cdf77a26150953bb477c887e5832f84ccb6162b8
[pandora-kernel.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25
26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
28                                    struct genl_info *info,
29                                    struct cfg80211_crypto_settings *settings,
30                                    int cipher_limit);
31
32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
33                             struct genl_info *info);
34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
35                               struct genl_info *info);
36
37 /* the netlink family */
38 static struct genl_family nl80211_fam = {
39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
40         .name = "nl80211",      /* have users key off the name instead */
41         .hdrsize = 0,           /* no private header */
42         .version = 1,           /* no particular meaning now */
43         .maxattr = NL80211_ATTR_MAX,
44         .netnsok = true,
45         .pre_doit = nl80211_pre_doit,
46         .post_doit = nl80211_post_doit,
47 };
48
49 /* internal helper: get rdev and dev */
50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
51                                        struct cfg80211_registered_device **rdev,
52                                        struct net_device **dev)
53 {
54         struct nlattr **attrs = info->attrs;
55         int ifindex;
56
57         if (!attrs[NL80211_ATTR_IFINDEX])
58                 return -EINVAL;
59
60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
62         if (!*dev)
63                 return -ENODEV;
64
65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
66         if (IS_ERR(*rdev)) {
67                 dev_put(*dev);
68                 return PTR_ERR(*rdev);
69         }
70
71         return 0;
72 }
73
74 /* policy for the attributes */
75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
78                                       .len = 20-1 },
79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
87
88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
91
92         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
93         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
94
95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
97                                     .len = WLAN_MAX_KEY_LEN },
98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
103
104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
107                                        .len = IEEE80211_MAX_DATA_LEN },
108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
109                                        .len = IEEE80211_MAX_DATA_LEN },
110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
114                                                .len = NL80211_MAX_SUPP_RATES },
115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
121
122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
124
125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
129                                            .len = NL80211_MAX_SUPP_RATES },
130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
131
132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
134
135         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
136
137         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
138         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
139                               .len = IEEE80211_MAX_DATA_LEN },
140         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
141         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
142
143         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
144                                 .len = IEEE80211_MAX_SSID_LEN },
145         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
146         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
147         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
148         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
149         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
150         [NL80211_ATTR_STA_FLAGS2] = {
151                 .len = sizeof(struct nl80211_sta_flag_update),
152         },
153         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
154         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
155         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
156         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
157         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
158         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
159         [NL80211_ATTR_PID] = { .type = NLA_U32 },
160         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
161         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
162                                  .len = WLAN_PMKID_LEN },
163         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
164         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
165         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
166         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
167                                  .len = IEEE80211_MAX_DATA_LEN },
168         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
169         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
170         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
171         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
172         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
173         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
174         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
175         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
176         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
177         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
178         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
179         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
180         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
181         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
182         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
183         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
184         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
185         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
186         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
187         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
188                                          .len = IEEE80211_MAX_DATA_LEN },
189         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
190                                          .len = IEEE80211_MAX_DATA_LEN },
191         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
192         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
193         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
194         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
195         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
196         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
197         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
198         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
199 };
200
201 /* policy for the key attributes */
202 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
203         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
204         [NL80211_KEY_IDX] = { .type = NLA_U8 },
205         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
206         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
207         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
208         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
209         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
210         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
211 };
212
213 /* policy for the key default flags */
214 static const struct nla_policy
215 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
216         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
217         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
218 };
219
220 /* policy for WoWLAN attributes */
221 static const struct nla_policy
222 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
223         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
224         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
225         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
226         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
227         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
228         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
229         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
230         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
231 };
232
233 /* policy for GTK rekey offload attributes */
234 static const struct nla_policy
235 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
236         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
237         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
238         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
239 };
240
241 static const struct nla_policy
242 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
243         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
244                                                  .len = IEEE80211_MAX_SSID_LEN },
245 };
246
247 /* ifidx get helper */
248 static int nl80211_get_ifidx(struct netlink_callback *cb)
249 {
250         int res;
251
252         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
253                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
254                           nl80211_policy);
255         if (res)
256                 return res;
257
258         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
259                 return -EINVAL;
260
261         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
262         if (!res)
263                 return -EINVAL;
264         return res;
265 }
266
267 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
268                                        struct netlink_callback *cb,
269                                        struct cfg80211_registered_device **rdev,
270                                        struct net_device **dev)
271 {
272         int ifidx = cb->args[0];
273         int err;
274
275         if (!ifidx)
276                 ifidx = nl80211_get_ifidx(cb);
277         if (ifidx < 0)
278                 return ifidx;
279
280         cb->args[0] = ifidx;
281
282         rtnl_lock();
283
284         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
285         if (!*dev) {
286                 err = -ENODEV;
287                 goto out_rtnl;
288         }
289
290         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
291         if (IS_ERR(*rdev)) {
292                 err = PTR_ERR(*rdev);
293                 goto out_rtnl;
294         }
295
296         return 0;
297  out_rtnl:
298         rtnl_unlock();
299         return err;
300 }
301
302 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
303 {
304         cfg80211_unlock_rdev(rdev);
305         rtnl_unlock();
306 }
307
308 /* IE validation */
309 static bool is_valid_ie_attr(const struct nlattr *attr)
310 {
311         const u8 *pos;
312         int len;
313
314         if (!attr)
315                 return true;
316
317         pos = nla_data(attr);
318         len = nla_len(attr);
319
320         while (len) {
321                 u8 elemlen;
322
323                 if (len < 2)
324                         return false;
325                 len -= 2;
326
327                 elemlen = pos[1];
328                 if (elemlen > len)
329                         return false;
330
331                 len -= elemlen;
332                 pos += 2 + elemlen;
333         }
334
335         return true;
336 }
337
338 /* message building helper */
339 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
340                                    int flags, u8 cmd)
341 {
342         /* since there is no private header just add the generic one */
343         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
344 }
345
346 static int nl80211_msg_put_channel(struct sk_buff *msg,
347                                    struct ieee80211_channel *chan)
348 {
349         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
350                     chan->center_freq);
351
352         if (chan->flags & IEEE80211_CHAN_DISABLED)
353                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
354         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
355                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
356         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
357                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
358         if (chan->flags & IEEE80211_CHAN_RADAR)
359                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
360
361         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
362                     DBM_TO_MBM(chan->max_power));
363
364         return 0;
365
366  nla_put_failure:
367         return -ENOBUFS;
368 }
369
370 /* netlink command implementations */
371
372 struct key_parse {
373         struct key_params p;
374         int idx;
375         int type;
376         bool def, defmgmt;
377         bool def_uni, def_multi;
378 };
379
380 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
381 {
382         struct nlattr *tb[NL80211_KEY_MAX + 1];
383         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
384                                    nl80211_key_policy);
385         if (err)
386                 return err;
387
388         k->def = !!tb[NL80211_KEY_DEFAULT];
389         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
390
391         if (k->def) {
392                 k->def_uni = true;
393                 k->def_multi = true;
394         }
395         if (k->defmgmt)
396                 k->def_multi = true;
397
398         if (tb[NL80211_KEY_IDX])
399                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
400
401         if (tb[NL80211_KEY_DATA]) {
402                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
403                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
404         }
405
406         if (tb[NL80211_KEY_SEQ]) {
407                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
408                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
409         }
410
411         if (tb[NL80211_KEY_CIPHER])
412                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
413
414         if (tb[NL80211_KEY_TYPE]) {
415                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
416                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
417                         return -EINVAL;
418         }
419
420         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
421                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
422                 int err = nla_parse_nested(kdt,
423                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
424                                            tb[NL80211_KEY_DEFAULT_TYPES],
425                                            nl80211_key_default_policy);
426                 if (err)
427                         return err;
428
429                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
430                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
431         }
432
433         return 0;
434 }
435
436 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
437 {
438         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
439                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
440                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
441         }
442
443         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
444                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
445                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
446         }
447
448         if (info->attrs[NL80211_ATTR_KEY_IDX])
449                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
450
451         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
452                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
453
454         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
455         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
456
457         if (k->def) {
458                 k->def_uni = true;
459                 k->def_multi = true;
460         }
461         if (k->defmgmt)
462                 k->def_multi = true;
463
464         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
465                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
466                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
467                         return -EINVAL;
468         }
469
470         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
471                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
472                 int err = nla_parse_nested(
473                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
474                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
475                                 nl80211_key_default_policy);
476                 if (err)
477                         return err;
478
479                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
480                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
481         }
482
483         return 0;
484 }
485
486 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
487 {
488         int err;
489
490         memset(k, 0, sizeof(*k));
491         k->idx = -1;
492         k->type = -1;
493
494         if (info->attrs[NL80211_ATTR_KEY])
495                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
496         else
497                 err = nl80211_parse_key_old(info, k);
498
499         if (err)
500                 return err;
501
502         if (k->def && k->defmgmt)
503                 return -EINVAL;
504
505         if (k->defmgmt) {
506                 if (k->def_uni || !k->def_multi)
507                         return -EINVAL;
508         }
509
510         if (k->idx != -1) {
511                 if (k->defmgmt) {
512                         if (k->idx < 4 || k->idx > 5)
513                                 return -EINVAL;
514                 } else if (k->def) {
515                         if (k->idx < 0 || k->idx > 3)
516                                 return -EINVAL;
517                 } else {
518                         if (k->idx < 0 || k->idx > 5)
519                                 return -EINVAL;
520                 }
521         }
522
523         return 0;
524 }
525
526 static struct cfg80211_cached_keys *
527 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
528                        struct nlattr *keys)
529 {
530         struct key_parse parse;
531         struct nlattr *key;
532         struct cfg80211_cached_keys *result;
533         int rem, err, def = 0;
534
535         result = kzalloc(sizeof(*result), GFP_KERNEL);
536         if (!result)
537                 return ERR_PTR(-ENOMEM);
538
539         result->def = -1;
540         result->defmgmt = -1;
541
542         nla_for_each_nested(key, keys, rem) {
543                 memset(&parse, 0, sizeof(parse));
544                 parse.idx = -1;
545
546                 err = nl80211_parse_key_new(key, &parse);
547                 if (err)
548                         goto error;
549                 err = -EINVAL;
550                 if (!parse.p.key)
551                         goto error;
552                 if (parse.idx < 0 || parse.idx > 4)
553                         goto error;
554                 if (parse.def) {
555                         if (def)
556                                 goto error;
557                         def = 1;
558                         result->def = parse.idx;
559                         if (!parse.def_uni || !parse.def_multi)
560                                 goto error;
561                 } else if (parse.defmgmt)
562                         goto error;
563                 err = cfg80211_validate_key_settings(rdev, &parse.p,
564                                                      parse.idx, false, NULL);
565                 if (err)
566                         goto error;
567                 result->params[parse.idx].cipher = parse.p.cipher;
568                 result->params[parse.idx].key_len = parse.p.key_len;
569                 result->params[parse.idx].key = result->data[parse.idx];
570                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
571         }
572
573         return result;
574  error:
575         kfree(result);
576         return ERR_PTR(err);
577 }
578
579 static int nl80211_key_allowed(struct wireless_dev *wdev)
580 {
581         ASSERT_WDEV_LOCK(wdev);
582
583         switch (wdev->iftype) {
584         case NL80211_IFTYPE_AP:
585         case NL80211_IFTYPE_AP_VLAN:
586         case NL80211_IFTYPE_P2P_GO:
587         case NL80211_IFTYPE_MESH_POINT:
588                 break;
589         case NL80211_IFTYPE_ADHOC:
590                 if (!wdev->current_bss)
