(params));
2563
2564         if (!info->attrs[NL80211_ATTR_MAC])
2565                 return -EINVAL;
2566
2567         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2568                 return -EINVAL;
2569
2570         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2571                 return -EINVAL;
2572
2573         if (!info->attrs[NL80211_ATTR_STA_AID])
2574                 return -EINVAL;
2575
2576         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2577         params.supported_rates =
2578                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2579         params.supported_rates_len =
2580                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2581         params.listen_interval =
2582                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2583
2584         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2585         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2586                 return -EINVAL;
2587
2588         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2589                 params.ht_capa =
2590                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2591
2592         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2593                 params.plink_action =
2594                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2595
2596         if (parse_station_flags(info, &params))
2597                 return -EINVAL;
2598
2599         /* parse WME attributes if sta is WME capable */
2600         if ((params.sta_flags_set & NL80211_STA_FLAG_WME) &&
2601             info->attrs[NL80211_ATTR_STA_WME]) {
2602                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2603                 struct nlattr *nla;
2604
2605                 nla = info->attrs[NL80211_ATTR_STA_WME];
2606                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2607                                        nl80211_sta_wme_policy);
2608                 if (err)
2609                         return err;
2610
2611                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2612                         params.uapsd_queues =
2613                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2614
2615                 if (tb[NL80211_STA_WME_MAX_SP])
2616                         params.max_sp =
2617                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2618         }
2619
2620         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2621             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2622             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2623             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2624                 return -EINVAL;
2625
2626         err = get_vlan(info, rdev, &params.vlan);
2627         if (err)
2628                 goto out;
2629
2630         /* validate settings */
2631         err = 0;
2632
2633         if (!rdev->ops->add_station) {
2634                 err = -EOPNOTSUPP;
2635                 goto out;
2636         }
2637
2638         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2639
2640  out:
2641         if (params.vlan)
2642                 dev_put(params.vlan);
2643         return err;
2644 }
2645
2646 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2647 {
2648         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2649         struct net_device *dev = info->user_ptr[1];
2650         u8 *mac_addr = NULL;
2651
2652         if (info->attrs[NL80211_ATTR_MAC])
2653                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2654
2655         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2656             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2657             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2658             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2659                 return -EINVAL;
2660
2661         if (!rdev->ops->del_station)
2662                 return -EOPNOTSUPP;
2663
2664         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2665 }
2666
2667 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2668                                 int flags, struct net_device *dev,
2669                                 u8 *dst, u8 *next_hop,
2670                                 struct mpath_info *pinfo)
2671 {
2672         void *hdr;
2673         struct nlattr *pinfoattr;
2674
2675         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2676         if (!hdr)
2677                 return -1;
2678
2679         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2680         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2681         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2682
2683         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2684
2685         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2686         if (!pinfoattr)
2687                 goto nla_put_failure;
2688         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2689                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2690                             pinfo->frame_qlen);
2691         if (pinfo->filled & MPATH_INFO_SN)
2692                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2693                             pinfo->sn);
2694         if (pinfo->filled & MPATH_INFO_METRIC)
2695                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2696                             pinfo->metric);
2697         if (pinfo->filled & MPATH_INFO_EXPTIME)
2698                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2699                             pinfo->exptime);
2700         if (pinfo->filled & MPATH_INFO_FLAGS)
2701                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2702                             pinfo->flags);
2703         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2704                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2705                             pinfo->discovery_timeout);
2706         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2707                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2708                             pinfo->discovery_retries);
2709
2710         nla_nest_end(msg, pinfoattr);
2711
2712         return genlmsg_end(msg, hdr);
2713
2714  nla_put_failure:
2715         genlmsg_cancel(msg, hdr);
2716         return -EMSGSIZE;
2717 }
2718
2719 static int nl80211_dump_mpath(struct sk_buff *skb,
2720                               struct netlink_callback *cb)
2721 {
2722         struct mpath_info pinfo;
2723         struct cfg80211_registered_device *dev;
2724         struct net_device *netdev;
2725         u8 dst[ETH_ALEN];
2726         u8 next_hop[ETH_ALEN];
2727         int path_idx = cb->args[1];
2728         int err;
2729
2730         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2731         if (err)
2732                 return err;
2733
2734         if (!dev->ops->dump_mpath) {
2735                 err = -EOPNOTSUPP;
2736                 goto out_err;
2737         }
2738
2739         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2740                 err = -EOPNOTSUPP;
2741                 goto out_err;
2742         }
2743
2744         while (1) {
2745                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2746                                            dst, next_hop, &pinfo);
2747                 if (err == -ENOENT)
2748                         break;
2749                 if (err)
2750                         goto out_err;
2751
2752                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2753                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2754                                        netdev, dst, next_hop,
2755                                        &pinfo) < 0)
2756                         goto out;
2757
2758                 path_idx++;
2759         }
2760
2761
2762  out:
2763         cb->args[1] = path_idx;
2764         err = skb->len;
2765  out_err:
2766         nl80211_finish_netdev_dump(dev);
2767         return err;
2768 }
2769
2770 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2771 {
2772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2773         int err;
2774         struct net_device *dev = info->user_ptr[1];
2775         struct mpath_info pinfo;
2776         struct sk_buff *msg;
2777         u8 *dst = NULL;
2778         u8 next_hop[ETH_ALEN];
2779
2780         memset(&pinfo, 0, sizeof(pinfo));
2781
2782         if (!info->attrs[NL80211_ATTR_MAC])
2783                 return -EINVAL;
2784
2785         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2786
2787         if (!rdev->ops->get_mpath)
2788                 return -EOPNOTSUPP;
2789
2790         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2791                 return -EOPNOTSUPP;
2792
2793         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2794         if (err)
2795                 return err;
2796
2797         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2798         if (!msg)
2799                 return -ENOMEM;
2800
2801         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2802                                  dev, dst, next_hop, &pinfo) < 0) {
2803                 nlmsg_free(msg);
2804                 return -ENOBUFS;
2805         }
2806
2807         return genlmsg_reply(msg, info);
2808 }
2809
2810 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2811 {
2812         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2813         struct net_device *dev = info->user_ptr[1];
2814         u8 *dst = NULL;
2815         u8 *next_hop = NULL;
2816
2817         if (!info->attrs[NL80211_ATTR_MAC])
2818                 return -EINVAL;
2819
2820         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2821                 return -EINVAL;
2822
2823         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2824         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2825
2826         if (!rdev->ops->change_mpath)
2827                 return -EOPNOTSUPP;
2828
2829         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2830                 return -EOPNOTSUPP;
2831
2832         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2833 }
2834
2835 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2836 {
2837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2838         struct net_device *dev = info->user_ptr[1];
2839         u8 *dst = NULL;
2840         u8 *next_hop = NULL;
2841
2842         if (!info->attrs[NL80211_ATTR_MAC])
2843                 return -EINVAL;
2844
2845         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2846                 return -EINVAL;
2847
2848         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2849         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2850
2851         if (!rdev->ops->add_mpath)
2852                 return -EOPNOTSUPP;
2853
2854         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2855                 return -EOPNOTSUPP;
2856
2857         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2858 }
2859
2860 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2861 {
2862         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2863         struct net_device *dev = info->user_ptr[1];
2864         u8 *dst = NULL;
2865
2866         if (info->attrs[NL80211_ATTR_MAC])
2867                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2868
2869         if (!rdev->ops->del_mpath)
2870                 return -EOPNOTSUPP;
2871
2872         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2873 }
2874
2875 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2876 {
2877         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2878         struct net_device *dev = info->user_ptr[1];
2879         struct bss_parameters params;
2880
2881         memset(&params, 0, sizeof(params));
2882         /* default to not changing parameters */
2883         params.use_cts_prot = -1;
2884         params.use_short_preamble = -1;
2885         params.use_short_slot_time = -1;
2886         params.ap_isolate = -1;
2887         params.ht_opmode = -1;
2888
2889         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2890                 params.use_cts_prot =
2891                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2892         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2893                 params.use_short_preamble =
2894                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2895         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2896                 params.use_short_slot_time =
2897                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2898         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2899                 params.basic_rates =
2900                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2901                 params.basic_rates_len =
2902                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2903         }
2904         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2905                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2906         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2907                 params.ht_opmode =
2908                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2909
2910         if (!rdev->ops->change_bss)
2911                 return -EOPNOTSUPP;
2912
2913         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2914             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2915                 return -EOPNOTSUPP;
2916
2917         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2918 }
2919
2920 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2921         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2922         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2923         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2924         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2925         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2926         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2927 };
2928
2929 static int parse_reg_rule(struct nlattr *tb[],
2930         struct ieee80211_reg_rule *reg_rule)
2931 {
2932         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2933         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2934
2935         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2936                 return -EINVAL;
2937         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2938                 return -EINVAL;
2939         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2940                 return -EINVAL;
2941         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2942                 return -EINVAL;
2943         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2944                 return -EINVAL;
2945
2946         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2947
2948         freq_range->start_freq_khz =
2949                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2950         freq_range->end_freq_khz =
2951                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2952         freq_range->max_bandwidth_khz =
2953                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2954
2955         power_rule->max_eirp =
2956                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2957
2958         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2959                 power_rule->max_antenna_gain =
2960                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2961
2962         return 0;
2963 }
2964
2965 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2966 {
2967         int r;
2968         char *data = NULL;
2969
2970         /*
2971          * You should only get this when cfg80211 hasn't yet initialized
2972          * completely when built-in to the kernel right between the time
2973          * window between nl80211_init() and regulatory_init(), if that is
2974          * even possible.
2975          */
2976         mutex_lock(&cfg80211_mutex);
2977         if (unlikely(!cfg80211_regdomain)) {
2978                 mutex_unlock(&cfg80211_mutex);
2979                 return -EINPROGRESS;
2980         }
2981         mutex_unlock(&cfg80211_mutex);
2982
2983         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2984                 return -EINVAL;
2985
2986         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2987
2988         r = regulatory_hint_user(data);
2989
2990         return r;
2991 }
2992
2993 static int nl80211_get_mesh_config(struct sk_buff *skb,
2994                                    struct genl_info *info)
2995 {
2996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2997         struct net_device *dev = info->user_ptr[1];
2998         struct wireless_dev *wdev = dev->ieee80211_ptr;
2999         struct mesh_config cur_params;
3000         int err = 0;
3001         void *hdr;
3002         struct nlattr *pinfoattr;
3003         struct sk_buff *msg;
3004
3005         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3006                 return -EOPNOTSUPP;
3007
3008         if (!rdev->ops->get_mesh_config)
3009                 return -EOPNOTSUPP;
3010
3011         wdev_lock(wdev);
3012         /* If not connected, get default parameters */
3013         if (!wdev->mesh_id_len)
3014                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3015         else
3016                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3017                                                  &cur_params);
3018         wdev_unlock(wdev);
3019
3020         if (err)
3021                 return err;
3022
3023         /* Draw up a netlink message to send back */
3024         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3025         if (!msg)
3026                 return -ENOMEM;
3027         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3028                              NL80211_CMD_GET_MESH_CONFIG);
3029         if (!hdr)
3030                 goto out;
3031         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3032         if (!pinfoattr)
3033                 goto nla_put_failure;
3034         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3035         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3036                         cur_params.dot11MeshRetryTimeout);
3037         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3038                         cur_params.dot11MeshConfirmTimeout);
3039         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3040                         cur_params.dot11MeshHoldingTimeout);
3041         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3042                         cur_params.dot11MeshMaxPeerLinks);
3043         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3044                         cur_params.dot11MeshMaxRetries);
3045         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3046                         cur_params.dot11MeshTTL);
3047         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3048                         cur_params.element_ttl);
3049         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3050                         cur_params.auto_open_plinks);
3051         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3052                         cur_params.dot11MeshHWMPmaxPREQretries);
3053         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3054                         cur_params.path_refresh_time);
3055         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3056                         cur_params.min_discovery_timeout);
3057         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3058                         cur_params.dot11MeshHWMPactivePathTimeout);
3059         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3060                         cur_params.dot11MeshHWMPpreqMinInterval);
3061         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3062                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3063         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3064                         cur_params.dot11MeshHWMPRootMode);
3065         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3066                         cur_params.dot11MeshHWMPRannInterval);
3067         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3068                         cur_params.dot11MeshGateAnnouncementProtocol);
3069         nla_nest_end(msg, pinfoattr);
3070         genlmsg_end(msg, hdr);
3071         return genlmsg_reply(msg, info);
3072
3073  nla_put_failure:
3074         genlmsg_cancel(msg, hdr);
3075  out:
3076         nlmsg_free(msg);
3077         return -ENOBUFS;
3078 }
3079
3080 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3081         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3082         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3083         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3084         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3085         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3086         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3087         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3088         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3089
3090         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3091         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3092         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3093         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3094         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3095         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3096         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3097         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3098         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3099 };
3100
3101 static const struct nla_policy
3102         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3103         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3104         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3105         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3106         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3107                 .len = IEEE80211_MAX_DATA_LEN },
3108         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3109 };
3110
3111 static int nl80211_parse_mesh_config(struct genl_info *info,
3112                                      struct mesh_config *cfg,
3113                                      u32 *mask_out)
3114 {
3115         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3116         u32 mask = 0;
3117
3118 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3119 do {\
3120         if (table[attr_num]) {\
3121                 cfg->param = nla_fn(table[attr_num]); \
3122                 mask |= (1 << (attr_num - 1)); \
3123         } \
3124 } while (0);\
3125
3126
3127         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3128                 return -EINVAL;
3129         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3130                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3131                              nl80211_meshconf_params_policy))
3132                 return -EINVAL;
3133
3134         /* This makes sure that there aren't more than 32 mesh config
3135          * parameters (otherwise our bitfield scheme would not work.) */
3136         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3137
3138         /* Fill in the params struct */
3139         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3140                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3141         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3142                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3143         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3144                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3145         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3146                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3147         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3148                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3149         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3150                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3151         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3152                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3153         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3154                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3155         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3156                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3157                         nla_get_u8);
3158         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3159                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3161                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3162                         nla_get_u16);
3163         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3164                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3165                         nla_get_u32);
3166         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3167                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3168                         nla_get_u16);
3169         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3170                         dot11MeshHWMPnetDiameterTraversalTime,
3171                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3172                         nla_get_u16);
3173         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3174                         dot11MeshHWMPRootMode, mask,
3175                         NL80211_MESHCONF_HWMP_ROOTMODE,
3176                         nla_get_u8);
3177         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3178                         dot11MeshHWMPRannInterval, mask,
3179                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3180                         nla_get_u16);
3181         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3182                         dot11MeshGateAnnouncementProtocol, mask,
3183                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3184                         nla_get_u8);
3185         if (mask_out)
3186                 *mask_out = mask;
3187
3188         return 0;
3189
