net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  27                             struct genl_info *info);
  28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  29                               struct genl_info *info);
  30
  31 /* the netlink family */
  32 static struct genl_family nl80211_fam = {
  33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  34         .name = "nl80211",      /* have users key off the name instead */
  35         .hdrsize = 0,           /* no private header */
  36         .version = 1,           /* no particular meaning now */
  37         .maxattr = NL80211_ATTR_MAX,
  38         .netnsok = true,
  39         .pre_doit = nl80211_pre_doit,
  40         .post_doit = nl80211_post_doit,
  41 };
  42
  43 /* internal helper: get rdev and dev */
  44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  45                                        struct cfg80211_registered_device **rdev,
  46                                        struct net_device **dev)
  47 {
  48         struct nlattr **attrs = info->attrs;
  49         int ifindex;
  50
  51         if (!attrs[NL80211_ATTR_IFINDEX])
  52                 return -EINVAL;
  53
  54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  56         if (!*dev)
  57                 return -ENODEV;
  58
  59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  60         if (IS_ERR(*rdev)) {
  61                 dev_put(*dev);
  62                 return PTR_ERR(*rdev);
  63         }
  64
  65         return 0;
  66 }
  67
  68 /* policy for the attributes */
  69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  72                                       .len = 20-1 },
  73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  81
  82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  85
  86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  88
  89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  91                                     .len = WLAN_MAX_KEY_LEN },
  92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  96         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
  97
  98         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  99         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 100         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 101                                        .len = IEEE80211_MAX_DATA_LEN },
 102         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 103                                        .len = IEEE80211_MAX_DATA_LEN },
 104         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 105         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 106         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 107         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 108                                                .len = NL80211_MAX_SUPP_RATES },
 109         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 110         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 111         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 112         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 113                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 114         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 115
 116         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 117         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 120         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 122         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 123                                            .len = NL80211_MAX_SUPP_RATES },
 124         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 125
 126         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 127         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 128
 129         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 130                                          .len = NL80211_HT_CAPABILITY_LEN },
 131
 132         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 133         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 134                               .len = IEEE80211_MAX_DATA_LEN },
 135         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 136         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 137
 138         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 139                                 .len = IEEE80211_MAX_SSID_LEN },
 140         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 141         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 142         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 143         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 144         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 145         [NL80211_ATTR_STA_FLAGS2] = {
 146                 .len = sizeof(struct nl80211_sta_flag_update),
 147         },
 148         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 150         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 151         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 152         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 153         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 154         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 155         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 156         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 157                                  .len = WLAN_PMKID_LEN },
 158         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 159         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 160         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 161         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 162                                  .len = IEEE80211_MAX_DATA_LEN },
 163         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 164         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 165         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 166         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 167         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 168         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 169         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 170         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 171         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 172         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 173         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 174         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 175         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 176 };
 177
 178 /* policy for the key attributes */
 179 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 180         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 181         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 182         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 183         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 184         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 185         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 186         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 187         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 188 };
 189
 190 /* policy for the key default flags */
 191 static const struct nla_policy
 192 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 193         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 194         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 195 };
 196
 197 /* ifidx get helper */
 198 static int nl80211_get_ifidx(struct netlink_callback *cb)
 199 {
 200         int res;
 201
 202         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 203                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 204                           nl80211_policy);
 205         if (res)
 206                 return res;
 207
 208         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 209                 return -EINVAL;
 210
 211         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 212         if (!res)
 213                 return -EINVAL;
 214         return res;
 215 }
 216
 217 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 218                                        struct netlink_callback *cb,
 219                                        struct cfg80211_registered_device **rdev,
 220                                        struct net_device **dev)
 221 {
 222         int ifidx = cb->args[0];
 223         int err;
 224
 225         if (!ifidx)
 226                 ifidx = nl80211_get_ifidx(cb);
 227         if (ifidx < 0)
 228                 return ifidx;
 229
 230         cb->args[0] = ifidx;
 231
 232         rtnl_lock();
 233
 234         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 235         if (!*dev) {
 236                 err = -ENODEV;
 237                 goto out_rtnl;
 238         }
 239
 240         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 241         if (IS_ERR(*rdev)) {
 242                 err = PTR_ERR(*rdev);
 243                 goto out_rtnl;
 244         }
 245
 246         return 0;
 247  out_rtnl:
 248         rtnl_unlock();
 249         return err;
 250 }
 251
 252 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 253 {
 254         cfg80211_unlock_rdev(rdev);
 255         rtnl_unlock();
 256 }
 257
 258 /* IE validation */
 259 static bool is_valid_ie_attr(const struct nlattr *attr)
 260 {
 261         const u8 *pos;
 262         int len;
 263
 264         if (!attr)
 265                 return true;
 266
 267         pos = nla_data(attr);
 268         len = nla_len(attr);
 269
 270         while (len) {
 271                 u8 elemlen;
 272
 273                 if (len < 2)
 274                         return false;
 275                 len -= 2;
 276
 277                 elemlen = pos[1];
 278                 if (elemlen > len)
 279                         return false;
 280
 281                 len -= elemlen;
 282                 pos += 2 + elemlen;
 283         }
 284
 285         return true;
 286 }
 287
 288 /* message building helper */
 289 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 290                                    int flags, u8 cmd)
 291 {
 292         /* since there is no private header just add the generic one */
 293         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 294 }
 295
 296 static int nl80211_msg_put_channel(struct sk_buff *msg,
 297                                    struct ieee80211_channel *chan)
 298 {
 299         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 300                     chan->center_freq);
 301
 302         if (chan->flags & IEEE80211_CHAN_DISABLED)
 303                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 304         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 305                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 306         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 307                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 308         if (chan->flags & IEEE80211_CHAN_RADAR)
 309                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 310
 311         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 312                     DBM_TO_MBM(chan->max_power));
 313
 314         return 0;
 315
 316  nla_put_failure:
 317         return -ENOBUFS;
 318 }
 319
 320 /* netlink command implementations */
 321
 322 struct key_parse {
 323         struct key_params p;
 324         int idx;
 325         int type;
 326         bool def, defmgmt;
 327         bool def_uni, def_multi;
 328 };
 329
 330 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 331 {
 332         struct nlattr *tb[NL80211_KEY_MAX + 1];
 333         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 334                                    nl80211_key_policy);
 335         if (err)
 336                 return err;
 337
 338         k->def = !!tb[NL80211_KEY_DEFAULT];
 339         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 340
 341         if (k->def) {
 342                 k->def_uni = true;
 343                 k->def_multi = true;
 344         }
 345         if (k->defmgmt)
 346                 k->def_multi = true;
 347
 348         if (tb[NL80211_KEY_IDX])
 349                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 350
 351         if (tb[NL80211_KEY_DATA]) {
 352                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 353                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 354         }
 355
 356         if (tb[NL80211_KEY_SEQ]) {
 357                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 358                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 359         }
 360
 361         if (tb[NL80211_KEY_CIPHER])
 362                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 363
 364         if (tb[NL80211_KEY_TYPE]) {
 365                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 366                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 367                         return -EINVAL;
 368         }
 369
 370         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 371                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 372                 int err = nla_parse_nested(kdt,
 373                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 374                                            tb[NL80211_KEY_DEFAULT_TYPES],
 375                                            nl80211_key_default_policy);
 376                 if (err)
 377                         return err;
 378
 379                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 380                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 381         }
 382
 383         return 0;
 384 }
 385
 386 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 387 {
 388         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 389                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 390                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 391         }
 392
 393         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 394                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 395                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 396         }
 397
 398         if (info->attrs[NL80211_ATTR_KEY_IDX])
 399                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 400
 401         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 402                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 403
 404         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 405         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 406
 407         if (k->def) {
 408                 k->def_uni = true;
 409                 k->def_multi = true;
 410         }
 411         if (k->defmgmt)
 412                 k->def_multi = true;
 413
 414         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 415                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 416                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 417                         return -EINVAL;
 418         }
 419
 420         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 421                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 422                 int err = nla_parse_nested(
 423                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 424                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 425                                 nl80211_key_default_policy);
 426                 if (err)
 427                         return err;
 428
 429                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 430                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 431         }
 432
 433         return 0;
 434 }
 435
 436 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 437 {
 438         int err;
 439
 440         memset(k, 0, sizeof(*k));
 441         k->idx = -1;
 442         k->type = -1;
 443
 444         if (info->attrs[NL80211_ATTR_KEY])
 445                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 446         else
 447                 err = nl80211_parse_key_old(info, k);
 448
 449         if (err)
 450                 return err;
 451
 452         if (k->def && k->defmgmt)
 453                 return -EINVAL;
 454
 455         if (k->defmgmt) {
 456                 if (k->def_uni || !k->def_multi)
 457                         return -EINVAL;
 458         }
 459
 460         if (k->idx != -1) {
 461                 if (k->defmgmt) {
 462                         if (k->idx < 4 || k->idx > 5)
 463                                 return -EINVAL;
 464                 } else if (k->def) {
 465                         if (k->idx < 0 || k->idx > 3)
 466                                 return -EINVAL;
 467                 } else {
 468                         if (k->idx < 0 || k->idx > 5)
 469                                 return -EINVAL;
 470                 }
 471         }
 472
 473         return 0;
 474 }
 475
 476 static struct cfg80211_cached_keys *
 477 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 478                        struct nlattr *keys)
 479 {
 480         struct key_parse parse;
 481         struct nlattr *key;
 482         struct cfg80211_cached_keys *result;
 483         int rem, err, def = 0;
 484
 485         result = kzalloc(sizeof(*result), GFP_KERNEL);
 486         if (!result)
 487                 return ERR_PTR(-ENOMEM);
 488
 489         result->def = -1;
 490         result->defmgmt = -1;
 491
 492         nla_for_each_nested(key, keys, rem) {
 493                 memset(&parse, 0, sizeof(parse));
 494                 parse.idx = -1;
 495
 496                 err = nl80211_parse_key_new(key, &parse);
 497                 if (err)
 498                         goto error;
 499                 err = -EINVAL;
 500                 if (!parse.p.key)
 501                         goto error;
 502                 if (parse.idx < 0 || parse.idx > 4)
 503                         goto error;
 504                 if (parse.def) {
 505                         if (def)
 506                                 goto error;
 507                         def = 1;
 508                         result->def = parse.idx;
 509                         if (!parse.def_uni || !parse.def_multi)
 510                                 goto error;
 511                 } else if (parse.defmgmt)
 512                         goto error;
 513                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 514                                                      parse.idx, false, NULL);
 515                 if (err)
 516                         goto error;
 517                 result->params[parse.idx].cipher = parse.p.cipher;
 518                 result->params[parse.idx].key_len = parse.p.key_len;
 519                 result->params[parse.idx].key = result->data[parse.idx];
 520                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 521         }
 522
 523         return result;
 524  error:
 525         kfree(result);
 526         return ERR_PTR(err);
 527 }
 528
 529 static int nl80211_key_allowed(struct wireless_dev *wdev)
 530 {
 531         ASSERT_WDEV_LOCK(wdev);
 532
 533         switch (wdev->iftype) {
 534         case NL80211_IFTYPE_AP:
 535         case NL80211_IFTYPE_AP_VLAN:
 536         case NL80211_IFTYPE_P2P_GO:
 537                 break;
 538         case NL80211_IFTYPE_ADHOC:
 539                 if (!wdev->current_bss)
 540                         return -ENOLINK;
 541                 break;
 542         case NL80211_IFTYPE_STATION:
 543         case NL80211_IFTYPE_P2P_CLIENT:
 544                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 545                         return -ENOLINK;
 546                 break;
 547         default:
 548                 return -EINVAL;
 549         }
 550
 551         return 0;
 552 }
 553
 554 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 555                               struct cfg80211_registered_device *dev)
 556 {
 557         void *hdr;
 558         struct nlattr *nl_bands, *nl_band;
 559         struct nlattr *nl_freqs, *nl_freq;
 560         struct nlattr *nl_rates, *nl_rate;
 561         struct nlattr *nl_modes;
 562         struct nlattr *nl_cmds;
 563         enum ieee80211_band band;
 564         struct ieee80211_channel *chan;
 565         struct ieee80211_rate *rate;
 566         int i;
 567         u16 ifmodes = dev->wiphy.interface_modes;
 568         const struct ieee80211_txrx_stypes *mgmt_stypes =
 569                                 dev->wiphy.mgmt_stypes;
 570
 571         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 572         if (!hdr)
 573                 return -1;
 574
 575         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 576         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 577
 578         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 579                     cfg80211_rdev_list_generation);
 580
 581         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 582                    dev->wiphy.retry_short);
 583         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 584                    dev->wiphy.retry_long);
 585         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 586                     dev->wiphy.frag_threshold);
 587         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 588                     dev->wiphy.rts_threshold);
 589         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 590                     dev->wiphy.coverage_class);
 591         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 592                    dev->wiphy.max_scan_ssids);
 593         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 594                     dev->wiphy.max_scan_ie_len);
 595
 596         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 597                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 598         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 599                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 600
 601         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 602                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 603                 dev->wiphy.cipher_suites);
 604
 605         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 606                    dev->wiphy.max_num_pmkids);
 607
 608         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 609                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 610
 611         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 612                     dev->wiphy.available_antennas_tx);
 613         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 614                     dev->wiphy.available_antennas_rx);
 615
 616         if ((dev->wiphy.available_antennas_tx ||
 617              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 618                 u32 tx_ant = 0, rx_ant = 0;
 619                 int res;
 620                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 621                 if (!res) {
 622                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 623                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 624                 }
 625         }
 626
 627         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 628         if (!nl_modes)
 629                 goto nla_put_failure;
 630
 631         i = 0;
 632         while (ifmodes) {
 633                 if (ifmodes & 1)
 634                         NLA_PUT_FLAG(msg, i);
 635                 ifmodes >>= 1;
 636                 i++;
 637         }
 638
 639         nla_nest_end(msg, nl_modes);
 640
 641         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 642         if (!nl_bands)
 643                 goto nla_put_failure;
 644
 645         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 646                 if (!dev->wiphy.bands[band])
 647                         continue;
 648
 649                 nl_band = nla_nest_start(msg, band);
 650                 if (!nl_band)
 651                         goto nla_put_failure;
 652
 653                 /* add HT info */
 654                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 655                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 656                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 657                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 658                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 659                                 dev->wiphy.bands[band]->ht_cap.cap);
 660                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 661                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 662                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 663                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 664                 }
 665
 666                 /* add frequencies */
 667                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 668                 if (!nl_freqs)
 669                         goto nla_put_failure;
 670
 671                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 672                         nl_freq = nla_nest_start(msg, i);
 673                         if (!nl_freq)
 674                                 goto nla_put_failure;
 675
 676                         chan = &dev->wiphy.bands[band]->channels[i];
 677
 678                         if (nl80211_msg_put_channel(msg, chan))
 679                                 goto nla_put_failure;
 680
 681                         nla_nest_end(msg, nl_freq);
 682                 }
 683
 684                 nla_nest_end(msg, nl_freqs);
 685
 686                 /* add bitrates */
 687                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 688                 if (!nl_rates)
 689                         goto nla_put_failure;
 690
 691                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 692                         nl_rate = nla_nest_start(msg, i);
 693                         if (!nl_rate)
 694                                 goto nla_put_failure;
 695
 696                         rate = &dev->wiphy.bands[band]->bitrates[i];
 697                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 698                                     rate->bitrate);
 699                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 700                                 NLA_PUT_FLAG(msg,
 701                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 702
 703                         nla_nest_end(msg, nl_rate);
 704                 }
 705
 706                 nla_nest_end(msg, nl_rates);
 707
 708                 nla_nest_end(msg, nl_band);
 709         }
 710         nla_nest_end(msg, nl_bands);
 711
 712         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 713         if (!nl_cmds)
 714                 goto nla_put_failure;
 715
 716         i = 0;
 717 #define CMD(op, n)                                              \
 718          do {                                                   \
 719                 if (dev->ops->op) {                             \
 720                         i++;                                    \
 721                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 722                 }                                               \
 723         } while (0)
 724
 725         CMD(add_virtual_intf, NEW_INTERFACE);
 726         CMD(change_virtual_intf, SET_INTERFACE);
 727         CMD(add_key, NEW_KEY);
 728         CMD(add_beacon, NEW_BEACON);
 729         CMD(add_station, NEW_STATION);
 730         CMD(add_mpath, NEW_MPATH);
 731         CMD(update_mesh_config, SET_MESH_CONFIG);
 732         CMD(change_bss, SET_BSS);
 733         CMD(auth, AUTHENTICATE);
 734         CMD(assoc, ASSOCIATE);
 735         CMD(deauth, DEAUTHENTICATE);
 736         CMD(disassoc, DISASSOCIATE);
 737         CMD(join_ibss, JOIN_IBSS);
 738         CMD(join_mesh, JOIN_MESH);
 739         CMD(set_pmksa, SET_PMKSA);
 740         CMD(del_pmksa, DEL_PMKSA);
 741         CMD(flush_pmksa, FLUSH_PMKSA);
 742         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 743         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 744         CMD(mgmt_tx, FRAME);
 745         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 746         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 747                 i++;
 748                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 749         }
 750         CMD(set_channel, SET_CHANNEL);
 751         CMD(set_wds_peer, SET_WDS_PEER);
 752
 753 #undef CMD
 754
 755         if (dev->ops->connect || dev->ops->auth) {
 756                 i++;
 757                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 758         }
 759
 760         if (dev->ops->disconnect || dev->ops->deauth) {
 761                 i++;
 762                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 763         }
 764
 765         nla_nest_end(msg, nl_cmds);
 766
 767         if (dev->ops->remain_on_channel)
 768                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 769                             dev->wiphy.max_remain_on_channel_duration);
 770
 771         /* for now at least assume all drivers have it */
 772         if (dev->ops->mgmt_tx)
 773                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 774
 775         if (mgmt_stypes) {
 776                 u16 stypes;
 777                 struct nlattr *nl_ftypes, *nl_ifs;
 778                 enum nl80211_iftype ift;
 779
 780                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 781                 if (!nl_ifs)
 782                         goto nla_put_failure;
 783
 784                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 785                         nl_ftypes = nla_nest_start(msg, ift);
 786                         if (!nl_ftypes)
 787                                 goto nla_put_failure;
 788                         i = 0;
 789                         stypes = mgmt_stypes[ift].tx;
 790                         while (stypes) {
 791                                 if (stypes & 1)
 792                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 793                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 794                                 stypes >>= 1;
 795                                 i++;
 796                         }
 797                         nla_nest_end(msg, nl_ftypes);
 798                 }
 799
 800                 nla_nest_end(msg, nl_ifs);
 801
 802                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 803                 if (!nl_ifs)
 804                         goto nla_put_failure;
 805
 806                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 807                         nl_ftypes = nla_nest_start(msg, ift);
 808                         if (!nl_ftypes)
 809                                 goto nla_put_failure;
 810                         i = 0;
 811                         stypes = mgmt_stypes[ift].rx;
 812                         while (stypes) {
 813                                 if (stypes & 1)
 814                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 815                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 816                                 stypes >>= 1;
 817                                 i++;
 818                         }
 819                         nla_nest_end(msg, nl_ftypes);
 820                 }
 821                 nla_nest_end(msg, nl_ifs);
 822         }
 823
 824         return genlmsg_end(msg, hdr);
 825
 826  nla_put_failure:
 827         genlmsg_cancel(msg, hdr);
 828         return -EMSGSIZE;
 829 }
 830
 831 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 832 {
 833         int idx = 0;
 834         int start = cb->args[0];
 835         struct cfg80211_registered_device *dev;
 836
 837         mutex_lock(&cfg80211_mutex);
 838         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 839                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 840                         continue;
 841                 if (++idx <= start)
 842                         continue;
 843                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 844                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 845                                        dev) < 0) {
 846                         idx--;
 847                         break;
 848                 }
 849         }
 850         mutex_unlock(&cfg80211_mutex);
 851
 852         cb->args[0] = idx;
 853
 854         return skb->len;
 855 }
 856
 857 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 858 {
 859         struct sk_buff *msg;
 860         struct cfg80211_registered_device *dev = info->user_ptr[0];
 861
 862         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 863         if (!msg)
 864                 return -ENOMEM;
 865
 866         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
 867                 nlmsg_free(msg);
 868                 return -ENOBUFS;
 869         }
 870
 871         return genlmsg_reply(msg, info);
 872 }
 873
 874 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 875         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 876         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 877         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 878         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 879         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 880 };
 881
 882 static int parse_txq_params(struct nlattr *tb[],
 883                             struct ieee80211_txq_params *txq_params)
 884 {
 885         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 886             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 887             !tb[NL80211_TXQ_ATTR_AIFS])
 888                 return -EINVAL;
 889
 890         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 891         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 892         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 893         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 894         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 895
 896         return 0;
 897 }
 898
 899 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 900 {
 901         /*
 902          * You can only set the channel explicitly for AP, mesh
 903          * and WDS type interfaces; all others have their channel
 904          * managed via their respective "establish a connection"
 905          * command (connect, join, ...)