591                         return -ENOLINK;
592                 break;
593         case NL80211_IFTYPE_STATION:
594         case NL80211_IFTYPE_P2P_CLIENT:
595                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
596                         return -ENOLINK;
597                 break;
598         default:
599                 return -EINVAL;
600         }
601
602         return 0;
603 }
604
605 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
606 {
607         struct nlattr *nl_modes = nla_nest_start(msg, attr);
608         int i;
609
610         if (!nl_modes)
611                 goto nla_put_failure;
612
613         i = 0;
614         while (ifmodes) {
615                 if (ifmodes & 1)
616                         NLA_PUT_FLAG(msg, i);
617                 ifmodes >>= 1;
618                 i++;
619         }
620
621         nla_nest_end(msg, nl_modes);
622         return 0;
623
624 nla_put_failure:
625         return -ENOBUFS;
626 }
627
628 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
629                                           struct sk_buff *msg)
630 {
631         struct nlattr *nl_combis;
632         int i, j;
633
634         nl_combis = nla_nest_start(msg,
635                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
636         if (!nl_combis)
637                 goto nla_put_failure;
638
639         for (i = 0; i < wiphy->n_iface_combinations; i++) {
640                 const struct ieee80211_iface_combination *c;
641                 struct nlattr *nl_combi, *nl_limits;
642
643                 c = &wiphy->iface_combinations[i];
644
645                 nl_combi = nla_nest_start(msg, i + 1);
646                 if (!nl_combi)
647                         goto nla_put_failure;
648
649                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
650                 if (!nl_limits)
651                         goto nla_put_failure;
652
653                 for (j = 0; j < c->n_limits; j++) {
654                         struct nlattr *nl_limit;
655
656                         nl_limit = nla_nest_start(msg, j + 1);
657                         if (!nl_limit)
658                                 goto nla_put_failure;
659                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
660                                     c->limits[j].max);
661                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
662                                                 c->limits[j].types))
663                                 goto nla_put_failure;
664                         nla_nest_end(msg, nl_limit);
665                 }
666
667                 nla_nest_end(msg, nl_limits);
668
669                 if (c->beacon_int_infra_match)
670                         NLA_PUT_FLAG(msg,
671                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
672                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
673                             c->num_different_channels);
674                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
675                             c->max_interfaces);
676
677                 nla_nest_end(msg, nl_combi);
678         }
679
680         nla_nest_end(msg, nl_combis);
681
682         return 0;
683 nla_put_failure:
684         return -ENOBUFS;
685 }
686
687 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
688                               struct cfg80211_registered_device *dev)
689 {
690         void *hdr;
691         struct nlattr *nl_bands, *nl_band;
692         struct nlattr *nl_freqs, *nl_freq;
693         struct nlattr *nl_rates, *nl_rate;
694         struct nlattr *nl_cmds;
695         enum ieee80211_band band;
696         struct ieee80211_channel *chan;
697         struct ieee80211_rate *rate;
698         int i;
699         const struct ieee80211_txrx_stypes *mgmt_stypes =
700                                 dev->wiphy.mgmt_stypes;
701
702         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
703         if (!hdr)
704                 return -1;
705
706         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
707         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
708
709         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
710                     cfg80211_rdev_list_generation);
711
712         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
713                    dev->wiphy.retry_short);
714         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
715                    dev->wiphy.retry_long);
716         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
717                     dev->wiphy.frag_threshold);
718         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
719                     dev->wiphy.rts_threshold);
720         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
721                     dev->wiphy.coverage_class);
722         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
723                    dev->wiphy.max_scan_ssids);
724         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
725                    dev->wiphy.max_sched_scan_ssids);
726         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
727                     dev->wiphy.max_scan_ie_len);
728         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
729                     dev->wiphy.max_sched_scan_ie_len);
730         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
731                    dev->wiphy.max_match_sets);
732
733         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
734                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
735         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
736                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
737         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
738                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
739         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
740                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
741         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)
742                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_SUPPORT);
743         if (dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)
744                 NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP);
745
746         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
747                 sizeof(u32) * dev->wiphy.n_cipher_suites,
748                 dev->wiphy.cipher_suites);
749
750         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
751                    dev->wiphy.max_num_pmkids);
752
753         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
754                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
755
756         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
757                     dev->wiphy.available_antennas_tx);
758         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
759                     dev->wiphy.available_antennas_rx);
760
761         if ((dev->wiphy.available_antennas_tx ||
762              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
763                 u32 tx_ant = 0, rx_ant = 0;
764                 int res;
765                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
766                 if (!res) {
767                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
768                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
769                 }
770         }
771
772         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
773                                 dev->wiphy.interface_modes))
774                 goto nla_put_failure;
775
776         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
777         if (!nl_bands)
778                 goto nla_put_failure;
779
780         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
781                 if (!dev->wiphy.bands[band])
782                         continue;
783
784                 nl_band = nla_nest_start(msg, band);
785                 if (!nl_band)
786                         goto nla_put_failure;
787
788                 /* add HT info */
789                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
790                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
791                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
792                                 &dev->wiphy.bands[band]->ht_cap.mcs);
793                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
794                                 dev->wiphy.bands[band]->ht_cap.cap);
795                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
796                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
797                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
798                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
799                 }
800
801                 /* add frequencies */
802                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
803                 if (!nl_freqs)
804                         goto nla_put_failure;
805
806                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
807                         nl_freq = nla_nest_start(msg, i);
808                         if (!nl_freq)
809                                 goto nla_put_failure;
810
811                         chan = &dev->wiphy.bands[band]->channels[i];
812
813                         if (nl80211_msg_put_channel(msg, chan))
814                                 goto nla_put_failure;
815
816                         nla_nest_end(msg, nl_freq);
817                 }
818
819                 nla_nest_end(msg, nl_freqs);
820
821                 /* add bitrates */
822                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
823                 if (!nl_rates)
824                         goto nla_put_failure;
825
826                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
827                         nl_rate = nla_nest_start(msg, i);
828                         if (!nl_rate)
829                                 goto nla_put_failure;
830
831                         rate = &dev->wiphy.bands[band]->bitrates[i];
832                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
833                                     rate->bitrate);
834                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
835                                 NLA_PUT_FLAG(msg,
836                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
837
838                         nla_nest_end(msg, nl_rate);
839                 }
840
841                 nla_nest_end(msg, nl_rates);
842
843                 nla_nest_end(msg, nl_band);
844         }
845         nla_nest_end(msg, nl_bands);
846
847         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
848         if (!nl_cmds)
849                 goto nla_put_failure;
850
851         i = 0;
852 #define CMD(op, n)                                              \
853          do {                                                   \
854                 if (dev->ops->op) {                             \
855                         i++;                                    \
856                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
857                 }                                               \
858         } while (0)
859
860         CMD(add_virtual_intf, NEW_INTERFACE);
861         CMD(change_virtual_intf, SET_INTERFACE);
862         CMD(add_key, NEW_KEY);
863         CMD(add_beacon, NEW_BEACON);
864         CMD(add_station, NEW_STATION);
865         CMD(add_mpath, NEW_MPATH);
866         CMD(update_mesh_config, SET_MESH_CONFIG);
867         CMD(change_bss, SET_BSS);
868         CMD(auth, AUTHENTICATE);
869         CMD(assoc, ASSOCIATE);
870         CMD(deauth, DEAUTHENTICATE);
871         CMD(disassoc, DISASSOCIATE);
872         CMD(join_ibss, JOIN_IBSS);
873         CMD(join_mesh, JOIN_MESH);
874         CMD(set_pmksa, SET_PMKSA);
875         CMD(del_pmksa, DEL_PMKSA);
876         CMD(flush_pmksa, FLUSH_PMKSA);
877         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
878         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
879         CMD(mgmt_tx, FRAME);
880         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
881         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
882                 i++;
883                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
884         }
885         CMD(set_channel, SET_CHANNEL);
886         CMD(set_wds_peer, SET_WDS_PEER);
887         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
888                 CMD(tdls_mgmt, TDLS_MGMT);
889                 CMD(tdls_oper, TDLS_OPER);
890         }
891         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
892                 CMD(sched_scan_start, START_SCHED_SCAN);
893
894 #undef CMD
895
896         if (dev->ops->connect || dev->ops->auth) {
897                 i++;
898                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
899         }
900
901         if (dev->ops->disconnect || dev->ops->deauth) {
902                 i++;
903                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
904         }
905
906         nla_nest_end(msg, nl_cmds);
907
908         if (dev->ops->remain_on_channel)
909                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
910                             dev->wiphy.max_remain_on_channel_duration);
911
912         if (dev->ops->mgmt_tx_cancel_wait)
913                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
914
915         if (mgmt_stypes) {
916                 u16 stypes;
917                 struct nlattr *nl_ftypes, *nl_ifs;
918                 enum nl80211_iftype ift;
919
920                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
921                 if (!nl_ifs)
922                         goto nla_put_failure;
923
924                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
925                         nl_ftypes = nla_nest_start(msg, ift);
926                         if (!nl_ftypes)
927                                 goto nla_put_failure;
928                         i = 0;
929                         stypes = mgmt_stypes[ift].tx;
930                         while (stypes) {
931                                 if (stypes & 1)
932                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
933                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
934                                 stypes >>= 1;
935                                 i++;
936                         }
937                         nla_nest_end(msg, nl_ftypes);
938                 }
939
940                 nla_nest_end(msg, nl_ifs);
941
942                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
943                 if (!nl_ifs)
944                         goto nla_put_failure;
945
946                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
947                         nl_ftypes = nla_nest_start(msg, ift);
948                         if (!nl_ftypes)
949                                 goto nla_put_failure;
950                         i = 0;
951                         stypes = mgmt_stypes[ift].rx;
952                         while (stypes) {
953                                 if (stypes & 1)
954                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
955                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
956                                 stypes >>= 1;
957                                 i++;
958                         }
959                         nla_nest_end(msg, nl_ftypes);
960                 }
961                 nla_nest_end(msg, nl_ifs);
962         }
963
964         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
965                 struct nlattr *nl_wowlan;
966
967                 nl_wowlan = nla_nest_start(msg,
968                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
969                 if (!nl_wowlan)
970                         goto nla_put_failure;
971
972                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
973                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
974                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
975                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
976                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
977                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
978                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
979                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
980                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
981                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
982                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
983                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
984                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
985                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
986                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
987                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
988                 if (dev->wiphy.wowlan.n_patterns) {
989                         struct nl80211_wowlan_pattern_support pat = {
990                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
991                                 .min_pattern_len =
992                                         dev->wiphy.wowlan.pattern_min_len,
993                                 .max_pattern_len =
994                                         dev->wiphy.wowlan.pattern_max_len,
995                         };
996                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
997                                 sizeof(pat), &pat);
998                 }
999
1000                 nla_nest_end(msg, nl_wowlan);
1001         }
1002
1003         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1004                                 dev->wiphy.software_iftypes))
1005                 goto nla_put_failure;
1006
1007         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1008                 goto nla_put_failure;
1009
1010         return genlmsg_end(msg, hdr);
1011
1012  nla_put_failure:
1013         genlmsg_cancel(msg, hdr);
1014         return -EMSGSIZE;
1015 }
1016
1017 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1018 {
1019         int idx = 0;
1020         int start = cb->args[0];
1021         struct cfg80211_registered_device *dev;
1022
1023         mutex_lock(&cfg80211_mutex);
1024         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1025                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1026                         continue;
1027                 if (++idx <= start)
1028                         continue;
1029                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1030                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1031                                        dev) < 0) {
1032                         idx--;
1033                         break;
1034                 }
1035         }
1036         mutex_unlock(&cfg80211_mutex);
1037
1038         cb->args[0] = idx;
1039
1040         return skb->len;
1041 }
1042
1043 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1044 {
1045         struct sk_buff *msg;
1046         struct cfg80211_registered_device *dev = info->user_ptr[0];
1047
1048         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1049         if (!msg)
1050                 return -ENOMEM;
1051
1052         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1053                 nlmsg_free(msg);
1054                 return -ENOBUFS;
1055         }
1056
1057         return genlmsg_reply(msg, info);
1058 }
1059
1060 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1061         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1062         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1063         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1064         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1065         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1066 };
1067
1068 static int parse_txq_params(struct nlattr *tb[],
1069                             struct ieee80211_txq_params *txq_params)
1070 {
1071         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1072             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1073             !tb[NL80211_TXQ_ATTR_AIFS])
1074                 return -EINVAL;
1075
1076         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1077         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1078         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1079         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1080         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1081
1082         return 0;
1083 }
1084
1085 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1086 {
1087         /*
1088          * You can only set the channel explicitly for AP, mesh
1089          * and WDS type interfaces; all others have their channel
1090          * managed via their respective "establish a connection"
1091          * command (connect, join, ...)