3190 #undef FILL_IN_MESH_PARAM_IF_SET
3191 }
3192
3193 static int nl80211_parse_mesh_setup(struct genl_info *info,
3194                                      struct mesh_setup *setup)
3195 {
3196         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3197
3198         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3199                 return -EINVAL;
3200         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3201                              info->attrs[NL80211_ATTR_MESH_SETUP],
3202                              nl80211_mesh_setup_params_policy))
3203                 return -EINVAL;
3204
3205         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3206                 setup->path_sel_proto =
3207                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3208                  IEEE80211_PATH_PROTOCOL_VENDOR :
3209                  IEEE80211_PATH_PROTOCOL_HWMP;
3210
3211         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3212                 setup->path_metric =
3213                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3214                  IEEE80211_PATH_METRIC_VENDOR :
3215                  IEEE80211_PATH_METRIC_AIRTIME;
3216
3217
3218         if (tb[NL80211_MESH_SETUP_IE]) {
3219                 struct nlattr *ieattr =
3220                         tb[NL80211_MESH_SETUP_IE];
3221                 if (!is_valid_ie_attr(ieattr))
3222                         return -EINVAL;
3223                 setup->ie = nla_data(ieattr);
3224                 setup->ie_len = nla_len(ieattr);
3225         }
3226         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3227         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3228
3229         return 0;
3230 }
3231
3232 static int nl80211_update_mesh_config(struct sk_buff *skb,
3233                                       struct genl_info *info)
3234 {
3235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3236         struct net_device *dev = info->user_ptr[1];
3237         struct wireless_dev *wdev = dev->ieee80211_ptr;
3238         struct mesh_config cfg;
3239         u32 mask;
3240         int err;
3241
3242         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3243                 return -EOPNOTSUPP;
3244
3245         if (!rdev->ops->update_mesh_config)
3246                 return -EOPNOTSUPP;
3247
3248         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3249         if (err)
3250                 return err;
3251
3252         wdev_lock(wdev);
3253         if (!wdev->mesh_id_len)
3254                 err = -ENOLINK;
3255
3256         if (!err)
3257                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3258                                                     mask, &cfg);
3259
3260         wdev_unlock(wdev);
3261
3262         return err;
3263 }
3264
3265 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3266 {
3267         struct sk_buff *msg;
3268         void *hdr = NULL;
3269         struct nlattr *nl_reg_rules;
3270         unsigned int i;
3271         int err = -EINVAL;
3272
3273         mutex_lock(&cfg80211_mutex);
3274
3275         if (!cfg80211_regdomain)
3276                 goto out;
3277
3278         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3279         if (!msg) {
3280                 err = -ENOBUFS;
3281                 goto out;
3282         }
3283
3284         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3285                              NL80211_CMD_GET_REG);
3286         if (!hdr)
3287                 goto put_failure;
3288
3289         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3290                 cfg80211_regdomain->alpha2);
3291
3292         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3293         if (!nl_reg_rules)
3294                 goto nla_put_failure;
3295
3296         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3297                 struct nlattr *nl_reg_rule;
3298                 const struct ieee80211_reg_rule *reg_rule;
3299                 const struct ieee80211_freq_range *freq_range;
3300                 const struct ieee80211_power_rule *power_rule;
3301
3302                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3303                 freq_range = &reg_rule->freq_range;
3304                 power_rule = &reg_rule->power_rule;
3305
3306                 nl_reg_rule = nla_nest_start(msg, i);
3307                 if (!nl_reg_rule)
3308                         goto nla_put_failure;
3309
3310                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3311                         reg_rule->flags);
3312                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3313                         freq_range->start_freq_khz);
3314                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3315                         freq_range->end_freq_khz);
3316                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3317                         freq_range->max_bandwidth_khz);
3318                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3319                         power_rule->max_antenna_gain);
3320                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3321                         power_rule->max_eirp);
3322
3323                 nla_nest_end(msg, nl_reg_rule);
3324         }
3325
3326         nla_nest_end(msg, nl_reg_rules);
3327
3328         genlmsg_end(msg, hdr);
3329         err = genlmsg_reply(msg, info);
3330         goto out;
3331
3332 nla_put_failure:
3333         genlmsg_cancel(msg, hdr);
3334 put_failure:
3335         nlmsg_free(msg);
3336         err = -EMSGSIZE;
3337 out:
3338         mutex_unlock(&cfg80211_mutex);
3339         return err;
3340 }
3341
3342 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3343 {
3344         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3345         struct nlattr *nl_reg_rule;
3346         char *alpha2 = NULL;
3347         int rem_reg_rules = 0, r = 0;
3348         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3349         struct ieee80211_regdomain *rd = NULL;
3350
3351         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3352                 return -EINVAL;
3353
3354         if (!info->attrs[NL80211_ATTR_REG_RULES])
3355                 return -EINVAL;
3356
3357         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3358
3359         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3360                         rem_reg_rules) {
3361                 num_rules++;
3362                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3363                         return -EINVAL;
3364         }
3365
3366         mutex_lock(&cfg80211_mutex);
3367
3368         if (!reg_is_valid_request(alpha2)) {
3369                 r = -EINVAL;
3370                 goto bad_reg;
3371         }
3372
3373         size_of_regd = sizeof(struct ieee80211_regdomain) +
3374                 (num_rules * sizeof(struct ieee80211_reg_rule));
3375
3376         rd = kzalloc(size_of_regd, GFP_KERNEL);
3377         if (!rd) {
3378                 r = -ENOMEM;
3379                 goto bad_reg;
3380         }
3381
3382         rd->n_reg_rules = num_rules;
3383         rd->alpha2[0] = alpha2[0];
3384         rd->alpha2[1] = alpha2[1];
3385
3386         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3387                         rem_reg_rules) {
3388                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3389                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3390                         reg_rule_policy);
3391                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3392                 if (r)
3393                         goto bad_reg;
3394
3395                 rule_idx++;
3396
3397                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3398                         r = -EINVAL;
3399                         goto bad_reg;
3400                 }
3401         }
3402
3403         BUG_ON(rule_idx != num_rules);
3404
3405         r = set_regdom(rd);
3406
3407         mutex_unlock(&cfg80211_mutex);
3408
3409         return r;
3410
3411  bad_reg:
3412         mutex_unlock(&cfg80211_mutex);
3413         kfree(rd);
3414         return r;
3415 }
3416
3417 static int validate_scan_freqs(struct nlattr *freqs)
3418 {
3419         struct nlattr *attr1, *attr2;
3420         int n_channels = 0, tmp1, tmp2;
3421
3422         nla_for_each_nested(attr1, freqs, tmp1) {
3423                 n_channels++;
3424                 /*
3425                  * Some hardware has a limited channel list for
3426                  * scanning, and it is pretty much nonsensical
3427                  * to scan for a channel twice, so disallow that
3428                  * and don't require drivers to check that the
3429                  * channel list they get isn't longer than what
3430                  * they can scan, as long as they can scan all
3431                  * the channels they registered at once.
3432                  */
3433                 nla_for_each_nested(attr2, freqs, tmp2)
3434                         if (attr1 != attr2 &&
3435                             nla_get_u32(attr1) == nla_get_u32(attr2))
3436                                 return 0;
3437         }
3438
3439         return n_channels;
3440 }
3441
3442 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3443 {
3444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3445         struct net_device *dev = info->user_ptr[1];
3446         struct cfg80211_scan_request *request;
3447         struct nlattr *attr;
3448         struct wiphy *wiphy;
3449         int err, tmp, n_ssids = 0, n_channels, i;
3450         size_t ie_len;
3451
3452         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3453                 return -EINVAL;
3454
3455         wiphy = &rdev->wiphy;
3456
3457         if (!rdev->ops->scan)
3458                 return -EOPNOTSUPP;
3459
3460         if (rdev->scan_req)
3461                 return -EBUSY;
3462
3463         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3464                 n_channels = validate_scan_freqs(
3465                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3466                 if (!n_channels)
3467                         return -EINVAL;
3468         } else {
3469                 enum ieee80211_band band;
3470                 n_channels = 0;
3471
3472                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3473                         if (wiphy->bands[band])
3474                                 n_channels += wiphy->bands[band]->n_channels;
3475         }
3476
3477         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3478                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3479                         n_ssids++;
3480
3481         if (n_ssids > wiphy->max_scan_ssids)
3482                 return -EINVAL;
3483
3484         if (info->attrs[NL80211_ATTR_IE])
3485                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3486         else
3487                 ie_len = 0;
3488
3489         if (ie_len > wiphy->max_scan_ie_len)
3490                 return -EINVAL;
3491
3492         request = kzalloc(sizeof(*request)
3493                         + sizeof(*request->ssids) * n_ssids
3494                         + sizeof(*request->channels) * n_channels
3495                         + ie_len, GFP_KERNEL);
3496         if (!request)
3497                 return -ENOMEM;
3498
3499         if (n_ssids)
3500                 request->ssids = (void *)&request->channels[n_channels];
3501         request->n_ssids = n_ssids;
3502         if (ie_len) {
3503                 if (request->ssids)
3504                         request->ie = (void *)(request->ssids + n_ssids);
3505                 else
3506                         request->ie = (void *)(request->channels + n_channels);
3507         }
3508
3509         i = 0;
3510         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3511                 /* user specified, bail out if channel not found */
3512                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3513                         struct ieee80211_channel *chan;
3514
3515                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3516
3517                         if (!chan) {
3518                                 err = -EINVAL;
3519                                 goto out_free;
3520                         }
3521
3522                         /* ignore disabled channels */
3523                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3524                                 continue;
3525
3526                         request->channels[i] = chan;
3527                         i++;
3528                 }
3529         } else {
3530                 enum ieee80211_band band;
3531
3532                 /* all channels */
3533                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3534                         int j;
3535                         if (!wiphy->bands[band])
3536                                 continue;
3537                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3538                                 struct ieee80211_channel *chan;
3539
3540                                 chan = &wiphy->bands[band]->channels[j];
3541
3542                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3543                                         continue;
3544
3545                                 request->channels[i] = chan;
3546                                 i++;
3547                         }
3548                 }
3549         }
3550
3551         if (!i) {
3552                 err = -EINVAL;
3553                 goto out_free;
3554         }
3555
3556         request->n_channels = i;
3557
3558         i = 0;
3559         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3560                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3561                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3562                                 err = -EINVAL;
3563                                 goto out_free;
3564                         }
3565                         request->ssids[i].ssid_len = nla_len(attr);
3566                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3567                         i++;
3568                 }
3569         }
3570
3571         if (info->attrs[NL80211_ATTR_IE]) {
3572                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3573                 memcpy((void *)request->ie,
3574                        nla_data(info->attrs[NL80211_ATTR_IE]),
3575                        request->ie_len);
3576         }
3577
3578         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3579                 if (wiphy->bands[i])
3580                         request->rates[i] =
3581                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3582
3583         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3584                 nla_for_each_nested(attr,
3585                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3586                                     tmp) {
3587                         enum ieee80211_band band = nla_type(attr);
3588
3589                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3590                                 err = -EINVAL;
3591                                 goto out_free;
3592                         }
3593                         err = ieee80211_get_ratemask(wiphy->bands[band],
3594                                                      nla_data(attr),
3595                                                      nla_len(attr),
3596                                                      &request->rates[band]);
3597                         if (err)
3598                                 goto out_free;
3599                 }
3600         }
3601
3602         request->dev = dev;
3603         request->wiphy = &rdev->wiphy;
3604
3605         rdev->scan_req = request;
3606         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3607
3608         if (!err) {
3609                 nl80211_send_scan_start(rdev, dev);
3610                 dev_hold(dev);
3611         } else {
3612  out_free:
3613                 rdev->scan_req = NULL;
3614                 kfree(request);
3615         }
3616
3617         return err;
3618 }
3619
3620 static int nl80211_start_sched_scan(struct sk_buff *skb,
3621                                     struct genl_info *info)
3622 {
3623         struct cfg80211_sched_scan_request *request;
3624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3625         struct net_device *dev = info->user_ptr[1];
3626         struct nlattr *attr;
3627         struct wiphy *wiphy;
3628         int err, tmp, n_ssids = 0, n_channels, i;
3629         u32 interval;
3630         enum ieee80211_band band;
3631         size_t ie_len;
3632
3633         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3634             !rdev->ops->sched_scan_start)
3635                 return -EOPNOTSUPP;
3636
3637         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3638                 return -EINVAL;
3639
3640         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3641                 return -EINVAL;
3642
3643         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3644         if (interval == 0)
3645                 return -EINVAL;
3646
3647         wiphy = &rdev->wiphy;
3648
3649         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3650                 n_channels = validate_scan_freqs(
3651                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3652                 if (!n_channels)
3653                         return -EINVAL;
3654         } else {
3655                 n_channels = 0;
3656
3657                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3658                         if (wiphy->bands[band])
3659                                 n_channels += wiphy->bands[band]->n_channels;
3660         }
3661
3662         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3663                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3664                                     tmp)
3665                         n_ssids++;
3666
3667         if (n_ssids > wiphy->max_sched_scan_ssids)
3668                 return -EINVAL;
3669
3670         if (info->attrs[NL80211_ATTR_IE])
3671                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3672         else
3673                 ie_len = 0;
3674
3675         if (ie_len > wiphy->max_sched_scan_ie_len)
3676                 return -EINVAL;
3677
3678         mutex_lock(&rdev->sched_scan_mtx);
3679
3680         if (rdev->sched_scan_req) {
3681                 err = -EINPROGRESS;
3682                 goto out;
3683         }
3684
3685         request = kzalloc(sizeof(*request)
3686                         + sizeof(*request->ssids) * n_ssids
3687                         + sizeof(*request->channels) * n_channels
3688                         + ie_len, GFP_KERNEL);
3689         if (!request) {
3690                 err = -ENOMEM;
3691                 goto out;
3692         }
3693
3694         if (n_ssids)
3695                 request->ssids = (void *)&request->channels[n_channels];
3696         request->n_ssids = n_ssids;
3697         if (ie_len) {
3698                 if (request->ssids)
3699                         request->ie = (void *)(request->ssids + n_ssids);
3700                 else
3701                         request->ie = (void *)(request->channels + n_channels);
3702         }
3703
3704         i = 0;
3705         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3706                 /* user specified, bail out if channel not found */
3707                 nla_for_each_nested(attr,
3708                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3709                                     tmp) {
3710                         struct ieee80211_channel *chan;
3711
3712                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3713
3714                         if (!chan) {
3715                                 err = -EINVAL;
3716                                 goto out_free;
3717                         }
3718
3719                         /* ignore disabled channels */
3720                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3721                                 continue;
3722
3723                         request->channels[i] = chan;
3724                         i++;
3725                 }
3726         } else {
3727                 /* all channels */
3728                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3729                         int j;
3730                         if (!wiphy->bands[band])
3731                                 continue;
3732                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3733                                 struct ieee80211_channel *chan;
3734
3735                                 chan = &wiphy->bands[band]->channels[j];
3736
3737                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3738                                         continue;
3739
3740                                 request->channels[i] = chan;
3741                                 i++;
3742                         }
3743                 }
3744         }
3745
3746         if (!i) {
3747                 err = -EINVAL;
3748                 goto out_free;
3749         }
3750
3751         request->n_channels = i;
3752
3753         i = 0;
3754         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3755                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3756                                     tmp) {
3757                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3758                                 err = -EINVAL;
3759                                 goto out_free;
3760                         }
3761                         request->ssids[i].ssid_len = nla_len(attr);
3762                         memcpy(request->ssids[i].ssid, nla_data(attr),
3763                                nla_len(attr));
3764                         i++;
3765                 }
3766         }
3767
3768         if (info->attrs[NL80211_ATTR_IE]) {
3769                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3770                 memcpy((void *)request->ie,
3771                        nla_data(info->attrs[NL80211_ATTR_IE]),
3772                        request->ie_len);
3773         }
3774
3775         request->dev = dev;
3776         request->wiphy = &rdev->wiphy;
3777         request->interval = interval;
3778
3779         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3780         if (!err) {
3781                 rdev->sched_scan_req = request;
3782                 nl80211_send_sched_scan(rdev, dev,
3783                                         NL80211_CMD_START_SCHED_SCAN);
3784                 goto out;
3785         }
3786
3787 out_free:
3788         kfree(request);
3789 out:
3790         mutex_unlock(&rdev->sched_scan_mtx);
3791         return err;
3792 }
3793
3794 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3795                                    struct genl_info *info)
3796 {
3797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3798         int err;
3799
3800         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3801             !rdev->ops->sched_scan_stop)
3802                 return -EOPNOTSUPP;
3803
3804         mutex_lock(&rdev->sched_scan_mtx);
3805         err = __cfg80211_stop_sched_scan(rdev, false);
3806         mutex_unlock(&rdev->sched_scan_mtx);
3807
3808         return err;
3809 }
3810
3811 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3812                             u32 seq, int flags,
3813                             struct cfg80211_registered_device *rdev,
3814                             struct wireless_dev *wdev,
3815                             struct cfg80211_internal_bss *intbss)
3816 {
3817         struct cfg80211_bss *res = &intbss->pub;
3818         void *hdr;
3819         struct nlattr *bss;
3820         int i;
3821
3822         ASSERT_WDEV_LOCK(wdev);
3823
3824         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3825                              NL80211_CMD_NEW_SCAN_RESULTS);
3826         if (!hdr)
3827                 return -1;
3828
3829         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3830
3831         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3832         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3833
3834         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3835         if (!bss)
3836                 goto nla_put_failure;
3837         if (!is_zero_ether_addr(res->bssid))
3838                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3839         if (res->information_elements && res->len_information_elements)
3840                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3841                         res->len_information_elements,
3842                         res->information_elements);
3843         if (res->beacon_ies && res->len_beacon_ies &&
3844             res->beacon_ies != res->information_elements)
3845                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3846                         res->len_beacon_ies, res->beacon_ies);
3847         if (res->tsf)
3848                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3849         if (res->beacon_interval)
3850                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3851         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3852         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3853         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3854                 jiffies_to_msecs(jiffies - intbss->ts));
3855
3856         switch (rdev->wiphy.signal_type) {
3857         case CFG80211_SIGNAL_TYPE_MBM:
3858                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3859                 break;
3860         case CFG80211_SIGNAL_TYPE_UNSPEC:
3861                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3862                 break;
3863         default:
3864                 break;
3865         }
3866
3867         switch (wdev->iftype) {
3868         case NL80211_IFTYPE_P2P_CLIENT:
3869         case NL80211_IFTYPE_STATION:
3870                 if (intbss == wdev->current_bss)
3871                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3872                                     NL80211_BSS_STATUS_ASSOCIATED);
3873                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3874                         if (intbss != wdev->auth_bsses[i])
3875                                 continue;