 906          *
 907          * Monitors are special as they are normally slaved to
 908          * whatever else is going on, so they behave as though
 909          * you tried setting the wiphy channel itself.
 910          */
 911         return !wdev ||
 912                 wdev->iftype == NL80211_IFTYPE_AP ||
 913                 wdev->iftype == NL80211_IFTYPE_WDS ||
 914                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 915                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
 916                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
 917 }
 918
 919 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 920                                  struct wireless_dev *wdev,
 921                                  struct genl_info *info)
 922 {
 923         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 924         u32 freq;
 925         int result;
 926
 927         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
 928                 return -EINVAL;
 929
 930         if (!nl80211_can_set_dev_channel(wdev))
 931                 return -EOPNOTSUPP;
 932
 933         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 934                 channel_type = nla_get_u32(info->attrs[
 935                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 936                 if (channel_type != NL80211_CHAN_NO_HT &&
 937                     channel_type != NL80211_CHAN_HT20 &&
 938                     channel_type != NL80211_CHAN_HT40PLUS &&
 939                     channel_type != NL80211_CHAN_HT40MINUS)
 940                         return -EINVAL;
 941         }
 942
 943         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 944
 945         mutex_lock(&rdev->devlist_mtx);
 946         if (wdev) {
 947                 wdev_lock(wdev);
 948                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
 949                 wdev_unlock(wdev);
 950         } else {
 951                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
 952         }
 953         mutex_unlock(&rdev->devlist_mtx);
 954
 955         return result;
 956 }
 957
 958 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 959 {
 960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 961         struct net_device *netdev = info->user_ptr[1];
 962
 963         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 964 }
 965
 966 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
 967 {
 968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 969         struct net_device *dev = info->user_ptr[1];
 970         struct wireless_dev *wdev = dev->ieee80211_ptr;
 971         const u8 *bssid;
 972
 973         if (!info->attrs[NL80211_ATTR_MAC])
 974                 return -EINVAL;
 975
 976         if (netif_running(dev))
 977                 return -EBUSY;
 978
 979         if (!rdev->ops->set_wds_peer)
 980                 return -EOPNOTSUPP;
 981
 982         if (wdev->iftype != NL80211_IFTYPE_WDS)
 983                 return -EOPNOTSUPP;
 984
 985         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 986         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
 987 }
 988
 989
 990 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 991 {
 992         struct cfg80211_registered_device *rdev;
 993         struct net_device *netdev = NULL;
 994         struct wireless_dev *wdev;
 995         int result = 0, rem_txq_params = 0;
 996         struct nlattr *nl_txq_params;
 997         u32 changed;
 998         u8 retry_short = 0, retry_long = 0;
 999         u32 frag_threshold = 0, rts_threshold = 0;
1000         u8 coverage_class = 0;
1001
1002         /*
1003          * Try to find the wiphy and netdev. Normally this
1004          * function shouldn't need the netdev, but this is
1005          * done for backward compatibility -- previously
1006          * setting the channel was done per wiphy, but now
1007          * it is per netdev. Previous userland like hostapd
1008          * also passed a netdev to set_wiphy, so that it is
1009          * possible to let that go to the right netdev!
1010          */
1011         mutex_lock(&cfg80211_mutex);
1012
1013         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1014                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1015
1016                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1017                 if (netdev && netdev->ieee80211_ptr) {
1018                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1019                         mutex_lock(&rdev->mtx);
1020                 } else
1021                         netdev = NULL;
1022         }
1023
1024         if (!netdev) {
1025                 rdev = __cfg80211_rdev_from_info(info);
1026                 if (IS_ERR(rdev)) {
1027                         mutex_unlock(&cfg80211_mutex);
1028                         return PTR_ERR(rdev);
1029                 }
1030                 wdev = NULL;
1031                 netdev = NULL;
1032                 result = 0;
1033
1034                 mutex_lock(&rdev->mtx);
1035         } else if (netif_running(netdev) &&
1036                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1037                 wdev = netdev->ieee80211_ptr;
1038         else
1039                 wdev = NULL;
1040
1041         /*
1042          * end workaround code, by now the rdev is available
1043          * and locked, and wdev may or may not be NULL.
1044          */
1045
1046         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1047                 result = cfg80211_dev_rename(
1048                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1049
1050         mutex_unlock(&cfg80211_mutex);
1051
1052         if (result)
1053                 goto bad_res;
1054
1055         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1056                 struct ieee80211_txq_params txq_params;
1057                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1058
1059                 if (!rdev->ops->set_txq_params) {
1060                         result = -EOPNOTSUPP;
1061                         goto bad_res;
1062                 }
1063
1064                 nla_for_each_nested(nl_txq_params,
1065                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1066                                     rem_txq_params) {
1067                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1068                                   nla_data(nl_txq_params),
1069                                   nla_len(nl_txq_params),
1070                                   txq_params_policy);
1071                         result = parse_txq_params(tb, &txq_params);
1072                         if (result)
1073                                 goto bad_res;
1074
1075                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1076                                                            &txq_params);
1077                         if (result)
1078                                 goto bad_res;
1079                 }
1080         }
1081
1082         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1083                 result = __nl80211_set_channel(rdev, wdev, info);
1084                 if (result)
1085                         goto bad_res;
1086         }
1087
1088         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1089                 enum nl80211_tx_power_setting type;
1090                 int idx, mbm = 0;
1091
1092                 if (!rdev->ops->set_tx_power) {
1093                         result = -EOPNOTSUPP;
1094                         goto bad_res;
1095                 }
1096
1097                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1098                 type = nla_get_u32(info->attrs[idx]);
1099
1100                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1101                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1102                         result = -EINVAL;
1103                         goto bad_res;
1104                 }
1105
1106                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1107                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1108                         mbm = nla_get_u32(info->attrs[idx]);
1109                 }
1110
1111                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1112                 if (result)
1113                         goto bad_res;
1114         }
1115
1116         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1117             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1118                 u32 tx_ant, rx_ant;
1119                 if ((!rdev->wiphy.available_antennas_tx &&
1120                      !rdev->wiphy.available_antennas_rx) ||
1121                     !rdev->ops->set_antenna) {
1122                         result = -EOPNOTSUPP;
1123                         goto bad_res;
1124                 }
1125
1126                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1127                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1128
1129                 /* reject antenna configurations which don't match the
1130                  * available antenna masks, except for the "all" mask */
1131                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1132                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1133                         result = -EINVAL;
1134                         goto bad_res;
1135                 }
1136
1137                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1138                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1139
1140                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1141                 if (result)
1142                         goto bad_res;
1143         }
1144
1145         changed = 0;
1146
1147         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1148                 retry_short = nla_get_u8(
1149                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1150                 if (retry_short == 0) {
1151                         result = -EINVAL;
1152                         goto bad_res;
1153                 }
1154                 changed |= WIPHY_PARAM_RETRY_SHORT;
1155         }
1156
1157         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1158                 retry_long = nla_get_u8(
1159                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1160                 if (retry_long == 0) {
1161                         result = -EINVAL;
1162                         goto bad_res;
1163                 }
1164                 changed |= WIPHY_PARAM_RETRY_LONG;
1165         }
1166
1167         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1168                 frag_threshold = nla_get_u32(
1169                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1170                 if (frag_threshold < 256) {
1171                         result = -EINVAL;
1172                         goto bad_res;
1173                 }
1174                 if (frag_threshold != (u32) -1) {
1175                         /*
1176                          * Fragments (apart from the last one) are required to
1177                          * have even length. Make the fragmentation code
1178                          * simpler by stripping LSB should someone try to use
1179                          * odd threshold value.
1180                          */
1181                         frag_threshold &= ~0x1;
1182                 }
1183                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1184         }
1185
1186         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1187                 rts_threshold = nla_get_u32(
1188                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1189                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1190         }
1191
1192         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1193                 coverage_class = nla_get_u8(
1194                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1195                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1196         }
1197
1198         if (changed) {
1199                 u8 old_retry_short, old_retry_long;
1200                 u32 old_frag_threshold, old_rts_threshold;
1201                 u8 old_coverage_class;
1202
1203                 if (!rdev->ops->set_wiphy_params) {
1204                         result = -EOPNOTSUPP;
1205                         goto bad_res;
1206                 }
1207
1208                 old_retry_short = rdev->wiphy.retry_short;
1209                 old_retry_long = rdev->wiphy.retry_long;
1210                 old_frag_threshold = rdev->wiphy.frag_threshold;
1211                 old_rts_threshold = rdev->wiphy.rts_threshold;
1212                 old_coverage_class = rdev->wiphy.coverage_class;
1213
1214                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1215                         rdev->wiphy.retry_short = retry_short;
1216                 if (changed & WIPHY_PARAM_RETRY_LONG)
1217                         rdev->wiphy.retry_long = retry_long;
1218                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1219                         rdev->wiphy.frag_threshold = frag_threshold;
1220                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1221                         rdev->wiphy.rts_threshold = rts_threshold;
1222                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1223                         rdev->wiphy.coverage_class = coverage_class;
1224
1225                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1226                 if (result) {
1227                         rdev->wiphy.retry_short = old_retry_short;
1228                         rdev->wiphy.retry_long = old_retry_long;
1229                         rdev->wiphy.frag_threshold = old_frag_threshold;
1230                         rdev->wiphy.rts_threshold = old_rts_threshold;
1231                         rdev->wiphy.coverage_class = old_coverage_class;
1232                 }
1233         }
1234
1235  bad_res:
1236         mutex_unlock(&rdev->mtx);
1237         if (netdev)
1238                 dev_put(netdev);
1239         return result;
1240 }
1241
1242
1243 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1244                               struct cfg80211_registered_device *rdev,
1245                               struct net_device *dev)
1246 {
1247         void *hdr;
1248
1249         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1250         if (!hdr)
1251                 return -1;
1252
1253         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1254         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1255         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1256         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1257
1258         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1259                     rdev->devlist_generation ^
1260                         (cfg80211_rdev_list_generation << 2));
1261
1262         return genlmsg_end(msg, hdr);
1263
1264  nla_put_failure:
1265         genlmsg_cancel(msg, hdr);
1266         return -EMSGSIZE;
1267 }
1268
1269 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1270 {
1271         int wp_idx = 0;
1272         int if_idx = 0;
1273         int wp_start = cb->args[0];
1274         int if_start = cb->args[1];
1275         struct cfg80211_registered_device *rdev;
1276         struct wireless_dev *wdev;
1277
1278         mutex_lock(&cfg80211_mutex);
1279         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1280                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1281                         continue;
1282                 if (wp_idx < wp_start) {
1283                         wp_idx++;
1284                         continue;
1285                 }
1286                 if_idx = 0;
1287
1288                 mutex_lock(&rdev->devlist_mtx);
1289                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1290                         if (if_idx < if_start) {
1291                                 if_idx++;
1292                                 continue;
1293                         }
1294                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1295                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1296                                                rdev, wdev->netdev) < 0) {
1297                                 mutex_unlock(&rdev->devlist_mtx);
1298                                 goto out;
1299                         }
1300                         if_idx++;
1301                 }
1302                 mutex_unlock(&rdev->devlist_mtx);
1303
1304                 wp_idx++;
1305         }
1306  out:
1307         mutex_unlock(&cfg80211_mutex);
1308
1309         cb->args[0] = wp_idx;
1310         cb->args[1] = if_idx;
1311
1312         return skb->len;
1313 }
1314
1315 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1316 {
1317         struct sk_buff *msg;
1318         struct cfg80211_registered_device *dev = info->user_ptr[0];
1319         struct net_device *netdev = info->user_ptr[1];
1320
1321         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1322         if (!msg)
1323                 return -ENOMEM;
1324
1325         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1326                                dev, netdev) < 0) {
1327                 nlmsg_free(msg);
1328                 return -ENOBUFS;
1329         }
1330
1331         return genlmsg_reply(msg, info);
1332 }
1333
1334 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1335         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1336         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1337         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1338         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1339         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1340 };
1341
1342 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1343 {
1344         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1345         int flag;
1346
1347         *mntrflags = 0;
1348
1349         if (!nla)
1350                 return -EINVAL;
1351
1352         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1353                              nla, mntr_flags_policy))
1354                 return -EINVAL;
1355
1356         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1357                 if (flags[flag])
1358                         *mntrflags |= (1<<flag);
1359
1360         return 0;
1361 }
1362
1363 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1364                                struct net_device *netdev, u8 use_4addr,
1365                                enum nl80211_iftype iftype)
1366 {
1367         if (!use_4addr) {
1368                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1369                         return -EBUSY;
1370                 return 0;
1371         }
1372
1373         switch (iftype) {
1374         case NL80211_IFTYPE_AP_VLAN:
1375                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1376                         return 0;
1377                 break;
1378         case NL80211_IFTYPE_STATION:
1379                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1380                         return 0;
1381                 break;
1382         default:
1383                 break;
1384         }
1385
1386         return -EOPNOTSUPP;
1387 }
1388
1389 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1390 {
1391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1392         struct vif_params params;
1393         int err;
1394         enum nl80211_iftype otype, ntype;
1395         struct net_device *dev = info->user_ptr[1];
1396         u32 _flags, *flags = NULL;
1397         bool change = false;
1398
1399         memset(&params, 0, sizeof(params));
1400
1401         otype = ntype = dev->ieee80211_ptr->iftype;
1402
1403         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1404                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1405                 if (otype != ntype)
1406                         change = true;
1407                 if (ntype > NL80211_IFTYPE_MAX)
1408                         return -EINVAL;
1409         }
1410
1411         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1412                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1413
1414                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1415                         return -EINVAL;
1416                 if (netif_running(dev))
1417                         return -EBUSY;
1418
1419                 wdev_lock(wdev);
1420                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1421                              IEEE80211_MAX_MESH_ID_LEN);
1422                 wdev->mesh_id_up_len =
1423                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1424                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1425                        wdev->mesh_id_up_len);
1426                 wdev_unlock(wdev);
1427         }
1428
1429         if (info->attrs[NL80211_ATTR_4ADDR]) {
1430                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1431                 change = true;
1432                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1433                 if (err)
1434                         return err;
1435         } else {
1436                 params.use_4addr = -1;
1437         }
1438
1439         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1440                 if (ntype != NL80211_IFTYPE_MONITOR)
1441                         return -EINVAL;
1442                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1443                                           &_flags);
1444                 if (err)
1445                         return err;
1446
1447                 flags = &_flags;
1448                 change = true;
1449         }
1450
1451         if (change)
1452                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1453         else
1454                 err = 0;
1455
1456         if (!err && params.use_4addr != -1)
1457                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1458
1459         return err;
1460 }
1461
1462 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1463 {
1464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1465         struct vif_params params;
1466         struct net_device *dev;
1467         int err;
1468         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1469         u32 flags;
1470
1471         memset(&params, 0, sizeof(params));
1472
1473         if (!info->attrs[NL80211_ATTR_IFNAME])
1474                 return -EINVAL;
1475
1476         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1477                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1478                 if (type > NL80211_IFTYPE_MAX)
1479                         return -EINVAL;
1480         }
1481
1482         if (!rdev->ops->add_virtual_intf ||
1483             !(rdev->wiphy.interface_modes & (1 << type)))
1484                 return -EOPNOTSUPP;
1485
1486         if (info->attrs[NL80211_ATTR_4ADDR]) {
1487                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1488                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1489                 if (err)
1490                         return err;
1491         }
1492
1493         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1494                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1495                                   &flags);
1496         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1497                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1498                 type, err ? NULL : &flags, &params);
1499         if (IS_ERR(dev))
1500                 return PTR_ERR(dev);
1501
1502         if (type == NL80211_IFTYPE_MESH_POINT &&
1503             info->attrs[NL80211_ATTR_MESH_ID]) {
1504                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1505
1506                 wdev_lock(wdev);
1507                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1508                              IEEE80211_MAX_MESH_ID_LEN);
1509                 wdev->mesh_id_up_len =
1510                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1511                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1512                        wdev->mesh_id_up_len);
1513                 wdev_unlock(wdev);
1514         }
1515
1516         return 0;
1517 }
1518
1519 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1520 {
1521         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1522         struct net_device *dev = info->user_ptr[1];
1523
1524         if (!rdev->ops->del_virtual_intf)
1525                 return -EOPNOTSUPP;
1526
1527         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1528 }
1529
1530 struct get_key_cookie {
1531         struct sk_buff *msg;
1532         int error;
1533         int idx;
1534 };
1535
1536 static void get_key_callback(void *c, struct key_params *params)
1537 {
1538         struct nlattr *key;
1539         struct get_key_cookie *cookie = c;
1540
1541         if (params->key)
1542                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1543                         params->key_len, params->key);
1544
1545         if (params->seq)
1546                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1547                         params->seq_len, params->seq);
1548
1549         if (params->cipher)
1550                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1551                             params->cipher);
1552
1553         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1554         if (!key)
1555                 goto nla_put_failure;
1556
1557         if (params->key)
1558                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1559                         params->key_len, params->key);
1560
1561         if (params->seq)
1562                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1563                         params->seq_len, params->seq);
1564
1565         if (params->cipher)
1566                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1567                             params->cipher);
1568
1569         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1570
1571         nla_nest_end(cookie->msg, key);
1572
1573         return;
1574  nla_put_failure:
1575         cookie->error = 1;
1576 }
1577
1578 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1579 {
1580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1581         int err;
1582         struct net_device *dev = info->user_ptr[1];
1583         u8 key_idx = 0;
1584         const u8 *mac_addr = NULL;
1585         bool pairwise;
1586         struct get_key_cookie cookie = {
1587                 .error = 0,
1588         };
1589         void *hdr;
1590         struct sk_buff *msg;
1591
1592         if (info->attrs[NL80211_ATTR_KEY_IDX])
1593                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1594
1595         if (key_idx > 5)
1596                 return -EINVAL;
1597
1598         if (info->attrs[NL80211_ATTR_MAC])
1599                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1600
1601         pairwise = !!mac_addr;
1602         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1603                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1604                 if (kt >= NUM_NL80211_KEYTYPES)
1605                         return -EINVAL;
1606                 if (kt != NL80211_KEYTYPE_GROUP &&
1607                     kt != NL80211_KEYTYPE_PAIRWISE)
1608                         return -EINVAL;
1609                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1610         }
1611
1612         if (!rdev->ops->get_key)
1613                 return -EOPNOTSUPP;
1614
1615         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1616         if (!msg)
1617                 return -ENOMEM;
1618
1619         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1620                              NL80211_CMD_NEW_KEY);
1621         if (IS_ERR(hdr))
1622                 return PTR_ERR(hdr);
1623
1624         cookie.msg = msg;
1625         cookie.idx = key_idx;
1626
1627         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1628         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1629         if (mac_addr)
1630                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1631
1632         if (pairwise && mac_addr &&
1633             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1634                 return -ENOENT;
1635
1636         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1637                                  mac_addr, &cookie, get_key_callback);
1638
1639         if (err)
1640                 goto free_msg;
1641
1642         if (cookie.error)
1643                 goto nla_put_failure;
1644
1645         genlmsg_end(msg, hdr);
1646         return genlmsg_reply(msg, info);
1647
1648  nla_put_failure:
1649         err = -ENOBUFS;
1650  free_msg:
1651         nlmsg_free(msg);
1652         return err;
1653 }
1654
1655 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1656 {
1657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1658         struct key_parse key;
1659         int err;
1660         struct net_device *dev = info->user_ptr[1];
1661
1662         err = nl80211_parse_key(info, &key);
1663         if (err)
1664                 return err;
1665
1666         if (key.idx < 0)
1667                 return -EINVAL;
1668
1669         /* only support setting default key */
1670         if (!key.def && !key.defmgmt)
1671                 return -EINVAL;
1672
1673         wdev_lock(dev->ieee80211_ptr);
1674
1675         if (key.def) {
1676                 if (!rdev->ops->set_default_key) {
1677                         err = -EOPNOTSUPP;
1678                         goto out;
1679                 }
1680
1681                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1682                 if (err)
1683                         goto out;
1684
1685                 if (!(rdev->wiphy.flags &
1686                                 WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS)) {
1687                         if (!key.def_uni || !key.def_multi) {
1688                                 err = -EOPNOTSUPP;
1689                                 goto out;
1690                         }
1691                 }
1692
1693                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1694                                                  key.def_uni, key.def_multi);
1695
1696                 if (err)
1697                         goto out;
1698
1699 #ifdef CONFIG_CFG80211_WEXT
1700                 dev->ieee80211_ptr->wext.default_key = key.idx;
1701 #endif
1702         } else {
1703                 if (key.def_uni || !key.def_multi) {
1704                         err = -EINVAL;
1705                         goto out;
1706                 }
1707
1708                 if (!rdev->ops->set_default_mgmt_key) {
1709                         err = -EOPNOTSUPP;
1710                         goto out;
1711                 }
1712
1713                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1714                 if (err)
1715                         goto out;
1716
1717                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1718                                                       dev, key.idx);
1719                 if (err)
1720                         goto out;
1721
1722 #ifdef CONFIG_CFG80211_WEXT
1723                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1724 #endif
1725         }
1726
1727  out:
1728         wdev_unlock(dev->ieee80211_ptr);
1729
1730         return err;
1731 }
1732
1733 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1734 {
1735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1736         int err;
1737         struct net_device *dev = info->user_ptr[1];
1738         struct key_parse key;
1739         const u8 *mac_addr = NULL;
1740
1741         err = nl80211_parse_key(info, &key);
1742         if (err)
1743                 return err;
1744
1745         if (!key.p.key)
1746                 return -EINVAL;
1747
1748         if (info->attrs[NL80211_ATTR_MAC])
1749                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1750
1751         if (key.type == -1) {
1752                 if (mac_addr)
1753                         key.type = NL80211_KEYTYPE_PAIRWISE;
1754                 else
1755                         key.type = NL80211_KEYTYPE_GROUP;
1756         }
1757
1758         /* for now */
1759         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1760             key.type != NL80211_KEYTYPE_GROUP)
1761                 return -EINVAL;
1762
1763         if (!rdev->ops->add_key)
1764                 return -EOPNOTSUPP;
1765
1766         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1767                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1768                                            mac_addr))
1769                 return -EINVAL;
1770
1771         wdev_lock(dev->ieee80211_ptr);
1772         err = nl80211_key_allowed(dev->ieee80211_ptr);
1773         if (!err)
1774                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1775                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1776                                          mac_addr, &key.p);
1777         wdev_unlock(dev->ieee80211_ptr);
1778
1779         return err;
1780 }
1781
1782 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1783 {
1784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1785         int err;
1786         struct net_device *dev = info->user_ptr[1];
1787         u8 *mac_addr = NULL;
1788         struct key_parse key;
1789
1790         err = nl80211_parse_key(info, &key);
1791         if (err)
1792                 return err;
1793
1794         if (info->attrs[NL80211_ATTR_MAC])
1795                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1796
1797         if (key.type == -1) {
1798                 if (mac_addr)
1799                         key.type = NL80211_KEYTYPE_PAIRWISE;
1800                 else
1801                         key.type = NL80211_KEYTYPE_GROUP;
1802         }
1803
1804         /* for now */
1805         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1806             key.type != NL80211_KEYTYPE_GROUP)
1807                 return -EINVAL;
1808
1809         if (!rdev->ops->del_key)
1810                 return -EOPNOTSUPP;
1811
1812         wdev_lock(dev->ieee80211_ptr);
1813         err = nl80211_key_allowed(dev->ieee80211_ptr);
1814
1815         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1816             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1817                 err = -ENOENT;
1818
1819         if (!err)