1092          *
1093          * Monitors are special as they are normally slaved to
1094          * whatever else is going on, so they behave as though
1095          * you tried setting the wiphy channel itself.
1096          */
1097         return !wdev ||
1098                 wdev->iftype == NL80211_IFTYPE_AP ||
1099                 wdev->iftype == NL80211_IFTYPE_WDS ||
1100                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1101                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1102                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1103 }
1104
1105 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1106                                  struct wireless_dev *wdev,
1107                                  struct genl_info *info)
1108 {
1109         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1110         u32 freq;
1111         int result;
1112
1113         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1114                 return -EINVAL;
1115
1116         if (!nl80211_can_set_dev_channel(wdev))
1117                 return -EOPNOTSUPP;
1118
1119         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1120                 channel_type = nla_get_u32(info->attrs[
1121                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1122                 if (channel_type != NL80211_CHAN_NO_HT &&
1123                     channel_type != NL80211_CHAN_HT20 &&
1124                     channel_type != NL80211_CHAN_HT40PLUS &&
1125                     channel_type != NL80211_CHAN_HT40MINUS)
1126                         return -EINVAL;
1127         }
1128
1129         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1130
1131         mutex_lock(&rdev->devlist_mtx);
1132         if (wdev) {
1133                 wdev_lock(wdev);
1134                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1135                 wdev_unlock(wdev);
1136         } else {
1137                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1138         }
1139         mutex_unlock(&rdev->devlist_mtx);
1140
1141         return result;
1142 }
1143
1144 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1145 {
1146         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1147         struct net_device *netdev = info->user_ptr[1];
1148
1149         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1150 }
1151
1152 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1153 {
1154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1155         struct net_device *dev = info->user_ptr[1];
1156         struct wireless_dev *wdev = dev->ieee80211_ptr;
1157         const u8 *bssid;
1158
1159         if (!info->attrs[NL80211_ATTR_MAC])
1160                 return -EINVAL;
1161
1162         if (netif_running(dev))
1163                 return -EBUSY;
1164
1165         if (!rdev->ops->set_wds_peer)
1166                 return -EOPNOTSUPP;
1167
1168         if (wdev->iftype != NL80211_IFTYPE_WDS)
1169                 return -EOPNOTSUPP;
1170
1171         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1172         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1173 }
1174
1175
1176 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1177 {
1178         struct cfg80211_registered_device *rdev;
1179         struct net_device *netdev = NULL;
1180         struct wireless_dev *wdev;
1181         int result = 0, rem_txq_params = 0;
1182         struct nlattr *nl_txq_params;
1183         u32 changed;
1184         u8 retry_short = 0, retry_long = 0;
1185         u32 frag_threshold = 0, rts_threshold = 0;
1186         u8 coverage_class = 0;
1187
1188         /*
1189          * Try to find the wiphy and netdev. Normally this
1190          * function shouldn't need the netdev, but this is
1191          * done for backward compatibility -- previously
1192          * setting the channel was done per wiphy, but now
1193          * it is per netdev. Previous userland like hostapd
1194          * also passed a netdev to set_wiphy, so that it is
1195          * possible to let that go to the right netdev!
1196          */
1197         mutex_lock(&cfg80211_mutex);
1198
1199         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1200                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1201
1202                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1203                 if (netdev && netdev->ieee80211_ptr) {
1204                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1205                         mutex_lock(&rdev->mtx);
1206                 } else
1207                         netdev = NULL;
1208         }
1209
1210         if (!netdev) {
1211                 rdev = __cfg80211_rdev_from_info(info);
1212                 if (IS_ERR(rdev)) {
1213                         mutex_unlock(&cfg80211_mutex);
1214                         return PTR_ERR(rdev);
1215                 }
1216                 wdev = NULL;
1217                 netdev = NULL;
1218                 result = 0;
1219
1220                 mutex_lock(&rdev->mtx);
1221         } else if (netif_running(netdev) &&
1222                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1223                 wdev = netdev->ieee80211_ptr;
1224         else
1225                 wdev = NULL;
1226
1227         /*
1228          * end workaround code, by now the rdev is available
1229          * and locked, and wdev may or may not be NULL.
1230          */
1231
1232         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1233                 result = cfg80211_dev_rename(
1234                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1235
1236         mutex_unlock(&cfg80211_mutex);
1237
1238         if (result)
1239                 goto bad_res;
1240
1241         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1242                 struct ieee80211_txq_params txq_params;
1243                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1244
1245                 if (!rdev->ops->set_txq_params) {
1246                         result = -EOPNOTSUPP;
1247                         goto bad_res;
1248                 }
1249
1250                 if (!netdev) {
1251                         result = -EINVAL;
1252                         goto bad_res;
1253                 }
1254
1255                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1256                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1257                         result = -EINVAL;
1258                         goto bad_res;
1259                 }
1260
1261                 if (!netif_running(netdev)) {
1262                         result = -ENETDOWN;
1263                         goto bad_res;
1264                 }
1265
1266                 nla_for_each_nested(nl_txq_params,
1267                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1268                                     rem_txq_params) {
1269                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1270                                   nla_data(nl_txq_params),
1271                                   nla_len(nl_txq_params),
1272                                   txq_params_policy);
1273                         result = parse_txq_params(tb, &txq_params);
1274                         if (result)
1275                                 goto bad_res;
1276
1277                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1278                                                            netdev,
1279                                                            &txq_params);
1280                         if (result)
1281                                 goto bad_res;
1282                 }
1283         }
1284
1285         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1286                 result = __nl80211_set_channel(rdev, wdev, info);
1287                 if (result)
1288                         goto bad_res;
1289         }
1290
1291         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1292                 enum nl80211_tx_power_setting type;
1293                 int idx, mbm = 0;
1294
1295                 if (!rdev->ops->set_tx_power) {
1296                         result = -EOPNOTSUPP;
1297                         goto bad_res;
1298                 }
1299
1300                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1301                 type = nla_get_u32(info->attrs[idx]);
1302
1303                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1304                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1305                         result = -EINVAL;
1306                         goto bad_res;
1307                 }
1308
1309                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1310                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1311                         mbm = nla_get_u32(info->attrs[idx]);
1312                 }
1313
1314                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1315                 if (result)
1316                         goto bad_res;
1317         }
1318
1319         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1320             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1321                 u32 tx_ant, rx_ant;
1322                 if ((!rdev->wiphy.available_antennas_tx &&
1323                      !rdev->wiphy.available_antennas_rx) ||
1324                     !rdev->ops->set_antenna) {
1325                         result = -EOPNOTSUPP;
1326                         goto bad_res;
1327                 }
1328
1329                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1330                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1331
1332                 /* reject antenna configurations which don't match the
1333                  * available antenna masks, except for the "all" mask */
1334                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1335                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1336                         result = -EINVAL;
1337                         goto bad_res;
1338                 }
1339
1340                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1341                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1342
1343                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1344                 if (result)
1345                         goto bad_res;
1346         }
1347
1348         changed = 0;
1349
1350         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1351                 retry_short = nla_get_u8(
1352                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1353                 if (retry_short == 0) {
1354                         result = -EINVAL;
1355                         goto bad_res;
1356                 }
1357                 changed |= WIPHY_PARAM_RETRY_SHORT;
1358         }
1359
1360         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1361                 retry_long = nla_get_u8(
1362                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1363                 if (retry_long == 0) {
1364                         result = -EINVAL;
1365                         goto bad_res;
1366                 }
1367                 changed |= WIPHY_PARAM_RETRY_LONG;
1368         }
1369
1370         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1371                 frag_threshold = nla_get_u32(
1372                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1373                 if (frag_threshold < 256) {
1374                         result = -EINVAL;
1375                         goto bad_res;
1376                 }
1377                 if (frag_threshold != (u32) -1) {
1378                         /*
1379                          * Fragments (apart from the last one) are required to
1380                          * have even length. Make the fragmentation code
1381                          * simpler by stripping LSB should someone try to use
1382                          * odd threshold value.