3876                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3877                                     NL80211_BSS_STATUS_AUTHENTICATED);
3878                         break;
3879                 }
3880                 break;
3881         case NL80211_IFTYPE_ADHOC:
3882                 if (intbss == wdev->current_bss)
3883                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3884                                     NL80211_BSS_STATUS_IBSS_JOINED);
3885                 break;
3886         default:
3887                 break;
3888         }
3889
3890         nla_nest_end(msg, bss);
3891
3892         return genlmsg_end(msg, hdr);
3893
3894  nla_put_failure:
3895         genlmsg_cancel(msg, hdr);
3896         return -EMSGSIZE;
3897 }
3898
3899 static int nl80211_dump_scan(struct sk_buff *skb,
3900                              struct netlink_callback *cb)
3901 {
3902         struct cfg80211_registered_device *rdev;
3903         struct net_device *dev;
3904         struct cfg80211_internal_bss *scan;
3905         struct wireless_dev *wdev;
3906         int start = cb->args[1], idx = 0;
3907         int err;
3908
3909         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3910         if (err)
3911                 return err;
3912
3913         wdev = dev->ieee80211_ptr;
3914
3915         wdev_lock(wdev);
3916         spin_lock_bh(&rdev->bss_lock);
3917         cfg80211_bss_expire(rdev);
3918
3919         cb->seq = rdev->bss_generation;
3920
3921         list_for_each_entry(scan, &rdev->bss_list, list) {
3922                 if (++idx <= start)
3923                         continue;
3924                 if (nl80211_send_bss(skb, cb,
3925                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3926                                 rdev, wdev, scan) < 0) {
3927                         idx--;
3928                         break;
3929                 }
3930         }
3931
3932         spin_unlock_bh(&rdev->bss_lock);
3933         wdev_unlock(wdev);
3934
3935         cb->args[1] = idx;
3936         nl80211_finish_netdev_dump(rdev);
3937
3938         return skb->len;
3939 }
3940
3941 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3942                                 int flags, struct net_device *dev,
3943                                 struct survey_info *survey)
3944 {
3945         void *hdr;
3946         struct nlattr *infoattr;
3947
3948         hdr = nl80211hdr_put(msg, pid, seq, flags,
3949                              NL80211_CMD_NEW_SURVEY_RESULTS);
3950         if (!hdr)
3951                 return -ENOMEM;
3952
3953         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3954
3955         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3956         if (!infoattr)
3957                 goto nla_put_failure;
3958
3959         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3960                     survey->channel->center_freq);
3961         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3962                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3963                             survey->noise);
3964         if (survey->filled & SURVEY_INFO_IN_USE)
3965                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3966         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3967                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3968                             survey->channel_time);
3969         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3970                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3971                             survey->channel_time_busy);
3972         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3973                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3974                             survey->channel_time_ext_busy);
3975         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3976                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3977                             survey->channel_time_rx);
3978         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3979                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3980                             survey->channel_time_tx);
3981
3982         nla_nest_end(msg, infoattr);
3983
3984         return genlmsg_end(msg, hdr);
3985
3986  nla_put_failure:
3987         genlmsg_cancel(msg, hdr);
3988         return -EMSGSIZE;
3989 }
3990
3991 static int nl80211_dump_survey(struct sk_buff *skb,
3992                         struct netlink_callback *cb)
3993 {
3994         struct survey_info survey;
3995         struct cfg80211_registered_device *dev;
3996         struct net_device *netdev;
3997         int survey_idx = cb->args[1];
3998         int res;
3999
4000         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4001         if (res)
4002                 return res;
4003
4004         if (!dev->ops->dump_survey) {
4005                 res = -EOPNOTSUPP;
4006                 goto out_err;
4007         }
4008
4009         while (1) {
4010                 struct ieee80211_channel *chan;
4011
4012                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4013                                             &survey);
4014                 if (res == -ENOENT)
4015                         break;
4016                 if (res)
4017                         goto out_err;
4018
4019                 /* Survey without a channel doesn't make sense */
4020                 if (!survey.channel) {
4021                         res = -EINVAL;
4022                         goto out;
4023                 }
4024
4025                 chan = ieee80211_get_channel(&dev->wiphy,
4026                                              survey.channel->center_freq);
4027                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4028                         survey_idx++;
4029                         continue;
4030                 }
4031
4032                 if (nl80211_send_survey(skb,
4033                                 NETLINK_CB(cb->skb).pid,
4034                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4035                                 netdev,
4036                                 &survey) < 0)
4037                         goto out;
4038                 survey_idx++;
4039         }
4040
4041  out:
4042         cb->args[1] = survey_idx;
4043         res = skb->len;
4044  out_err:
4045         nl80211_finish_netdev_dump(dev);
4046         return res;
4047 }
4048
4049 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4050 {
4051         return auth_type <= NL80211_AUTHTYPE_MAX;
4052 }
4053
4054 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4055 {
4056         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4057                                   NL80211_WPA_VERSION_2));
4058 }
4059
4060 static bool nl80211_valid_akm_suite(u32 akm)
4061 {
4062         return akm == WLAN_AKM_SUITE_8021X ||
4063                 akm == WLAN_AKM_SUITE_PSK;
4064 }
4065
4066 static bool nl80211_valid_cipher_suite(u32 cipher)
4067 {
4068         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
4069                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
4070                 cipher == WLAN_CIPHER_SUITE_TKIP ||
4071                 cipher == WLAN_CIPHER_SUITE_CCMP ||
4072                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
4073 }
4074
4075
4076 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4077 {
4078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4079         struct net_device *dev = info->user_ptr[1];
4080         struct ieee80211_channel *chan;
4081         const u8 *bssid, *ssid, *ie = NULL;
4082         int err, ssid_len, ie_len = 0;
4083         enum nl80211_auth_type auth_type;
4084         struct key_parse key;
4085         bool local_state_change;
4086
4087         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4088                 return -EINVAL;
4089
4090         if (!info->attrs[NL80211_ATTR_MAC])
4091                 return -EINVAL;
4092
4093         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4094                 return -EINVAL;
4095
4096         if (!info->attrs[NL80211_ATTR_SSID])
4097                 return -EINVAL;
4098
4099         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4100                 return -EINVAL;
4101
4102         err = nl80211_parse_key(info, &key);
4103         if (err)
4104                 return err;
4105
4106         if (key.idx >= 0) {
4107                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4108                         return -EINVAL;
4109                 if (!key.p.key || !key.p.key_len)
4110                         return -EINVAL;
4111                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4112                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4113                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4114                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4115                         return -EINVAL;
4116                 if (key.idx > 4)
4117                         return -EINVAL;
4118         } else {
4119                 key.p.key_len = 0;
4120                 key.p.key = NULL;
4121         }
4122
4123         if (key.idx >= 0) {
4124                 int i;
4125                 bool ok = false;
4126                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4127                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4128                                 ok = true;
4129                                 break;
4130                         }
4131                 }
4132                 if (!ok)
4133                         return -EINVAL;
4134         }
4135
4136         if (!rdev->ops->auth)
4137                 return -EOPNOTSUPP;
4138
4139         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4140             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4141                 return -EOPNOTSUPP;
4142
4143         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4144         chan = ieee80211_get_channel(&rdev->wiphy,
4145                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4146         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4147                 return -EINVAL;
4148
4149         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4150         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4151
4152         if (info->attrs[NL80211_ATTR_IE]) {
4153                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4154                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4155         }
4156
4157         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4158         if (!nl80211_valid_auth_type(auth_type))
4159                 return -EINVAL;
4160
4161         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4162
4163         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4164                                   ssid, ssid_len, ie, ie_len,
4165                                   key.p.key, key.p.key_len, key.idx,
4166                                   local_state_change);
4167 }
4168
4169 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4170                                    struct genl_info *info,
4171                                    struct cfg80211_crypto_settings *settings,
4172                                    int cipher_limit)
4173 {
4174         memset(settings, 0, sizeof(*settings));
4175
4176         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4177
4178         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4179                 u16 proto;
4180                 proto = nla_get_u16(
4181                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4182                 settings->control_port_ethertype = cpu_to_be16(proto);
4183                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4184                     proto != ETH_P_PAE)
4185                         return -EINVAL;
4186                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4187                         settings->control_port_no_encrypt = true;
4188         } else
4189                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4190
4191         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4192                 void *data;
4193                 int len, i;
4194
4195                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4196                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4197                 settings->n_ciphers_pairwise = len / sizeof(u32);
4198
4199                 if (len % sizeof(u32))
4200                         return -EINVAL;
4201
4202                 if (settings->n_ciphers_pairwise > cipher_limit)
4203                         return -EINVAL;
4204
4205                 memcpy(settings->ciphers_pairwise, data, len);
4206
4207                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4208                         if (!nl80211_valid_cipher_suite(
4209                                         settings->ciphers_pairwise[i]))
4210                                 return -EINVAL;
4211         }
4212
4213         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4214                 settings->cipher_group =
4215                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4216                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4217                         return -EINVAL;
4218         }
4219
4220         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4221                 settings->wpa_versions =
4222                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4223                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4224                         return -EINVAL;
4225         }
4226
4227         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4228                 void *data;
4229                 int len, i;
4230
4231                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4232                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4233                 settings->n_akm_suites = len / sizeof(u32);
4234
4235                 if (len % sizeof(u32))
4236                         return -EINVAL;
4237
4238                 memcpy(settings->akm_suites, data, len);
4239
4240                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4241                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4242                                 return -EINVAL;
4243         }
4244
4245         return 0;
4246 }
4247
4248 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4249 {
4250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4251         struct net_device *dev = info->user_ptr[1];
4252         struct cfg80211_crypto_settings crypto;
4253         struct ieee80211_channel *chan;
4254         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4255         int err, ssid_len, ie_len = 0;
4256         bool use_mfp = false;
4257
4258         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4259                 return -EINVAL;
4260
4261         if (!info->attrs[NL80211_ATTR_MAC] ||
4262             !info->attrs[NL80211_ATTR_SSID] ||
4263             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4264                 return -EINVAL;
4265
4266         if (!rdev->ops->assoc)
4267                 return -EOPNOTSUPP;
4268
4269         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4270             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4271                 return -EOPNOTSUPP;
4272
4273         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4274
4275         chan = ieee80211_get_channel(&rdev->wiphy,
4276                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4277         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4278                 return -EINVAL;
4279
4280         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4281         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4282
4283         if (info->attrs[NL80211_ATTR_IE]) {
4284                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4285                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4286         }
4287
4288         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4289                 enum nl80211_mfp mfp =
4290                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4291                 if (mfp == NL80211_MFP_REQUIRED)
4292                         use_mfp = true;
4293                 else if (mfp != NL80211_MFP_NO)
4294                         return -EINVAL;
4295         }
4296
4297         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4298                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4299
4300         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4301         if (!err)
4302                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4303                                           ssid, ssid_len, ie, ie_len, use_mfp,
4304                                           &crypto);
4305
4306         return err;
4307 }
4308
4309 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4310 {
4311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4312         struct net_device *dev = info->user_ptr[1];
4313         const u8 *ie = NULL, *bssid;
4314         int ie_len = 0;
4315         u16 reason_code;
4316         bool local_state_change;
4317
4318         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4319                 return -EINVAL;
4320
4321         if (!info->attrs[NL80211_ATTR_MAC])
4322                 return -EINVAL;
4323
4324         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4325                 return -EINVAL;
4326
4327         if (!rdev->ops->deauth)
4328                 return -EOPNOTSUPP;
4329
4330         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4331             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4332                 return -EOPNOTSUPP;
4333
4334         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4335
4336         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4337         if (reason_code == 0) {
4338                 /* Reason Code 0 is reserved */
4339                 return -EINVAL;
4340         }
4341
4342         if (info->attrs[NL80211_ATTR_IE]) {
4343                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4344                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4345         }
4346
4347         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4348
4349         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4350                                     local_state_change);
4351 }
4352
4353 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4354 {
4355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4356         struct net_device *dev = info->user_ptr[1];
4357         const u8 *ie = NULL, *bssid;
4358         int ie_len = 0;
4359         u16 reason_code;
4360         bool local_state_change;
4361
4362         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4363                 return -EINVAL;
4364
4365         if (!info->attrs[NL80211_ATTR_MAC])
4366                 return -EINVAL;
4367
4368         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4369                 return -EINVAL;
4370
4371         if (!rdev->ops->disassoc)
4372                 return -EOPNOTSUPP;
4373
4374         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4375             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4376                 return -EOPNOTSUPP;
4377
4378         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4379
4380         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4381         if (reason_code == 0) {
4382                 /* Reason Code 0 is reserved */
4383                 return -EINVAL;
4384         }
4385
4386         if (info->attrs[NL80211_ATTR_IE]) {
4387                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4388                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4389         }
4390
4391         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4392
4393         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4394                                       local_state_change);
4395 }
4396
4397 static bool
4398 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4399                          int mcast_rate[IEEE80211_NUM_BANDS],
4400                          int rateval)
4401 {
4402         struct wiphy *wiphy = &rdev->wiphy;
4403         bool found = false;
4404         int band, i;
4405
4406         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4407                 struct ieee80211_supported_band *sband;
4408
4409                 sband = wiphy->bands[band];
4410                 if (!sband)
4411                         continue;
4412
4413                 for (i = 0; i < sband->n_bitrates; i++) {
4414                         if (sband->bitrates[i].bitrate == rateval) {
4415                                 mcast_rate[band] = i + 1;
4416                                 found = true;
4417                                 break;
4418                         }
4419                 }
4420         }
4421
4422         return found;
4423 }
4424
4425 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4426 {
4427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4428         struct net_device *dev = info->user_ptr[1];
4429         struct cfg80211_ibss_params ibss;
4430         struct wiphy *wiphy;
4431         struct cfg80211_cached_keys *connkeys = NULL;
4432         int err;
4433
4434         memset(&ibss, 0, sizeof(ibss));
4435
4436         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4437                 return -EINVAL;
4438
4439         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4440             !info->attrs[NL80211_ATTR_SSID] ||
4441             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4442                 return -EINVAL;
4443
4444         ibss.beacon_interval = 100;
4445
4446         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4447                 ibss.beacon_interval =
4448                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4449                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4450                         return -EINVAL;
4451         }
4452
4453         if (!rdev->ops->join_ibss)
4454                 return -EOPNOTSUPP;
4455
4456         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4457                 return -EOPNOTSUPP;
4458
4459         wiphy = &rdev->wiphy;
4460
4461         if (info->attrs[NL80211_ATTR_MAC])
4462                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4463         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4464         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4465
4466         if (info->attrs[NL80211_ATTR_IE]) {
4467                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4468                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4469         }
4470
4471         ibss.channel = ieee80211_get_channel(wiphy,
4472                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4473         if (!ibss.channel ||
4474             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4475             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4476                 return -EINVAL;
4477
4478         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4479         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4480
4481         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4482                 u8 *rates =
4483                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4484                 int n_rates =
4485                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4486                 struct ieee80211_supported_band *sband =
4487                         wiphy->bands[ibss.channel->band];
4488                 int err;
4489
4490                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4491                                              &ibss.basic_rates);
4492                 if (err)
4493                         return err;
4494         }
4495
4496         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4497             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4498                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4499                 return -EINVAL;
4500
4501         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4502                 connkeys = nl80211_parse_connkeys(rdev,
4503                                         info->attrs[NL80211_ATTR_KEYS]);
4504                 if (IS_ERR(connkeys))
4505                         return PTR_ERR(connkeys);
4506         }
4507
4508         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4509         if (err)
4510                 kfree(connkeys);
4511         return err;
4512 }
4513
4514 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4515 {
4516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4517         struct net_device *dev = info->user_ptr[1];
4518
4519         if (!rdev->ops->leave_ibss)
4520                 return -EOPNOTSUPP;
4521
4522         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4523                 return -EOPNOTSUPP;
4524
4525         return cfg80211_leave_ibss(rdev, dev, false);
4526 }
4527
4528 #ifdef CONFIG_NL80211_TESTMODE
4529 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4530         .name = "testmode",
4531 };
4532
4533 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4534 {
4535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4536         int err;
4537
4538         if (!info->attrs[NL80211_ATTR_TESTDATA])
4539                 return -EINVAL;
4540
4541         err = -EOPNOTSUPP;
4542         if (rdev->ops->testmode_cmd) {
4543                 rdev->testmode_info = info;
4544                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4545                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4546                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4547                 rdev->testmode_info = NULL;
4548         }
4549
4550         return err;
4551 }
4552
4553 static int nl80211_testmode_dump(struct sk_buff *skb,
4554                                  struct netlink_callback *cb)
4555 {
4556         struct cfg80211_registered_device *dev;
4557         int err;
4558         long phy_idx;
4559         void *data = NULL;
4560         int data_len = 0;
4561
4562         if (cb->args[0]) {
4563                 /*
4564                  * 0 is a valid index, but not valid for args[0],
4565                  * so we need to offset by 1.