1820                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1821                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1822                                          mac_addr);
1823
1824 #ifdef CONFIG_CFG80211_WEXT
1825         if (!err) {
1826                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1827                         dev->ieee80211_ptr->wext.default_key = -1;
1828                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1829                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1830         }
1831 #endif
1832         wdev_unlock(dev->ieee80211_ptr);
1833
1834         return err;
1835 }
1836
1837 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1838 {
1839         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1840                     struct beacon_parameters *info);
1841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1842         struct net_device *dev = info->user_ptr[1];
1843         struct beacon_parameters params;
1844         int haveinfo = 0;
1845
1846         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1847                 return -EINVAL;
1848
1849         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1850             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1851                 return -EOPNOTSUPP;
1852
1853         switch (info->genlhdr->cmd) {
1854         case NL80211_CMD_NEW_BEACON:
1855                 /* these are required for NEW_BEACON */
1856                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1857                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1858                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1859                         return -EINVAL;
1860
1861                 call = rdev->ops->add_beacon;
1862                 break;
1863         case NL80211_CMD_SET_BEACON:
1864                 call = rdev->ops->set_beacon;
1865                 break;
1866         default:
1867                 WARN_ON(1);
1868                 return -EOPNOTSUPP;
1869         }
1870
1871         if (!call)
1872                 return -EOPNOTSUPP;
1873
1874         memset(&params, 0, sizeof(params));
1875
1876         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1877                 params.interval =
1878                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1879                 haveinfo = 1;
1880         }
1881
1882         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1883                 params.dtim_period =
1884                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1885                 haveinfo = 1;
1886         }
1887
1888         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1889                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1890                 params.head_len =
1891                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1892                 haveinfo = 1;
1893         }
1894
1895         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1896                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1897                 params.tail_len =
1898                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1899                 haveinfo = 1;
1900         }
1901
1902         if (!haveinfo)
1903                 return -EINVAL;
1904
1905         return call(&rdev->wiphy, dev, &params);
1906 }
1907
1908 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1909 {
1910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1911         struct net_device *dev = info->user_ptr[1];
1912
1913         if (!rdev->ops->del_beacon)
1914                 return -EOPNOTSUPP;
1915
1916         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1917             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1918                 return -EOPNOTSUPP;
1919
1920         return rdev->ops->del_beacon(&rdev->wiphy, dev);
1921 }
1922
1923 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1924         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1925         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1926         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1927         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1928         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
1929 };
1930
1931 static int parse_station_flags(struct genl_info *info,
1932                                struct station_parameters *params)
1933 {
1934         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1935         struct nlattr *nla;
1936         int flag;
1937
1938         /*
1939          * Try parsing the new attribute first so userspace
1940          * can specify both for older kernels.
1941          */
1942         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1943         if (nla) {
1944                 struct nl80211_sta_flag_update *sta_flags;
1945
1946                 sta_flags = nla_data(nla);
1947                 params->sta_flags_mask = sta_flags->mask;
1948                 params->sta_flags_set = sta_flags->set;
1949                 if ((params->sta_flags_mask |
1950                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1951                         return -EINVAL;
1952                 return 0;
1953         }
1954
1955         /* if present, parse the old attribute */
1956
1957         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1958         if (!nla)
1959                 return 0;
1960
1961         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1962                              nla, sta_flags_policy))
1963                 return -EINVAL;
1964
1965         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1966         params->sta_flags_mask &= ~1;
1967
1968         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1969                 if (flags[flag])
1970                         params->sta_flags_set |= (1<<flag);
1971
1972         return 0;
1973 }
1974
1975 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
1976                                  int attr)
1977 {
1978         struct nlattr *rate;
1979         u16 bitrate;
1980
1981         rate = nla_nest_start(msg, attr);
1982         if (!rate)
1983                 goto nla_put_failure;
1984
1985         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1986         bitrate = cfg80211_calculate_bitrate(info);
1987         if (bitrate > 0)
1988                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1989
1990         if (info->flags & RATE_INFO_FLAGS_MCS)
1991                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
1992         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1993                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1994         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
1995                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1996
1997         nla_nest_end(msg, rate);
1998         return true;
1999
2000 nla_put_failure:
2001         return false;
2002 }
2003
2004 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2005                                 int flags, struct net_device *dev,
2006                                 const u8 *mac_addr, struct station_info *sinfo)
2007 {
2008         void *hdr;
2009         struct nlattr *sinfoattr, *bss_param;
2010
2011         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2012         if (!hdr)
2013                 return -1;
2014
2015         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2016         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2017
2018         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2019
2020         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2021         if (!sinfoattr)
2022                 goto nla_put_failure;
2023         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2024                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2025                             sinfo->connected_time);
2026         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2027                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2028                             sinfo->inactive_time);
2029         if (sinfo->filled & STATION_INFO_RX_BYTES)
2030                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2031                             sinfo->rx_bytes);
2032         if (sinfo->filled & STATION_INFO_TX_BYTES)
2033                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2034                             sinfo->tx_bytes);
2035         if (sinfo->filled & STATION_INFO_LLID)
2036                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2037                             sinfo->llid);
2038         if (sinfo->filled & STATION_INFO_PLID)
2039                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2040                             sinfo->plid);
2041         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2042                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2043                             sinfo->plink_state);
2044         if (sinfo->filled & STATION_INFO_SIGNAL)
2045                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2046                            sinfo->signal);
2047         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2048                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2049                            sinfo->signal_avg);
2050         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2051                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2052                                           NL80211_STA_INFO_TX_BITRATE))
2053                         goto nla_put_failure;
2054         }
2055         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2056                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2057                                           NL80211_STA_INFO_RX_BITRATE))
2058                         goto nla_put_failure;
2059         }
2060         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2061                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2062                             sinfo->rx_packets);
2063         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2064                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2065                             sinfo->tx_packets);
2066         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2067                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2068                             sinfo->tx_retries);
2069         if (sinfo->filled & STATION_INFO_TX_FAILED)
2070                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2071                             sinfo->tx_failed);
2072         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2073                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2074                 if (!bss_param)
2075                         goto nla_put_failure;
2076
2077                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2078                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2079                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2080                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2081                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2082                         NLA_PUT_FLAG(msg,
2083                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2084                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2085                            sinfo->bss_param.dtim_period);
2086                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2087                             sinfo->bss_param.beacon_interval);
2088
2089                 nla_nest_end(msg, bss_param);
2090         }
2091         nla_nest_end(msg, sinfoattr);
2092
2093         return genlmsg_end(msg, hdr);
2094
2095  nla_put_failure:
2096         genlmsg_cancel(msg, hdr);
2097         return -EMSGSIZE;
2098 }
2099
2100 static int nl80211_dump_station(struct sk_buff *skb,
2101                                 struct netlink_callback *cb)
2102 {
2103         struct station_info sinfo;
2104         struct cfg80211_registered_device *dev;
2105         struct net_device *netdev;
2106         u8 mac_addr[ETH_ALEN];
2107         int sta_idx = cb->args[1];
2108         int err;
2109
2110         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2111         if (err)
2112                 return err;
2113
2114         if (!dev->ops->dump_station) {
2115                 err = -EOPNOTSUPP;
2116                 goto out_err;
2117         }
2118
2119         while (1) {
2120                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2121                                              mac_addr, &sinfo);
2122                 if (err == -ENOENT)
2123                         break;
2124                 if (err)
2125                         goto out_err;
2126
2127                 if (nl80211_send_station(skb,
2128                                 NETLINK_CB(cb->skb).pid,
2129                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2130                                 netdev, mac_addr,
2131                                 &sinfo) < 0)
2132                         goto out;
2133
2134                 sta_idx++;
2135         }
2136
2137
2138  out:
2139         cb->args[1] = sta_idx;
2140         err = skb->len;
2141  out_err:
2142         nl80211_finish_netdev_dump(dev);
2143
2144         return err;
2145 }
2146
2147 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2148 {
2149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2150         struct net_device *dev = info->user_ptr[1];
2151         struct station_info sinfo;
2152         struct sk_buff *msg;
2153         u8 *mac_addr = NULL;
2154         int err;
2155
2156         memset(&sinfo, 0, sizeof(sinfo));
2157
2158         if (!info->attrs[NL80211_ATTR_MAC])
2159                 return -EINVAL;
2160
2161         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2162
2163         if (!rdev->ops->get_station)
2164                 return -EOPNOTSUPP;
2165
2166         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2167         if (err)
2168                 return err;
2169
2170         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2171         if (!msg)
2172                 return -ENOMEM;
2173
2174         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2175                                  dev, mac_addr, &sinfo) < 0) {
2176                 nlmsg_free(msg);
2177                 return -ENOBUFS;
2178         }
2179
2180         return genlmsg_reply(msg, info);
2181 }
2182
2183 /*
2184  * Get vlan interface making sure it is running and on the right wiphy.
2185  */
2186 static int get_vlan(struct genl_info *info,
2187                     struct cfg80211_registered_device *rdev,
2188                     struct net_device **vlan)
2189 {
2190         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2191         *vlan = NULL;
2192
2193         if (vlanattr) {
2194                 *vlan = dev_get_by_index(genl_info_net(info),
2195                                          nla_get_u32(vlanattr));
2196                 if (!*vlan)
2197                         return -ENODEV;
2198                 if (!(*vlan)->ieee80211_ptr)
2199                         return -EINVAL;
2200                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2201                         return -EINVAL;
2202                 if (!netif_running(*vlan))
2203                         return -ENETDOWN;
2204         }
2205         return 0;
2206 }
2207
2208 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2209 {
2210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2211         int err;
2212         struct net_device *dev = info->user_ptr[1];
2213         struct station_parameters params;
2214         u8 *mac_addr = NULL;
2215
2216         memset(&params, 0, sizeof(params));
2217
2218         params.listen_interval = -1;
2219
2220         if (info->attrs[NL80211_ATTR_STA_AID])
2221                 return -EINVAL;
2222
2223         if (!info->attrs[NL80211_ATTR_MAC])
2224                 return -EINVAL;
2225
2226         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2227
2228         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2229                 params.supported_rates =
2230                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2231                 params.supported_rates_len =
2232                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2233         }
2234
2235         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2236                 params.listen_interval =
2237                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2238
2239         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2240                 params.ht_capa =
2241                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2242
2243         if (parse_station_flags(info, &params))
2244                 return -EINVAL;
2245
2246         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2247                 params.plink_action =
2248                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2249
2250         err = get_vlan(info, rdev, &params.vlan);
2251         if (err)
2252                 goto out;
2253
2254         /* validate settings */
2255         err = 0;
2256
2257         switch (dev->ieee80211_ptr->iftype) {
2258         case NL80211_IFTYPE_AP:
2259         case NL80211_IFTYPE_AP_VLAN:
2260         case NL80211_IFTYPE_P2P_GO:
2261                 /* disallow mesh-specific things */
2262                 if (params.plink_action)
2263                         err = -EINVAL;
2264                 break;
2265         case NL80211_IFTYPE_P2P_CLIENT:
2266         case NL80211_IFTYPE_STATION:
2267                 /* disallow everything but AUTHORIZED flag */
2268                 if (params.plink_action)
2269                         err = -EINVAL;
2270                 if (params.vlan)
2271                         err = -EINVAL;
2272                 if (params.supported_rates)
2273                         err = -EINVAL;
2274                 if (params.ht_capa)
2275                         err = -EINVAL;
2276                 if (params.listen_interval >= 0)
2277                         err = -EINVAL;
2278                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2279                         err = -EINVAL;
2280                 break;
2281         case NL80211_IFTYPE_MESH_POINT:
2282                 /* disallow things mesh doesn't support */
2283                 if (params.vlan)
2284                         err = -EINVAL;
2285                 if (params.ht_capa)
2286                         err = -EINVAL;
2287                 if (params.listen_interval >= 0)
2288                         err = -EINVAL;
2289                 if (params.supported_rates)
2290                         err = -EINVAL;
2291                 if (params.sta_flags_mask &
2292                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2293                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2294                         err = -EINVAL;
2295                 break;
2296         default:
2297                 err = -EINVAL;
2298         }
2299
2300         if (err)
2301                 goto out;
2302
2303         if (!rdev->ops->change_station) {
2304                 err = -EOPNOTSUPP;
2305                 goto out;
2306         }
2307
2308         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2309
2310  out:
2311         if (params.vlan)
2312                 dev_put(params.vlan);
2313
2314         return err;
2315 }
2316
2317 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2318 {
2319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2320         int err;
2321         struct net_device *dev = info->user_ptr[1];
2322         struct station_parameters params;
2323         u8 *mac_addr = NULL;
2324
2325         memset(&params, 0, sizeof(params));
2326
2327         if (!info->attrs[NL80211_ATTR_MAC])
2328                 return -EINVAL;
2329
2330         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2331                 return -EINVAL;
2332
2333         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2334                 return -EINVAL;
2335
2336         if (!info->attrs[NL80211_ATTR_STA_AID])
2337                 return -EINVAL;
2338
2339         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2340         params.supported_rates =
2341                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2342         params.supported_rates_len =
2343                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2344         params.listen_interval =
2345                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2346
2347         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2348         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2349                 return -EINVAL;
2350
2351         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2352                 params.ht_capa =
2353                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2354
2355         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2356                 params.plink_action =
2357                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2358
2359         if (parse_station_flags(info, &params))
2360                 return -EINVAL;
2361
2362         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2363             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2364             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2365             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2366                 return -EINVAL;
2367
2368         err = get_vlan(info, rdev, &params.vlan);
2369         if (err)
2370                 goto out;
2371
2372         /* validate settings */
2373         err = 0;
2374
2375         if (!rdev->ops->add_station) {
2376                 err = -EOPNOTSUPP;
2377                 goto out;
2378         }
2379
2380         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2381
2382  out:
2383         if (params.vlan)
2384                 dev_put(params.vlan);
2385         return err;
2386 }
2387
2388 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2389 {
2390         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2391         struct net_device *dev = info->user_ptr[1];
2392         u8 *mac_addr = NULL;
2393
2394         if (info->attrs[NL80211_ATTR_MAC])
2395                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2396
2397         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2398             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2399             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2400             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2401                 return -EINVAL;
2402
2403         if (!rdev->ops->del_station)
2404                 return -EOPNOTSUPP;
2405
2406         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2407 }
2408
2409 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2410                                 int flags, struct net_device *dev,
2411                                 u8 *dst, u8 *next_hop,
2412                                 struct mpath_info *pinfo)
2413 {
2414         void *hdr;
2415         struct nlattr *pinfoattr;
2416
2417         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2418         if (!hdr)
2419                 return -1;
2420
2421         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2422         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2423         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2424
2425         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2426
2427         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2428         if (!pinfoattr)
2429                 goto nla_put_failure;
2430         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2431                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2432                             pinfo->frame_qlen);
2433         if (pinfo->filled & MPATH_INFO_SN)
2434                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2435                             pinfo->sn);
2436         if (pinfo->filled & MPATH_INFO_METRIC)
2437                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2438                             pinfo->metric);
2439         if (pinfo->filled & MPATH_INFO_EXPTIME)
2440                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2441                             pinfo->exptime);
2442         if (pinfo->filled & MPATH_INFO_FLAGS)
2443                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2444                             pinfo->flags);
2445         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2446                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2447                             pinfo->discovery_timeout);
2448         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2449                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2450                             pinfo->discovery_retries);
2451
2452         nla_nest_end(msg, pinfoattr);
2453
2454         return genlmsg_end(msg, hdr);
2455
2456  nla_put_failure:
2457         genlmsg_cancel(msg, hdr);
2458         return -EMSGSIZE;
2459 }
2460
2461 static int nl80211_dump_mpath(struct sk_buff *skb,
2462                               struct netlink_callback *cb)
2463 {
2464         struct mpath_info pinfo;
2465         struct cfg80211_registered_device *dev;
2466         struct net_device *netdev;
2467         u8 dst[ETH_ALEN];
2468         u8 next_hop[ETH_ALEN];
2469         int path_idx = cb->args[1];
2470         int err;
2471
2472         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2473         if (err)
2474                 return err;
2475
2476         if (!dev->ops->dump_mpath) {
2477                 err = -EOPNOTSUPP;
2478                 goto out_err;
2479         }
2480
2481         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2482                 err = -EOPNOTSUPP;
2483                 goto out_err;
2484         }
2485
2486         while (1) {
2487                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2488                                            dst, next_hop, &pinfo);
2489                 if (err == -ENOENT)
2490                         break;
2491                 if (err)
2492                         goto out_err;
2493
2494                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2495                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2496                                        netdev, dst, next_hop,
2497                                        &pinfo) < 0)
2498                         goto out;
2499
2500                 path_idx++;
2501         }
2502
2503
2504  out:
2505         cb->args[1] = path_idx;
2506         err = skb->len;
2507  out_err:
2508         nl80211_finish_netdev_dump(dev);
2509         return err;
2510 }
2511
2512 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2513 {
2514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2515         int err;
2516         struct net_device *dev = info->user_ptr[1];
2517         struct mpath_info pinfo;
2518         struct sk_buff *msg;
2519         u8 *dst = NULL;
2520         u8 next_hop[ETH_ALEN];
2521
2522         memset(&pinfo, 0, sizeof(pinfo));
2523
2524         if (!info->attrs[NL80211_ATTR_MAC])
2525                 return -EINVAL;
2526
2527         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2528
2529         if (!rdev->ops->get_mpath)
2530                 return -EOPNOTSUPP;
2531
2532         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2533                 return -EOPNOTSUPP;
2534
2535         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2536         if (err)
2537                 return err;
2538
2539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2540         if (!msg)
2541                 return -ENOMEM;
2542
2543         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2544                                  dev, dst, next_hop, &pinfo) < 0) {
2545                 nlmsg_free(msg);
2546                 return -ENOBUFS;
2547         }
2548
2549         return genlmsg_reply(msg, info);
2550 }
2551
2552 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2553 {
2554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2555         struct net_device *dev = info->user_ptr[1];
2556         u8 *dst = NULL;
2557         u8 *next_hop = NULL;
2558
2559         if (!info->attrs[NL80211_ATTR_MAC])
2560                 return -EINVAL;
2561
2562         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2563                 return -EINVAL;
2564
2565         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2566         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2567
2568         if (!rdev->ops->change_mpath)
2569                 return -EOPNOTSUPP;
2570
2571         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2572                 return -EOPNOTSUPP;
2573
2574         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2575 }
2576
2577 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2578 {
2579         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2580         struct net_device *dev = info->user_ptr[1];
2581         u8 *dst = NULL;
2582         u8 *next_hop = NULL;
2583
2584         if (!info->attrs[NL80211_ATTR_MAC])
2585                 return -EINVAL;
2586
2587         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2588                 return -EINVAL;
2589
2590         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2591         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2592
2593         if (!rdev->ops->add_mpath)
2594                 return -EOPNOTSUPP;
2595
2596         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2597                 return -EOPNOTSUPP;
2598
2599         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2600 }
2601
2602 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2603 {
2604         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2605         struct net_device *dev = info->user_ptr[1];
2606         u8 *dst = NULL;
2607
2608         if (info->attrs[NL80211_ATTR_MAC])
2609                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2610
2611         if (!rdev->ops->del_mpath)
2612                 return -EOPNOTSUPP;
2613
2614         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2615 }
2616
2617 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2618 {
2619         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2620         struct net_device *dev = info->user_ptr[1];
2621         struct bss_parameters params;
2622
2623         memset(&params, 0, sizeof(params));
2624         /* default to not changing parameters */
2625         params.use_cts_prot = -1;
2626         params.use_short_preamble = -1;
2627         params.use_short_slot_time = -1;
2628         params.ap_isolate = -1;
2629         params.ht_opmode = -1;
2630
2631         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2632                 params.use_cts_prot =
2633                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2634         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2635                 params.use_short_preamble =
2636                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2637         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2638                 params.use_short_slot_time =
2639                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2640         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2641                 params.basic_rates =
2642                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2643                 params.basic_rates_len =
2644                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2645         }
2646         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2647                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2648         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2649                 params.ht_opmode =
2650                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2651
2652         if (!rdev->ops->change_bss)
2653                 return -EOPNOTSUPP;
2654
2655         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2656             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2657                 return -EOPNOTSUPP;
2658
2659         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2660 }
2661
2662 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2663         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2664         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2665         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2666         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2667         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2668         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2669 };
2670
2671 static int parse_reg_rule(struct nlattr *tb[],
2672         struct ieee80211_reg_rule *reg_rule)
2673 {
2674         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2675         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2676
2677         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2678                 return -EINVAL;
2679         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2680                 return -EINVAL;
2681         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2682                 return -EINVAL;
2683         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2684                 return -EINVAL;
2685         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2686                 return -EINVAL;
2687
2688         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2689
2690         freq_range->start_freq_khz =
2691                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2692         freq_range->end_freq_khz =
2693                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2694         freq_range->max_bandwidth_khz =
2695                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2696
2697         power_rule->max_eirp =
2698                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2699
2700         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2701                 power_rule->max_antenna_gain =
2702                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2703
2704         return 0;
2705 }
2706
2707 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2708 {
2709         int r;
2710         char *data = NULL;
2711
2712         /*
2713          * You should only get this when cfg80211 hasn't yet initialized
2714          * completely when built-in to the kernel right between the time
2715          * window between nl80211_init() and regulatory_init(), if that is
2716          * even possible.