1383                          */
1384                         frag_threshold &= ~0x1;
1385                 }
1386                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1387         }
1388
1389         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1390                 rts_threshold = nla_get_u32(
1391                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1392                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1393         }
1394
1395         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1396                 coverage_class = nla_get_u8(
1397                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1398                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1399         }
1400
1401         if (changed) {
1402                 u8 old_retry_short, old_retry_long;
1403                 u32 old_frag_threshold, old_rts_threshold;
1404                 u8 old_coverage_class;
1405
1406                 if (!rdev->ops->set_wiphy_params) {
1407                         result = -EOPNOTSUPP;
1408                         goto bad_res;
1409                 }
1410
1411                 old_retry_short = rdev->wiphy.retry_short;
1412                 old_retry_long = rdev->wiphy.retry_long;
1413                 old_frag_threshold = rdev->wiphy.frag_threshold;
1414                 old_rts_threshold = rdev->wiphy.rts_threshold;
1415                 old_coverage_class = rdev->wiphy.coverage_class;
1416
1417                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1418                         rdev->wiphy.retry_short = retry_short;
1419                 if (changed & WIPHY_PARAM_RETRY_LONG)
1420                         rdev->wiphy.retry_long = retry_long;
1421                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1422                         rdev->wiphy.frag_threshold = frag_threshold;
1423                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1424                         rdev->wiphy.rts_threshold = rts_threshold;
1425                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1426                         rdev->wiphy.coverage_class = coverage_class;
1427
1428                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1429                 if (result) {
1430                         rdev->wiphy.retry_short = old_retry_short;
1431                         rdev->wiphy.retry_long = old_retry_long;
1432                         rdev->wiphy.frag_threshold = old_frag_threshold;
1433                         rdev->wiphy.rts_threshold = old_rts_threshold;
1434                         rdev->wiphy.coverage_class = old_coverage_class;
1435                 }
1436         }
1437
1438  bad_res:
1439         mutex_unlock(&rdev->mtx);
1440         if (netdev)
1441                 dev_put(netdev);
1442         return result;
1443 }
1444
1445
1446 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1447                               struct cfg80211_registered_device *rdev,
1448                               struct net_device *dev)
1449 {
1450         void *hdr;
1451
1452         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1453         if (!hdr)
1454                 return -1;
1455
1456         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1457         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1458         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1459         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1460
1461         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1462                     rdev->devlist_generation ^
1463                         (cfg80211_rdev_list_generation << 2));
1464
1465         return genlmsg_end(msg, hdr);
1466
1467  nla_put_failure:
1468         genlmsg_cancel(msg, hdr);
1469         return -EMSGSIZE;
1470 }
1471
1472 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1473 {
1474         int wp_idx = 0;
1475         int if_idx = 0;
1476         int wp_start = cb->args[0];
1477         int if_start = cb->args[1];
1478         struct cfg80211_registered_device *rdev;
1479         struct wireless_dev *wdev;
1480
1481         mutex_lock(&cfg80211_mutex);
1482         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1483                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1484                         continue;
1485                 if (wp_idx < wp_start) {
1486                         wp_idx++;
1487                         continue;
1488                 }
1489                 if_idx = 0;
1490
1491                 mutex_lock(&rdev->devlist_mtx);
1492                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1493                         if (if_idx < if_start) {
1494                                 if_idx++;
1495                                 continue;
1496                         }
1497                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1498                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1499                                                rdev, wdev->netdev) < 0) {
1500                                 mutex_unlock(&rdev->devlist_mtx);
1501                                 goto out;
1502                         }
1503                         if_idx++;
1504                 }
1505                 mutex_unlock(&rdev->devlist_mtx);
1506
1507                 wp_idx++;
1508         }
1509  out:
1510         mutex_unlock(&cfg80211_mutex);
1511
1512         cb->args[0] = wp_idx;
1513         cb->args[1] = if_idx;
1514
1515         return skb->len;
1516 }
1517
1518 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1519 {
1520         struct sk_buff *msg;
1521         struct cfg80211_registered_device *dev = info->user_ptr[0];
1522         struct net_device *netdev = info->user_ptr[1];
1523
1524         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1525         if (!msg)
1526                 return -ENOMEM;
1527
1528         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1529                                dev, netdev) < 0) {
1530                 nlmsg_free(msg);
1531                 return -ENOBUFS;
1532         }
1533
1534         return genlmsg_reply(msg, info);
1535 }
1536
1537 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1538         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1539         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1540         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1541         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1542         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1543 };
1544
1545 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1546 {
1547         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1548         int flag;
1549
1550         *mntrflags = 0;
1551
1552         if (!nla)
1553                 return -EINVAL;
1554
1555         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1556                              nla, mntr_flags_policy))
1557                 return -EINVAL;
1558
1559         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1560                 if (flags[flag])
1561                         *mntrflags |= (1<<flag);
1562
1563         return 0;
1564 }
1565
1566 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1567                                struct net_device *netdev, u8 use_4addr,
1568                                enum nl80211_iftype iftype)
1569 {
1570         if (!use_4addr) {
1571                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1572                         return -EBUSY;
1573                 return 0;
1574         }
1575
1576         switch (iftype) {
1577         case NL80211_IFTYPE_AP_VLAN:
1578                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1579                         return 0;
1580                 break;
1581         case NL80211_IFTYPE_STATION:
1582                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1583                         return 0;
1584                 break;
1585         default:
1586                 break;
1587         }
1588
1589         return -EOPNOTSUPP;
1590 }
1591
1592 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1593 {
1594         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1595         struct vif_params params;
1596         int err;
1597         enum nl80211_iftype otype, ntype;
1598         struct net_device *dev = info->user_ptr[1];
1599         u32 _flags, *flags = NULL;
1600         bool change = false;
1601
1602         memset(&params, 0, sizeof(params));
1603
1604         otype = ntype = dev->ieee80211_ptr->iftype;
1605
1606         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1607                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1608                 if (otype != ntype)
1609                         change = true;
1610                 if (ntype > NL80211_IFTYPE_MAX)
1611                         return -EINVAL;
1612         }
1613
1614         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1615                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1616
1617                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1618                         return -EINVAL;
1619                 if (netif_running(dev))
1620                         return -EBUSY;
1621
1622                 wdev_lock(wdev);
1623                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1624                              IEEE80211_MAX_MESH_ID_LEN);
1625                 wdev->mesh_id_up_len =
1626                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1627                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1628                        wdev->mesh_id_up_len);
1629                 wdev_unlock(wdev);
1630         }
1631
1632         if (info->attrs[NL80211_ATTR_4ADDR]) {
1633                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1634                 change = true;
1635                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1636                 if (err)
1637                         return err;
1638         } else {
1639                 params.use_4addr = -1;
1640         }
1641
1642         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1643                 if (ntype != NL80211_IFTYPE_MONITOR)
1644                         return -EINVAL;
1645                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1646                                           &_flags);
1647                 if (err)
1648                         return err;
1649
1650                 flags = &_flags;
1651                 change = true;
1652         }
1653
1654         if (change)
1655                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1656         else
1657                 err = 0;
1658
1659         if (!err && params.use_4addr != -1)
1660                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1661
1662         return err;
1663 }
1664
1665 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1666 {
1667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1668         struct vif_params params;
1669         struct net_device *dev;
1670         int err;
1671         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1672         u32 flags;
1673
1674         memset(&params, 0, sizeof(params));
1675
1676         if (!info->attrs[NL80211_ATTR_IFNAME])
1677                 return -EINVAL;
1678
1679         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1680                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1681                 if (type > NL80211_IFTYPE_MAX)
1682                         return -EINVAL;
1683         }
1684
1685         if (!rdev->ops->add_virtual_intf ||
1686             !(rdev->wiphy.interface_modes & (1 << type)))
1687                 return -EOPNOTSUPP;
1688
1689         if (info->attrs[NL80211_ATTR_4ADDR]) {
1690                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1691                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1692                 if (err)
1693                         return err;
1694         }
1695
1696         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1697                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1698                                   &flags);
1699         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1700                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1701                 type, err ? NULL : &flags, &params);
1702         if (IS_ERR(dev))
1703                 return PTR_ERR(dev);
1704
1705         if (type == NL80211_IFTYPE_MESH_POINT &&
1706             info->attrs[NL80211_ATTR_MESH_ID]) {
1707                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1708
1709                 wdev_lock(wdev);
1710                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1711                              IEEE80211_MAX_MESH_ID_LEN);
1712                 wdev->mesh_id_up_len =
1713                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1714                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1715                        wdev->mesh_id_up_len);
1716                 wdev_unlock(wdev);
1717         }
1718
1719         return 0;
1720 }
1721
1722 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1723 {
1724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1725         struct net_device *dev = info->user_ptr[1];
1726
1727         if (!rdev->ops->del_virtual_intf)
1728                 return -EOPNOTSUPP;
1729
1730         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1731 }
1732
1733 struct get_key_cookie {
1734         struct sk_buff *msg;
1735         int error;
1736         int idx;
1737 };
1738
1739 static void get_key_callback(void *c, struct key_params *params)
1740 {
1741         struct nlattr *key;
1742         struct get_key_cookie *cookie = c;
1743
1744         if (params->key)
1745                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1746                         params->key_len, params->key);
1747
1748         if (params->seq)
1749                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1750                         params->seq_len, params->seq);
1751
1752         if (params->cipher)
1753                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1754                             params->cipher);
1755
1756         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1757         if (!key)
1758                 goto nla_put_failure;
1759
1760         if (params->key)
1761                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1762                         params->key_len, params->key);
1763
1764         if (params->seq)
1765                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1766                         params->seq_len, params->seq);
1767
1768         if (params->cipher)
1769                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1770                             params->cipher);
1771
1772         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1773
1774         nla_nest_end(cookie->msg, key);
1775
1776         return;
1777  nla_put_failure:
1778         cookie->error = 1;
1779 }
1780
1781 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1782 {
1783         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1784         int err;
1785         struct net_device *dev = info->user_ptr[1];
1786         u8 key_idx = 0;
1787         const u8 *mac_addr = NULL;
1788         bool pairwise;
1789         struct get_key_cookie cookie = {
1790                 .error = 0,
1791         };
1792         void *hdr;
1793         struct sk_buff *msg;
1794
1795         if (info->attrs[NL80211_ATTR_KEY_IDX])
1796                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1797