4566                  */
4567                 phy_idx = cb->args[0] - 1;
4568         } else {
4569                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4570                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4571                                   nl80211_policy);
4572                 if (err)
4573                         return err;
4574                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4575                         return -EINVAL;
4576                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4577                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4578                         cb->args[1] =
4579                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4580         }
4581
4582         if (cb->args[1]) {
4583                 data = nla_data((void *)cb->args[1]);
4584                 data_len = nla_len((void *)cb->args[1]);
4585         }
4586
4587         mutex_lock(&cfg80211_mutex);
4588         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4589         if (!dev) {
4590                 mutex_unlock(&cfg80211_mutex);
4591                 return -ENOENT;
4592         }
4593         cfg80211_lock_rdev(dev);
4594         mutex_unlock(&cfg80211_mutex);
4595
4596         if (!dev->ops->testmode_dump) {
4597                 err = -EOPNOTSUPP;
4598                 goto out_err;
4599         }
4600
4601         while (1) {
4602                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4603                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4604                                            NL80211_CMD_TESTMODE);
4605                 struct nlattr *tmdata;
4606
4607                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4608                         genlmsg_cancel(skb, hdr);
4609                         break;
4610                 }
4611
4612                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4613                 if (!tmdata) {
4614                         genlmsg_cancel(skb, hdr);
4615                         break;
4616                 }
4617                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4618                                               data, data_len);
4619                 nla_nest_end(skb, tmdata);
4620
4621                 if (err == -ENOBUFS || err == -ENOENT) {
4622                         genlmsg_cancel(skb, hdr);
4623                         break;
4624                 } else if (err) {
4625                         genlmsg_cancel(skb, hdr);
4626                         goto out_err;
4627                 }
4628
4629                 genlmsg_end(skb, hdr);
4630         }
4631
4632         err = skb->len;
4633         /* see above */
4634         cb->args[0] = phy_idx + 1;
4635  out_err:
4636         cfg80211_unlock_rdev(dev);
4637         return err;
4638 }
4639
4640 static struct sk_buff *
4641 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4642                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4643 {
4644         struct sk_buff *skb;
4645         void *hdr;
4646         struct nlattr *data;
4647
4648         skb = nlmsg_new(approxlen + 100, gfp);
4649         if (!skb)
4650                 return NULL;
4651
4652         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4653         if (!hdr) {
4654                 kfree_skb(skb);
4655                 return NULL;
4656         }
4657
4658         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4659         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4660
4661         ((void **)skb->cb)[0] = rdev;
4662         ((void **)skb->cb)[1] = hdr;
4663         ((void **)skb->cb)[2] = data;
4664
4665         return skb;
4666
4667  nla_put_failure:
4668         kfree_skb(skb);
4669         return NULL;
4670 }
4671
4672 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4673                                                   int approxlen)
4674 {
4675         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4676
4677         if (WARN_ON(!rdev->testmode_info))
4678                 return NULL;
4679
4680         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4681                                 rdev->testmode_info->snd_pid,
4682                                 rdev->testmode_info->snd_seq,
4683                                 GFP_KERNEL);
4684 }
4685 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4686
4687 int cfg80211_testmode_reply(struct sk_buff *skb)
4688 {
4689         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4690         void *hdr = ((void **)skb->cb)[1];
4691         struct nlattr *data = ((void **)skb->cb)[2];
4692
4693         if (WARN_ON(!rdev->testmode_info)) {
4694                 kfree_skb(skb);
4695                 return -EINVAL;
4696         }
4697
4698         nla_nest_end(skb, data);
4699         genlmsg_end(skb, hdr);
4700         return genlmsg_reply(skb, rdev->testmode_info);
4701 }
4702 EXPORT_SYMBOL(cfg80211_testmode_reply);
4703
4704 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4705                                                   int approxlen, gfp_t gfp)
4706 {
4707         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4708
4709         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4710 }
4711 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4712
4713 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4714 {
4715         void *hdr = ((void **)skb->cb)[1];
4716         struct nlattr *data = ((void **)skb->cb)[2];
4717
4718         nla_nest_end(skb, data);
4719         genlmsg_end(skb, hdr);
4720         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4721 }
4722 EXPORT_SYMBOL(cfg80211_testmode_event);
4723 #endif
4724
4725 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4726 {
4727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4728         struct net_device *dev = info->user_ptr[1];
4729         struct cfg80211_connect_params connect;
4730         struct wiphy *wiphy;
4731         struct cfg80211_cached_keys *connkeys = NULL;
4732         int err;
4733
4734         memset(&connect, 0, sizeof(connect));
4735
4736         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4737                 return -EINVAL;
4738
4739         if (!info->attrs[NL80211_ATTR_SSID] ||
4740             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4741                 return -EINVAL;
4742
4743         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4744                 connect.auth_type =
4745                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4746                 if (!nl80211_valid_auth_type(connect.auth_type))
4747                         return -EINVAL;
4748         } else
4749                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4750
4751         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4752
4753         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4754                                       NL80211_MAX_NR_CIPHER_SUITES);
4755         if (err)
4756                 return err;
4757
4758         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4759             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4760                 return -EOPNOTSUPP;
4761
4762         wiphy = &rdev->wiphy;
4763
4764         if (info->attrs[NL80211_ATTR_MAC])
4765                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4766         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4767         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4768
4769         if (info->attrs[NL80211_ATTR_IE]) {
4770                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4771                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4772         }
4773
4774         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4775                 connect.channel =
4776                         ieee80211_get_channel(wiphy,
4777                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4778                 if (!connect.channel ||
4779                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4780                         return -EINVAL;
4781         }
4782
4783         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4784                 connkeys = nl80211_parse_connkeys(rdev,
4785                                         info->attrs[NL80211_ATTR_KEYS]);
4786                 if (IS_ERR(connkeys))
4787                         return PTR_ERR(connkeys);
4788         }
4789
4790         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4791         if (err)
4792                 kfree(connkeys);
4793         return err;
4794 }
4795
4796 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4797 {
4798         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4799         struct net_device *dev = info->user_ptr[1];
4800         u16 reason;
4801
4802         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4803                 reason = WLAN_REASON_DEAUTH_LEAVING;
4804         else
4805                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4806
4807         if (reason == 0)
4808                 return -EINVAL;
4809
4810         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4811             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4812                 return -EOPNOTSUPP;
4813
4814         return cfg80211_disconnect(rdev, dev, reason, true);
4815 }
4816
4817 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4818 {
4819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4820         struct net *net;
4821         int err;
4822         u32 pid;
4823
4824         if (!info->attrs[NL80211_ATTR_PID])
4825                 return -EINVAL;
4826
4827         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4828
4829         net = get_net_ns_by_pid(pid);
4830         if (IS_ERR(net))
4831                 return PTR_ERR(net);
4832
4833         err = 0;
4834
4835         /* check if anything to do */
4836         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4837                 err = cfg80211_switch_netns(rdev, net);
4838
4839         put_net(net);
4840         return err;
4841 }
4842
4843 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4844 {
4845         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4846         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4847                         struct cfg80211_pmksa *pmksa) = NULL;
4848         struct net_device *dev = info->user_ptr[1];
4849         struct cfg80211_pmksa pmksa;
4850
4851         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4852
4853         if (!info->attrs[NL80211_ATTR_MAC])
4854                 return -EINVAL;
4855
4856         if (!info->attrs[NL80211_ATTR_PMKID])
4857                 return -EINVAL;
4858
4859         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4860         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4861
4862         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4863             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4864                 return -EOPNOTSUPP;
4865
4866         switch (info->genlhdr->cmd) {
4867         case NL80211_CMD_SET_PMKSA:
4868                 rdev_ops = rdev->ops->set_pmksa;
4869                 break;
4870         case NL80211_CMD_DEL_PMKSA:
4871                 rdev_ops = rdev->ops->del_pmksa;
4872                 break;
4873         default:
4874                 WARN_ON(1);
4875                 break;
4876         }
4877
4878         if (!rdev_ops)
4879                 return -EOPNOTSUPP;
4880
4881         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4882 }
4883
4884 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4885 {
4886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4887         struct net_device *dev = info->user_ptr[1];
4888
4889         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4890             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4891                 return -EOPNOTSUPP;
4892
4893         if (!rdev->ops->flush_pmksa)
4894                 return -EOPNOTSUPP;
4895
4896         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4897 }
4898
4899 static int nl80211_remain_on_channel(struct sk_buff *skb,
4900                                      struct genl_info *info)
4901 {
4902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4903         struct net_device *dev = info->user_ptr[1];
4904         struct ieee80211_channel *chan;
4905         struct sk_buff *msg;
4906         void *hdr;
4907         u64 cookie;
4908         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4909         u32 freq, duration;
4910         int err;
4911
4912         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4913             !info->attrs[NL80211_ATTR_DURATION])
4914                 return -EINVAL;
4915
4916         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4917
4918         /*
4919          * We should be on that channel for at least one jiffie,
4920          * and more than 5 seconds seems excessive.
4921          */
4922         if (!duration || !msecs_to_jiffies(duration) ||
4923             duration > rdev->wiphy.max_remain_on_channel_duration)
4924                 return -EINVAL;
4925
4926         if (!rdev->ops->remain_on_channel)
4927                 return -EOPNOTSUPP;
4928
4929         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4930                 channel_type = nla_get_u32(
4931                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4932                 if (channel_type != NL80211_CHAN_NO_HT &&
4933                     channel_type != NL80211_CHAN_HT20 &&
4934                     channel_type != NL80211_CHAN_HT40PLUS &&
4935                     channel_type != NL80211_CHAN_HT40MINUS)
4936                         return -EINVAL;
4937         }
4938
4939         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4940         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4941         if (chan == NULL)
4942                 return -EINVAL;
4943
4944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4945         if (!msg)
4946                 return -ENOMEM;
4947
4948         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4949                              NL80211_CMD_REMAIN_ON_CHANNEL);
4950
4951         if (IS_ERR(hdr)) {
4952                 err = PTR_ERR(hdr);
4953                 goto free_msg;
4954         }
4955
4956         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4957                                            channel_type, duration, &cookie);
4958
4959         if (err)
4960                 goto free_msg;
4961
4962         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4963
4964         genlmsg_end(msg, hdr);
4965
4966         return genlmsg_reply(msg, info);
4967
4968  nla_put_failure:
4969         err = -ENOBUFS;
4970  free_msg:
4971         nlmsg_free(msg);
4972         return err;
4973 }
4974
4975 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4976                                             struct genl_info *info)
4977 {
4978         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4979         struct net_device *dev = info->user_ptr[1];
4980         u64 cookie;
4981
4982         if (!info->attrs[NL80211_ATTR_COOKIE])
4983                 return -EINVAL;
4984
4985         if (!rdev->ops->cancel_remain_on_channel)
4986                 return -EOPNOTSUPP;
4987
4988         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4989
4990         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4991 }
4992
4993 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4994                            u8 *rates, u8 rates_len)
4995 {
4996         u8 i;
4997         u32 mask = 0;
4998
4999         for (i = 0; i < rates_len; i++) {
5000                 int rate = (rates[i] & 0x7f) * 5;
5001                 int ridx;
5002                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5003                         struct ieee80211_rate *srate =
5004                                 &sband->bitrates[ridx];
5005                         if (rate == srate->bitrate) {
5006                                 mask |= 1 << ridx;
5007                                 break;
5008                         }
5009                 }
5010                 if (ridx == sband->n_bitrates)
5011                         return 0; /* rate not found */
5012         }
5013
5014         return mask;
5015 }
5016
5017 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5018         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5019                                     .len = NL80211_MAX_SUPP_RATES },
5020 };
5021
5022 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5023                                        struct genl_info *info)
5024 {
5025         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5027         struct cfg80211_bitrate_mask mask;
5028         int rem, i;
5029         struct net_device *dev = info->user_ptr[1];
5030         struct nlattr *tx_rates;
5031         struct ieee80211_supported_band *sband;
5032
5033         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5034                 return -EINVAL;
5035
5036         if (!rdev->ops->set_bitrate_mask)
5037                 return -EOPNOTSUPP;
5038
5039         memset(&mask, 0, sizeof(mask));
5040         /* Default to all rates enabled */
5041         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5042                 sband = rdev->wiphy.bands[i];
5043                 mask.control[i].legacy =
5044                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5045         }
5046
5047         /*
5048          * The nested attribute uses enum nl80211_band as the index. This maps
5049          * directly to the enum ieee80211_band values used in cfg80211.