2717          */
2718         mutex_lock(&cfg80211_mutex);
2719         if (unlikely(!cfg80211_regdomain)) {
2720                 mutex_unlock(&cfg80211_mutex);
2721                 return -EINPROGRESS;
2722         }
2723         mutex_unlock(&cfg80211_mutex);
2724
2725         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2726                 return -EINVAL;
2727
2728         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2729
2730         r = regulatory_hint_user(data);
2731
2732         return r;
2733 }
2734
2735 static int nl80211_get_mesh_config(struct sk_buff *skb,
2736                                    struct genl_info *info)
2737 {
2738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2739         struct net_device *dev = info->user_ptr[1];
2740         struct wireless_dev *wdev = dev->ieee80211_ptr;
2741         struct mesh_config cur_params;
2742         int err = 0;
2743         void *hdr;
2744         struct nlattr *pinfoattr;
2745         struct sk_buff *msg;
2746
2747         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2748                 return -EOPNOTSUPP;
2749
2750         if (!rdev->ops->get_mesh_config)
2751                 return -EOPNOTSUPP;
2752
2753         wdev_lock(wdev);
2754         /* If not connected, get default parameters */
2755         if (!wdev->mesh_id_len)
2756                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
2757         else
2758                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
2759                                                  &cur_params);
2760         wdev_unlock(wdev);
2761
2762         if (err)
2763                 return err;
2764
2765         /* Draw up a netlink message to send back */
2766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2767         if (!msg)
2768                 return -ENOMEM;
2769         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2770                              NL80211_CMD_GET_MESH_CONFIG);
2771         if (!hdr)
2772                 goto out;
2773         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
2774         if (!pinfoattr)
2775                 goto nla_put_failure;
2776         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2777         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2778                         cur_params.dot11MeshRetryTimeout);
2779         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2780                         cur_params.dot11MeshConfirmTimeout);
2781         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2782                         cur_params.dot11MeshHoldingTimeout);
2783         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2784                         cur_params.dot11MeshMaxPeerLinks);
2785         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2786                         cur_params.dot11MeshMaxRetries);
2787         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2788                         cur_params.dot11MeshTTL);
2789         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
2790                         cur_params.element_ttl);
2791         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2792                         cur_params.auto_open_plinks);
2793         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2794                         cur_params.dot11MeshHWMPmaxPREQretries);
2795         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2796                         cur_params.path_refresh_time);
2797         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2798                         cur_params.min_discovery_timeout);
2799         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2800                         cur_params.dot11MeshHWMPactivePathTimeout);
2801         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2802                         cur_params.dot11MeshHWMPpreqMinInterval);
2803         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2804                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2805         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2806                         cur_params.dot11MeshHWMPRootMode);
2807         nla_nest_end(msg, pinfoattr);
2808         genlmsg_end(msg, hdr);
2809         return genlmsg_reply(msg, info);
2810
2811  nla_put_failure:
2812         genlmsg_cancel(msg, hdr);
2813  out:
2814         nlmsg_free(msg);
2815         return -ENOBUFS;
2816 }
2817
2818 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2819         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2820         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2821         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2822         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2823         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2824         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2825         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
2826         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2827
2828         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2829         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2830         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2831         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2832         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2833         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2834 };
2835
2836 static const struct nla_policy
2837         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
2838         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
2839         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
2840         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
2841         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
2842                 .len = IEEE80211_MAX_DATA_LEN },
2843 };
2844
2845 static int nl80211_parse_mesh_config(struct genl_info *info,
2846                                      struct mesh_config *cfg,
2847                                      u32 *mask_out)
2848 {
2849         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2850         u32 mask = 0;
2851
2852 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2853 do {\
2854         if (table[attr_num]) {\
2855                 cfg->param = nla_fn(table[attr_num]); \
2856                 mask |= (1 << (attr_num - 1)); \
2857         } \
2858 } while (0);\
2859
2860
2861         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
2862                 return -EINVAL;
2863         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2864                              info->attrs[NL80211_ATTR_MESH_CONFIG],
2865                              nl80211_meshconf_params_policy))
2866                 return -EINVAL;
2867
2868         /* This makes sure that there aren't more than 32 mesh config
2869          * parameters (otherwise our bitfield scheme would not work.) */
2870         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2871
2872         /* Fill in the params struct */
2873         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2874                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2875         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2876                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2878                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2879         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2880                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2881         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2882                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2884                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
2886                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
2887         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2888                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2890                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2891                         nla_get_u8);
2892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2893                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2894         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2895                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2896                         nla_get_u16);
2897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2898                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2899                         nla_get_u32);
2900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2901                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2902                         nla_get_u16);
2903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2904                         dot11MeshHWMPnetDiameterTraversalTime,
2905                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2906                         nla_get_u16);
2907         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2908                         dot11MeshHWMPRootMode, mask,
2909                         NL80211_MESHCONF_HWMP_ROOTMODE,
2910                         nla_get_u8);
2911         if (mask_out)
2912                 *mask_out = mask;
2913
2914         return 0;
2915
2916 #undef FILL_IN_MESH_PARAM_IF_SET
2917 }
2918
2919 static int nl80211_parse_mesh_setup(struct genl_info *info,
2920                                      struct mesh_setup *setup)
2921 {
2922         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
2923
2924         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
2925                 return -EINVAL;
2926         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
2927                              info->attrs[NL80211_ATTR_MESH_SETUP],
2928                              nl80211_mesh_setup_params_policy))
2929                 return -EINVAL;
2930
2931         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
2932                 setup->path_sel_proto =
2933                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
2934                  IEEE80211_PATH_PROTOCOL_VENDOR :
2935                  IEEE80211_PATH_PROTOCOL_HWMP;
2936
2937         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
2938                 setup->path_metric =
2939                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
2940                  IEEE80211_PATH_METRIC_VENDOR :
2941                  IEEE80211_PATH_METRIC_AIRTIME;
2942
2943
2944         if (tb[NL80211_MESH_SETUP_IE]) {
2945                 struct nlattr *ieattr =
2946                         tb[NL80211_MESH_SETUP_IE];
2947                 if (!is_valid_ie_attr(ieattr))
2948                         return -EINVAL;
2949                 setup->ie = nla_data(ieattr);
2950                 setup->ie_len = nla_len(ieattr);
2951         }
2952         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
2953
2954         return 0;
2955 }
2956
2957 static int nl80211_update_mesh_config(struct sk_buff *skb,
2958                                       struct genl_info *info)
2959 {
2960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2961         struct net_device *dev = info->user_ptr[1];
2962         struct wireless_dev *wdev = dev->ieee80211_ptr;
2963         struct mesh_config cfg;
2964         u32 mask;
2965         int err;
2966
2967         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2968                 return -EOPNOTSUPP;
2969
2970         if (!rdev->ops->update_mesh_config)
2971                 return -EOPNOTSUPP;
2972
2973         err = nl80211_parse_mesh_config(info, &cfg, &mask);
2974         if (err)
2975                 return err;
2976
2977         wdev_lock(wdev);
2978         if (!wdev->mesh_id_len)
2979                 err = -ENOLINK;
2980
2981         if (!err)
2982                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
2983                                                     mask, &cfg);
2984
2985         wdev_unlock(wdev);
2986
2987         return err;
2988 }
2989
2990 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2991 {
2992         struct sk_buff *msg;
2993         void *hdr = NULL;
2994         struct nlattr *nl_reg_rules;
2995         unsigned int i;
2996         int err = -EINVAL;
2997
2998         mutex_lock(&cfg80211_mutex);
2999
3000         if (!cfg80211_regdomain)
3001                 goto out;
3002
3003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3004         if (!msg) {
3005                 err = -ENOBUFS;
3006                 goto out;
3007         }
3008
3009         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3010                              NL80211_CMD_GET_REG);
3011         if (!hdr)
3012                 goto put_failure;
3013
3014         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3015                 cfg80211_regdomain->alpha2);
3016
3017         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3018         if (!nl_reg_rules)
3019                 goto nla_put_failure;
3020
3021         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3022                 struct nlattr *nl_reg_rule;
3023                 const struct ieee80211_reg_rule *reg_rule;
3024                 const struct ieee80211_freq_range *freq_range;
3025                 const struct ieee80211_power_rule *power_rule;
3026
3027                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3028                 freq_range = &reg_rule->freq_range;
3029                 power_rule = &reg_rule->power_rule;
3030
3031                 nl_reg_rule = nla_nest_start(msg, i);
3032                 if (!nl_reg_rule)
3033                         goto nla_put_failure;
3034
3035                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3036                         reg_rule->flags);
3037                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3038                         freq_range->start_freq_khz);
3039                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3040                         freq_range->end_freq_khz);
3041                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3042                         freq_range->max_bandwidth_khz);
3043                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3044                         power_rule->max_antenna_gain);
3045                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3046                         power_rule->max_eirp);
3047
3048                 nla_nest_end(msg, nl_reg_rule);
3049         }
3050
3051         nla_nest_end(msg, nl_reg_rules);
3052
3053         genlmsg_end(msg, hdr);
3054         err = genlmsg_reply(msg, info);
3055         goto out;
3056
3057 nla_put_failure:
3058         genlmsg_cancel(msg, hdr);
3059 put_failure:
3060         nlmsg_free(msg);
3061         err = -EMSGSIZE;
3062 out:
3063         mutex_unlock(&cfg80211_mutex);
3064         return err;
3065 }
3066
3067 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3068 {
3069         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3070         struct nlattr *nl_reg_rule;
3071         char *alpha2 = NULL;
3072         int rem_reg_rules = 0, r = 0;
3073         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3074         struct ieee80211_regdomain *rd = NULL;
3075
3076         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3077                 return -EINVAL;
3078
3079         if (!info->attrs[NL80211_ATTR_REG_RULES])
3080                 return -EINVAL;
3081
3082         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3083
3084         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3085                         rem_reg_rules) {
3086                 num_rules++;
3087                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3088                         return -EINVAL;
3089         }
3090
3091         mutex_lock(&cfg80211_mutex);
3092
3093         if (!reg_is_valid_request(alpha2)) {
3094                 r = -EINVAL;
3095                 goto bad_reg;
3096         }
3097
3098         size_of_regd = sizeof(struct ieee80211_regdomain) +
3099                 (num_rules * sizeof(struct ieee80211_reg_rule));
3100
3101         rd = kzalloc(size_of_regd, GFP_KERNEL);
3102         if (!rd) {
3103                 r = -ENOMEM;
3104                 goto bad_reg;
3105         }
3106
3107         rd->n_reg_rules = num_rules;
3108         rd->alpha2[0] = alpha2[0];
3109         rd->alpha2[1] = alpha2[1];
3110
3111         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3112                         rem_reg_rules) {
3113                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3114                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3115                         reg_rule_policy);
3116                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3117                 if (r)
3118                         goto bad_reg;
3119
3120                 rule_idx++;
3121
3122                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3123                         r = -EINVAL;
3124                         goto bad_reg;
3125                 }
3126         }
3127
3128         BUG_ON(rule_idx != num_rules);
3129
3130         r = set_regdom(rd);
3131
3132         mutex_unlock(&cfg80211_mutex);
3133
3134         return r;
3135
3136  bad_reg:
3137         mutex_unlock(&cfg80211_mutex);
3138         kfree(rd);
3139         return r;
3140 }
3141
3142 static int validate_scan_freqs(struct nlattr *freqs)
3143 {
3144         struct nlattr *attr1, *attr2;
3145         int n_channels = 0, tmp1, tmp2;
3146
3147         nla_for_each_nested(attr1, freqs, tmp1) {
3148                 n_channels++;
3149                 /*
3150                  * Some hardware has a limited channel list for
3151                  * scanning, and it is pretty much nonsensical
3152                  * to scan for a channel twice, so disallow that
3153                  * and don't require drivers to check that the
3154                  * channel list they get isn't longer than what
3155                  * they can scan, as long as they can scan all
3156                  * the channels they registered at once.