1798         if (key_idx > 5)
1799                 return -EINVAL;
1800
1801         if (info->attrs[NL80211_ATTR_MAC])
1802                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1803
1804         pairwise = !!mac_addr;
1805         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1806                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1807                 if (kt >= NUM_NL80211_KEYTYPES)
1808                         return -EINVAL;
1809                 if (kt != NL80211_KEYTYPE_GROUP &&
1810                     kt != NL80211_KEYTYPE_PAIRWISE)
1811                         return -EINVAL;
1812                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1813         }
1814
1815         if (!rdev->ops->get_key)
1816                 return -EOPNOTSUPP;
1817
1818         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1819         if (!msg)
1820                 return -ENOMEM;
1821
1822         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1823                              NL80211_CMD_NEW_KEY);
1824         if (IS_ERR(hdr))
1825                 return PTR_ERR(hdr);
1826
1827         cookie.msg = msg;
1828         cookie.idx = key_idx;
1829
1830         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1831         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1832         if (mac_addr)
1833                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1834
1835         if (pairwise && mac_addr &&
1836             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1837                 return -ENOENT;
1838
1839         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1840                                  mac_addr, &cookie, get_key_callback);
1841
1842         if (err)
1843                 goto free_msg;
1844
1845         if (cookie.error)
1846                 goto nla_put_failure;
1847
1848         genlmsg_end(msg, hdr);
1849         return genlmsg_reply(msg, info);
1850
1851  nla_put_failure:
1852         err = -ENOBUFS;
1853  free_msg:
1854         nlmsg_free(msg);
1855         return err;
1856 }
1857
1858 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1859 {
1860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1861         struct key_parse key;
1862         int err;
1863         struct net_device *dev = info->user_ptr[1];
1864
1865         err = nl80211_parse_key(info, &key);
1866         if (err)
1867                 return err;
1868
1869         if (key.idx < 0)
1870                 return -EINVAL;
1871
1872         /* only support setting default key */
1873         if (!key.def && !key.defmgmt)
1874                 return -EINVAL;
1875
1876         wdev_lock(dev->ieee80211_ptr);
1877
1878         if (key.def) {
1879                 if (!rdev->ops->set_default_key) {
1880                         err = -EOPNOTSUPP;
1881                         goto out;
1882                 }
1883
1884                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1885                 if (err)
1886                         goto out;
1887
1888                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1889                                                  key.def_uni, key.def_multi);
1890
1891                 if (err)
1892                         goto out;
1893
1894 #ifdef CONFIG_CFG80211_WEXT
1895                 dev->ieee80211_ptr->wext.default_key = key.idx;
1896 #endif
1897         } else {
1898                 if (key.def_uni || !key.def_multi) {
1899                         err = -EINVAL;
1900                         goto out;
1901                 }
1902
1903                 if (!rdev->ops->set_default_mgmt_key) {
1904                         err = -EOPNOTSUPP;
1905                         goto out;
1906                 }
1907
1908                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1909                 if (err)
1910                         goto out;
1911
1912                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1913                                                       dev, key.idx);
1914                 if (err)
1915                         goto out;
1916
1917 #ifdef CONFIG_CFG80211_WEXT
1918                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1919 #endif
1920         }
1921
1922  out:
1923         wdev_unlock(dev->ieee80211_ptr);
1924
1925         return err;
1926 }
1927
1928 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1929 {
1930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1931         int err;
1932         struct net_device *dev = info->user_ptr[1];
1933         struct key_parse key;
1934         const u8 *mac_addr = NULL;
1935
1936         err = nl80211_parse_key(info, &key);
1937         if (err)
1938                 return err;
1939
1940         if (!key.p.key)
1941                 return -EINVAL;
1942
1943         if (info->attrs[NL80211_ATTR_MAC])
1944                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1945
1946         if (key.type == -1) {
1947                 if (mac_addr)
1948                         key.type = NL80211_KEYTYPE_PAIRWISE;
1949                 else
1950                         key.type = NL80211_KEYTYPE_GROUP;
1951         }
1952
1953         /* for now */
1954         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1955             key.type != NL80211_KEYTYPE_GROUP)
1956                 return -EINVAL;
1957
1958         if (!rdev->ops->add_key)
1959                 return -EOPNOTSUPP;
1960
1961         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1962                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1963                                            mac_addr))
1964                 return -EINVAL;
1965
1966         wdev_lock(dev->ieee80211_ptr);
1967         err = nl80211_key_allowed(dev->ieee80211_ptr);
1968         if (!err)
1969                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1970                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1971                                          mac_addr, &key.p);
1972         wdev_unlock(dev->ieee80211_ptr);
1973
1974         return err;
1975 }
1976
1977 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1978 {
1979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1980         int err;
1981         struct net_device *dev = info->user_ptr[1];
1982         u8 *mac_addr = NULL;
1983         struct key_parse key;
1984
1985         err = nl80211_parse_key(info, &key);
1986         if (err)
1987                 return err;
1988
1989         if (info->attrs[NL80211_ATTR_MAC])
1990                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1991
1992         if (key.type == -1) {
1993                 if (mac_addr)
1994                         key.type = NL80211_KEYTYPE_PAIRWISE;
1995                 else
1996                         key.type = NL80211_KEYTYPE_GROUP;
1997         }
1998
1999         /* for now */
2000         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2001             key.type != NL80211_KEYTYPE_GROUP)
2002                 return -EINVAL;
2003
2004         if (!rdev->ops->del_key)
2005                 return -EOPNOTSUPP;
2006
2007         wdev_lock(dev->ieee80211_ptr);
2008         err = nl80211_key_allowed(dev->ieee80211_ptr);
2009
2010         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2011             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2012                 err = -ENOENT;
2013
2014         if (!err)
2015                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2016                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2017                                          mac_addr);
2018
2019 #ifdef CONFIG_CFG80211_WEXT
2020         if (!err) {
2021                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2022                         dev->ieee80211_ptr->wext.default_key = -1;
2023                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2024                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2025         }
2026 #endif
2027         wdev_unlock(dev->ieee80211_ptr);
2028
2029         return err;
2030 }
2031
2032 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2033 {
2034         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2035                     struct beacon_parameters *info);
2036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2037         struct net_device *dev = info->user_ptr[1];
2038         struct wireless_dev *wdev = dev->ieee80211_ptr;
2039         struct beacon_parameters params;
2040         int haveinfo = 0, err;
2041
2042         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2043             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2044             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2045             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2046                 return -EINVAL;
2047
2048         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2049             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2050                 return -EOPNOTSUPP;
2051
2052         memset(&params, 0, sizeof(params));
2053
2054         switch (info->genlhdr->cmd) {
2055         case NL80211_CMD_NEW_BEACON:
2056                 /* these are required for NEW_BEACON */
2057                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2058                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2059                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2060                         return -EINVAL;
2061
2062                 params.interval =
2063                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2064                 params.dtim_period =
2065                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2066
2067                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2068                 if (err)
2069                         return err;
2070
2071                 /*
2072                  * In theory, some of these attributes could be required for
2073                  * NEW_BEACON, but since they were not used when the command was
2074                  * originally added, keep them optional for old user space
2075                  * programs to work with drivers that do not need the additional
2076                  * information.
2077                  */
2078                 if (info->attrs[NL80211_ATTR_SSID]) {
2079                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2080                         params.ssid_len =
2081                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2082                         if (params.ssid_len == 0 ||
2083                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2084                                 return -EINVAL;
2085                 }
2086
2087                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2088                         params.hidden_ssid = nla_get_u32(
2089                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2090                         if (params.hidden_ssid !=
2091                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2092                             params.hidden_ssid !=
2093                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2094                             params.hidden_ssid !=
2095                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2096                                 return -EINVAL;
2097                 }
2098
2099                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2100
2101                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2102                         params.auth_type = nla_get_u32(
2103                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2104                         if (!nl80211_valid_auth_type(params.auth_type))
2105                                 return -EINVAL;
2106                 } else
2107                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2108
2109                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2110                                               NL80211_MAX_NR_CIPHER_SUITES);
2111                 if (err)
2112                         return err;
2113
2114                 call = rdev->ops->add_beacon;
2115                 break;
2116         case NL80211_CMD_SET_BEACON:
2117                 call = rdev->ops->set_beacon;
2118                 break;
2119         default:
2120                 WARN_ON(1);
2121                 return -EOPNOTSUPP;
2122         }
2123
2124         if (!call)
2125                 return -EOPNOTSUPP;
2126
2127         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2128                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2129                 params.head_len =
2130                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2131                 haveinfo = 1;
2132         }
2133
2134         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2135                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2136                 params.tail_len =
2137                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2138                 haveinfo = 1;
2139         }
2140
2141         if (!haveinfo)
2142                 return -EINVAL;
2143
2144         if (info->attrs[NL80211_ATTR_IE]) {
2145                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2146                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2147         }
2148
2149         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2150                 params.proberesp_ies =
2151                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2152                 params.proberesp_ies_len =
2153                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2154         }
2155
2156         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2157                 params.assocresp_ies =
2158                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2159                 params.assocresp_ies_len =
2160                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2161         }
2162
2163         err = call(&rdev->wiphy, dev, &params);
2164         if (!err && params.interval)
2165                 wdev->beacon_interval = params.interval;
2166         return err;
2167 }
2168
2169 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2170 {
2171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2172         struct net_device *dev = info->user_ptr[1];
2173         struct wireless_dev *wdev = dev->ieee80211_ptr;
2174         int err;
2175
2176         if (!rdev->ops->del_beacon)
2177                 return -EOPNOTSUPP;
2178
2179         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2180             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2181                 return -EOPNOTSUPP;
2182
2183         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2184         if (!err)
2185                 wdev->beacon_interval = 0;
2186         return err;
2187 }
2188
2189 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2190         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2191         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2192         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2193         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2194         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2195 };
2196
2197 static int parse_station_flags(struct genl_info *info,
2198                                struct station_parameters *params)
2199 {
2200         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2201         struct nlattr *nla;
2202         int flag;
2203
2204         /*
2205          * Try parsing the new attribute first so userspace
2206          * can specify both for older kernels.