5050          */
5051         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5052         {
5053                 enum ieee80211_band band = nla_type(tx_rates);
5054                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5055                         return -EINVAL;
5056                 sband = rdev->wiphy.bands[band];
5057                 if (sband == NULL)
5058                         return -EINVAL;
5059                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5060                           nla_len(tx_rates), nl80211_txattr_policy);
5061                 if (tb[NL80211_TXRATE_LEGACY]) {
5062                         mask.control[band].legacy = rateset_to_mask(
5063                                 sband,
5064                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5065                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5066                         if (mask.control[band].legacy == 0)
5067                                 return -EINVAL;
5068                 }
5069         }
5070
5071         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5072 }
5073
5074 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5075 {
5076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5077         struct net_device *dev = info->user_ptr[1];
5078         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5079
5080         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5081                 return -EINVAL;
5082
5083         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5084                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5085
5086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5088             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5089             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5090             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5091             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5092             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5093                 return -EOPNOTSUPP;
5094
5095         /* not much point in registering if we can't reply */
5096         if (!rdev->ops->mgmt_tx)
5097                 return -EOPNOTSUPP;
5098
5099         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5100                         frame_type,
5101                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5102                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5103 }
5104
5105 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5106 {
5107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5108         struct net_device *dev = info->user_ptr[1];
5109         struct ieee80211_channel *chan;
5110         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5111         bool channel_type_valid = false;
5112         u32 freq;
5113         int err;
5114         void *hdr;
5115         u64 cookie;
5116         struct sk_buff *msg;
5117         unsigned int wait = 0;
5118         bool offchan;
5119
5120         if (!info->attrs[NL80211_ATTR_FRAME] ||
5121             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5122                 return -EINVAL;
5123
5124         if (!rdev->ops->mgmt_tx)
5125                 return -EOPNOTSUPP;
5126
5127         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5128             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5129             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5130             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5131             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5132             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5133             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5134                 return -EOPNOTSUPP;
5135
5136         if (info->attrs[NL80211_ATTR_DURATION]) {
5137                 if (!rdev->ops->mgmt_tx_cancel_wait)
5138                         return -EINVAL;
5139                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5140         }
5141
5142         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5143                 channel_type = nla_get_u32(
5144                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5145                 if (channel_type != NL80211_CHAN_NO_HT &&
5146                     channel_type != NL80211_CHAN_HT20 &&
5147                     channel_type != NL80211_CHAN_HT40PLUS &&
5148                     channel_type != NL80211_CHAN_HT40MINUS)
5149                         return -EINVAL;
5150                 channel_type_valid = true;
5151         }
5152
5153         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5154
5155         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5156         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5157         if (chan == NULL)
5158                 return -EINVAL;
5159
5160         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5161         if (!msg)
5162                 return -ENOMEM;
5163
5164         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5165                              NL80211_CMD_FRAME);
5166
5167         if (IS_ERR(hdr)) {
5168                 err = PTR_ERR(hdr);
5169                 goto free_msg;
5170         }
5171         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5172                                     channel_type_valid, wait,
5173                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5174                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5175                                     &cookie);
5176         if (err)
5177                 goto free_msg;
5178
5179         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5180
5181         genlmsg_end(msg, hdr);
5182         return genlmsg_reply(msg, info);
5183
5184  nla_put_failure:
5185         err = -ENOBUFS;
5186  free_msg:
5187         nlmsg_free(msg);
5188         return err;
5189 }
5190
5191 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5192 {
5193         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5194         struct net_device *dev = info->user_ptr[1];
5195         u64 cookie;
5196
5197         if (!info->attrs[NL80211_ATTR_COOKIE])
5198                 return -EINVAL;
5199
5200         if (!rdev->ops->mgmt_tx_cancel_wait)
5201                 return -EOPNOTSUPP;
5202
5203         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5204             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5205             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5206             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5207             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5208             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5209                 return -EOPNOTSUPP;
5210
5211         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5212
5213         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5214 }
5215
5216 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5217 {
5218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5219         struct wireless_dev *wdev;
5220         struct net_device *dev = info->user_ptr[1];
5221         u8 ps_state;
5222         bool state;
5223         int err;
5224
5225         if (!info->attrs[NL80211_ATTR_PS_STATE])
5226                 return -EINVAL;
5227
5228         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5229
5230         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5231                 return -EINVAL;
5232
5233         wdev = dev->ieee80211_ptr;
5234
5235         if (!rdev->ops->set_power_mgmt)
5236                 return -EOPNOTSUPP;
5237
5238         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5239
5240         if (state == wdev->ps)
5241                 return 0;
5242
5243         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5244                                         wdev->ps_timeout);
5245         if (!err)
5246                 wdev->ps = state;
5247         return err;
5248 }
5249
5250 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5251 {
5252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5253         enum nl80211_ps_state ps_state;
5254         struct wireless_dev *wdev;
5255         struct net_device *dev = info->user_ptr[1];
5256         struct sk_buff *msg;
5257         void *hdr;
5258         int err;
5259
5260         wdev = dev->ieee80211_ptr;
5261
5262         if (!rdev->ops->set_power_mgmt)
5263                 return -EOPNOTSUPP;
5264
5265         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5266         if (!msg)
5267                 return -ENOMEM;
5268
5269         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5270                              NL80211_CMD_GET_POWER_SAVE);
5271         if (!hdr) {
5272                 err = -ENOBUFS;
5273                 goto free_msg;
5274         }
5275
5276         if (wdev->ps)
5277                 ps_state = NL80211_PS_ENABLED;
5278         else
5279                 ps_state = NL80211_PS_DISABLED;
5280
5281         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5282
5283         genlmsg_end(msg, hdr);
5284         return genlmsg_reply(msg, info);
5285
5286  nla_put_failure:
5287         err = -ENOBUFS;
5288  free_msg:
5289         nlmsg_free(msg);
5290         return err;
5291 }
5292
5293 static struct nla_policy
5294 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5295         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5296         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5297         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5298 };
5299
5300 static int nl80211_set_cqm_rssi(struct genl_info *info,
5301                                 s32 threshold, u32 hysteresis)
5302 {
5303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5304         struct wireless_dev *wdev;
5305         struct net_device *dev = info->user_ptr[1];
5306
5307         if (threshold > 0)
5308                 return -EINVAL;
5309
5310         wdev = dev->ieee80211_ptr;
5311
5312         if (!rdev->ops->set_cqm_rssi_config)
5313                 return -EOPNOTSUPP;
5314
5315         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5316             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5317                 return -EOPNOTSUPP;
5318
5319         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5320                                               threshold, hysteresis);
5321 }
5322
5323 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5324 {
5325         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5326         struct nlattr *cqm;
5327         int err;
5328
5329         cqm = info->attrs[NL80211_ATTR_CQM];
5330         if (!cqm) {
5331                 err = -EINVAL;
5332                 goto out;
5333         }
5334
5335         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5336                                nl80211_attr_cqm_policy);
5337         if (err)
5338                 goto out;
5339
5340         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5341             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5342                 s32 threshold;
5343                 u32 hysteresis;
5344                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5345                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5346                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5347         } else
5348                 err = -EINVAL;
5349
5350 out:
5351         return err;
5352 }
5353
5354 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5355 {
5356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5357         struct net_device *dev = info->user_ptr[1];
5358         struct mesh_config cfg;
5359         struct mesh_setup setup;
5360         int err;
5361
5362         /* start with default */
5363         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5364         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5365
5366         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5367                 /* and parse parameters if given */
5368                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5369                 if (err)
5370                         return err;
5371         }
5372
5373         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5374             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5375                 return -EINVAL;
5376
5377         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5378         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5379
5380         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5381                 /* parse additional setup parameters if given */
5382                 err = nl80211_parse_mesh_setup(info, &setup);
5383                 if (err)
5384                         return err;
5385         }
5386
5387         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5388 }
5389
5390 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5391 {
5392         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5393         struct net_device *dev = info->user_ptr[1];
5394
5395         return cfg80211_leave_mesh(rdev, dev);
5396 }
5397
5398 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5399 {
5400         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5401         struct sk_buff *msg;
5402         void *hdr;
5403
5404         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5405                 return -EOPNOTSUPP;
5406
5407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5408         if (!msg)
5409                 return -ENOMEM;
5410
5411         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5412                              NL80211_CMD_GET_WOWLAN);
5413         if (!hdr)
5414                 goto nla_put_failure;
5415
5416         if (rdev->wowlan) {
5417                 struct nlattr *nl_wowlan;
5418
5419                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5420                 if (!nl_wowlan)
5421                         goto nla_put_failure;
5422
5423                 if (rdev->wowlan->any)
5424                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5425                 if (rdev->wowlan->disconnect)
5426                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5427                 if (rdev->wowlan->magic_pkt)
5428                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5429                 if (rdev->wowlan->gtk_rekey_failure)
5430                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5431                 if (rdev->wowlan->eap_identity_req)
5432                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5433                 if (rdev->wowlan->four_way_handshake)
5434                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5435                 if (rdev->wowlan->rfkill_release)
5436                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5437                 if (rdev->wowlan->n_patterns) {
5438                         struct nlattr *nl_pats, *nl_pat;
5439                         int i, pat_len;
5440
5441                         nl_pats = nla_nest_start(msg,
5442                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5443                         if (!nl_pats)
5444                                 goto nla_put_failure;
5445
5446                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5447                                 nl_pat = nla_nest_start(msg, i + 1);
5448                                 if (!nl_pat)
5449                                         goto nla_put_failure;
5450                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5451                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5452                                         DIV_ROUND_UP(pat_len, 8),
5453                                         rdev->wowlan->patterns[i].mask);
5454                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5455                                         pat_len,
5456                                         rdev->wowlan->patterns[i].pattern);
5457                                 nla_nest_end(msg, nl_pat);
5458                         }
5459                         nla_nest_end(msg, nl_pats);
5460                 }
5461
5462                 nla_nest_end(msg, nl_wowlan);
5463         }
5464
5465         genlmsg_end(msg, hdr);
5466         return genlmsg_reply(msg, info);
5467
5468 nla_put_failure:
5469         nlmsg_free(msg);
5470         return -ENOBUFS;
5471 }
5472
5473 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5474 {
5475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5476         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5477         struct cfg80211_wowlan no_triggers = {};
5478         struct cfg80211_wowlan new_triggers = {};
5479         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5480         int err, i;
5481
5482         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5483                 return -EOPNOTSUPP;
5484
5485         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5486                 goto no_triggers;
5487
5488         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5489                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5490                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5491                         nl80211_wowlan_policy);
5492         if (err)
5493                 return err;
5494
5495         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5496                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5497                         return -EINVAL;
5498                 new_triggers.any = true;
5499         }
5500
5501         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5502                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5503                         return -EINVAL;
5504                 new_triggers.disconnect = true;
5505         }
5506
5507         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5508                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5509                         return -EINVAL;
5510                 new_triggers.magic_pkt = true;
5511         }
5512
5513         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5514                 return -EINVAL;
5515
5516         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5517                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5518                         return -EINVAL;
5519                 new_triggers.gtk_rekey_failure = true;
5520         }
5521
5522         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5523                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5524                         return -EINVAL;
5525                 new_triggers.eap_identity_req = true;
5526         }
5527
5528         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5529                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5530                         return -EINVAL;
5531                 new_triggers.four_way_handshake = true;
5532         }
5533
5534         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5535                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5536                         return -EINVAL;
5537                 new_triggers.rfkill_release = true;
5538         }
5539
5540         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5541                 struct nlattr *pat;
5542                 int n_patterns = 0;
5543                 int rem, pat_len, mask_len;
5544                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5545
5546                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5547                                     rem)
5548                         n_patterns++;
5549                 if (n_patterns > wowlan->n_patterns)
5550                         return -EINVAL;
5551
5552                 new_triggers.patterns = kcalloc(n_patterns,
5553                                                 sizeof(new_triggers.patterns[0]),
5554                                                 GFP_KERNEL);
5555                 if (!new_triggers.patterns)
5556                         return -ENOMEM;
5557
5558                 new_triggers.n_patterns = n_patterns;
5559                 i = 0;
5560
5561                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5562                                     rem) {
5563                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5564                                   nla_data(pat), nla_len(pat), NULL);
5565                         err = -EINVAL;
5566                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5567                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5568                                 goto error;
5569                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5570                         mask_len = DIV_ROUND_UP(pat_len, 8);
5571                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5572                             mask_len)
5573                                 goto error;
5574                         if (pat_len > wowlan->pattern_max_len ||
5575                             pat_len < wowlan->pattern_min_len)
5576                                 goto error;
5577
5578                         new_triggers.patterns[i].mask =
5579                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5580                         if (!new_triggers.patterns[i].mask) {
5581                                 err = -ENOMEM;
5582                                 goto error;
5583                         }
5584                         new_triggers.patterns[i].pattern =
5585                                 new_triggers.patterns[i].mask + mask_len;
5586                         memcpy(new_triggers.patterns[i].mask,