3157                  */
3158                 nla_for_each_nested(attr2, freqs, tmp2)
3159                         if (attr1 != attr2 &&
3160                             nla_get_u32(attr1) == nla_get_u32(attr2))
3161                                 return 0;
3162         }
3163
3164         return n_channels;
3165 }
3166
3167 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3168 {
3169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3170         struct net_device *dev = info->user_ptr[1];
3171         struct cfg80211_scan_request *request;
3172         struct cfg80211_ssid *ssid;
3173         struct ieee80211_channel *channel;
3174         struct nlattr *attr;
3175         struct wiphy *wiphy;
3176         int err, tmp, n_ssids = 0, n_channels, i;
3177         enum ieee80211_band band;
3178         size_t ie_len;
3179
3180         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3181                 return -EINVAL;
3182
3183         wiphy = &rdev->wiphy;
3184
3185         if (!rdev->ops->scan)
3186                 return -EOPNOTSUPP;
3187
3188         if (rdev->scan_req)
3189                 return -EBUSY;
3190
3191         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3192                 n_channels = validate_scan_freqs(
3193                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3194                 if (!n_channels)
3195                         return -EINVAL;
3196         } else {
3197                 n_channels = 0;
3198
3199                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3200                         if (wiphy->bands[band])
3201                                 n_channels += wiphy->bands[band]->n_channels;
3202         }
3203
3204         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3205                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3206                         n_ssids++;
3207
3208         if (n_ssids > wiphy->max_scan_ssids)
3209                 return -EINVAL;
3210
3211         if (info->attrs[NL80211_ATTR_IE])
3212                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3213         else
3214                 ie_len = 0;
3215
3216         if (ie_len > wiphy->max_scan_ie_len)
3217                 return -EINVAL;
3218
3219         request = kzalloc(sizeof(*request)
3220                         + sizeof(*ssid) * n_ssids
3221                         + sizeof(channel) * n_channels
3222                         + ie_len, GFP_KERNEL);
3223         if (!request)
3224                 return -ENOMEM;
3225
3226         if (n_ssids)
3227                 request->ssids = (void *)&request->channels[n_channels];
3228         request->n_ssids = n_ssids;
3229         if (ie_len) {
3230                 if (request->ssids)
3231                         request->ie = (void *)(request->ssids + n_ssids);
3232                 else
3233                         request->ie = (void *)(request->channels + n_channels);
3234         }
3235
3236         i = 0;
3237         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3238                 /* user specified, bail out if channel not found */
3239                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3240                         struct ieee80211_channel *chan;
3241
3242                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3243
3244                         if (!chan) {
3245                                 err = -EINVAL;
3246                                 goto out_free;
3247                         }
3248
3249                         /* ignore disabled channels */
3250                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3251                                 continue;
3252
3253                         request->channels[i] = chan;
3254                         i++;
3255                 }
3256         } else {
3257                 /* all channels */
3258                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3259                         int j;
3260                         if (!wiphy->bands[band])
3261                                 continue;
3262                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3263                                 struct ieee80211_channel *chan;
3264
3265                                 chan = &wiphy->bands[band]->channels[j];
3266
3267                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3268                                         continue;
3269
3270                                 request->channels[i] = chan;
3271                                 i++;
3272                         }
3273                 }
3274         }
3275
3276         if (!i) {
3277                 err = -EINVAL;
3278                 goto out_free;
3279         }
3280
3281         request->n_channels = i;
3282
3283         i = 0;
3284         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3285                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3286                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3287                                 err = -EINVAL;
3288                                 goto out_free;
3289                         }
3290                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3291                         request->ssids[i].ssid_len = nla_len(attr);
3292                         i++;
3293                 }
3294         }
3295
3296         if (info->attrs[NL80211_ATTR_IE]) {
3297                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3298                 memcpy((void *)request->ie,
3299                        nla_data(info->attrs[NL80211_ATTR_IE]),
3300                        request->ie_len);
3301         }
3302
3303         request->dev = dev;
3304         request->wiphy = &rdev->wiphy;
3305
3306         rdev->scan_req = request;
3307         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3308
3309         if (!err) {
3310                 nl80211_send_scan_start(rdev, dev);
3311                 dev_hold(dev);
3312         } else {
3313  out_free:
3314                 rdev->scan_req = NULL;
3315                 kfree(request);
3316         }
3317
3318         return err;
3319 }
3320
3321 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3322                             struct cfg80211_registered_device *rdev,
3323                             struct wireless_dev *wdev,
3324                             struct cfg80211_internal_bss *intbss)
3325 {
3326         struct cfg80211_bss *res = &intbss->pub;
3327         void *hdr;
3328         struct nlattr *bss;
3329         int i;
3330
3331         ASSERT_WDEV_LOCK(wdev);
3332
3333         hdr = nl80211hdr_put(msg, pid, seq, flags,
3334                              NL80211_CMD_NEW_SCAN_RESULTS);
3335         if (!hdr)
3336                 return -1;
3337
3338         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3339         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3340
3341         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3342         if (!bss)
3343                 goto nla_put_failure;
3344         if (!is_zero_ether_addr(res->bssid))
3345                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3346         if (res->information_elements && res->len_information_elements)
3347                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3348                         res->len_information_elements,
3349                         res->information_elements);
3350         if (res->beacon_ies && res->len_beacon_ies &&
3351             res->beacon_ies != res->information_elements)
3352                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3353                         res->len_beacon_ies, res->beacon_ies);
3354         if (res->tsf)
3355                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3356         if (res->beacon_interval)
3357                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3358         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3359         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3360         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3361                 jiffies_to_msecs(jiffies - intbss->ts));
3362
3363         switch (rdev->wiphy.signal_type) {
3364         case CFG80211_SIGNAL_TYPE_MBM:
3365                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3366                 break;
3367         case CFG80211_SIGNAL_TYPE_UNSPEC:
3368                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3369                 break;
3370         default:
3371                 break;
3372         }
3373
3374         switch (wdev->iftype) {
3375         case NL80211_IFTYPE_P2P_CLIENT:
3376         case NL80211_IFTYPE_STATION:
3377                 if (intbss == wdev->current_bss)
3378                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3379                                     NL80211_BSS_STATUS_ASSOCIATED);
3380                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3381                         if (intbss != wdev->auth_bsses[i])
3382                                 continue;
3383                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3384                                     NL80211_BSS_STATUS_AUTHENTICATED);
3385                         break;
3386                 }
3387                 break;
3388         case NL80211_IFTYPE_ADHOC:
3389                 if (intbss == wdev->current_bss)
3390                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3391                                     NL80211_BSS_STATUS_IBSS_JOINED);
3392                 break;
3393         default:
3394                 break;
3395         }
3396
3397         nla_nest_end(msg, bss);
3398
3399         return genlmsg_end(msg, hdr);
3400
3401  nla_put_failure:
3402         genlmsg_cancel(msg, hdr);
3403         return -EMSGSIZE;
3404 }
3405
3406 static int nl80211_dump_scan(struct sk_buff *skb,
3407                              struct netlink_callback *cb)
3408 {
3409         struct cfg80211_registered_device *rdev;
3410         struct net_device *dev;
3411         struct cfg80211_internal_bss *scan;
3412         struct wireless_dev *wdev;
3413         int start = cb->args[1], idx = 0;
3414         int err;
3415
3416         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3417         if (err)
3418                 return err;
3419
3420         wdev = dev->ieee80211_ptr;
3421
3422         wdev_lock(wdev);
3423         spin_lock_bh(&rdev->bss_lock);
3424         cfg80211_bss_expire(rdev);
3425
3426         list_for_each_entry(scan, &rdev->bss_list, list) {
3427                 if (++idx <= start)
3428                         continue;
3429                 if (nl80211_send_bss(skb,
3430                                 NETLINK_CB(cb->skb).pid,
3431                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3432                                 rdev, wdev, scan) < 0) {
3433                         idx--;
3434                         break;
3435                 }
3436         }
3437
3438         spin_unlock_bh(&rdev->bss_lock);
3439         wdev_unlock(wdev);
3440
3441         cb->args[1] = idx;
3442         nl80211_finish_netdev_dump(rdev);
3443
3444         return skb->len;
3445 }
3446
3447 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3448                                 int flags, struct net_device *dev,
3449                                 struct survey_info *survey)
3450 {
3451         void *hdr;
3452         struct nlattr *infoattr;
3453
3454         /* Survey without a channel doesn't make sense */
3455         if (!survey->channel)
3456                 return -EINVAL;
3457
3458         hdr = nl80211hdr_put(msg, pid, seq, flags,
3459                              NL80211_CMD_NEW_SURVEY_RESULTS);
3460         if (!hdr)
3461                 return -ENOMEM;
3462
3463         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3464
3465         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3466         if (!infoattr)
3467                 goto nla_put_failure;
3468
3469         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3470                     survey->channel->center_freq);
3471         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3472                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3473                             survey->noise);
3474         if (survey->filled & SURVEY_INFO_IN_USE)
3475                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3476         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3477                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3478                             survey->channel_time);
3479         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3480                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3481                             survey->channel_time_busy);
3482         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3483                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3484                             survey->channel_time_ext_busy);
3485         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3486                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3487                             survey->channel_time_rx);
3488         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3489                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3490                             survey->channel_time_tx);
3491
3492         nla_nest_end(msg, infoattr);
3493
3494         return genlmsg_end(msg, hdr);
3495
3496  nla_put_failure:
3497         genlmsg_cancel(msg, hdr);
3498         return -EMSGSIZE;
3499 }
3500
3501 static int nl80211_dump_survey(struct sk_buff *skb,
3502                         struct netlink_callback *cb)
3503 {
3504         struct survey_info survey;
3505         struct cfg80211_registered_device *dev;
3506         struct net_device *netdev;
3507         int survey_idx = cb->args[1];
3508         int res;
3509
3510         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3511         if (res)
3512                 return res;
3513
3514         if (!dev->ops->dump_survey) {
3515                 res = -EOPNOTSUPP;
3516                 goto out_err;
3517         }
3518
3519         while (1) {
3520                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3521                                             &survey);
3522                 if (res == -ENOENT)
3523                         break;
3524                 if (res)
3525                         goto out_err;
3526
3527                 if (nl80211_send_survey(skb,
3528                                 NETLINK_CB(cb->skb).pid,
3529                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3530                                 netdev,
3531                                 &survey) < 0)
3532                         goto out;
3533                 survey_idx++;
3534         }
3535
3536  out:
3537         cb->args[1] = survey_idx;
3538         res = skb->len;
3539  out_err:
3540         nl80211_finish_netdev_dump(dev);
3541         return res;
3542 }
3543
3544 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3545 {
3546         return auth_type <= NL80211_AUTHTYPE_MAX;
3547 }
3548
3549 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3550 {
3551         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3552                                   NL80211_WPA_VERSION_2));
3553 }
3554
3555 static bool nl80211_valid_akm_suite(u32 akm)
3556 {
3557         return akm == WLAN_AKM_SUITE_8021X ||
3558                 akm == WLAN_AKM_SUITE_PSK;
3559 }
3560
3561 static bool nl80211_valid_cipher_suite(u32 cipher)
3562 {
3563         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3564                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3565                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3566                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3567                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3568 }
3569
3570
3571 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3572 {
3573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3574         struct net_device *dev = info->user_ptr[1];
3575         struct ieee80211_channel *chan;
3576         const u8 *bssid, *ssid, *ie = NULL;
3577         int err, ssid_len, ie_len = 0;
3578         enum nl80211_auth_type auth_type;
3579         struct key_parse key;
3580         bool local_state_change;
3581
3582         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3583                 return -EINVAL;
3584
3585         if (!info->attrs[NL80211_ATTR_MAC])
3586                 return -EINVAL;
3587
3588         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3589                 return -EINVAL;
3590
3591         if (!info->attrs[NL80211_ATTR_SSID])
3592                 return -EINVAL;
3593
3594         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3595                 return -EINVAL;
3596
3597         err = nl80211_parse_key(info, &key);
3598         if (err)
3599                 return err;
3600
3601         if (key.idx >= 0) {
3602                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
3603                         return -EINVAL;
3604                 if (!key.p.key || !key.p.key_len)
3605                         return -EINVAL;
3606                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3607                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3608                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3609                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3610                         return -EINVAL;
3611                 if (key.idx > 4)
3612                         return -EINVAL;
3613         } else {
3614                 key.p.key_len = 0;
3615                 key.p.key = NULL;
3616         }
3617
3618         if (key.idx >= 0) {
3619                 int i;
3620                 bool ok = false;
3621                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3622                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3623                                 ok = true;
3624                                 break;
3625                         }
3626                 }
3627                 if (!ok)
3628                         return -EINVAL;
3629         }
3630
3631         if (!rdev->ops->auth)
3632                 return -EOPNOTSUPP;
3633
3634         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3635             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3636                 return -EOPNOTSUPP;
3637
3638         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3639         chan = ieee80211_get_channel(&rdev->wiphy,
3640                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3641         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3642                 return -EINVAL;
3643
3644         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3645         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3646
3647         if (info->attrs[NL80211_ATTR_IE]) {
3648                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3649                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3650         }
3651
3652         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3653         if (!nl80211_valid_auth_type(auth_type))
3654                 return -EINVAL;
3655
3656         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3657
3658         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3659                                   ssid, ssid_len, ie, ie_len,
3660                                   key.p.key, key.p.key_len, key.idx,
3661                                   local_state_change);
3662 }
3663
3664 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
3665                                    struct genl_info *info,
3666                                    struct cfg80211_crypto_settings *settings,
3667                                    int cipher_limit)
3668 {
3669         memset(settings, 0, sizeof(*settings));
3670
3671         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3672
3673         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
3674                 u16 proto;
3675                 proto = nla_get_u16(
3676                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3677                 settings->control_port_ethertype = cpu_to_be16(proto);
3678                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
3679                     proto != ETH_P_PAE)
3680                         return -EINVAL;
3681                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
3682                         settings->control_port_no_encrypt = true;
3683         } else
3684                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
3685
3686         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3687                 void *data;
3688                 int len, i;
3689
3690                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3691                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3692                 settings->n_ciphers_pairwise = len / sizeof(u32);
3693
3694                 if (len % sizeof(u32))
3695                         return -EINVAL;
3696
3697                 if (settings->n_ciphers_pairwise > cipher_limit)
3698                         return -EINVAL;
3699
3700                 memcpy(settings->ciphers_pairwise, data, len);
3701
3702                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3703                         if (!nl80211_valid_cipher_suite(
3704                                         settings->ciphers_pairwise[i]))
3705                                 return -EINVAL;
3706         }
3707
3708         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3709                 settings->cipher_group =
3710                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3711                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3712                         return -EINVAL;
3713         }
3714
3715         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3716                 settings->wpa_versions =
3717                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3718                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3719                         return -EINVAL;
3720         }
3721
3722         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3723                 void *data;
3724                 int len, i;
3725
3726                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3727                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3728                 settings->n_akm_suites = len / sizeof(u32);
3729
3730                 if (len % sizeof(u32))
3731                         return -EINVAL;
3732
3733                 memcpy(settings->akm_suites, data, len);
3734
3735                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3736                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3737                                 return -EINVAL;
3738         }
3739
3740         return 0;
3741 }
3742
3743 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3744 {
3745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3746         struct net_device *dev = info->user_ptr[1];
3747         struct cfg80211_crypto_settings crypto;
3748         struct ieee80211_channel *chan;
3749         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3750         int err, ssid_len, ie_len = 0;
3751         bool use_mfp = false;
3752
3753         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3754                 return -EINVAL;
3755
3756         if (!info->attrs[NL80211_ATTR_MAC] ||
3757             !info->attrs[NL80211_ATTR_SSID] ||
3758             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3759                 return -EINVAL;
3760
3761         if (!rdev->ops->assoc)
3762                 return -EOPNOTSUPP;
3763
3764         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3765             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3766                 return -EOPNOTSUPP;
3767
3768         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3769
3770         chan = ieee80211_get_channel(&rdev->wiphy,
3771                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3772         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3773                 return -EINVAL;
3774
3775         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3776         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3777
3778         if (info->attrs[NL80211_ATTR_IE]) {
3779                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3780                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3781         }
3782
3783         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3784                 enum nl80211_mfp mfp =
3785                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3786                 if (mfp == NL80211_MFP_REQUIRED)
3787                         use_mfp = true;
3788                 else if (mfp != NL80211_MFP_NO)
3789                         return -EINVAL;
3790         }
3791
3792         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3793                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3794
3795         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
3796         if (!err)
3797                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3798                                           ssid, ssid_len, ie, ie_len, use_mfp,
3799                                           &crypto);
3800
3801         return err;
3802 }
3803
3804 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3805 {
3806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3807         struct net_device *dev = info->user_ptr[1];
3808         const u8 *ie = NULL, *bssid;
3809         int ie_len = 0;
3810         u16 reason_code;
3811         bool local_state_change;
3812
3813         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3814                 return -EINVAL;
3815
3816         if (!info->attrs[NL80211_ATTR_MAC])
3817                 return -EINVAL;
3818
3819         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3820                 return -EINVAL;
3821
3822         if (!rdev->ops->deauth)
3823                 return -EOPNOTSUPP;
3824
3825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3826             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3827                 return -EOPNOTSUPP;
3828
3829         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3830
3831         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3832         if (reason_code == 0) {
3833                 /* Reason Code 0 is reserved */
3834                 return -EINVAL;
3835         }
3836
3837         if (info->attrs[NL80211_ATTR_IE]) {
3838                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3839                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3840         }
3841
3842         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3843
3844         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3845                                     local_state_change);
3846 }
3847
3848 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3849 {
3850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3851         struct net_device *dev = info->user_ptr[1];
3852         const u8 *ie = NULL, *bssid;
3853         int ie_len = 0;
3854         u16 reason_code;
3855         bool local_state_change;
3856
3857         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3858                 return -EINVAL;
3859
3860         if (!info->attrs[NL80211_ATTR_MAC])
3861                 return -EINVAL;
3862
3863         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3864                 return -EINVAL;
3865
3866         if (!rdev->ops->disassoc)
3867                 return -EOPNOTSUPP;
3868
3869         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3870             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3871                 return -EOPNOTSUPP;
3872
3873         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3874
3875         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3876         if (reason_code == 0) {
3877                 /* Reason Code 0 is reserved */
3878                 return -EINVAL;
3879         }
3880
3881         if (info->attrs[NL80211_ATTR_IE]) {
3882                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3883                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3884         }
3885
3886         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3887
3888         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3889                                       local_state_change);
3890 }
3891
3892 static bool
3893 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
3894                          int mcast_rate[IEEE80211_NUM_BANDS],
3895                          int rateval)
3896 {
3897         struct wiphy *wiphy = &rdev->wiphy;
3898         bool found = false;
3899         int band, i;
3900
3901         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3902                 struct ieee80211_supported_band *sband;
3903
3904                 sband = wiphy->bands[band];
3905                 if (!sband)
3906                         continue;
3907
3908                 for (i = 0; i < sband->n_bitrates; i++) {
3909                         if (sband->bitrates[i].bitrate == rateval) {
3910                                 mcast_rate[band] = i + 1;
3911                                 found = true;
3912                                 break;
3913                         }
3914                 }
3915         }
3916
3917         return found;
3918 }
3919
3920 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3921 {
3922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3923         struct net_device *dev = info->user_ptr[1];
3924         struct cfg80211_ibss_params ibss;
3925         struct wiphy *wiphy;
3926         struct cfg80211_cached_keys *connkeys = NULL;
3927         int err;
3928
3929         memset(&ibss, 0, sizeof(ibss));