2207          */
2208         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2209         if (nla) {
2210                 struct nl80211_sta_flag_update *sta_flags;
2211
2212                 sta_flags = nla_data(nla);
2213                 params->sta_flags_mask = sta_flags->mask;
2214                 params->sta_flags_set = sta_flags->set;
2215                 if ((params->sta_flags_mask |
2216                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2217                         return -EINVAL;
2218                 return 0;
2219         }
2220
2221         /* if present, parse the old attribute */
2222
2223         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2224         if (!nla)
2225                 return 0;
2226
2227         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2228                              nla, sta_flags_policy))
2229                 return -EINVAL;
2230
2231         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2232         params->sta_flags_mask &= ~1;
2233
2234         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2235                 if (flags[flag])
2236                         params->sta_flags_set |= (1<<flag);
2237
2238         return 0;
2239 }
2240
2241 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2242                                  int attr)
2243 {
2244         struct nlattr *rate;
2245         u16 bitrate;
2246
2247         rate = nla_nest_start(msg, attr);
2248         if (!rate)
2249                 goto nla_put_failure;
2250
2251         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2252         bitrate = cfg80211_calculate_bitrate(info);
2253         if (bitrate > 0)
2254                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2255
2256         if (info->flags & RATE_INFO_FLAGS_MCS)
2257                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2258         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2259                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2260         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2261                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2262
2263         nla_nest_end(msg, rate);
2264         return true;
2265
2266 nla_put_failure:
2267         return false;
2268 }
2269
2270 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2271                                 int flags, struct net_device *dev,
2272                                 const u8 *mac_addr, struct station_info *sinfo)
2273 {
2274         void *hdr;
2275         struct nlattr *sinfoattr, *bss_param;
2276
2277         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2278         if (!hdr)
2279                 return -1;
2280
2281         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2282         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2283
2284         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2285
2286         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2287         if (!sinfoattr)
2288                 goto nla_put_failure;
2289         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2290                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2291                             sinfo->connected_time);
2292         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2293                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2294                             sinfo->inactive_time);
2295         if (sinfo->filled & STATION_INFO_RX_BYTES)
2296                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2297                             sinfo->rx_bytes);
2298         if (sinfo->filled & STATION_INFO_TX_BYTES)
2299                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2300                             sinfo->tx_bytes);
2301         if (sinfo->filled & STATION_INFO_LLID)
2302                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2303                             sinfo->llid);
2304         if (sinfo->filled & STATION_INFO_PLID)
2305                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2306                             sinfo->plid);
2307         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2308                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2309                             sinfo->plink_state);
2310         if (sinfo->filled & STATION_INFO_SIGNAL)
2311                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2312                            sinfo->signal);
2313         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2314                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2315                            sinfo->signal_avg);
2316         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2317                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2318                                           NL80211_STA_INFO_TX_BITRATE))
2319                         goto nla_put_failure;
2320         }
2321         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2322                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2323                                           NL80211_STA_INFO_RX_BITRATE))
2324                         goto nla_put_failure;
2325         }
2326         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2327                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2328                             sinfo->rx_packets);
2329         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2330                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2331                             sinfo->tx_packets);
2332         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2333                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2334                             sinfo->tx_retries);
2335         if (sinfo->filled & STATION_INFO_TX_FAILED)
2336                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2337                             sinfo->tx_failed);
2338         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2339                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2340                 if (!bss_param)
2341                         goto nla_put_failure;
2342
2343                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2344                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2345                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2346                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2347                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2348                         NLA_PUT_FLAG(msg,
2349                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2350                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2351                            sinfo->bss_param.dtim_period);
2352                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2353                             sinfo->bss_param.beacon_interval);
2354
2355                 nla_nest_end(msg, bss_param);
2356         }
2357         if (sinfo->filled & STATION_INFO_STA_FLAGS)
2358                 NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
2359                         sizeof(struct nl80211_sta_flag_update),
2360                         &sinfo->sta_flags);
2361         nla_nest_end(msg, sinfoattr);
2362
2363         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2364                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2365                         sinfo->assoc_req_ies);
2366
2367         return genlmsg_end(msg, hdr);
2368
2369  nla_put_failure:
2370         genlmsg_cancel(msg, hdr);
2371         return -EMSGSIZE;
2372 }
2373
2374 static int nl80211_dump_station(struct sk_buff *skb,
2375                                 struct netlink_callback *cb)
2376 {
2377         struct station_info sinfo;
2378         struct cfg80211_registered_device *dev;
2379         struct net_device *netdev;
2380         u8 mac_addr[ETH_ALEN];
2381         int sta_idx = cb->args[1];
2382         int err;
2383
2384         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2385         if (err)
2386                 return err;
2387
2388         if (!dev->ops->dump_station) {
2389                 err = -EOPNOTSUPP;
2390                 goto out_err;
2391         }
2392
2393         while (1) {
2394                 memset(&sinfo, 0, sizeof(sinfo));
2395                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2396                                              mac_addr, &sinfo);
2397                 if (err == -ENOENT)
2398                         break;
2399                 if (err)
2400                         goto out_err;
2401
2402                 if (nl80211_send_station(skb,
2403                                 NETLINK_CB(cb->skb).pid,
2404                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2405                                 netdev, mac_addr,
2406                                 &sinfo) < 0)
2407                         goto out;
2408
2409                 sta_idx++;
2410         }
2411
2412
2413  out:
2414         cb->args[1] = sta_idx;
2415         err = skb->len;
2416  out_err:
2417         nl80211_finish_netdev_dump(dev);
2418
2419         return err;
2420 }
2421
2422 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2423 {
2424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2425         struct net_device *dev = info->user_ptr[1];
2426         struct station_info sinfo;
2427         struct sk_buff *msg;
2428         u8 *mac_addr = NULL;
2429         int err;
2430
2431         memset(&sinfo, 0, sizeof(sinfo));
2432
2433         if (!info->attrs[NL80211_ATTR_MAC])
2434                 return -EINVAL;
2435
2436         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2437
2438         if (!rdev->ops->get_station)
2439                 return -EOPNOTSUPP;
2440
2441         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2442         if (err)
2443                 return err;
2444
2445         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2446         if (!msg)
2447                 return -ENOMEM;
2448
2449         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2450                                  dev, mac_addr, &sinfo) < 0) {
2451                 nlmsg_free(msg);
2452                 return -ENOBUFS;
2453         }
2454
2455         return genlmsg_reply(msg, info);
2456 }
2457
2458 /*
2459  * Get vlan interface making sure it is running and on the right wiphy.
2460  */
2461 static int get_vlan(struct genl_info *info,
2462                     struct cfg80211_registered_device *rdev,
2463                     struct net_device **vlan)
2464 {
2465         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2466         *vlan = NULL;
2467
2468         if (vlanattr) {
2469                 *vlan = dev_get_by_index(genl_info_net(info),
2470                                          nla_get_u32(vlanattr));
2471                 if (!*vlan)
2472                         return -ENODEV;
2473                 if (!(*vlan)->ieee80211_ptr)
2474                         return -EINVAL;
2475                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2476                         return -EINVAL;
2477                 if (!netif_running(*vlan))
2478                         return -ENETDOWN;
2479         }
2480         return 0;
2481 }
2482
2483 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2484 {
2485         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2486         int err;
2487         struct net_device *dev = info->user_ptr[1];
2488         struct station_parameters params;
2489         u8 *mac_addr = NULL;
2490
2491         memset(&params, 0, sizeof(params));
2492
2493         params.listen_interval = -1;
2494         params.plink_state = -1;
2495
2496         if (info->attrs[NL80211_ATTR_STA_AID])
2497                 return -EINVAL;
2498
2499         if (!info->attrs[NL80211_ATTR_MAC])
2500                 return -EINVAL;
2501
2502         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2503
2504         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2505                 params.supported_rates =
2506                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2507                 params.supported_rates_len =
2508                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2509         }
2510
2511         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2512                 params.listen_interval =
2513                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2514
2515         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2516                 params.ht_capa =
2517                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2518
2519         if (parse_station_flags(info, &params))
2520                 return -EINVAL;
2521
2522         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2523                 params.plink_action =
2524                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2525
2526         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2527                 params.plink_state =
2528                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2529
2530         err = get_vlan(info, rdev, &params.vlan);
2531         if (err)
2532                 goto out;
2533
2534         /* validate settings */
2535         err = 0;
2536
2537         switch (dev->ieee80211_ptr->iftype) {
2538         case NL80211_IFTYPE_AP:
2539         case NL80211_IFTYPE_AP_VLAN:
2540         case NL80211_IFTYPE_P2P_GO:
2541                 /* disallow mesh-specific things */
2542                 if (params.plink_action)
2543                         err = -EINVAL;
2544                 break;
2545         case NL80211_IFTYPE_P2P_CLIENT:
2546         case NL80211_IFTYPE_STATION:
2547                 /* disallow things sta doesn't support */
2548                 if (params.plink_action)
2549                         err = -EINVAL;
2550                 if (params.vlan)
2551                         err = -EINVAL;
2552                 if (params.supported_rates &&
2553                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
2554                         err = -EINVAL;
2555                 if (params.ht_capa)
2556                         err = -EINVAL;
2557                 if (params.listen_interval >= 0)
2558                         err = -EINVAL;
2559                 if (params.sta_flags_mask &
2560                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
2561                                   BIT(NL80211_STA_FLAG_TDLS_PEER)))
2562                         err = -EINVAL;
2563                 /* can't change the TDLS bit */
2564                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
2565                     (params.sta_flags_mask & BIT(NL80211_STA_FLAG_TDLS_PEER)))
2566                         err = -EINVAL;
2567                 break;
2568         case NL80211_IFTYPE_MESH_POINT:
2569                 /* disallow things mesh doesn't support */
2570                 if (params.vlan)
2571                         err = -EINVAL;
2572                 if (params.ht_capa)
2573                         err = -EINVAL;
2574                 if (params.listen_interval >= 0)
2575                         err = -EINVAL;
2576                 if (params.sta_flags_mask &
2577                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2578                                   BIT(NL80211_STA_FLAG_MFP) |
2579                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2580                         err = -EINVAL;
2581                 break;
2582         default:
2583                 err = -EINVAL;
2584         }
2585
2586         if (err)
2587                 goto out;
2588
2589         if (!rdev->ops->change_station) {
2590                 err = -EOPNOTSUPP;
2591                 goto out;
2592         }
2593
2594         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2595
2596  out:
2597         if (params.vlan)
2598                 dev_put(params.vlan);
2599
2600         return err;
2601 }
2602
2603 static struct nla_policy
2604 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2605         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2606         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2607 };
2608
2609 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2610 {
2611         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2612         int err;
2613         struct net_device *dev = info->user_ptr[1];
2614         struct station_parameters params;
2615         u8 *mac_addr = NULL;
2616
2617         memset(&params, 0, sizeof(params));
2618
2619         if (!info->attrs[NL80211_ATTR_MAC])
2620                 return -EINVAL;
2621
2622         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2623                 return -EINVAL;
2624
2625         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2626                 return -EINVAL;
2627
2628         if (!info->attrs[NL80211_ATTR_STA_AID])
2629                 return -EINVAL;
2630
2631         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2632         params.supported_rates =
2633                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2634         params.supported_rates_len =
2635                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2636         params.listen_interval =
2637                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2638
2639         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2640         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2641                 return -EINVAL;
2642
2643         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2644                 params.ht_capa =
2645                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2646
2647         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2648                 params.plink_action =
2649                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2650
2651         if (parse_station_flags(info, &params))
2652                 return -EINVAL;
2653
2654         /* parse WME attributes if sta is WME capable */
2655         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2656             (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
2657             info->attrs[NL80211_ATTR_STA_WME]) {
2658                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2659                 struct nlattr *nla;
2660
2661                 nla = info->attrs[NL80211_ATTR_STA_WME];
2662                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2663                                        nl80211_sta_wme_policy);
2664                 if (err)
2665                         return err;
2666
2667                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2668                         params.uapsd_queues =
2669                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2670                 if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2671                         return -EINVAL;
2672
2673                 if (tb[NL80211_STA_WME_MAX_SP])
2674                         params.max_sp =
2675                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2676
2677                 if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2678                         return -EINVAL;
2679
2680                 params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
2681         }
2682
2683         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2684             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2685             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2686             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO &&
2687             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
2688                 return -EINVAL;
2689
2690         /*
2691          * Only managed stations can add TDLS peers, and only when the
2692          * wiphy supports external TDLS setup.