5587                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5588                                mask_len);
5589                         new_triggers.patterns[i].pattern_len = pat_len;
5590                         memcpy(new_triggers.patterns[i].pattern,
5591                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5592                                pat_len);
5593                         i++;
5594                 }
5595         }
5596
5597         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5598                 struct cfg80211_wowlan *ntrig;
5599                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5600                                 GFP_KERNEL);
5601                 if (!ntrig) {
5602                         err = -ENOMEM;
5603                         goto error;
5604                 }
5605                 cfg80211_rdev_free_wowlan(rdev);
5606                 rdev->wowlan = ntrig;
5607         } else {
5608  no_triggers:
5609                 cfg80211_rdev_free_wowlan(rdev);
5610                 rdev->wowlan = NULL;
5611         }
5612
5613         return 0;
5614  error:
5615         for (i = 0; i < new_triggers.n_patterns; i++)
5616                 kfree(new_triggers.patterns[i].mask);
5617         kfree(new_triggers.patterns);
5618         return err;
5619 }
5620
5621 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5622 {
5623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5624         struct net_device *dev = info->user_ptr[1];
5625         struct wireless_dev *wdev = dev->ieee80211_ptr;
5626         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5627         struct cfg80211_gtk_rekey_data rekey_data;
5628         int err;
5629
5630         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5631                 return -EINVAL;
5632
5633         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5634                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5635                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5636                         nl80211_rekey_policy);
5637         if (err)
5638                 return err;
5639
5640         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5641                 return -ERANGE;
5642         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5643                 return -ERANGE;
5644         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5645                 return -ERANGE;
5646
5647         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5648                NL80211_KEK_LEN);
5649         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5650                NL80211_KCK_LEN);
5651         memcpy(rekey_data.replay_ctr,
5652                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5653                NL80211_REPLAY_CTR_LEN);
5654
5655         wdev_lock(wdev);
5656         if (!wdev->current_bss) {
5657                 err = -ENOTCONN;
5658                 goto out;
5659         }
5660
5661         if (!rdev->ops->set_rekey_data) {
5662                 err = -EOPNOTSUPP;
5663                 goto out;
5664         }
5665
5666         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5667  out:
5668         wdev_unlock(wdev);
5669         return err;
5670 }
5671
5672 #define NL80211_FLAG_NEED_WIPHY         0x01
5673 #define NL80211_FLAG_NEED_NETDEV        0x02
5674 #define NL80211_FLAG_NEED_RTNL          0x04
5675 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5676 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5677                                          NL80211_FLAG_CHECK_NETDEV_UP)
5678
5679 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5680                             struct genl_info *info)
5681 {
5682         struct cfg80211_registered_device *rdev;
5683         struct net_device *dev;
5684         int err;
5685         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5686
5687         if (rtnl)
5688                 rtnl_lock();
5689
5690         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5691                 rdev = cfg80211_get_dev_from_info(info);
5692                 if (IS_ERR(rdev)) {
5693                         if (rtnl)
5694                                 rtnl_unlock();
5695                         return PTR_ERR(rdev);
5696                 }
5697                 info->user_ptr[0] = rdev;
5698         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5699                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5700                 if (err) {
5701                         if (rtnl)
5702                                 rtnl_unlock();
5703                         return err;
5704                 }
5705                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5706                     !netif_running(dev)) {
5707                         cfg80211_unlock_rdev(rdev);
5708                         dev_put(dev);
5709                         if (rtnl)
5710                                 rtnl_unlock();
5711                         return -ENETDOWN;
5712                 }
5713                 info->user_ptr[0] = rdev;
5714                 info->user_ptr[1] = dev;
5715         }
5716
5717         return 0;
5718 }
5719
5720 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5721                               struct genl_info *info)
5722 {
5723         if (info->user_ptr[0])
5724                 cfg80211_unlock_rdev(info->user_ptr[0]);
5725         if (info->user_ptr[1])
5726                 dev_put(info->user_ptr[1]);
5727         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5728                 rtnl_unlock();
5729 }
5730
5731 static struct genl_ops nl80211_ops[] = {
5732         {
5733                 .cmd = NL80211_CMD_GET_WIPHY,
5734                 .doit = nl80211_get_wiphy,
5735                 .dumpit = nl80211_dump_wiphy,
5736                 .policy = nl80211_policy,
5737                 /* can be retrieved by unprivileged users */
5738                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5739         },
5740         {
5741                 .cmd = NL80211_CMD_SET_WIPHY,
5742                 .doit = nl80211_set_wiphy,
5743                 .policy = nl80211_policy,
5744                 .flags = GENL_ADMIN_PERM,
5745                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5746         },
5747         {
5748                 .cmd = NL80211_CMD_GET_INTERFACE,
5749                 .doit = nl80211_get_interface,
5750                 .dumpit = nl80211_dump_interface,
5751                 .policy = nl80211_policy,
5752                 /* can be retrieved by unprivileged users */
5753                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5754         },
5755         {
5756                 .cmd = NL80211_CMD_SET_INTERFACE,
5757                 .doit = nl80211_set_interface,
5758                 .policy = nl80211_policy,
5759                 .flags = GENL_ADMIN_PERM,
5760                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5761                                   NL80211_FLAG_NEED_RTNL,
5762         },
5763         {
5764                 .cmd = NL80211_CMD_NEW_INTERFACE,
5765                 .doit = nl80211_new_interface,
5766                 .policy = nl80211_policy,
5767                 .flags = GENL_ADMIN_PERM,
5768                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5769                                   NL80211_FLAG_NEED_RTNL,
5770         },
5771         {
5772                 .cmd = NL80211_CMD_DEL_INTERFACE,
5773                 .doit = nl80211_del_interface,
5774                 .policy = nl80211_policy,
5775                 .flags = GENL_ADMIN_PERM,
5776                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5777                                   NL80211_FLAG_NEED_RTNL,
5778         },
5779         {
5780                 .cmd = NL80211_CMD_GET_KEY,
5781                 .doit = nl80211_get_key,
5782                 .policy = nl80211_policy,
5783                 .flags = GENL_ADMIN_PERM,
5784                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5785                                   NL80211_FLAG_NEED_RTNL,
5786         },
5787         {
5788                 .cmd = NL80211_CMD_SET_KEY,
5789                 .doit = nl80211_set_key,
5790                 .policy = nl80211_policy,
5791                 .flags = GENL_ADMIN_PERM,
5792                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5793                                   NL80211_FLAG_NEED_RTNL,
5794         },
5795         {
5796                 .cmd = NL80211_CMD_NEW_KEY,
5797                 .doit = nl80211_new_key,
5798                 .policy = nl80211_policy,
5799                 .flags = GENL_ADMIN_PERM,
5800                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5801                                   NL80211_FLAG_NEED_RTNL,
5802         },
5803         {
5804                 .cmd = NL80211_CMD_DEL_KEY,
5805                 .doit = nl80211_del_key,
5806                 .policy = nl80211_policy,
5807                 .flags = GENL_ADMIN_PERM,
5808                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5809                                   NL80211_FLAG_NEED_RTNL,
5810         },
5811         {
5812                 .cmd = NL80211_CMD_SET_BEACON,
5813                 .policy = nl80211_policy,
5814                 .flags = GENL_ADMIN_PERM,
5815                 .doit = nl80211_addset_beacon,
5816                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5817                                   NL80211_FLAG_NEED_RTNL,
5818         },
5819         {
5820                 .cmd = NL80211_CMD_NEW_BEACON,
5821                 .policy = nl80211_policy,
5822                 .flags = GENL_ADMIN_PERM,
5823                 .doit = nl80211_addset_beacon,
5824                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5825                                   NL80211_FLAG_NEED_RTNL,
5826         },
5827         {
5828                 .cmd = NL80211_CMD_DEL_BEACON,
5829                 .policy = nl80211_policy,
5830                 .flags = GENL_ADMIN_PERM,
5831                 .doit = nl80211_del_beacon,
5832                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5833                                   NL80211_FLAG_NEED_RTNL,
5834         },
5835         {
5836                 .cmd = NL80211_CMD_GET_STATION,
5837                 .doit = nl80211_get_station,
5838                 .dumpit = nl80211_dump_station,
5839                 .policy = nl80211_policy,
5840                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5841                                   NL80211_FLAG_NEED_RTNL,
5842         },
5843         {
5844                 .cmd = NL80211_CMD_SET_STATION,
5845                 .doit = nl80211_set_station,
5846                 .policy = nl80211_policy,
5847                 .flags = GENL_ADMIN_PERM,
5848                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5849                                   NL80211_FLAG_NEED_RTNL,
5850         },
5851         {
5852                 .cmd = NL80211_CMD_NEW_STATION,
5853                 .doit = nl80211_new_station,
5854                 .policy = nl80211_policy,
5855                 .flags = GENL_ADMIN_PERM,
5856                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5857                                   NL80211_FLAG_NEED_RTNL,
5858         },
5859         {
5860                 .cmd = NL80211_CMD_DEL_STATION,
5861                 .doit = nl80211_del_station,
5862                 .policy = nl80211_policy,
5863                 .flags = GENL_ADMIN_PERM,
5864                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5865                                   NL80211_FLAG_NEED_RTNL,
5866         },
5867         {
5868                 .cmd = NL80211_CMD_GET_MPATH,
5869                 .doit = nl80211_get_mpath,
5870                 .dumpit = nl80211_dump_mpath,
5871                 .policy = nl80211_policy,
5872                 .flags = GENL_ADMIN_PERM,
5873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5874                                   NL80211_FLAG_NEED_RTNL,
5875         },
5876         {
5877                 .cmd = NL80211_CMD_SET_MPATH,
5878                 .doit = nl80211_set_mpath,
5879                 .policy = nl80211_policy,
5880                 .flags = GENL_ADMIN_PERM,
5881                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5882                                   NL80211_FLAG_NEED_RTNL,
5883         },
5884         {
5885                 .cmd = NL80211_CMD_NEW_MPATH,
5886                 .doit = nl80211_new_mpath,
5887                 .policy = nl80211_policy,
5888                 .flags = GENL_ADMIN_PERM,
5889                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5890                                   NL80211_FLAG_NEED_RTNL,
5891         },
5892         {
5893                 .cmd = NL80211_CMD_DEL_MPATH,
5894                 .doit = nl80211_del_mpath,
5895                 .policy = nl80211_policy,
5896                 .flags = GENL_ADMIN_PERM,
5897                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5898                                   NL80211_FLAG_NEED_RTNL,
5899         },
5900         {
5901                 .cmd = NL80211_CMD_SET_BSS,
5902                 .doit = nl80211_set_bss,
5903                 .policy = nl80211_policy,
5904                 .flags = GENL_ADMIN_PERM,
5905                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5906                                   NL80211_FLAG_NEED_RTNL,
5907         },
5908         {
5909                 .cmd = NL80211_CMD_GET_REG,
5910                 .doit = nl80211_get_reg,
5911                 .policy = nl80211_policy,
5912                 /* can be retrieved by unprivileged users */
5913         },
5914         {
5915                 .cmd = NL80211_CMD_SET_REG,
5916                 .doit = nl80211_set_reg,
5917                 .policy = nl80211_policy,
5918                 .flags = GENL_ADMIN_PERM,
5919         },
5920         {
5921                 .cmd = NL80211_CMD_REQ_SET_REG,
5922                 .doit = nl80211_req_set_reg,
5923                 .policy = nl80211_policy,
5924                 .flags = GENL_ADMIN_PERM,
5925         },
5926         {
5927                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5928                 .doit = nl80211_get_mesh_config,
5929                 .policy = nl80211_policy,
5930                 /* can be retrieved by unprivileged users */
5931                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5932                                   NL80211_FLAG_NEED_RTNL,
5933         },
5934         {
5935                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5936                 .doit = nl80211_update_mesh_config,
5937                 .policy = nl80211_policy,
5938                 .flags = GENL_ADMIN_PERM,
5939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5940                                   NL80211_FLAG_NEED_RTNL,
5941         },
5942         {
5943                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5944                 .doit = nl80211_trigger_scan,
5945                 .policy = nl80211_policy,
5946                 .flags = GENL_ADMIN_PERM,
5947                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5948                                   NL80211_FLAG_NEED_RTNL,
5949         },
5950         {
5951                 .cmd = NL80211_CMD_GET_SCAN,
5952                 .policy = nl80211_policy,
5953                 .dumpit = nl80211_dump_scan,
5954         },
5955         {
5956                 .cmd = NL80211_CMD_START_SCHED_SCAN,
5957                 .doit = nl80211_start_sched_scan,
5958                 .policy = nl80211_policy,
5959                 .flags = GENL_ADMIN_PERM,
5960                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5961                                   NL80211_FLAG_NEED_RTNL,
5962         },
5963         {
5964                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
5965                 .doit = nl80211_stop_sched_scan,
5966                 .policy = nl80211_policy,
5967                 .flags = GENL_ADMIN_PERM,
5968                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5969                                   NL80211_FLAG_NEED_RTNL,
5970         },
5971         {
5972                 .cmd = NL80211_CMD_AUTHENTICATE,
5973                 .doit = nl80211_authenticate,
5974                 .policy = nl80211_policy,
5975                 .flags = GENL_ADMIN_PERM,
5976                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5977                                   NL80211_FLAG_NEED_RTNL,
5978         },
5979         {
5980                 .cmd = NL80211_CMD_ASSOCIATE,
5981                 .doit = nl80211_associate,
5982                 .policy = nl80211_policy,
5983                 .flags = GENL_ADMIN_PERM,
5984                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5985                                   NL80211_FLAG_NEED_RTNL,
5986         },
5987         {
5988                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5989                 .doit = nl80211_deauthenticate,
5990                 .policy = nl80211_policy,
5991                 .flags = GENL_ADMIN_PERM,
5992                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5993                                   NL80211_FLAG_NEED_RTNL,
5994         },
5995         {
5996                 .cmd = NL80211_CMD_DISASSOCIATE,
5997                 .doit = nl80211_disassociate,
5998                 .policy = nl80211_policy,
5999                 .flags = GENL_ADMIN_PERM,
6000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6001                                   NL80211_FLAG_NEED_RTNL,
6002         },
6003         {
6004                 .cmd = NL80211_CMD_JOIN_IBSS,
6005                 .doit = nl80211_join_ibss,
6006                 .policy = nl80211_policy,
6007                 .flags = GENL_ADMIN_PERM,
6008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6009                                   NL80211_FLAG_NEED_RTNL,
6010         },
6011         {
6012                 .cmd = NL80211_CMD_LEAVE_IBSS,
6013                 .doit = nl80211_leave_ibss,
6014                 .policy = nl80211_policy,
6015                 .flags = GENL_ADMIN_PERM,
6016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6017                                   NL80211_FLAG_NEED_RTNL,
6018         },
6019 #ifdef CONFIG_NL80211_TESTMODE
6020         {
6021                 .cmd = NL80211_CMD_TESTMODE,
6022                 .doit = nl80211_testmode_do,
6023                 .dumpit = nl80211_testmode_dump,
6024                 .policy = nl80211_policy,
6025                 .flags = GENL_ADMIN_PERM,
6026                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6027                                   NL80211_FLAG_NEED_RTNL,
6028         },
6029 #endif
6030         {
6031                 .cmd = NL80211_CMD_CONNECT,
6032                 .doit = nl80211_connect,
6033                 .policy = nl80211_policy,
6034                 .flags = GENL_ADMIN_PERM,
6035                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6036                                   NL80211_FLAG_NEED_RTNL,
6037         },
6038         {
6039                 .cmd = NL80211_CMD_DISCONNECT,
6040                 .doit = nl80211_disconnect,
6041                 .policy = nl80211_policy,
6042                 .flags = GENL_ADMIN_PERM,
6043                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6044                                   NL80211_FLAG_NEED_RTNL,
6045         },
6046         {
6047                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6048                 .doit = nl80211_wiphy_netns,
6049                 .policy = nl80211_policy,
6050                 .flags = GENL_ADMIN_PERM,
6051                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6052                                   NL80211_FLAG_NEED_RTNL,
6053         },
6054         {
6055                 .cmd = NL80211_CMD_GET_SURVEY,
6056                 .policy = nl80211_policy,
6057                 .dumpit = nl80211_dump_survey,
6058         },
6059         {
6060                 .cmd = NL80211_CMD_SET_PMKSA,
6061                 .doit = nl80211_setdel_pmksa,
6062                 .policy = nl80211_policy,
6063                 .flags = GENL_ADMIN_PERM,
6064                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6065                                   NL80211_FLAG_NEED_RTNL,
6066         },
6067         {
6068                 .cmd = NL80211_CMD_DEL_PMKSA,
6069                 .doit = nl80211_setdel_pmksa,
6070                 .policy = nl80211_policy,
6071                 .flags = GENL_ADMIN_PERM,
6072                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6073                                   NL80211_FLAG_NEED_RTNL,
6074         },
6075         {
6076                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6077                 .doit = nl80211_flush_pmksa,
6078                 .policy = nl80211_policy,
6079                 .flags = GENL_ADMIN_PERM,
6080                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6081                                   NL80211_FLAG_NEED_RTNL,
6082         },
6083         {
6084                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6085                 .doit = nl80211_remain_on_channel,
6086                 .policy = nl80211_policy,
6087                 .flags = GENL_ADMIN_PERM,
6088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6089                                   NL80211_FLAG_NEED_RTNL,
6090         },
6091         {
6092                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6093                 .doit = nl80211_cancel_remain_on_channel,
6094                 .policy = nl80211_policy,