3930
3931         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3932                 return -EINVAL;
3933
3934         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3935             !info->attrs[NL80211_ATTR_SSID] ||
3936             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3937                 return -EINVAL;
3938
3939         ibss.beacon_interval = 100;
3940
3941         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3942                 ibss.beacon_interval =
3943                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3944                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3945                         return -EINVAL;
3946         }
3947
3948         if (!rdev->ops->join_ibss)
3949                 return -EOPNOTSUPP;
3950
3951         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3952                 return -EOPNOTSUPP;
3953
3954         wiphy = &rdev->wiphy;
3955
3956         if (info->attrs[NL80211_ATTR_MAC])
3957                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3958         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3959         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3960
3961         if (info->attrs[NL80211_ATTR_IE]) {
3962                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3963                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3964         }
3965
3966         ibss.channel = ieee80211_get_channel(wiphy,
3967                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3968         if (!ibss.channel ||
3969             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3970             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
3971                 return -EINVAL;
3972
3973         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3974         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3975
3976         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3977                 u8 *rates =
3978                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3979                 int n_rates =
3980                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3981                 struct ieee80211_supported_band *sband =
3982                         wiphy->bands[ibss.channel->band];
3983                 int i, j;
3984
3985                 if (n_rates == 0)
3986                         return -EINVAL;
3987
3988                 for (i = 0; i < n_rates; i++) {
3989                         int rate = (rates[i] & 0x7f) * 5;
3990                         bool found = false;
3991
3992                         for (j = 0; j < sband->n_bitrates; j++) {
3993                                 if (sband->bitrates[j].bitrate == rate) {
3994                                         found = true;
3995                                         ibss.basic_rates |= BIT(j);
3996                                         break;
3997                                 }
3998                         }
3999                         if (!found)
4000                                 return -EINVAL;
4001                 }
4002         }
4003
4004         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4005             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4006                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4007                 return -EINVAL;
4008
4009         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4010                 connkeys = nl80211_parse_connkeys(rdev,
4011                                         info->attrs[NL80211_ATTR_KEYS]);
4012                 if (IS_ERR(connkeys))
4013                         return PTR_ERR(connkeys);
4014         }
4015
4016         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4017         if (err)
4018                 kfree(connkeys);
4019         return err;
4020 }
4021
4022 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4023 {
4024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4025         struct net_device *dev = info->user_ptr[1];
4026
4027         if (!rdev->ops->leave_ibss)
4028                 return -EOPNOTSUPP;
4029
4030         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4031                 return -EOPNOTSUPP;
4032
4033         return cfg80211_leave_ibss(rdev, dev, false);
4034 }
4035
4036 #ifdef CONFIG_NL80211_TESTMODE
4037 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4038         .name = "testmode",
4039 };
4040
4041 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4042 {
4043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4044         int err;
4045
4046         if (!info->attrs[NL80211_ATTR_TESTDATA])
4047                 return -EINVAL;
4048
4049         err = -EOPNOTSUPP;
4050         if (rdev->ops->testmode_cmd) {
4051                 rdev->testmode_info = info;
4052                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4053                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4054                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4055                 rdev->testmode_info = NULL;
4056         }
4057
4058         return err;
4059 }
4060
4061 static struct sk_buff *
4062 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4063                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4064 {
4065         struct sk_buff *skb;
4066         void *hdr;
4067         struct nlattr *data;
4068
4069         skb = nlmsg_new(approxlen + 100, gfp);
4070         if (!skb)
4071                 return NULL;
4072
4073         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4074         if (!hdr) {
4075                 kfree_skb(skb);
4076                 return NULL;
4077         }
4078
4079         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4080         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4081
4082         ((void **)skb->cb)[0] = rdev;
4083         ((void **)skb->cb)[1] = hdr;
4084         ((void **)skb->cb)[2] = data;
4085
4086         return skb;
4087
4088  nla_put_failure:
4089         kfree_skb(skb);
4090         return NULL;
4091 }
4092
4093 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4094                                                   int approxlen)
4095 {
4096         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4097
4098         if (WARN_ON(!rdev->testmode_info))
4099                 return NULL;
4100
4101         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4102                                 rdev->testmode_info->snd_pid,
4103                                 rdev->testmode_info->snd_seq,
4104                                 GFP_KERNEL);
4105 }
4106 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4107
4108 int cfg80211_testmode_reply(struct sk_buff *skb)
4109 {
4110         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4111         void *hdr = ((void **)skb->cb)[1];
4112         struct nlattr *data = ((void **)skb->cb)[2];
4113
4114         if (WARN_ON(!rdev->testmode_info)) {
4115                 kfree_skb(skb);
4116                 return -EINVAL;
4117         }
4118
4119         nla_nest_end(skb, data);
4120         genlmsg_end(skb, hdr);
4121         return genlmsg_reply(skb, rdev->testmode_info);
4122 }
4123 EXPORT_SYMBOL(cfg80211_testmode_reply);
4124
4125 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4126                                                   int approxlen, gfp_t gfp)
4127 {
4128         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4129
4130         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4131 }
4132 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4133
4134 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4135 {
4136         void *hdr = ((void **)skb->cb)[1];
4137         struct nlattr *data = ((void **)skb->cb)[2];
4138
4139         nla_nest_end(skb, data);
4140         genlmsg_end(skb, hdr);
4141         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4142 }
4143 EXPORT_SYMBOL(cfg80211_testmode_event);
4144 #endif
4145
4146 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4147 {
4148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4149         struct net_device *dev = info->user_ptr[1];
4150         struct cfg80211_connect_params connect;
4151         struct wiphy *wiphy;
4152         struct cfg80211_cached_keys *connkeys = NULL;
4153         int err;
4154
4155         memset(&connect, 0, sizeof(connect));
4156
4157         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4158                 return -EINVAL;
4159
4160         if (!info->attrs[NL80211_ATTR_SSID] ||
4161             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4162                 return -EINVAL;
4163
4164         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4165                 connect.auth_type =
4166                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4167                 if (!nl80211_valid_auth_type(connect.auth_type))
4168                         return -EINVAL;
4169         } else
4170                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4171
4172         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4173
4174         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4175                                       NL80211_MAX_NR_CIPHER_SUITES);
4176         if (err)
4177                 return err;
4178
4179         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4180             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4181                 return -EOPNOTSUPP;
4182
4183         wiphy = &rdev->wiphy;
4184
4185         if (info->attrs[NL80211_ATTR_MAC])
4186                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4187         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4188         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4189
4190         if (info->attrs[NL80211_ATTR_IE]) {
4191                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4192                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4193         }
4194
4195         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4196                 connect.channel =
4197                         ieee80211_get_channel(wiphy,
4198                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4199                 if (!connect.channel ||
4200                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4201                         return -EINVAL;
4202         }
4203
4204         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4205                 connkeys = nl80211_parse_connkeys(rdev,
4206                                         info->attrs[NL80211_ATTR_KEYS]);
4207                 if (IS_ERR(connkeys))
4208                         return PTR_ERR(connkeys);
4209         }
4210
4211         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4212         if (err)
4213                 kfree(connkeys);
4214         return err;
4215 }
4216
4217 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4218 {
4219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4220         struct net_device *dev = info->user_ptr[1];
4221         u16 reason;
4222
4223         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4224                 reason = WLAN_REASON_DEAUTH_LEAVING;
4225         else
4226                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4227
4228         if (reason == 0)
4229                 return -EINVAL;
4230
4231         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4233                 return -EOPNOTSUPP;
4234
4235         return cfg80211_disconnect(rdev, dev, reason, true);
4236 }
4237
4238 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4239 {
4240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4241         struct net *net;
4242         int err;
4243         u32 pid;
4244
4245         if (!info->attrs[NL80211_ATTR_PID])
4246                 return -EINVAL;
4247
4248         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4249
4250         net = get_net_ns_by_pid(pid);
4251         if (IS_ERR(net))
4252                 return PTR_ERR(net);
4253
4254         err = 0;
4255
4256         /* check if anything to do */
4257         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4258                 err = cfg80211_switch_netns(rdev, net);
4259
4260         put_net(net);
4261         return err;
4262 }
4263
4264 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4265 {
4266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4267         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4268                         struct cfg80211_pmksa *pmksa) = NULL;
4269         struct net_device *dev = info->user_ptr[1];
4270         struct cfg80211_pmksa pmksa;
4271
4272         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4273
4274         if (!info->attrs[NL80211_ATTR_MAC])
4275                 return -EINVAL;
4276
4277         if (!info->attrs[NL80211_ATTR_PMKID])
4278                 return -EINVAL;
4279
4280         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4281         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4282
4283         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4284             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4285                 return -EOPNOTSUPP;
4286
4287         switch (info->genlhdr->cmd) {
4288         case NL80211_CMD_SET_PMKSA:
4289                 rdev_ops = rdev->ops->set_pmksa;
4290                 break;
4291         case NL80211_CMD_DEL_PMKSA:
4292                 rdev_ops = rdev->ops->del_pmksa;
4293                 break;
4294         default:
4295                 WARN_ON(1);
4296                 break;
4297         }
4298
4299         if (!rdev_ops)
4300                 return -EOPNOTSUPP;
4301
4302         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4303 }
4304
4305 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4306 {
4307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4308         struct net_device *dev = info->user_ptr[1];
4309
4310         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4311             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4312                 return -EOPNOTSUPP;
4313
4314         if (!rdev->ops->flush_pmksa)
4315                 return -EOPNOTSUPP;
4316
4317         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4318 }
4319
4320 static int nl80211_remain_on_channel(struct sk_buff *skb,
4321                                      struct genl_info *info)
4322 {
4323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4324         struct net_device *dev = info->user_ptr[1];
4325         struct ieee80211_channel *chan;
4326         struct sk_buff *msg;
4327         void *hdr;
4328         u64 cookie;
4329         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4330         u32 freq, duration;
4331         int err;
4332
4333         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4334             !info->attrs[NL80211_ATTR_DURATION])
4335                 return -EINVAL;
4336
4337         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4338
4339         /*
4340          * We should be on that channel for at least one jiffie,
4341          * and more than 5 seconds seems excessive.
4342          */
4343         if (!duration || !msecs_to_jiffies(duration) ||
4344             duration > rdev->wiphy.max_remain_on_channel_duration)
4345                 return -EINVAL;
4346
4347         if (!rdev->ops->remain_on_channel)
4348                 return -EOPNOTSUPP;
4349
4350         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4351                 channel_type = nla_get_u32(
4352                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4353                 if (channel_type != NL80211_CHAN_NO_HT &&
4354                     channel_type != NL80211_CHAN_HT20 &&
4355                     channel_type != NL80211_CHAN_HT40PLUS &&
4356                     channel_type != NL80211_CHAN_HT40MINUS)
4357                         return -EINVAL;
4358         }
4359
4360         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4361         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4362         if (chan == NULL)
4363                 return -EINVAL;
4364
4365         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4366         if (!msg)
4367                 return -ENOMEM;
4368
4369         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4370                              NL80211_CMD_REMAIN_ON_CHANNEL);
4371
4372         if (IS_ERR(hdr)) {
4373                 err = PTR_ERR(hdr);
4374                 goto free_msg;
4375         }
4376
4377         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4378                                            channel_type, duration, &cookie);
4379
4380         if (err)
4381                 goto free_msg;
4382
4383         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4384
4385         genlmsg_end(msg, hdr);
4386
4387         return genlmsg_reply(msg, info);
4388
4389  nla_put_failure:
4390         err = -ENOBUFS;
4391  free_msg:
4392         nlmsg_free(msg);
4393         return err;
4394 }
4395
4396 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4397                                             struct genl_info *info)
4398 {
4399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4400         struct net_device *dev = info->user_ptr[1];
4401         u64 cookie;
4402
4403         if (!info->attrs[NL80211_ATTR_COOKIE])
4404                 return -EINVAL;
4405
4406         if (!rdev->ops->cancel_remain_on_channel)
4407                 return -EOPNOTSUPP;
4408
4409         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4410
4411         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4412 }
4413
4414 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4415                            u8 *rates, u8 rates_len)
4416 {
4417         u8 i;
4418         u32 mask = 0;
4419
4420         for (i = 0; i < rates_len; i++) {
4421                 int rate = (rates[i] & 0x7f) * 5;
4422                 int ridx;
4423                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4424                         struct ieee80211_rate *srate =
4425                                 &sband->bitrates[ridx];
4426                         if (rate == srate->bitrate) {
4427                                 mask |= 1 << ridx;
4428                                 break;
4429                         }
4430                 }
4431                 if (ridx == sband->n_bitrates)
4432                         return 0; /* rate not found */
4433         }
4434
4435         return mask;
4436 }
4437
4438 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4439         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4440                                     .len = NL80211_MAX_SUPP_RATES },
4441 };
4442
4443 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4444                                        struct genl_info *info)
4445 {
4446         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4448         struct cfg80211_bitrate_mask mask;
4449         int rem, i;
4450         struct net_device *dev = info->user_ptr[1];
4451         struct nlattr *tx_rates;
4452         struct ieee80211_supported_band *sband;
4453
4454         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4455                 return -EINVAL;
4456
4457         if (!rdev->ops->set_bitrate_mask)
4458                 return -EOPNOTSUPP;
4459
4460         memset(&mask, 0, sizeof(mask));
4461         /* Default to all rates enabled */
4462         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4463                 sband = rdev->wiphy.bands[i];
4464                 mask.control[i].legacy =
4465                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4466         }
4467
4468         /*
4469          * The nested attribute uses enum nl80211_band as the index. This maps
4470          * directly to the enum ieee80211_band values used in cfg80211.
4471          */
4472         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4473         {
4474                 enum ieee80211_band band = nla_type(tx_rates);
4475                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4476                         return -EINVAL;
4477                 sband = rdev->wiphy.bands[band];
4478                 if (sband == NULL)
4479                         return -EINVAL;
4480                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4481                           nla_len(tx_rates), nl80211_txattr_policy);
4482                 if (tb[NL80211_TXRATE_LEGACY]) {
4483                         mask.control[band].legacy = rateset_to_mask(
4484                                 sband,
4485                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4486                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4487                         if (mask.control[band].legacy == 0)
4488                                 return -EINVAL;
4489                 }
4490         }
4491
4492         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4493 }
4494
4495 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4496 {
4497         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4498         struct net_device *dev = info->user_ptr[1];
4499         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4500
4501         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4502                 return -EINVAL;
4503
4504         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4505                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4506
4507         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4508             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4509             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4510             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4511             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4512             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4513             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4514                 return -EOPNOTSUPP;
4515
4516         /* not much point in registering if we can't reply */
4517         if (!rdev->ops->mgmt_tx)
4518                 return -EOPNOTSUPP;
4519
4520         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4521                         frame_type,
4522                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4523                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4524 }
4525
4526 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4527 {
4528         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4529         struct net_device *dev = info->user_ptr[1];
4530         struct ieee80211_channel *chan;
4531         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4532         bool channel_type_valid = false;
4533         u32 freq;
4534         int err;
4535         void *hdr;
4536         u64 cookie;
4537         struct sk_buff *msg;
4538         unsigned int wait = 0;
4539         bool offchan;
4540
4541         if (!info->attrs[NL80211_ATTR_FRAME] ||
4542             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4543                 return -EINVAL;
4544
4545         if (!rdev->ops->mgmt_tx)
4546                 return -EOPNOTSUPP;
4547
4548         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4549             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4550             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4551             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4552             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4553             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4554             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4555                 return -EOPNOTSUPP;
4556
4557         if (info->attrs[NL80211_ATTR_DURATION]) {
4558                 if (!rdev->ops->mgmt_tx_cancel_wait)
4559                         return -EINVAL;
4560                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4561         }
4562
4563         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4564                 channel_type = nla_get_u32(
4565                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4566                 if (channel_type != NL80211_CHAN_NO_HT &&
4567                     channel_type != NL80211_CHAN_HT20 &&
4568                     channel_type != NL80211_CHAN_HT40PLUS &&
4569                     channel_type != NL80211_CHAN_HT40MINUS)
4570                         return -EINVAL;
4571                 channel_type_valid = true;
4572         }
4573
4574         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
4575
4576         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4577         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4578         if (chan == NULL)
4579                 return -EINVAL;
4580
4581         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4582         if (!msg)
4583                 return -ENOMEM;
4584
4585         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4586                              NL80211_CMD_FRAME);
4587
4588         if (IS_ERR(hdr)) {
4589                 err = PTR_ERR(hdr);
4590                 goto free_msg;
4591         }
4592         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
4593                                     channel_type_valid, wait,
4594                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
4595                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
4596                                     &cookie);
4597         if (err)
4598                 goto free_msg;
4599
4600         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4601
4602         genlmsg_end(msg, hdr);
4603         return genlmsg_reply(msg, info);
4604
4605  nla_put_failure:
4606         err = -ENOBUFS;
4607  free_msg:
4608         nlmsg_free(msg);
4609         return err;
4610 }
4611
4612 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
4613 {
4614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4615         struct net_device *dev = info->user_ptr[1];
4616         u64 cookie;
4617
4618         if (!info->attrs[NL80211_ATTR_COOKIE])
4619                 return -EINVAL;
4620
4621         if (!rdev->ops->mgmt_tx_cancel_wait)
4622                 return -EOPNOTSUPP;
4623
4624         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4625             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4626             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4627             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4628             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4629             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4630                 return -EOPNOTSUPP;
4631
4632         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4633
4634         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
4635 }
4636
4637 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4638 {
4639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4640         struct wireless_dev *wdev;
4641         struct net_device *dev = info->user_ptr[1];
4642         u8 ps_state;
4643         bool state;
4644         int err;
4645
4646         if (!info->attrs[NL80211_ATTR_PS_STATE])
4647                 return -EINVAL;
4648
4649         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4650
4651         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
4652                 return -EINVAL;
4653
4654         wdev = dev->ieee80211_ptr;
4655
4656         if (!rdev->ops->set_power_mgmt)
4657                 return -EOPNOTSUPP;
4658
4659         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4660
4661         if (state == wdev->ps)
4662                 return 0;
4663
4664         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
4665                                         wdev->ps_timeout);
4666         if (!err)
4667                 wdev->ps = state;
4668         return err;
4669 }
4670
4671 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4672 {
4673         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4674         enum nl80211_ps_state ps_state;
4675         struct wireless_dev *wdev;
4676         struct net_device *dev = info->user_ptr[1];
4677         struct sk_buff *msg;
4678         void *hdr;
4679         int err;
4680
4681         wdev = dev->ieee80211_ptr;
4682
4683         if (!rdev->ops->set_power_mgmt)
4684                 return -EOPNOTSUPP;
4685
4686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4687         if (!msg)
4688                 return -ENOMEM;
4689
4690         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4691                              NL80211_CMD_GET_POWER_SAVE);
4692         if (!hdr) {
4693                 err = -ENOBUFS;
4694                 goto free_msg;
4695         }
4696
4697         if (wdev->ps)
4698                 ps_state = NL80211_PS_ENABLED;
4699         else
4700                 ps_state = NL80211_PS_DISABLED;
4701
4702         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4703
4704         genlmsg_end(msg, hdr);
4705         return genlmsg_reply(msg, info);
4706
4707  nla_put_failure:
4708         err = -ENOBUFS;
4709  free_msg:
4710         nlmsg_free(msg);
4711         return err;
4712 }
4713
4714 static struct nla_policy
4715 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4716         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4717         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4718         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4719 };
4720
4721 static int nl80211_set_cqm_rssi(struct genl_info *info,
4722                                 s32 threshold, u32 hysteresis)
4723 {
4724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4725         struct wireless_dev *wdev;
4726         struct net_device *dev = info->user_ptr[1];
4727
4728         if (threshold > 0)
4729                 return -EINVAL;
4730
4731         wdev = dev->ieee80211_ptr;
4732
4733         if (!rdev->ops->set_cqm_rssi_config)
4734                 return -EOPNOTSUPP;
4735
4736         if (wdev->iftype != NL80211_IFTYPE_STATION &&