2693          */
2694         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION &&
2695             !((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
2696               (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2697               (rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)))
2698                 return -EINVAL;
2699
2700         err = get_vlan(info, rdev, &params.vlan);
2701         if (err)
2702                 goto out;
2703
2704         /* validate settings */
2705         err = 0;
2706
2707         if (!rdev->ops->add_station) {
2708                 err = -EOPNOTSUPP;
2709                 goto out;
2710         }
2711
2712         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2713
2714  out:
2715         if (params.vlan)
2716                 dev_put(params.vlan);
2717         return err;
2718 }
2719
2720 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2721 {
2722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2723         struct net_device *dev = info->user_ptr[1];
2724         u8 *mac_addr = NULL;
2725
2726         if (info->attrs[NL80211_ATTR_MAC])
2727                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2728
2729         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2730             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2731             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2732             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2733                 return -EINVAL;
2734
2735         if (!rdev->ops->del_station)
2736                 return -EOPNOTSUPP;
2737
2738         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2739 }
2740
2741 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2742                                 int flags, struct net_device *dev,
2743                                 u8 *dst, u8 *next_hop,
2744                                 struct mpath_info *pinfo)
2745 {
2746         void *hdr;
2747         struct nlattr *pinfoattr;
2748
2749         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2750         if (!hdr)
2751                 return -1;
2752
2753         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2754         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2755         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2756
2757         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2758
2759         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2760         if (!pinfoattr)
2761                 goto nla_put_failure;
2762         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2763                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2764                             pinfo->frame_qlen);
2765         if (pinfo->filled & MPATH_INFO_SN)
2766                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2767                             pinfo->sn);
2768         if (pinfo->filled & MPATH_INFO_METRIC)
2769                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2770                             pinfo->metric);
2771         if (pinfo->filled & MPATH_INFO_EXPTIME)
2772                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2773                             pinfo->exptime);
2774         if (pinfo->filled & MPATH_INFO_FLAGS)
2775                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2776                             pinfo->flags);
2777         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2778                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2779                             pinfo->discovery_timeout);
2780         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2781                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2782                             pinfo->discovery_retries);
2783
2784         nla_nest_end(msg, pinfoattr);
2785
2786         return genlmsg_end(msg, hdr);
2787
2788  nla_put_failure:
2789         genlmsg_cancel(msg, hdr);
2790         return -EMSGSIZE;
2791 }
2792
2793 static int nl80211_dump_mpath(struct sk_buff *skb,
2794                               struct netlink_callback *cb)
2795 {
2796         struct mpath_info pinfo;
2797         struct cfg80211_registered_device *dev;
2798         struct net_device *netdev;
2799         u8 dst[ETH_ALEN];
2800         u8 next_hop[ETH_ALEN];
2801         int path_idx = cb->args[1];
2802         int err;
2803
2804         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2805         if (err)
2806                 return err;
2807
2808         if (!dev->ops->dump_mpath) {
2809                 err = -EOPNOTSUPP;
2810                 goto out_err;
2811         }
2812
2813         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2814                 err = -EOPNOTSUPP;
2815                 goto out_err;
2816         }
2817
2818         while (1) {
2819                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2820                                            dst, next_hop, &pinfo);
2821                 if (err == -ENOENT)
2822                         break;
2823                 if (err)
2824                         goto out_err;
2825
2826                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2827                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2828                                        netdev, dst, next_hop,
2829                                        &pinfo) < 0)
2830                         goto out;
2831
2832                 path_idx++;
2833         }
2834
2835
2836  out:
2837         cb->args[1] = path_idx;
2838         err = skb->len;
2839  out_err:
2840         nl80211_finish_netdev_dump(dev);
2841         return err;
2842 }
2843
2844 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2845 {
2846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2847         int err;
2848         struct net_device *dev = info->user_ptr[1];
2849         struct mpath_info pinfo;
2850         struct sk_buff *msg;
2851         u8 *dst = NULL;
2852         u8 next_hop[ETH_ALEN];
2853
2854         memset(&pinfo, 0, sizeof(pinfo));
2855
2856         if (!info->attrs[NL80211_ATTR_MAC])
2857                 return -EINVAL;
2858
2859         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2860
2861         if (!rdev->ops->get_mpath)
2862                 return -EOPNOTSUPP;
2863
2864         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2865                 return -EOPNOTSUPP;
2866
2867         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2868         if (err)
2869                 return err;
2870
2871         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2872         if (!msg)
2873                 return -ENOMEM;
2874
2875         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2876                                  dev, dst, next_hop, &pinfo) < 0) {
2877                 nlmsg_free(msg);
2878                 return -ENOBUFS;
2879         }
2880
2881         return genlmsg_reply(msg, info);
2882 }
2883
2884 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2885 {
2886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2887         struct net_device *dev = info->user_ptr[1];
2888         u8 *dst = NULL;
2889         u8 *next_hop = NULL;
2890
2891         if (!info->attrs[NL80211_ATTR_MAC])
2892                 return -EINVAL;
2893
2894         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2895                 return -EINVAL;
2896
2897         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2898         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2899
2900         if (!rdev->ops->change_mpath)
2901                 return -EOPNOTSUPP;
2902
2903         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2904                 return -EOPNOTSUPP;
2905
2906         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2907 }
2908
2909 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2910 {
2911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2912         struct net_device *dev = info->user_ptr[1];
2913         u8 *dst = NULL;
2914         u8 *next_hop = NULL;
2915
2916         if (!info->attrs[NL80211_ATTR_MAC])
2917                 return -EINVAL;
2918
2919         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2920                 return -EINVAL;
2921
2922         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2923         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2924
2925         if (!rdev->ops->add_mpath)
2926                 return -EOPNOTSUPP;
2927
2928         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2929                 return -EOPNOTSUPP;
2930
2931         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2932 }
2933
2934 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2935 {
2936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2937         struct net_device *dev = info->user_ptr[1];
2938         u8 *dst = NULL;
2939
2940         if (info->attrs[NL80211_ATTR_MAC])
2941                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2942
2943         if (!rdev->ops->del_mpath)
2944                 return -EOPNOTSUPP;
2945
2946         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2947 }
2948
2949 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2950 {
2951         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2952         struct net_device *dev = info->user_ptr[1];
2953         struct bss_parameters params;
2954
2955         memset(&params, 0, sizeof(params));
2956         /* default to not changing parameters */
2957         params.use_cts_prot = -1;
2958         params.use_short_preamble = -1;
2959         params.use_short_slot_time = -1;
2960         params.ap_isolate = -1;
2961         params.ht_opmode = -1;
2962
2963         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2964                 params.use_cts_prot =
2965                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2966         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2967                 params.use_short_preamble =
2968                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2969         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2970                 params.use_short_slot_time =
2971                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2972         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2973                 params.basic_rates =
2974                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2975                 params.basic_rates_len =
2976                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2977         }
2978         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2979                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2980         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2981                 params.ht_opmode =
2982                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2983
2984         if (!rdev->ops->change_bss)
2985                 return -EOPNOTSUPP;
2986
2987         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2988             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2989                 return -EOPNOTSUPP;
2990
2991         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2992 }
2993
2994 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2995         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2996         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2997         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2998         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2999         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3000         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3001 };
3002
3003 static int parse_reg_rule(struct nlattr *tb[],
3004         struct ieee80211_reg_rule *reg_rule)
3005 {
3006         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3007         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3008
3009         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3010                 return -EINVAL;
3011         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3012                 return -EINVAL;
3013         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3014                 return -EINVAL;
3015         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3016                 return -EINVAL;
3017         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3018                 return -EINVAL;
3019
3020         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3021
3022         freq_range->start_freq_khz =
3023                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3024         freq_range->end_freq_khz =
3025                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3026         freq_range->max_bandwidth_khz =
3027                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3028
3029         power_rule->max_eirp =
3030                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3031
3032         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3033                 power_rule->max_antenna_gain =
3034                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3035
3036         return 0;
3037 }
3038
3039 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3040 {
3041         int r;
3042         char *data = NULL;
3043
3044         /*
3045          * You should only get this when cfg80211 hasn't yet initialized
3046          * completely when built-in to the kernel right between the time
3047          * window between nl80211_init() and regulatory_init(), if that is
3048          * even possible.
3049          */
3050         mutex_lock(&cfg80211_mutex);
3051         if (unlikely(!cfg80211_regdomain)) {
3052                 mutex_unlock(&cfg80211_mutex);
3053                 return -EINPROGRESS;
3054         }
3055         mutex_unlock(&cfg80211_mutex);
3056
3057         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3058                 return -EINVAL;
3059
3060         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3061
3062         r = regulatory_hint_user(data);
3063
3064         return r;
3065 }
3066
3067 static int nl80211_get_mesh_config(struct sk_buff *skb,
3068                                    struct genl_info *info)
3069 {
3070         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3071         struct net_device *dev = info->user_ptr[1];
3072         struct wireless_dev *wdev = dev->ieee80211_ptr;
3073         struct mesh_config cur_params;
3074         int err = 0;
3075         void *hdr;
3076         struct nlattr *pinfoattr;
3077         struct sk_buff *msg;
3078
3079         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3080                 return -EOPNOTSUPP;
3081
3082         if (!rdev->ops->get_mesh_config)
3083                 return -EOPNOTSUPP;
3084
3085         wdev_lock(wdev);
3086         /* If not connected, get default parameters */
3087         if (!wdev->mesh_id_len)
3088                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3089         else
3090                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3091                                                  &cur_params);
3092         wdev_unlock(wdev);
3093
3094         if (err)
3095                 return err;
3096
3097         /* Draw up a netlink message to send back */
3098         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3099         if (!msg)
3100                 return -ENOMEM;
3101         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3102                              NL80211_CMD_GET_MESH_CONFIG);
3103         if (!hdr)
3104                 goto out;
3105         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3106         if (!pinfoattr)
3107                 goto nla_put_failure;
3108         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3109         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3110                         cur_params.dot11MeshRetryTimeout);
3111         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3112                         cur_params.dot11MeshConfirmTimeout);
3113         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3114                         cur_params.dot11MeshHoldingTimeout);
3115         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3116                         cur_params.dot11MeshMaxPeerLinks);
3117         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3118                         cur_params.dot11MeshMaxRetries);
3119         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3120                         cur_params.dot11MeshTTL);
3121         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3122                         cur_params.element_ttl);
3123         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3124                         cur_params.auto_open_plinks);
3125         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3126                         cur_params.dot11MeshHWMPmaxPREQretries);
3127         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3128                         cur_params.path_refresh_time);
3129         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3130                         cur_params.min_discovery_timeout);
3131         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3132                         cur_params.dot11MeshHWMPactivePathTimeout);
3133         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3134                         cur_params.dot11MeshHWMPpreqMinInterval);
3135         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3136                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3137         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3138                         cur_params.dot11MeshHWMPRootMode);
3139         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3140                         cur_params.dot11MeshHWMPRannInterval);
3141         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3142                         cur_params.dot11MeshGateAnnouncementProtocol);
3143         nla_nest_end(msg, pinfoattr);
3144         genlmsg_end(msg, hdr);
3145         return genlmsg_reply(msg, info);
3146
3147  nla_put_failure:
3148         genlmsg_cancel(msg, hdr);