6095                 .flags = GENL_ADMIN_PERM,
6096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6097                                   NL80211_FLAG_NEED_RTNL,
6098         },
6099         {
6100                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6101                 .doit = nl80211_set_tx_bitrate_mask,
6102                 .policy = nl80211_policy,
6103                 .flags = GENL_ADMIN_PERM,
6104                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6105                                   NL80211_FLAG_NEED_RTNL,
6106         },
6107         {
6108                 .cmd = NL80211_CMD_REGISTER_FRAME,
6109                 .doit = nl80211_register_mgmt,
6110                 .policy = nl80211_policy,
6111                 .flags = GENL_ADMIN_PERM,
6112                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6113                                   NL80211_FLAG_NEED_RTNL,
6114         },
6115         {
6116                 .cmd = NL80211_CMD_FRAME,
6117                 .doit = nl80211_tx_mgmt,
6118                 .policy = nl80211_policy,
6119                 .flags = GENL_ADMIN_PERM,
6120                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6121                                   NL80211_FLAG_NEED_RTNL,
6122         },
6123         {
6124                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6125                 .doit = nl80211_tx_mgmt_cancel_wait,
6126                 .policy = nl80211_policy,
6127                 .flags = GENL_ADMIN_PERM,
6128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6129                                   NL80211_FLAG_NEED_RTNL,
6130         },
6131         {
6132                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6133                 .doit = nl80211_set_power_save,
6134                 .policy = nl80211_policy,
6135                 .flags = GENL_ADMIN_PERM,
6136                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6137                                   NL80211_FLAG_NEED_RTNL,
6138         },
6139         {
6140                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6141                 .doit = nl80211_get_power_save,
6142                 .policy = nl80211_policy,
6143                 /* can be retrieved by unprivileged users */
6144                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6145                                   NL80211_FLAG_NEED_RTNL,
6146         },
6147         {
6148                 .cmd = NL80211_CMD_SET_CQM,
6149                 .doit = nl80211_set_cqm,
6150                 .policy = nl80211_policy,
6151                 .flags = GENL_ADMIN_PERM,
6152                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6153                                   NL80211_FLAG_NEED_RTNL,
6154         },
6155         {
6156                 .cmd = NL80211_CMD_SET_CHANNEL,
6157                 .doit = nl80211_set_channel,
6158                 .policy = nl80211_policy,
6159                 .flags = GENL_ADMIN_PERM,
6160                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6161                                   NL80211_FLAG_NEED_RTNL,
6162         },
6163         {
6164                 .cmd = NL80211_CMD_SET_WDS_PEER,
6165                 .doit = nl80211_set_wds_peer,
6166                 .policy = nl80211_policy,
6167                 .flags = GENL_ADMIN_PERM,
6168                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6169                                   NL80211_FLAG_NEED_RTNL,
6170         },
6171         {
6172                 .cmd = NL80211_CMD_JOIN_MESH,
6173                 .doit = nl80211_join_mesh,
6174                 .policy = nl80211_policy,
6175                 .flags = GENL_ADMIN_PERM,
6176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6177                                   NL80211_FLAG_NEED_RTNL,
6178         },
6179         {
6180                 .cmd = NL80211_CMD_LEAVE_MESH,
6181                 .doit = nl80211_leave_mesh,
6182                 .policy = nl80211_policy,
6183                 .flags = GENL_ADMIN_PERM,
6184                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6185                                   NL80211_FLAG_NEED_RTNL,
6186         },
6187         {
6188                 .cmd = NL80211_CMD_GET_WOWLAN,
6189                 .doit = nl80211_get_wowlan,
6190                 .policy = nl80211_policy,
6191                 /* can be retrieved by unprivileged users */
6192                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6193                                   NL80211_FLAG_NEED_RTNL,
6194         },
6195         {
6196                 .cmd = NL80211_CMD_SET_WOWLAN,
6197                 .doit = nl80211_set_wowlan,
6198                 .policy = nl80211_policy,
6199                 .flags = GENL_ADMIN_PERM,
6200                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6201                                   NL80211_FLAG_NEED_RTNL,
6202         },
6203         {
6204                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6205                 .doit = nl80211_set_rekey_data,
6206                 .policy = nl80211_policy,
6207                 .flags = GENL_ADMIN_PERM,
6208                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6209                                   NL80211_FLAG_NEED_RTNL,
6210         },
6211 };
6212
6213 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6214         .name = "mlme",
6215 };
6216
6217 /* multicast groups */
6218 static struct genl_multicast_group nl80211_config_mcgrp = {
6219         .name = "config",
6220 };
6221 static struct genl_multicast_group nl80211_scan_mcgrp = {
6222         .name = "scan",
6223 };
6224 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6225         .name = "regulatory",
6226 };
6227
6228 /* notification functions */
6229
6230 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6231 {
6232         struct sk_buff *msg;
6233
6234         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6235         if (!msg)
6236                 return;
6237
6238         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6239                 nlmsg_free(msg);
6240                 return;
6241         }
6242
6243         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6244                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6245 }
6246
6247 static int nl80211_add_scan_req(struct sk_buff *msg,
6248                                 struct cfg80211_registered_device *rdev)
6249 {
6250         struct cfg80211_scan_request *req = rdev->scan_req;
6251         struct nlattr *nest;
6252         int i;
6253
6254         ASSERT_RDEV_LOCK(rdev);
6255
6256         if (WARN_ON(!req))
6257                 return 0;
6258
6259         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6260         if (!nest)
6261                 goto nla_put_failure;
6262         for (i = 0; i < req->n_ssids; i++)
6263                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6264         nla_nest_end(msg, nest);
6265
6266         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6267         if (!nest)
6268                 goto nla_put_failure;
6269         for (i = 0; i < req->n_channels; i++)
6270                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6271         nla_nest_end(msg, nest);
6272
6273         if (req->ie)
6274                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6275
6276         return 0;
6277  nla_put_failure:
6278         return -ENOBUFS;
6279 }
6280
6281 static int nl80211_send_scan_msg(struct sk_buff *msg,
6282                                  struct cfg80211_registered_device *rdev,
6283                                  struct net_device *netdev,
6284                                  u32 pid, u32 seq, int flags,
6285                                  u32 cmd)
6286 {
6287         void *hdr;
6288
6289         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6290         if (!hdr)
6291                 return -1;
6292
6293         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6294         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6295
6296         /* ignore errors and send incomplete event anyway */
6297         nl80211_add_scan_req(msg, rdev);
6298
6299         return genlmsg_end(msg, hdr);
6300
6301  nla_put_failure:
6302         genlmsg_cancel(msg, hdr);
6303         return -EMSGSIZE;
6304 }
6305
6306 static int
6307 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6308                             struct cfg80211_registered_device *rdev,
6309                             struct net_device *netdev,
6310                             u32 pid, u32 seq, int flags, u32 cmd)
6311 {
6312         void *hdr;
6313
6314         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6315         if (!hdr)
6316                 return -1;
6317
6318         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6319         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6320
6321         return genlmsg_end(msg, hdr);
6322
6323  nla_put_failure:
6324         genlmsg_cancel(msg, hdr);
6325         return -EMSGSIZE;
6326 }
6327
6328 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6329                              struct net_device *netdev)
6330 {
6331         struct sk_buff *msg;
6332
6333         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6334         if (!msg)
6335                 return;
6336
6337         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6338                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6339                 nlmsg_free(msg);
6340                 return;
6341         }
6342
6343         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6344                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6345 }
6346
6347 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6348                             struct net_device *netdev)
6349 {
6350         struct sk_buff *msg;
6351
6352         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6353         if (!msg)
6354                 return;
6355
6356         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6357                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6358                 nlmsg_free(msg);
6359                 return;
6360         }
6361
6362         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6363                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6364 }
6365
6366 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6367                                struct net_device *netdev)
6368 {
6369         struct sk_buff *msg;
6370
6371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6372         if (!msg)
6373                 return;
6374
6375         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6376                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6377                 nlmsg_free(msg);
6378                 return;
6379         }
6380
6381         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6382                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6383 }
6384
6385 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6386                                      struct net_device *netdev)
6387 {
6388         struct sk_buff *msg;
6389
6390         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6391         if (!msg)
6392                 return;
6393
6394         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6395                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6396                 nlmsg_free(msg);
6397                 return;
6398         }
6399
6400         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6401                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6402 }
6403
6404 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6405                              struct net_device *netdev, u32 cmd)
6406 {
6407         struct sk_buff *msg;
6408
6409         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6410         if (!msg)
6411                 return;
6412
6413         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6414                 nlmsg_free(msg);
6415                 return;
6416         }
6417
6418         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6419                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6420 }
6421
6422 /*
6423  * This can happen on global regulatory changes or device specific settings
6424  * based on custom world regulatory domains.
6425  */
6426 void nl80211_send_reg_change_event(struct regulatory_request *request)
6427 {
6428         struct sk_buff *msg;
6429         void *hdr;
6430
6431         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6432         if (!msg)
6433                 return;
6434
6435         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6436         if (!hdr) {
6437                 nlmsg_free(msg);
6438                 return;
6439         }
6440
6441         /* Userspace can always count this one always being set */
6442         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6443
6444         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6445                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6446                            NL80211_REGDOM_TYPE_WORLD);
6447         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6448                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6449                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6450         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6451                  request->intersect)
6452                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6453                            NL80211_REGDOM_TYPE_INTERSECTION);
6454         else {
6455                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6456                            NL80211_REGDOM_TYPE_COUNTRY);
6457                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6458         }
6459
6460         if (wiphy_idx_valid(request->wiphy_idx))
6461                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6462
6463         if (genlmsg_end(msg, hdr) < 0) {
6464                 nlmsg_free(msg);
6465                 return;
6466         }
6467
6468         rcu_read_lock();
6469         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6470                                 GFP_ATOMIC);
6471         rcu_read_unlock();
6472
6473         return;
6474
6475 nla_put_failure:
6476         genlmsg_cancel(msg, hdr);
6477         nlmsg_free(msg);
6478 }
6479
6480 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6481                                     struct net_device *netdev,
6482                                     const u8 *buf, size_t len,
6483                                     enum nl80211_commands cmd, gfp_t gfp)
6484 {
6485         struct sk_buff *msg;
6486         void *hdr;
6487
6488         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6489         if (!msg)
6490                 return;
6491
6492         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6493         if (!hdr) {
6494                 nlmsg_free(msg);
6495                 return;
6496         }
6497
6498         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6499         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6500         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6501
6502         if (genlmsg_end(msg, hdr) < 0) {
6503                 nlmsg_free(msg);
6504                 return;
6505         }
6506
6507         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6508                                 nl80211_mlme_mcgrp.id, gfp);
6509         return;
6510
6511  nla_put_failure:
6512         genlmsg_cancel(msg, hdr);
6513         nlmsg_free(msg);
6514 }
6515
6516 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6517                           struct net_device *netdev, const u8 *buf,
6518                           size_t len, gfp_t gfp)
6519 {
6520         nl80211_send_mlme_event(rdev, netdev, buf, len,
6521                                 NL80211_CMD_AUTHENTICATE, gfp);
6522 }
6523
6524 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6525                            struct net_device *netdev, const u8 *buf,
6526                            size_t len, gfp_t gfp)
6527 {
6528         nl80211_send_mlme_event(rdev, netdev, buf, len,
6529                                 NL80211_CMD_ASSOCIATE, gfp);
6530 }
6531
6532 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6533                          struct net_device *netdev, const u8 *buf,
6534                          size_t len, gfp_t gfp)
6535 {
6536         nl80211_send_mlme_event(rdev, netdev, buf, len,
6537                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6538 }
6539
6540 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6541                            struct net_device *netdev, const u8 *buf,
6542                            size_t len, gfp_t gfp)
6543 {
6544         nl80211_send_mlme_event(rdev, netdev, buf, len,
6545                                 NL80211_CMD_DISASSOCIATE, gfp);
6546 }
6547
6548 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6549                                 struct net_device *netdev, const u8 *buf,
6550                                 size_t len, gfp_t gfp)
6551 {
6552         nl80211_send_mlme_event(rdev, netdev, buf, len,
6553                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6554 }
6555
6556 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6557                                   struct net_device *netdev, const u8 *buf,
6558                                   size_t len, gfp_t gfp)
6559 {
6560         nl80211_send_mlme_event(rdev, netdev, buf, len,
6561                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6562 }
6563
6564 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6565                                       struct net_device *netdev, int cmd,
6566                                       const u8 *addr, gfp_t gfp)
6567 {
6568         struct sk_buff *msg;
6569         void *hdr;
6570
6571         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6572         if (!msg)
6573                 return;
6574
6575         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6576         if (!hdr) {
6577                 nlmsg_free(msg);
6578                 return;
6579         }
6580
6581         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6582         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6583         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6584         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6585
6586         if (genlmsg_end(msg, hdr) < 0) {
6587                 nlmsg_free(msg);
6588                 return;
6589         }
6590
6591         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6592                                 nl80211_mlme_mcgrp.id, gfp);
6593         return;
6594
6595  nla_put_failure:
6596         genlmsg_cancel(msg, hdr);
6597         nlmsg_free(msg);
6598 }
6599
6600 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6601                                struct net_device *netdev, const u8 *addr,
6602                                gfp_t gfp)
6603 {
6604         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6605                                   addr, gfp);
6606 }
6607
6608 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6609                                 struct net_device *netdev, const u8 *addr,
6610                                 gfp_t gfp)
6611 {
6612         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6613                                   addr, gfp);
6614 }
6615
6616 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6617                                  struct net_device *netdev, const u8 *bssid,
6618                                  const u8 *req_ie, size_t req_ie_len,
6619                                  const u8 *resp_ie, size_t resp_ie_len,
6620                                  u16 status, gfp_t gfp)
6621 {
6622         struct sk_buff *msg;
6623         void *hdr;
6624
6625         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6626         if (!msg)
6627                 return;
6628
6629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6630         if (!hdr) {
6631                 nlmsg_free(msg);
6632                 return;
6633         }
6634
6635         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6636         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6637         if (bssid)
6638                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6639         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6640         if (req_ie)
6641                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6642         if (resp_ie)
6643                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6644
6645         if (genlmsg_end(msg, hdr) < 0) {
6646                 nlmsg_free(msg);
6647                 return;
6648         }
6649
6650         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6651                                 nl80211_mlme_mcgrp.id, gfp);
6652         return;
6653
6654  nla_put_failure:
6655         genlmsg_cancel(msg, hdr);
6656         nlmsg_free(msg);
6657
6658 }
6659
6660 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6661                          struct net_device *netdev, const u8 *bssid,
6662                          const u8 *req_ie, size_t req_ie_len,
6663                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6664 {
6665         struct sk_buff *msg;
6666         void *hdr;
6667
6668         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6669         if (!msg)
6670                 return;
6671
6672         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6673         if (!hdr) {
6674                 nlmsg_free(msg);