4737             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
4738                 return -EOPNOTSUPP;
4739
4740         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4741                                               threshold, hysteresis);
4742 }
4743
4744 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4745 {
4746         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4747         struct nlattr *cqm;
4748         int err;
4749
4750         cqm = info->attrs[NL80211_ATTR_CQM];
4751         if (!cqm) {
4752                 err = -EINVAL;
4753                 goto out;
4754         }
4755
4756         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4757                                nl80211_attr_cqm_policy);
4758         if (err)
4759                 goto out;
4760
4761         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4762             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4763                 s32 threshold;
4764                 u32 hysteresis;
4765                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4766                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4767                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4768         } else
4769                 err = -EINVAL;
4770
4771 out:
4772         return err;
4773 }
4774
4775 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
4776 {
4777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4778         struct net_device *dev = info->user_ptr[1];
4779         struct mesh_config cfg;
4780         struct mesh_setup setup;
4781         int err;
4782
4783         /* start with default */
4784         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
4785         memcpy(&setup, &default_mesh_setup, sizeof(setup));
4786
4787         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
4788                 /* and parse parameters if given */
4789                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
4790                 if (err)
4791                         return err;
4792         }
4793
4794         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
4795             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
4796                 return -EINVAL;
4797
4798         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
4799         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4800
4801         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
4802                 /* parse additional setup parameters if given */
4803                 err = nl80211_parse_mesh_setup(info, &setup);
4804                 if (err)
4805                         return err;
4806         }
4807
4808         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
4809 }
4810
4811 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
4812 {
4813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4814         struct net_device *dev = info->user_ptr[1];
4815
4816         return cfg80211_leave_mesh(rdev, dev);
4817 }
4818
4819 #define NL80211_FLAG_NEED_WIPHY         0x01
4820 #define NL80211_FLAG_NEED_NETDEV        0x02
4821 #define NL80211_FLAG_NEED_RTNL          0x04
4822 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
4823 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
4824                                          NL80211_FLAG_CHECK_NETDEV_UP)
4825
4826 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
4827                             struct genl_info *info)
4828 {
4829         struct cfg80211_registered_device *rdev;
4830         struct net_device *dev;
4831         int err;
4832         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
4833
4834         if (rtnl)
4835                 rtnl_lock();
4836
4837         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
4838                 rdev = cfg80211_get_dev_from_info(info);
4839                 if (IS_ERR(rdev)) {
4840                         if (rtnl)
4841                                 rtnl_unlock();
4842                         return PTR_ERR(rdev);
4843                 }
4844                 info->user_ptr[0] = rdev;
4845         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
4846                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4847                 if (err) {
4848                         if (rtnl)
4849                                 rtnl_unlock();
4850                         return err;
4851                 }
4852                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
4853                     !netif_running(dev)) {
4854                         cfg80211_unlock_rdev(rdev);
4855                         dev_put(dev);
4856                         if (rtnl)
4857                                 rtnl_unlock();
4858                         return -ENETDOWN;
4859                 }
4860                 info->user_ptr[0] = rdev;
4861                 info->user_ptr[1] = dev;
4862         }
4863
4864         return 0;
4865 }
4866
4867 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
4868                               struct genl_info *info)
4869 {
4870         if (info->user_ptr[0])
4871                 cfg80211_unlock_rdev(info->user_ptr[0]);
4872         if (info->user_ptr[1])
4873                 dev_put(info->user_ptr[1]);
4874         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
4875                 rtnl_unlock();
4876 }
4877
4878 static struct genl_ops nl80211_ops[] = {
4879         {
4880                 .cmd = NL80211_CMD_GET_WIPHY,
4881                 .doit = nl80211_get_wiphy,
4882                 .dumpit = nl80211_dump_wiphy,
4883                 .policy = nl80211_policy,
4884                 /* can be retrieved by unprivileged users */
4885                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
4886         },
4887         {
4888                 .cmd = NL80211_CMD_SET_WIPHY,
4889                 .doit = nl80211_set_wiphy,
4890                 .policy = nl80211_policy,
4891                 .flags = GENL_ADMIN_PERM,
4892                 .internal_flags = NL80211_FLAG_NEED_RTNL,
4893         },
4894         {
4895                 .cmd = NL80211_CMD_GET_INTERFACE,
4896                 .doit = nl80211_get_interface,
4897                 .dumpit = nl80211_dump_interface,
4898                 .policy = nl80211_policy,
4899                 /* can be retrieved by unprivileged users */
4900                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
4901         },
4902         {
4903                 .cmd = NL80211_CMD_SET_INTERFACE,
4904                 .doit = nl80211_set_interface,
4905                 .policy = nl80211_policy,
4906                 .flags = GENL_ADMIN_PERM,
4907                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4908                                   NL80211_FLAG_NEED_RTNL,
4909         },
4910         {
4911                 .cmd = NL80211_CMD_NEW_INTERFACE,
4912                 .doit = nl80211_new_interface,
4913                 .policy = nl80211_policy,
4914                 .flags = GENL_ADMIN_PERM,
4915                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4916                                   NL80211_FLAG_NEED_RTNL,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_DEL_INTERFACE,
4920                 .doit = nl80211_del_interface,
4921                 .policy = nl80211_policy,
4922                 .flags = GENL_ADMIN_PERM,
4923                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4924                                   NL80211_FLAG_NEED_RTNL,
4925         },
4926         {
4927                 .cmd = NL80211_CMD_GET_KEY,
4928                 .doit = nl80211_get_key,
4929                 .policy = nl80211_policy,
4930                 .flags = GENL_ADMIN_PERM,
4931                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4932                                   NL80211_FLAG_NEED_RTNL,
4933         },
4934         {
4935                 .cmd = NL80211_CMD_SET_KEY,
4936                 .doit = nl80211_set_key,
4937                 .policy = nl80211_policy,
4938                 .flags = GENL_ADMIN_PERM,
4939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4940                                   NL80211_FLAG_NEED_RTNL,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_NEW_KEY,
4944                 .doit = nl80211_new_key,
4945                 .policy = nl80211_policy,
4946                 .flags = GENL_ADMIN_PERM,
4947                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4948                                   NL80211_FLAG_NEED_RTNL,
4949         },
4950         {
4951                 .cmd = NL80211_CMD_DEL_KEY,
4952                 .doit = nl80211_del_key,
4953                 .policy = nl80211_policy,
4954                 .flags = GENL_ADMIN_PERM,
4955                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4956                                   NL80211_FLAG_NEED_RTNL,
4957         },
4958         {
4959                 .cmd = NL80211_CMD_SET_BEACON,
4960                 .policy = nl80211_policy,
4961                 .flags = GENL_ADMIN_PERM,
4962                 .doit = nl80211_addset_beacon,
4963                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4964                                   NL80211_FLAG_NEED_RTNL,
4965         },
4966         {
4967                 .cmd = NL80211_CMD_NEW_BEACON,
4968                 .policy = nl80211_policy,
4969                 .flags = GENL_ADMIN_PERM,
4970                 .doit = nl80211_addset_beacon,
4971                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4972                                   NL80211_FLAG_NEED_RTNL,
4973         },
4974         {
4975                 .cmd = NL80211_CMD_DEL_BEACON,
4976                 .policy = nl80211_policy,
4977                 .flags = GENL_ADMIN_PERM,
4978                 .doit = nl80211_del_beacon,
4979                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4980                                   NL80211_FLAG_NEED_RTNL,
4981         },
4982         {
4983                 .cmd = NL80211_CMD_GET_STATION,
4984                 .doit = nl80211_get_station,
4985                 .dumpit = nl80211_dump_station,
4986                 .policy = nl80211_policy,
4987                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4988                                   NL80211_FLAG_NEED_RTNL,
4989         },
4990         {
4991                 .cmd = NL80211_CMD_SET_STATION,
4992                 .doit = nl80211_set_station,
4993                 .policy = nl80211_policy,
4994                 .flags = GENL_ADMIN_PERM,
4995                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4996                                   NL80211_FLAG_NEED_RTNL,
4997         },
4998         {
4999                 .cmd = NL80211_CMD_NEW_STATION,
5000                 .doit = nl80211_new_station,
5001                 .policy = nl80211_policy,
5002                 .flags = GENL_ADMIN_PERM,
5003                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5004                                   NL80211_FLAG_NEED_RTNL,
5005         },
5006         {
5007                 .cmd = NL80211_CMD_DEL_STATION,
5008                 .doit = nl80211_del_station,
5009                 .policy = nl80211_policy,
5010                 .flags = GENL_ADMIN_PERM,
5011                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5012                                   NL80211_FLAG_NEED_RTNL,
5013         },
5014         {
5015                 .cmd = NL80211_CMD_GET_MPATH,
5016                 .doit = nl80211_get_mpath,
5017                 .dumpit = nl80211_dump_mpath,
5018                 .policy = nl80211_policy,
5019                 .flags = GENL_ADMIN_PERM,
5020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5021                                   NL80211_FLAG_NEED_RTNL,
5022         },
5023         {
5024                 .cmd = NL80211_CMD_SET_MPATH,
5025                 .doit = nl80211_set_mpath,
5026                 .policy = nl80211_policy,
5027                 .flags = GENL_ADMIN_PERM,
5028                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5029                                   NL80211_FLAG_NEED_RTNL,
5030         },
5031         {
5032                 .cmd = NL80211_CMD_NEW_MPATH,
5033                 .doit = nl80211_new_mpath,
5034                 .policy = nl80211_policy,
5035                 .flags = GENL_ADMIN_PERM,
5036                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5037                                   NL80211_FLAG_NEED_RTNL,
5038         },
5039         {
5040                 .cmd = NL80211_CMD_DEL_MPATH,
5041                 .doit = nl80211_del_mpath,
5042                 .policy = nl80211_policy,
5043                 .flags = GENL_ADMIN_PERM,
5044                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5045                                   NL80211_FLAG_NEED_RTNL,
5046         },
5047         {
5048                 .cmd = NL80211_CMD_SET_BSS,
5049                 .doit = nl80211_set_bss,
5050                 .policy = nl80211_policy,
5051                 .flags = GENL_ADMIN_PERM,
5052                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5053                                   NL80211_FLAG_NEED_RTNL,
5054         },
5055         {
5056                 .cmd = NL80211_CMD_GET_REG,
5057                 .doit = nl80211_get_reg,
5058                 .policy = nl80211_policy,
5059                 /* can be retrieved by unprivileged users */
5060         },
5061         {
5062                 .cmd = NL80211_CMD_SET_REG,
5063                 .doit = nl80211_set_reg,
5064                 .policy = nl80211_policy,
5065                 .flags = GENL_ADMIN_PERM,
5066         },
5067         {
5068                 .cmd = NL80211_CMD_REQ_SET_REG,
5069                 .doit = nl80211_req_set_reg,
5070                 .policy = nl80211_policy,
5071                 .flags = GENL_ADMIN_PERM,
5072         },
5073         {
5074                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5075                 .doit = nl80211_get_mesh_config,
5076                 .policy = nl80211_policy,
5077                 /* can be retrieved by unprivileged users */
5078                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5079                                   NL80211_FLAG_NEED_RTNL,
5080         },
5081         {
5082                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5083                 .doit = nl80211_update_mesh_config,
5084                 .policy = nl80211_policy,
5085                 .flags = GENL_ADMIN_PERM,
5086                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5087                                   NL80211_FLAG_NEED_RTNL,
5088         },
5089         {
5090                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5091                 .doit = nl80211_trigger_scan,
5092                 .policy = nl80211_policy,
5093                 .flags = GENL_ADMIN_PERM,
5094                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5095                                   NL80211_FLAG_NEED_RTNL,
5096         },
5097         {
5098                 .cmd = NL80211_CMD_GET_SCAN,
5099                 .policy = nl80211_policy,
5100                 .dumpit = nl80211_dump_scan,
5101         },
5102         {
5103                 .cmd = NL80211_CMD_AUTHENTICATE,
5104                 .doit = nl80211_authenticate,
5105                 .policy = nl80211_policy,
5106                 .flags = GENL_ADMIN_PERM,
5107                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5108                                   NL80211_FLAG_NEED_RTNL,
5109         },
5110         {
5111                 .cmd = NL80211_CMD_ASSOCIATE,
5112                 .doit = nl80211_associate,
5113                 .policy = nl80211_policy,
5114                 .flags = GENL_ADMIN_PERM,
5115                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5116                                   NL80211_FLAG_NEED_RTNL,
5117         },
5118         {
5119                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5120                 .doit = nl80211_deauthenticate,
5121                 .policy = nl80211_policy,
5122                 .flags = GENL_ADMIN_PERM,
5123                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5124                                   NL80211_FLAG_NEED_RTNL,
5125         },
5126         {
5127                 .cmd = NL80211_CMD_DISASSOCIATE,
5128                 .doit = nl80211_disassociate,
5129                 .policy = nl80211_policy,
5130                 .flags = GENL_ADMIN_PERM,
5131                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5132                                   NL80211_FLAG_NEED_RTNL,
5133         },
5134         {
5135                 .cmd = NL80211_CMD_JOIN_IBSS,
5136                 .doit = nl80211_join_ibss,
5137                 .policy = nl80211_policy,
5138                 .flags = GENL_ADMIN_PERM,
5139                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5140                                   NL80211_FLAG_NEED_RTNL,
5141         },
5142         {
5143                 .cmd = NL80211_CMD_LEAVE_IBSS,
5144                 .doit = nl80211_leave_ibss,
5145                 .policy = nl80211_policy,
5146                 .flags = GENL_ADMIN_PERM,
5147                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5148                                   NL80211_FLAG_NEED_RTNL,
5149         },
5150 #ifdef CONFIG_NL80211_TESTMODE
5151         {
5152                 .cmd = NL80211_CMD_TESTMODE,
5153                 .doit = nl80211_testmode_do,
5154                 .policy = nl80211_policy,
5155                 .flags = GENL_ADMIN_PERM,
5156                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5157                                   NL80211_FLAG_NEED_RTNL,
5158         },
5159 #endif
5160         {
5161                 .cmd = NL80211_CMD_CONNECT,
5162                 .doit = nl80211_connect,
5163                 .policy = nl80211_policy,
5164                 .flags = GENL_ADMIN_PERM,
5165                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5166                                   NL80211_FLAG_NEED_RTNL,
5167         },
5168         {
5169                 .cmd = NL80211_CMD_DISCONNECT,
5170                 .doit = nl80211_disconnect,
5171                 .policy = nl80211_policy,
5172                 .flags = GENL_ADMIN_PERM,
5173                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5174                                   NL80211_FLAG_NEED_RTNL,
5175         },
5176         {
5177                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5178                 .doit = nl80211_wiphy_netns,
5179                 .policy = nl80211_policy,
5180                 .flags = GENL_ADMIN_PERM,
5181                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5182                                   NL80211_FLAG_NEED_RTNL,
5183         },
5184         {
5185                 .cmd = NL80211_CMD_GET_SURVEY,
5186                 .policy = nl80211_policy,
5187                 .dumpit = nl80211_dump_survey,
5188         },
5189         {
5190                 .cmd = NL80211_CMD_SET_PMKSA,
5191                 .doit = nl80211_setdel_pmksa,
5192                 .policy = nl80211_policy,
5193                 .flags = GENL_ADMIN_PERM,
5194                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5195                                   NL80211_FLAG_NEED_RTNL,
5196         },
5197         {
5198                 .cmd = NL80211_CMD_DEL_PMKSA,
5199                 .doit = nl80211_setdel_pmksa,
5200                 .policy = nl80211_policy,
5201                 .flags = GENL_ADMIN_PERM,
5202                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5203                                   NL80211_FLAG_NEED_RTNL,
5204         },
5205         {
5206                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5207                 .doit = nl80211_flush_pmksa,
5208                 .policy = nl80211_policy,
5209                 .flags = GENL_ADMIN_PERM,
5210                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5211                                   NL80211_FLAG_NEED_RTNL,
5212         },
5213         {
5214                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5215                 .doit = nl80211_remain_on_channel,
5216                 .policy = nl80211_policy,
5217                 .flags = GENL_ADMIN_PERM,
5218                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5219                                   NL80211_FLAG_NEED_RTNL,
5220         },
5221         {
5222                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5223                 .doit = nl80211_cancel_remain_on_channel,
5224                 .policy = nl80211_policy,
5225                 .flags = GENL_ADMIN_PERM,
5226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5227                                   NL80211_FLAG_NEED_RTNL,
5228         },
5229         {
5230                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5231                 .doit = nl80211_set_tx_bitrate_mask,
5232                 .policy = nl80211_policy,
5233                 .flags = GENL_ADMIN_PERM,
5234                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5235                                   NL80211_FLAG_NEED_RTNL,
5236         },
5237         {
5238                 .cmd = NL80211_CMD_REGISTER_FRAME,
5239                 .doit = nl80211_register_mgmt,
5240                 .policy = nl80211_policy,
5241                 .flags = GENL_ADMIN_PERM,
5242                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5243                                   NL80211_FLAG_NEED_RTNL,
5244         },
5245         {
5246                 .cmd = NL80211_CMD_FRAME,
5247                 .doit = nl80211_tx_mgmt,
5248                 .policy = nl80211_policy,
5249                 .flags = GENL_ADMIN_PERM,
5250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5251                                   NL80211_FLAG_NEED_RTNL,
5252         },
5253         {
5254                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
5255                 .doit = nl80211_tx_mgmt_cancel_wait,
5256                 .policy = nl80211_policy,
5257                 .flags = GENL_ADMIN_PERM,
5258                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5259                                   NL80211_FLAG_NEED_RTNL,
5260         },
5261         {
5262                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5263                 .doit = nl80211_set_power_save,
5264                 .policy = nl80211_policy,
5265                 .flags = GENL_ADMIN_PERM,
5266                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5267                                   NL80211_FLAG_NEED_RTNL,
5268         },
5269         {
5270                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5271                 .doit = nl80211_get_power_save,
5272                 .policy = nl80211_policy,
5273                 /* can be retrieved by unprivileged users */
5274                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5275                                   NL80211_FLAG_NEED_RTNL,
5276         },
5277         {
5278                 .cmd = NL80211_CMD_SET_CQM,
5279                 .doit = nl80211_set_cqm,
5280                 .policy = nl80211_policy,
5281                 .flags = GENL_ADMIN_PERM,
5282                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5283                                   NL80211_FLAG_NEED_RTNL,
5284         },
5285         {
5286                 .cmd = NL80211_CMD_SET_CHANNEL,
5287                 .doit = nl80211_set_channel,
5288                 .policy = nl80211_policy,
5289                 .flags = GENL_ADMIN_PERM,
5290                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5291                                   NL80211_FLAG_NEED_RTNL,
5292         },
5293         {
5294                 .cmd = NL80211_CMD_SET_WDS_PEER,
5295                 .doit = nl80211_set_wds_peer,
5296                 .policy = nl80211_policy,
5297                 .flags = GENL_ADMIN_PERM,
5298                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5299                                   NL80211_FLAG_NEED_RTNL,
5300         },
5301         {
5302                 .cmd = NL80211_CMD_JOIN_MESH,
5303                 .doit = nl80211_join_mesh,
5304                 .policy = nl80211_policy,
5305                 .flags = GENL_ADMIN_PERM,
5306                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5307                                   NL80211_FLAG_NEED_RTNL,
5308         },
5309         {
5310                 .cmd = NL80211_CMD_LEAVE_MESH,
5311                 .doit = nl80211_leave_mesh,
5312                 .policy = nl80211_policy,
5313                 .flags = GENL_ADMIN_PERM,
5314                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5315                                   NL80211_FLAG_NEED_RTNL,
5316         },
5317 };
5318
5319 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5320         .name = "mlme",
5321 };
5322
5323 /* multicast groups */
5324 static struct genl_multicast_group nl80211_config_mcgrp = {
5325         .name = "config",
5326 };
5327 static struct genl_multicast_group nl80211_scan_mcgrp = {
5328         .name = "scan",
5329 };
5330 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5331         .name = "regulatory",
5332 };
5333
5334 /* notification functions */
5335
5336 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5337 {
5338         struct sk_buff *msg;
5339
5340         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5341         if (!msg)
5342                 return;
5343
5344         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5345                 nlmsg_free(msg);
5346                 return;
5347         }
5348
5349         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5350                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5351 }
5352
5353 static int nl80211_add_scan_req(struct sk_buff *msg,
5354                                 struct cfg80211_registered_device *rdev)
5355 {
5356         struct cfg80211_scan_request *req = rdev->scan_req;
5357         struct nlattr *nest;
5358         int i;
5359
5360         ASSERT_RDEV_LOCK(rdev);
5361
5362         if (WARN_ON(!req))
5363                 return 0;
5364
5365         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5366         if (!nest)
5367                 goto nla_put_failure;
5368         for (i = 0; i < req->n_ssids; i++)
5369                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5370         nla_nest_end(msg, nest);
5371
5372         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5373         if (!nest)
5374                 goto nla_put_failure;
5375         for (i = 0; i < req->n_channels; i++)
5376                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5377         nla_nest_end(msg, nest);
5378
5379         if (req->ie)
5380                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5381
5382         return 0;
5383  nla_put_failure:
5384         return -ENOBUFS;
5385 }
5386
5387 static int nl80211_send_scan_msg(struct sk_buff *msg,
5388                                  struct cfg80211_registered_device *rdev,
5389                                  struct net_device *netdev,
5390                                  u32 pid, u32 seq, int flags,
5391                                  u32 cmd)
5392 {
5393         void *hdr;
5394
5395         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5396         if (!hdr)
5397                 return -1;
5398
5399         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5400         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5401
5402         /* ignore errors and send incomplete event anyway */
5403         nl80211_add_scan_req(msg, rdev);
5404
5405         return genlmsg_end(msg, hdr);
5406
5407  nla_put_failure:
5408         genlmsg_cancel(msg, hdr);
5409         return -EMSGSIZE;
5410 }
5411
5412 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5413                              struct net_device *netdev)
5414 {
5415         struct sk_buff *msg;
5416
5417         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5418         if (!msg)
5419                 return;
5420
5421         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5422                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5423                 nlmsg_free(msg);
5424                 return;
5425         }
5426
5427         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5428                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5429 }
5430
5431 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5432                             struct net_device *netdev)
5433 {
5434         struct sk_buff *msg;
5435
5436         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5437         if (!msg)
5438                 return;
5439
5440         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5441                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5442                 nlmsg_free(msg);
5443                 return;
5444         }
5445
5446         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5447                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5448 }
5449
5450 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5451                                struct net_device *netdev)
5452 {
5453         struct sk_buff *msg;
5454
5455         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5456         if (!msg)
5457                 return;
5458
5459         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5460                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5461                 nlmsg_free(msg);
5462                 return;
5463         }
5464
5465         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5466                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5467 }
5468
5469 /*
5470  * This can happen on global regulatory changes or device specific settings
5471  * based on custom world regulatory domains.