3149  out:
3150         nlmsg_free(msg);
3151         return -ENOBUFS;
3152 }
3153
3154 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3155         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3156         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3157         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3158         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3159         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3160         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3161         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3162         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3163
3164         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3165         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3166         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3167         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3168         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3169         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3170         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3171         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3172         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3173 };
3174
3175 static const struct nla_policy
3176         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3177         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3178         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3179         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3180         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3181                 .len = IEEE80211_MAX_DATA_LEN },
3182         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3183 };
3184
3185 static int nl80211_parse_mesh_config(struct genl_info *info,
3186                                      struct mesh_config *cfg,
3187                                      u32 *mask_out)
3188 {
3189         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3190         u32 mask = 0;
3191
3192 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3193 do {\
3194         if (table[attr_num]) {\
3195                 cfg->param = nla_fn(table[attr_num]); \
3196                 mask |= (1 << (attr_num - 1)); \
3197         } \
3198 } while (0);\
3199
3200
3201         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3202                 return -EINVAL;
3203         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3204                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3205                              nl80211_meshconf_params_policy))
3206                 return -EINVAL;
3207
3208         /* This makes sure that there aren't more than 32 mesh config
3209          * parameters (otherwise our bitfield scheme would not work.) */
3210         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3211
3212         /* Fill in the params struct */
3213         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3214                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3215         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3216                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3217         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3218                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3219         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3220                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3221         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3222                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3223         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3224                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3225         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3226                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3227         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3228                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3229         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3230                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3231                         nla_get_u8);
3232         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3233                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3234         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3235                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3236                         nla_get_u16);
3237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3238                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3239                         nla_get_u32);
3240         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3241                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3242                         nla_get_u16);
3243         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3244                         dot11MeshHWMPnetDiameterTraversalTime,
3245                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3246                         nla_get_u16);
3247         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3248                         dot11MeshHWMPRootMode, mask,
3249                         NL80211_MESHCONF_HWMP_ROOTMODE,
3250                         nla_get_u8);
3251         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3252                         dot11MeshHWMPRannInterval, mask,
3253                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3254                         nla_get_u16);
3255         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3256                         dot11MeshGateAnnouncementProtocol, mask,
3257                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3258                         nla_get_u8);
3259         if (mask_out)
3260                 *mask_out = mask;
3261
3262         return 0;
3263
3264 #undef FILL_IN_MESH_PARAM_IF_SET
3265 }
3266
3267 static int nl80211_parse_mesh_setup(struct genl_info *info,
3268                                      struct mesh_setup *setup)
3269 {
3270         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3271
3272         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3273                 return -EINVAL;
3274         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3275                              info->attrs[NL80211_ATTR_MESH_SETUP],
3276                              nl80211_mesh_setup_params_policy))
3277                 return -EINVAL;
3278
3279         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3280                 setup->path_sel_proto =
3281                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3282                  IEEE80211_PATH_PROTOCOL_VENDOR :
3283                  IEEE80211_PATH_PROTOCOL_HWMP;
3284
3285         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3286                 setup->path_metric =
3287                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3288                  IEEE80211_PATH_METRIC_VENDOR :
3289                  IEEE80211_PATH_METRIC_AIRTIME;
3290
3291
3292         if (tb[NL80211_MESH_SETUP_IE]) {
3293                 struct nlattr *ieattr =
3294                         tb[NL80211_MESH_SETUP_IE];
3295                 if (!is_valid_ie_attr(ieattr))
3296                         return -EINVAL;
3297                 setup->ie = nla_data(ieattr);
3298                 setup->ie_len = nla_len(ieattr);
3299         }
3300         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3301         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3302
3303         return 0;
3304 }
3305
3306 static int nl80211_update_mesh_config(struct sk_buff *skb,
3307                                       struct genl_info *info)
3308 {
3309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3310         struct net_device *dev = info->user_ptr[1];
3311         struct wireless_dev *wdev = dev->ieee80211_ptr;
3312         struct mesh_config cfg;
3313         u32 mask;
3314         int err;
3315
3316         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3317                 return -EOPNOTSUPP;
3318
3319         if (!rdev->ops->update_mesh_config)
3320                 return -EOPNOTSUPP;
3321
3322         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3323         if (err)
3324                 return err;
3325
3326         wdev_lock(wdev);
3327         if (!wdev->mesh_id_len)
3328                 err = -ENOLINK;
3329
3330         if (!err)
3331                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3332                                                     mask, &cfg);
3333
3334         wdev_unlock(wdev);
3335
3336         return err;
3337 }
3338
3339 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3340 {
3341         struct sk_buff *msg;
3342         void *hdr = NULL;
3343         struct nlattr *nl_reg_rules;
3344         unsigned int i;
3345         int err = -EINVAL;
3346
3347         mutex_lock(&cfg80211_mutex);
3348
3349         if (!cfg80211_regdomain)
3350                 goto out;
3351
3352         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3353         if (!msg) {
3354                 err = -ENOBUFS;
3355                 goto out;
3356         }
3357
3358         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3359                              NL80211_CMD_GET_REG);
3360         if (!hdr)
3361                 goto put_failure;
3362
3363         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3364                 cfg80211_regdomain->alpha2);
3365
3366         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3367         if (!nl_reg_rules)
3368                 goto nla_put_failure;
3369
3370         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3371                 struct nlattr *nl_reg_rule;
3372                 const struct ieee80211_reg_rule *reg_rule;
3373                 const struct ieee80211_freq_range *freq_range;
3374                 const struct ieee80211_power_rule *power_rule;
3375
3376                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3377                 freq_range = &reg_rule->freq_range;
3378                 power_rule = &reg_rule->power_rule;
3379
3380                 nl_reg_rule = nla_nest_start(msg, i);
3381                 if (!nl_reg_rule)
3382                         goto nla_put_failure;
3383
3384                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3385                         reg_rule->flags);
3386                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3387                         freq_range->start_freq_khz);
3388                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3389                         freq_range->end_freq_khz);
3390                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3391                         freq_range->max_bandwidth_khz);
3392                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3393                         power_rule->max_antenna_gain);
3394                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3395                         power_rule->max_eirp);
3396
3397                 nla_nest_end(msg, nl_reg_rule);
3398         }
3399
3400         nla_nest_end(msg, nl_reg_rules);
3401
3402         genlmsg_end(msg, hdr);
3403         err = genlmsg_reply(msg, info);
3404         goto out;
3405
3406 nla_put_failure:
3407         genlmsg_cancel(msg, hdr);
3408 put_failure:
3409         nlmsg_free(msg);
3410         err = -EMSGSIZE;
3411 out:
3412         mutex_unlock(&cfg80211_mutex);
3413         return err;
3414 }
3415
3416 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3417 {
3418         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3419         struct nlattr *nl_reg_rule;
3420         char *alpha2 = NULL;
3421         int rem_reg_rules = 0, r = 0;
3422         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3423         struct ieee80211_regdomain *rd = NULL;
3424
3425         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3426                 return -EINVAL;
3427
3428         if (!info->attrs[NL80211_ATTR_REG_RULES])
3429                 return -EINVAL;
3430
3431         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3432
3433         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3434                         rem_reg_rules) {
3435                 num_rules++;
3436                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3437                         return -EINVAL;
3438         }
3439
3440         mutex_lock(&cfg80211_mutex);
3441
3442         if (!reg_is_valid_request(alpha2)) {
3443                 r = -EINVAL;
3444                 goto bad_reg;
3445         }
3446
3447         size_of_regd = sizeof(struct ieee80211_regdomain) +
3448                 (num_rules * sizeof(struct ieee80211_reg_rule));
3449
3450         rd = kzalloc(size_of_regd, GFP_KERNEL);
3451         if (!rd) {
3452                 r = -ENOMEM;
3453                 goto bad_reg;
3454         }
3455
3456         rd->n_reg_rules = num_rules;
3457         rd->alpha2[0] = alpha2[0];
3458         rd->alpha2[1] = alpha2[1];
3459
3460         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3461                         rem_reg_rules) {
3462                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3463                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3464                         reg_rule_policy);
3465                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3466                 if (r)
3467                         goto bad_reg;
3468
3469                 rule_idx++;
3470
3471                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3472                         r = -EINVAL;
3473                         goto bad_reg;
3474                 }
3475         }
3476
3477         BUG_ON(rule_idx != num_rules);
3478
3479         r = set_regdom(rd);
3480
3481         mutex_unlock(&cfg80211_mutex);
3482
3483         return r;
3484
3485  bad_reg:
3486         mutex_unlock(&cfg80211_mutex);
3487         kfree(rd);
3488         return r;
3489 }
3490
3491 static int validate_scan_freqs(struct nlattr *freqs)
3492 {
3493         struct nlattr *attr1, *attr2;
3494         int n_channels = 0, tmp1, tmp2;
3495
3496         nla_for_each_nested(attr1, freqs, tmp1) {
3497                 n_channels++;
3498                 /*
3499                  * Some hardware has a limited channel list for
3500                  * scanning, and it is pretty much nonsensical
3501                  * to scan for a channel twice, so disallow that
3502                  * and don't require drivers to check that the
3503                  * channel list they get isn't longer than what
3504                  * they can scan, as long as they can scan all
3505                  * the channels they registered at once.
3506                  */
3507                 nla_for_each_nested(attr2, freqs, tmp2)
3508                         if (attr1 != attr2 &&
3509                             nla_get_u32(attr1) == nla_get_u32(attr2))
3510                                 return 0;
3511         }
3512
3513         return n_channels;
3514 }
3515
3516 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3517 {
3518         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3519         struct net_device *dev = info->user_ptr[1];
3520         struct cfg80211_scan_request *request;
3521         struct nlattr *attr;
3522         struct wiphy *wiphy;
3523         int err, tmp, n_ssids = 0, n_channels, i;
3524         size_t ie_len;
3525
3526         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3527                 return -EINVAL;
3528
3529         wiphy = &rdev->wiphy;
3530
3531         if (!rdev->ops->scan)
3532                 return -EOPNOTSUPP;
3533
3534         if (rdev->scan_req)
3535                 return -EBUSY;
3536
3537         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3538                 n_channels = validate_scan_freqs(
3539                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3540                 if (!n_channels)
3541                         return -EINVAL;
3542         } else {
3543                 enum ieee80211_band band;
3544                 n_channels = 0;
3545
3546                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3547                         if (wiphy->bands[band])
3548                                 n_channels += wiphy->bands[band]->n_channels;
3549         }
3550
3551         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3552                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3553                         n_ssids++;
3554
3555         if (n_ssids > wiphy->max_scan_ssids)
3556                 return -EINVAL;
3557
3558         if (info->attrs[NL80211_ATTR_IE])
3559                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3560         else
3561                 ie_len = 0;
3562
3563         if (ie_len > wiphy->max_scan_ie_len)
3564                 return -EINVAL;
3565
3566         request = kzalloc(sizeof(*request)
3567                         + sizeof(*request->ssids) * n_ssids
3568                         + sizeof(*request->channels) * n_channels
3569                         + ie_len, GFP_KERNEL);
3570         if (!request)
3571                 return -ENOMEM;
3572
3573         if (n_ssids)
3574                 request->ssids = (void *)&request->channels[n_channels];
3575         request->n_ssids = n_ssids;
3576         if (ie_len) {
3577                 if (request->ssids)
3578                         request->ie = (void *)(request->ssids + n_ssids);
3579                 else
3580                         request->ie = (void *)(request->channels + n_channels);
3581         }
3582
3583         i = 0;
3584         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3585                 /* user specified, bail out if channel not found */
3586                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3587                         struct ieee80211_channel *chan;
3588
3589                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3590
3591                         if (!chan) {
3592                                 err = -EINVAL;
3593                         &