6675                 return;
6676         }
6677
6678         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6679         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6680         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6681         if (req_ie)
6682                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6683         if (resp_ie)
6684                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6685
6686         if (genlmsg_end(msg, hdr) < 0) {
6687                 nlmsg_free(msg);
6688                 return;
6689         }
6690
6691         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6692                                 nl80211_mlme_mcgrp.id, gfp);
6693         return;
6694
6695  nla_put_failure:
6696         genlmsg_cancel(msg, hdr);
6697         nlmsg_free(msg);
6698
6699 }
6700
6701 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6702                                struct net_device *netdev, u16 reason,
6703                                const u8 *ie, size_t ie_len, bool from_ap)
6704 {
6705         struct sk_buff *msg;
6706         void *hdr;
6707
6708         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6709         if (!msg)
6710                 return;
6711
6712         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6713         if (!hdr) {
6714                 nlmsg_free(msg);
6715                 return;
6716         }
6717
6718         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6719         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6720         if (from_ap && reason)
6721                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6722         if (from_ap)
6723                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6724         if (ie)
6725                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6726
6727         if (genlmsg_end(msg, hdr) < 0) {
6728                 nlmsg_free(msg);
6729                 return;
6730         }
6731
6732         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6733                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6734         return;
6735
6736  nla_put_failure:
6737         genlmsg_cancel(msg, hdr);
6738         nlmsg_free(msg);
6739
6740 }
6741
6742 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6743                              struct net_device *netdev, const u8 *bssid,
6744                              gfp_t gfp)
6745 {
6746         struct sk_buff *msg;
6747         void *hdr;
6748
6749         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6750         if (!msg)
6751                 return;
6752
6753         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6754         if (!hdr) {
6755                 nlmsg_free(msg);
6756                 return;
6757         }
6758
6759         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6760         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6761         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6762
6763         if (genlmsg_end(msg, hdr) < 0) {
6764                 nlmsg_free(msg);
6765                 return;
6766         }
6767
6768         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6769                                 nl80211_mlme_mcgrp.id, gfp);
6770         return;
6771
6772  nla_put_failure:
6773         genlmsg_cancel(msg, hdr);
6774         nlmsg_free(msg);
6775 }
6776
6777 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6778                 struct net_device *netdev,
6779                 const u8 *macaddr, const u8* ie, u8 ie_len,
6780                 gfp_t gfp)
6781 {
6782         struct sk_buff *msg;
6783         void *hdr;
6784
6785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6786         if (!msg)
6787                 return;
6788
6789         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6790         if (!hdr) {
6791                 nlmsg_free(msg);
6792                 return;
6793         }
6794
6795         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6796         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6797         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6798         if (ie_len && ie)
6799                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6800
6801         if (genlmsg_end(msg, hdr) < 0) {
6802                 nlmsg_free(msg);
6803                 return;
6804         }
6805
6806         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6807                                 nl80211_mlme_mcgrp.id, gfp);
6808         return;
6809
6810  nla_put_failure:
6811         genlmsg_cancel(msg, hdr);
6812         nlmsg_free(msg);
6813 }
6814
6815 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6816                                  struct net_device *netdev, const u8 *addr,
6817                                  enum nl80211_key_type key_type, int key_id,
6818                                  const u8 *tsc, gfp_t gfp)
6819 {
6820         struct sk_buff *msg;
6821         void *hdr;
6822
6823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6824         if (!msg)
6825                 return;
6826
6827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6828         if (!hdr) {
6829                 nlmsg_free(msg);
6830                 return;
6831         }
6832
6833         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6834         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6835         if (addr)
6836                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6837         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6838         if (key_id != -1)
6839                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6840         if (tsc)
6841                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6842
6843         if (genlmsg_end(msg, hdr) < 0) {
6844                 nlmsg_free(msg);
6845                 return;
6846         }
6847
6848         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6849                                 nl80211_mlme_mcgrp.id, gfp);
6850         return;
6851
6852  nla_put_failure:
6853         genlmsg_cancel(msg, hdr);
6854         nlmsg_free(msg);
6855 }
6856
6857 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6858                                     struct ieee80211_channel *channel_before,
6859                                     struct ieee80211_channel *channel_after)
6860 {
6861         struct sk_buff *msg;
6862         void *hdr;
6863         struct nlattr *nl_freq;
6864
6865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6866         if (!msg)
6867                 return;
6868
6869         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6870         if (!hdr) {
6871                 nlmsg_free(msg);
6872                 return;
6873         }
6874
6875         /*
6876          * Since we are applying the beacon hint to a wiphy we know its
6877          * wiphy_idx is valid
6878          */
6879         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6880
6881         /* Before */
6882         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6883         if (!nl_freq)
6884                 goto nla_put_failure;
6885         if (nl80211_msg_put_channel(msg, channel_before))
6886                 goto nla_put_failure;
6887         nla_nest_end(msg, nl_freq);
6888
6889         /* After */
6890         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6891         if (!nl_freq)
6892                 goto nla_put_failure;
6893         if (nl80211_msg_put_channel(msg, channel_after))
6894                 goto nla_put_failure;
6895         nla_nest_end(msg, nl_freq);
6896
6897         if (genlmsg_end(msg, hdr) < 0) {
6898                 nlmsg_free(msg);
6899                 return;
6900         }
6901
6902         rcu_read_lock();
6903         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6904                                 GFP_ATOMIC);
6905         rcu_read_unlock();
6906
6907         return;
6908
6909 nla_put_failure:
6910         genlmsg_cancel(msg, hdr);
6911         nlmsg_free(msg);
6912 }
6913
6914 static void nl80211_send_remain_on_chan_event(
6915         int cmd, struct cfg80211_registered_device *rdev,
6916         struct net_device *netdev, u64 cookie,
6917         struct ieee80211_channel *chan,
6918         enum nl80211_channel_type channel_type,
6919         unsigned int duration, gfp_t gfp)
6920 {
6921         struct sk_buff *msg;
6922         void *hdr;
6923
6924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6925         if (!msg)
6926                 return;
6927
6928         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6929         if (!hdr) {
6930                 nlmsg_free(msg);
6931                 return;
6932         }
6933
6934         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6935         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6936         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
6937         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
6938         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6939
6940         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
6941                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
6942
6943         if (genlmsg_end(msg, hdr) < 0) {
6944                 nlmsg_free(msg);
6945                 return;
6946         }
6947
6948         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6949                                 nl80211_mlme_mcgrp.id, gfp);
6950         return;
6951
6952  nla_put_failure:
6953         genlmsg_cancel(msg, hdr);
6954         nlmsg_free(msg);
6955 }
6956
6957 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
6958                                     struct net_device *netdev, u64 cookie,
6959                                     struct ieee80211_channel *chan,
6960                                     enum nl80211_channel_type channel_type,
6961                                     unsigned int duration, gfp_t gfp)
6962 {
6963         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
6964                                           rdev, netdev, cookie, chan,
6965                                           channel_type, duration, gfp);
6966 }
6967
6968 void nl80211_send_remain_on_channel_cancel(
6969         struct cfg80211_registered_device *rdev, struct net_device *netdev,
6970         u64 cookie, struct ieee80211_channel *chan,
6971         enum nl80211_channel_type channel_type, gfp_t gfp)
6972 {
6973         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6974                                           rdev, netdev, cookie, chan,
6975                                           channel_type, 0, gfp);
6976 }
6977
6978 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
6979                             struct net_device *dev, const u8 *mac_addr,
6980                             struct station_info *sinfo, gfp_t gfp)
6981 {
6982         struct sk_buff *msg;
6983
6984         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6985         if (!msg)
6986                 return;
6987
6988         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
6989                 nlmsg_free(msg);
6990                 return;
6991         }
6992
6993         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6994                                 nl80211_mlme_mcgrp.id, gfp);
6995 }
6996
6997 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
6998                                 struct net_device *dev, const u8 *mac_addr,
6999                                 gfp_t gfp)
7000 {
7001         struct sk_buff *msg;
7002         void *hdr;
7003
7004         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7005         if (!msg)
7006                 return;
7007
7008         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7009         if (!hdr) {
7010                 nlmsg_free(msg);
7011                 return;
7012         }
7013
7014         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7015         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7016
7017         if (genlmsg_end(msg, hdr) < 0) {
7018                 nlmsg_free(msg);
7019                 return;
7020         }
7021
7022         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7023                                 nl80211_mlme_mcgrp.id, gfp);
7024         return;
7025
7026  nla_put_failure:
7027         genlmsg_cancel(msg, hdr);
7028         nlmsg_free(msg);
7029 }
7030
7031 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7032                       struct net_device *netdev, u32 nlpid,
7033                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7034 {
7035         struct sk_buff *msg;
7036         void *hdr;
7037         int err;
7038
7039         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7040         if (!msg)
7041                 return -ENOMEM;
7042
7043         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7044         if (!hdr) {
7045                 nlmsg_free(msg);
7046                 return -ENOMEM;
7047         }
7048
7049         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7050         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7051         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7052         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7053
7054         err = genlmsg_end(msg, hdr);
7055         if (err < 0) {
7056                 nlmsg_free(msg);
7057                 return err;
7058         }
7059
7060         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7061         if (err < 0)
7062                 return err;
7063         return 0;
7064
7065  nla_put_failure:
7066         genlmsg_cancel(msg, hdr);
7067         nlmsg_free(msg);
7068         return -ENOBUFS;
7069 }
7070
7071 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7072                                  struct net_device *netdev, u64 cookie,
7073                                  const u8 *buf, size_t len, bool ack,
7074                                  gfp_t gfp)
7075 {
7076         struct sk_buff *msg;
7077         void *hdr;
7078
7079         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7080         if (!msg)
7081                 return;
7082
7083         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7084         if (!hdr) {
7085                 nlmsg_free(msg);
7086                 return;
7087         }
7088
7089         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7090         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7091         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7092         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7093         if (ack)
7094                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7095
7096         if (genlmsg_end(msg, hdr) < 0) {
7097                 nlmsg_free(msg);
7098                 return;
7099         }
7100
7101         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7102         return;
7103
7104  nla_put_failure:
7105         genlmsg_cancel(msg, hdr);
7106         nlmsg_free(msg);
7107 }
7108
7109 void
7110 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7111                              struct net_device *netdev,
7112                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7113                              gfp_t gfp)
7114 {
7115         struct sk_buff *msg;
7116         struct nlattr *pinfoattr;
7117         void *hdr;
7118
7119         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7120         if (!msg)
7121                 return;
7122
7123         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7124         if (!hdr) {
7125                 nlmsg_free(msg);
7126                 return;
7127         }
7128
7129         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7130         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7131
7132         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7133         if (!pinfoattr)
7134                 goto nla_put_failure;
7135
7136         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7137                     rssi_event);
7138
7139         nla_nest_end(msg, pinfoattr);
7140
7141         if (genlmsg_end(msg, hdr) < 0) {
7142                 nlmsg_free(msg);
7143                 return;
7144         }
7145
7146         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7147                                 nl80211_mlme_mcgrp.id, gfp);
7148         return;
7149
7150  nla_put_failure:
7151         genlmsg_cancel(msg, hdr);
7152         nlmsg_free(msg);
7153 }
7154
7155 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7156                               struct net_device *netdev, const u8 *bssid,
7157                               const u8 *replay_ctr, gfp_t gfp)
7158 {
7159         struct sk_buff *msg;
7160         struct nlattr *rekey_attr;
7161         void *hdr;
7162
7163         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7164         if (!msg)
7165                 return;
7166
7167         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7168         if (!hdr) {
7169                 nlmsg_free(msg);
7170                 return;
7171         }
7172
7173         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7174         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7175         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7176
7177         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7178         if (!rekey_attr)
7179                 goto nla_put_failure;
7180
7181         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7182                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7183
7184         nla_nest_end(msg, rekey_attr);
7185
7186         if (genlmsg_end(msg, hdr) < 0) {
7187                 nlmsg_free(msg);
7188                 return;
7189         }
7190
7191         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7192                                 nl80211_mlme_mcgrp.id, gfp);
7193         return;
7194
7195  nla_put_failure:
7196         genlmsg_cancel(msg, hdr);
7197         nlmsg_free(msg);
7198 }
7199
7200 void
7201 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7202                                 struct net_device *netdev, const u8 *peer,
7203                                 u32 num_packets, gfp_t gfp)
7204 {
7205         struct sk_buff *msg;
7206         struct nlattr *pinfoattr;
7207         void *hdr;
7208
7209         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7210         if (!msg)
7211                 return;
7212
7213         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7214         if (!hdr) {
7215                 nlmsg_free(msg);
7216                 return;
7217         }
7218
7219         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7220         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7221         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7222
7223         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7224         if (!pinfoattr)
7225                 goto nla_put_failure;
7226
7227         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7228
7229         nla_nest_end(msg, pinfoattr);
7230
7231         if (genlmsg_end(msg, hdr) < 0) {
7232                 nlmsg_free(msg);
7233                 return;
7234         }
7235
7236         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7237                                 nl80211_mlme_mcgrp.id, gfp);
7238         return;
7239
7240  nla_put_failure:
7241         genlmsg_cancel(msg, hdr);
7242         nlmsg_free(msg);
7243 }
7244
7245 static int nl80211_netlink_notify(struct notifier_block * nb,
7246                                   unsigned long state,
7247                                   void *_notify)
7248 {
7249         struct netlink_notify *notify = _notify;
7250         struct cfg80211_registered_device *rdev;
7251         struct wireless_dev *wdev;
7252
7253         if (state != NETLINK_URELEASE)
7254                 return NOTIFY_DONE;
7255
7256         rcu_read_lock();
7257
7258         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7259                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7260                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7261
7262         rcu_read_unlock();
7263
7264         return NOTIFY_DONE;
7265 }
7266
7267 static struct notifier_block nl80211_netlink_notifier = {
7268         .notifier_call = nl80211_netlink_notify,
7269 };
7270
7271 /* initialisation/exit functions */
7272
7273 int nl80211_init(void)
7274 {
7275         int err;
7276
7277         err = genl_register_family_with_ops(&nl80211_fam,
7278                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7279         if (err)
7280                 return err;
7281
7282         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7283         if (err)
7284                 goto err_out;
7285
7286         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7287         if (err)
7288                 goto err_out;
7289
7290         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7291         if (err)
7292                 goto err_out;
7293
7294         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7295         if (err)
7296                 goto err_out;
7297
7298 #ifdef CONFIG_NL80211_TESTMODE
7299         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7300         if (err)
7301                 goto err_out;
7302 #endif
7303
7304         err = netlink_register_notifier(&nl80211_netlink_notifier);
7305         if (err)
7306                 goto err_out;
7307
7308         return 0;
7309  err_out:
7310         genl_unregister_family(&nl80211_fam);
7311         return err;
7312 }
7313
7314 void nl80211_exit(void)
7315 {
7316         netlink_unregister_notifier(&nl80211_netlink_notifier);
7317         genl_unregister_family(&nl80211_fam);
7318 }