5472  */
5473 void nl80211_send_reg_change_event(struct regulatory_request *request)
5474 {
5475         struct sk_buff *msg;
5476         void *hdr;
5477
5478         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5479         if (!msg)
5480                 return;
5481
5482         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5483         if (!hdr) {
5484                 nlmsg_free(msg);
5485                 return;
5486         }
5487
5488         /* Userspace can always count this one always being set */
5489         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5490
5491         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5492                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5493                            NL80211_REGDOM_TYPE_WORLD);
5494         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5495                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5496                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5497         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5498                  request->intersect)
5499                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5500                            NL80211_REGDOM_TYPE_INTERSECTION);
5501         else {
5502                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5503                            NL80211_REGDOM_TYPE_COUNTRY);
5504                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5505         }
5506
5507         if (wiphy_idx_valid(request->wiphy_idx))
5508                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5509
5510         if (genlmsg_end(msg, hdr) < 0) {
5511                 nlmsg_free(msg);
5512                 return;
5513         }
5514
5515         rcu_read_lock();
5516         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5517                                 GFP_ATOMIC);
5518         rcu_read_unlock();
5519
5520         return;
5521
5522 nla_put_failure:
5523         genlmsg_cancel(msg, hdr);
5524         nlmsg_free(msg);
5525 }
5526
5527 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5528                                     struct net_device *netdev,
5529                                     const u8 *buf, size_t len,
5530                                     enum nl80211_commands cmd, gfp_t gfp)
5531 {
5532         struct sk_buff *msg;
5533         void *hdr;
5534
5535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5536         if (!msg)
5537                 return;
5538
5539         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5540         if (!hdr) {
5541                 nlmsg_free(msg);
5542                 return;
5543         }
5544
5545         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5546         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5547         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5548
5549         if (genlmsg_end(msg, hdr) < 0) {
5550                 nlmsg_free(msg);
5551                 return;
5552         }
5553
5554         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5555                                 nl80211_mlme_mcgrp.id, gfp);
5556         return;
5557
5558  nla_put_failure:
5559         genlmsg_cancel(msg, hdr);
5560         nlmsg_free(msg);
5561 }
5562
5563 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5564                           struct net_device *netdev, const u8 *buf,
5565                           size_t len, gfp_t gfp)
5566 {
5567         nl80211_send_mlme_event(rdev, netdev, buf, len,
5568                                 NL80211_CMD_AUTHENTICATE, gfp);
5569 }
5570
5571 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5572                            struct net_device *netdev, const u8 *buf,
5573                            size_t len, gfp_t gfp)
5574 {
5575         nl80211_send_mlme_event(rdev, netdev, buf, len,
5576                                 NL80211_CMD_ASSOCIATE, gfp);
5577 }
5578
5579 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5580                          struct net_device *netdev, const u8 *buf,
5581                          size_t len, gfp_t gfp)
5582 {
5583         nl80211_send_mlme_event(rdev, netdev, buf, len,
5584                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5585 }
5586
5587 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5588                            struct net_device *netdev, const u8 *buf,
5589                            size_t len, gfp_t gfp)
5590 {
5591         nl80211_send_mlme_event(rdev, netdev, buf, len,
5592                                 NL80211_CMD_DISASSOCIATE, gfp);
5593 }
5594
5595 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
5596                                 struct net_device *netdev, const u8 *buf,
5597                                 size_t len, gfp_t gfp)
5598 {
5599         nl80211_send_mlme_event(rdev, netdev, buf, len,
5600                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
5601 }
5602
5603 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
5604                                   struct net_device *netdev, const u8 *buf,
5605                                   size_t len, gfp_t gfp)
5606 {
5607         nl80211_send_mlme_event(rdev, netdev, buf, len,
5608                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
5609 }
5610
5611 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5612                                       struct net_device *netdev, int cmd,
5613                                       const u8 *addr, gfp_t gfp)
5614 {
5615         struct sk_buff *msg;
5616         void *hdr;
5617
5618         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5619         if (!msg)
5620                 return;
5621
5622         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5623         if (!hdr) {
5624                 nlmsg_free(msg);
5625                 return;
5626         }
5627
5628         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5629         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5630         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5631         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5632
5633         if (genlmsg_end(msg, hdr) < 0) {
5634                 nlmsg_free(msg);
5635                 return;
5636         }
5637
5638         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5639                                 nl80211_mlme_mcgrp.id, gfp);
5640         return;
5641
5642  nla_put_failure:
5643         genlmsg_cancel(msg, hdr);
5644         nlmsg_free(msg);
5645 }
5646
5647 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5648                                struct net_device *netdev, const u8 *addr,
5649                                gfp_t gfp)
5650 {
5651         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5652                                   addr, gfp);
5653 }
5654
5655 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5656                                 struct net_device *netdev, const u8 *addr,
5657                                 gfp_t gfp)
5658 {
5659         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5660                                   addr, gfp);
5661 }
5662
5663 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5664                                  struct net_device *netdev, const u8 *bssid,
5665                                  const u8 *req_ie, size_t req_ie_len,
5666                                  const u8 *resp_ie, size_t resp_ie_len,
5667                                  u16 status, gfp_t gfp)
5668 {
5669         struct sk_buff *msg;
5670         void *hdr;
5671
5672         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5673         if (!msg)
5674                 return;
5675
5676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5677         if (!hdr) {
5678                 nlmsg_free(msg);
5679                 return;
5680         }
5681
5682         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5683         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5684         if (bssid)
5685                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5686         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5687         if (req_ie)
5688                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5689         if (resp_ie)
5690                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5691
5692         if (genlmsg_end(msg, hdr) < 0) {
5693                 nlmsg_free(msg);
5694                 return;
5695         }
5696
5697         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5698                                 nl80211_mlme_mcgrp.id, gfp);
5699         return;
5700
5701  nla_put_failure:
5702         genlmsg_cancel(msg, hdr);
5703         nlmsg_free(msg);
5704
5705 }
5706
5707 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5708                          struct net_device *netdev, const u8 *bssid,
5709                          const u8 *req_ie, size_t req_ie_len,
5710                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5711 {
5712         struct sk_buff *msg;
5713         void *hdr;
5714
5715         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5716         if (!msg)
5717                 return;
5718
5719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5720         if (!hdr) {
5721                 nlmsg_free(msg);
5722                 return;
5723         }
5724
5725         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5726         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5727         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5728         if (req_ie)
5729                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5730         if (resp_ie)
5731                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5732
5733         if (genlmsg_end(msg, hdr) < 0) {
5734                 nlmsg_free(msg);
5735                 return;
5736         }
5737
5738         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5739                                 nl80211_mlme_mcgrp.id, gfp);
5740         return;
5741
5742  nla_put_failure:
5743         genlmsg_cancel(msg, hdr);
5744         nlmsg_free(msg);
5745
5746 }
5747
5748 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5749                                struct net_device *netdev, u16 reason,
5750                                const u8 *ie, size_t ie_len, bool from_ap)
5751 {
5752         struct sk_buff *msg;
5753         void *hdr;
5754
5755         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5756         if (!msg)
5757                 return;
5758
5759         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5760         if (!hdr) {
5761                 nlmsg_free(msg);
5762                 return;
5763         }
5764
5765         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5766         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5767         if (from_ap && reason)
5768                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5769         if (from_ap)
5770                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5771         if (ie)
5772                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5773
5774         if (genlmsg_end(msg, hdr) < 0) {
5775                 nlmsg_free(msg);
5776                 return;
5777         }
5778
5779         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5780                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5781         return;
5782
5783  nla_put_failure:
5784         genlmsg_cancel(msg, hdr);
5785         nlmsg_free(msg);
5786
5787 }
5788
5789 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5790                              struct net_device *netdev, const u8 *bssid,
5791                              gfp_t gfp)
5792 {
5793         struct sk_buff *msg;
5794         void *hdr;
5795
5796         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5797         if (!msg)
5798                 return;
5799
5800         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5801         if (!hdr) {
5802                 nlmsg_free(msg);
5803                 return;
5804         }
5805
5806         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5807         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5808         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5809
5810         if (genlmsg_end(msg, hdr) < 0) {
5811                 nlmsg_free(msg);
5812                 return;
5813         }
5814
5815         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5816                                 nl80211_mlme_mcgrp.id, gfp);
5817         return;
5818
5819  nla_put_failure:
5820         genlmsg_cancel(msg, hdr);
5821         nlmsg_free(msg);
5822 }
5823
5824 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
5825                 struct net_device *netdev,
5826                 const u8 *macaddr, const u8* ie, u8 ie_len,
5827                 gfp_t gfp)
5828 {
5829         struct sk_buff *msg;
5830         void *hdr;
5831
5832         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5833         if (!msg)
5834                 return;
5835
5836         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
5837         if (!hdr) {
5838                 nlmsg_free(msg);
5839                 return;
5840         }
5841
5842         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5843         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5844         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
5845         if (ie_len && ie)
5846                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
5847
5848         if (genlmsg_end(msg, hdr) < 0) {
5849                 nlmsg_free(msg);
5850                 return;
5851         }
5852
5853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5854                                 nl80211_mlme_mcgrp.id, gfp);
5855         return;
5856
5857  nla_put_failure:
5858         genlmsg_cancel(msg, hdr);
5859         nlmsg_free(msg);
5860 }
5861
5862 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5863                                  struct net_device *netdev, const u8 *addr,
5864                                  enum nl80211_key_type key_type, int key_id,
5865                                  const u8 *tsc, gfp_t gfp)
5866 {
5867         struct sk_buff *msg;
5868         void *hdr;
5869
5870         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5871         if (!msg)
5872                 return;
5873
5874         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5875         if (!hdr) {
5876                 nlmsg_free(msg);
5877                 return;
5878         }
5879
5880         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5881         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5882         if (addr)
5883                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5884         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5885         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5886         if (tsc)
5887                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5888
5889         if (genlmsg_end(msg, hdr) < 0) {
5890                 nlmsg_free(msg);
5891                 return;
5892         }
5893
5894         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5895                                 nl80211_mlme_mcgrp.id, gfp);
5896         return;
5897
5898  nla_put_failure:
5899         genlmsg_cancel(msg, hdr);
5900         nlmsg_free(msg);
5901 }
5902
5903 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5904                                     struct ieee80211_channel *channel_before,
5905                                     struct ieee80211_channel *channel_after)
5906 {
5907         struct sk_buff *msg;
5908         void *hdr;
5909         struct nlattr *nl_freq;
5910
5911         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5912         if (!msg)
5913                 return;
5914
5915         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5916         if (!hdr) {
5917                 nlmsg_free(msg);
5918                 return;
5919         }
5920
5921         /*
5922          * Since we are applying the beacon hint to a wiphy we know its
5923          * wiphy_idx is valid
5924          */
5925         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5926
5927         /* Before */
5928         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5929         if (!nl_freq)
5930                 goto nla_put_failure;
5931         if (nl80211_msg_put_channel(msg, channel_before))
5932                 goto nla_put_failure;
5933         nla_nest_end(msg, nl_freq);
5934
5935         /* After */
5936         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5937         if (!nl_freq)
5938                 goto nla_put_failure;
5939         if (nl80211_msg_put_channel(msg, channel_after))
5940                 goto nla_put_failure;
5941         nla_nest_end(msg, nl_freq);
5942
5943         if (genlmsg_end(msg, hdr) < 0) {
5944                 nlmsg_free(msg);
5945                 return;
5946         }
5947
5948         rcu_read_lock();
5949         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5950                                 GFP_ATOMIC);
5951         rcu_read_unlock();
5952
5953         return;
5954
5955 nla_put_failure:
5956         genlmsg_cancel(msg, hdr);
5957         nlmsg_free(msg);
5958 }
5959
5960 static void nl80211_send_remain_on_chan_event(
5961         int cmd, struct cfg80211_registered_device *rdev,
5962         struct net_device *netdev, u64 cookie,
5963         struct ieee80211_channel *chan,
5964         enum nl80211_channel_type channel_type,
5965         unsigned int duration, gfp_t gfp)
5966 {
5967         struct sk_buff *msg;
5968         void *hdr;
5969
5970         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5971         if (!msg)
5972                 return;
5973
5974         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5975         if (!hdr) {
5976                 nlmsg_free(msg);
5977                 return;
5978         }
5979
5980         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5981         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5982         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5983         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5984         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5985
5986         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5987                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5988
5989         if (genlmsg_end(msg, hdr) < 0) {
5990                 nlmsg_free(msg);
5991                 return;
5992         }
5993
5994         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5995                                 nl80211_mlme_mcgrp.id, gfp);
5996         return;
5997
5998  nla_put_failure:
5999         genlmsg_cancel(msg, hdr);
6000         nlmsg_free(msg);
6001 }
6002
6003 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
6004                                     struct net_device *netdev, u64 cookie,
6005                                     struct ieee80211_channel *chan,
6006                                     enum nl80211_channel_type channel_type,
6007                                     unsigned int duration, gfp_t gfp)
6008 {
6009         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
6010                                           rdev, netdev, cookie, chan,
6011                                           channel_type, duration, gfp);
6012 }
6013
6014 void nl80211_send_remain_on_channel_cancel(
6015         struct cfg80211_registered_device *rdev, struct net_device *netdev,
6016         u64 cookie, struct ieee80211_channel *chan,
6017         enum nl80211_channel_type channel_type, gfp_t gfp)
6018 {
6019         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6020                                           rdev, netdev, cookie, chan,
6021                                           channel_type, 0, gfp);
6022 }
6023
6024 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
6025                             struct net_device *dev, const u8 *mac_addr,
6026                             struct station_info *sinfo, gfp_t gfp)
6027 {
6028         struct sk_buff *msg;
6029
6030         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6031         if (!msg)
6032                 return;
6033
6034         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
6035                 nlmsg_free(msg);
6036                 return;
6037         }
6038
6039         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6040                                 nl80211_mlme_mcgrp.id, gfp);
6041 }
6042
6043 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
6044                                 struct net_device *dev, const u8 *mac_addr,
6045                                 gfp_t gfp)
6046 {
6047         struct sk_buff *msg;
6048         void *hdr;
6049
6050         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6051         if (!msg)
6052                 return;
6053
6054         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
6055         if (!hdr) {
6056                 nlmsg_free(msg);
6057                 return;
6058         }
6059
6060         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
6061         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
6062
6063         if (genlmsg_end(msg, hdr) < 0) {
6064                 nlmsg_free(msg);
6065                 return;
6066         }
6067
6068         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6069                                 nl80211_mlme_mcgrp.id, gfp);
6070         return;
6071
6072  nla_put_failure:
6073         genlmsg_cancel(msg, hdr);
6074         nlmsg_free(msg);
6075 }
6076
6077 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
6078                       struct net_device *netdev, u32 nlpid,
6079                       int freq, const u8 *buf, size_t len, gfp_t gfp)
6080 {
6081         struct sk_buff *msg;
6082         void *hdr;
6083         int err;
6084
6085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6086         if (!msg)
6087                 return -ENOMEM;
6088
6089         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
6090         if (!hdr) {
6091                 nlmsg_free(msg);
6092                 return -ENOMEM;
6093         }
6094
6095         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6096         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6097         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6098         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6099
6100         err = genlmsg_end(msg, hdr);
6101         if (err < 0) {
6102                 nlmsg_free(msg);
6103                 return err;
6104         }
6105
6106         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
6107         if (err < 0)
6108                 return err;
6109         return 0;
6110
6111  nla_put_failure:
6112         genlmsg_cancel(msg, hdr);
6113         nlmsg_free(msg);
6114         return -ENOBUFS;
6115 }
6116
6117 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
6118                                  struct net_device *netdev, u64 cookie,
6119                                  const u8 *buf, size_t len, bool ack,
6120                                  gfp_t gfp)
6121 {
6122         struct sk_buff *msg;
6123         void *hdr;
6124
6125         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6126         if (!msg)
6127                 return;
6128
6129         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
6130         if (!hdr) {
6131                 nlmsg_free(msg);
6132                 return;
6133         }
6134
6135         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6136         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6137         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6138         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6139         if (ack)
6140                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
6141
6142         if (genlmsg_end(msg, hdr) < 0) {
6143                 nlmsg_free(msg);
6144                 return;
6145         }
6146
6147         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
6148         return;
6149
6150  nla_put_failure:
6151         genlmsg_cancel(msg, hdr);
6152         nlmsg_free(msg);
6153 }
6154
6155 void
6156 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
6157                              struct net_device *netdev,
6158                              enum nl80211_cqm_rssi_threshold_event rssi_event,
6159                              gfp_t gfp)
6160 {
6161         struct sk_buff *msg;
6162         struct nlattr *pinfoattr;
6163         void *hdr;
6164
6165         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6166         if (!msg)
6167                 return;
6168
6169         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6170         if (!hdr) {
6171                 nlmsg_free(msg);
6172                 return;
6173         }
6174
6175         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6176         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6177
6178         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6179         if (!pinfoattr)
6180                 goto nla_put_failure;
6181
6182         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
6183                     rssi_event);
6184
6185         nla_nest_end(msg, pinfoattr);
6186
6187         if (genlmsg_end(msg, hdr) < 0) {
6188                 nlmsg_free(msg);
6189                 return;
6190         }
6191
6192         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6193                                 nl80211_mlme_mcgrp.id, gfp);
6194         return;
6195
6196  nla_put_failure:
6197         genlmsg_cancel(msg, hdr);
6198         nlmsg_free(msg);
6199 }
6200
6201 void
6202 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
6203                                 struct net_device *netdev, const u8 *peer,
6204                                 u32 num_packets, gfp_t gfp)
6205 {
6206         struct sk_buff *msg;
6207         struct nlattr *pinfoattr;
6208         void *hdr;
6209
6210         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6211         if (!msg)
6212                 return;
6213
6214         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6215         if (!hdr) {
6216                 nlmsg_free(msg);
6217                 return;
6218         }
6219
6220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6221         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6222         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
6223
6224         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6225         if (!pinfoattr)
6226                 goto nla_put_failure;
6227
6228         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
6229
6230         nla_nest_end(msg, pinfoattr);
6231
6232         if (genlmsg_end(msg, hdr) < 0) {
6233                 nlmsg_free(msg);
6234                 return;
6235         }
6236
6237         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6238                                 nl80211_mlme_mcgrp.id, gfp);
6239         return;
6240
6241  nla_put_failure:
6242         genlmsg_cancel(msg, hdr);
6243         nlmsg_free(msg);
6244 }
6245
6246 static int nl80211_netlink_notify(struct notifier_block * nb,
6247                                   unsigned long state,
6248                                   void *_notify)
6249 {
6250         struct netlink_notify *notify = _notify;
6251         struct cfg80211_registered_device *rdev;
6252         struct wireless_dev *wdev;
6253
6254         if (state != NETLINK_URELEASE)
6255                 return NOTIFY_DONE;
6256
6257         rcu_read_lock();
6258
6259         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
6260                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
6261                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
6262
6263         rcu_read_unlock();
6264
6265         return NOTIFY_DONE;
6266 }
6267
6268 static struct notifier_block nl80211_netlink_notifier = {
6269         .notifier_call = nl80211_netlink_notify,
6270 };
6271
6272 /* initialisation/exit functions */
6273
6274 int nl80211_init(void)
6275 {
6276         int err;
6277
6278         err = genl_register_family_with_ops(&nl80211_fam,
6279                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6280         if (err)
6281                 return err;
6282
6283         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6284         if (err)
6285                 goto err_out;
6286
6287         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6288         if (err)
6289                 goto err_out;
6290
6291         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6292         if (err)
6293                 goto err_out;
6294
6295         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6296         if (err)
6297                 goto err_out;
6298
6299 #ifdef CONFIG_NL80211_TESTMODE
6300         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6301         if (err)
6302                 goto err_out;
6303 #endif
6304
6305         err = netlink_register_notifier(&nl80211_netlink_notifier);
6306         if (err)
6307                 goto err_out;
6308
6309         return 0;
6310  err_out:
6311         genl_unregister_family(&nl80211_fam);
6312         return err;
6313 }
6314
6315 void nl80211_exit(void)
6316 {
6317         netlink_unregister_notifier(&nl80211_netlink_notifier);
6318         genl_unregister_family(&nl80211_fam);
6319 }