Pileus Git - ~andy/linux/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_ifindex(struct net *netns, struct nlattr **attrs,
  51                                    struct cfg80211_registered_device **rdev,
  52                                    struct net_device **dev)
  53 {
  54         int ifindex;
  55
  56         if (!attrs[NL80211_ATTR_IFINDEX])
  57                 return -EINVAL;
  58
  59         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  60         *dev = dev_get_by_index(netns, ifindex);
  61         if (!*dev)
  62                 return -ENODEV;
  63
  64         *rdev = cfg80211_get_dev_from_ifindex(netns, ifindex);
  65         if (IS_ERR(*rdev)) {
  66                 dev_put(*dev);
  67                 return PTR_ERR(*rdev);
  68         }
  69
  70         return 0;
  71 }
  72
  73 static struct cfg80211_registered_device *
  74 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev = NULL, *tmp;
  77         struct net_device *netdev;
  78
  79         assert_cfg80211_lock();
  80
  81         if (!attrs[NL80211_ATTR_WIPHY] &&
  82             !attrs[NL80211_ATTR_IFINDEX])
  83                 return ERR_PTR(-EINVAL);
  84
  85         if (attrs[NL80211_ATTR_WIPHY])
  86                 rdev = cfg80211_rdev_by_wiphy_idx(
  87                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
  88
  89         if (attrs[NL80211_ATTR_IFINDEX]) {
  90                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91                 netdev = dev_get_by_index(netns, ifindex);
  92                 if (netdev) {
  93                         if (netdev->ieee80211_ptr)
  94                                 tmp = wiphy_to_dev(
  95                                                 netdev->ieee80211_ptr->wiphy);
  96                         else
  97                                 tmp = NULL;
  98
  99                         dev_put(netdev);
 100
 101                         /* not wireless device -- return error */
 102                         if (!tmp)
 103                                 return ERR_PTR(-EINVAL);
 104
 105                         /* mismatch -- return error */
 106                         if (rdev && tmp != rdev)
 107                                 return ERR_PTR(-EINVAL);
 108
 109                         rdev = tmp;
 110                 }
 111         }
 112
 113         if (!rdev)
 114                 return ERR_PTR(-ENODEV);
 115
 116         if (netns != wiphy_net(&rdev->wiphy))
 117                 return ERR_PTR(-ENODEV);
 118
 119         return rdev;
 120 }
 121
 122 /*
 123  * This function returns a pointer to the driver
 124  * that the genl_info item that is passed refers to.
 125  * If successful, it returns non-NULL and also locks
 126  * the driver's mutex!
 127  *
 128  * This means that you need to call cfg80211_unlock_rdev()
 129  * before being allowed to acquire &cfg80211_mutex!
 130  *
 131  * This is necessary because we need to lock the global
 132  * mutex to get an item off the list safely, and then
 133  * we lock the rdev mutex so it doesn't go away under us.
 134  *
 135  * We don't want to keep cfg80211_mutex locked
 136  * for all the time in order to allow requests on
 137  * other interfaces to go through at the same time.
 138  *
 139  * The result of this can be a PTR_ERR and hence must
 140  * be checked with IS_ERR() for errors.
 141  */
 142 static struct cfg80211_registered_device *
 143 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 144 {
 145         struct cfg80211_registered_device *rdev;
 146
 147         mutex_lock(&cfg80211_mutex);
 148         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 149
 150         /* if it is not an error we grab the lock on
 151          * it to assure it won't be going away while
 152          * we operate on it */
 153         if (!IS_ERR(rdev))
 154                 mutex_lock(&rdev->mtx);
 155
 156         mutex_unlock(&cfg80211_mutex);
 157
 158         return rdev;
 159 }
 160
 161 /* policy for the attributes */
 162 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 163         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 164         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 165                                       .len = 20-1 },
 166         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 168         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 169         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 170         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 171         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 172         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 173         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 174
 175         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 176         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 177         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 178
 179         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 180         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 181
 182         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 183         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 184                                     .len = WLAN_MAX_KEY_LEN },
 185         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 186         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 187         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 188         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 189         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 190
 191         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 192         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 193         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 194                                        .len = IEEE80211_MAX_DATA_LEN },
 195         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 196                                        .len = IEEE80211_MAX_DATA_LEN },
 197         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 198         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 199         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 200         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 201                                                .len = NL80211_MAX_SUPP_RATES },
 202         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 203         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 204         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 205         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 206                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 207         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 208
 209         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 210         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 211
 212         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 213         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 214         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 215         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 216                                            .len = NL80211_MAX_SUPP_RATES },
 217         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 218
 219         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 220         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 221
 222         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 223
 224         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 225         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 226                               .len = IEEE80211_MAX_DATA_LEN },
 227         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 228         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 229
 230         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 231                                 .len = IEEE80211_MAX_SSID_LEN },
 232         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 234         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 235         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 236         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 237         [NL80211_ATTR_STA_FLAGS2] = {
 238                 .len = sizeof(struct nl80211_sta_flag_update),
 239         },
 240         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 241         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 242         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 243         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 245         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 246         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 247         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 248         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 249                                  .len = WLAN_PMKID_LEN },
 250         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 251         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 252         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 254                                  .len = IEEE80211_MAX_DATA_LEN },
 255         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 256         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 257         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 258         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 259         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 261         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 262         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 263         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 264         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 265         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 266         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 267         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 268         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 269         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 271         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 272         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 273         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 274         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 275                                          .len = IEEE80211_MAX_DATA_LEN },
 276         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 277                                          .len = IEEE80211_MAX_DATA_LEN },
 278         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 280         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 281         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 282         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 283         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 284         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 285         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 286         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 287         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 288                                       .len = IEEE80211_MAX_DATA_LEN },
 289         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 290         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 292                 .len = NL80211_HT_CAPABILITY_LEN
 293         },
 294         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 295         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 296         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 297 };
 298
 299 /* policy for the key attributes */
 300 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 301         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 302         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 303         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 304         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 305         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 306         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 307         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 308         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 309 };
 310
 311 /* policy for the key default flags */
 312 static const struct nla_policy
 313 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 314         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 315         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 316 };
 317
 318 /* policy for WoWLAN attributes */
 319 static const struct nla_policy
 320 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 321         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 322         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 323         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 324         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 325         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 326         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 327         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 328         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 329 };
 330
 331 /* policy for GTK rekey offload attributes */
 332 static const struct nla_policy
 333 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 334         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 335         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 336         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 337 };
 338
 339 static const struct nla_policy
 340 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 341         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 342                                                  .len = IEEE80211_MAX_SSID_LEN },
 343         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 344 };
 345
 346 /* ifidx get helper */
 347 static int nl80211_get_ifidx(struct netlink_callback *cb)
 348 {
 349         int res;
 350
 351         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 352                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 353                           nl80211_policy);
 354         if (res)
 355                 return res;
 356
 357         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 358                 return -EINVAL;
 359
 360         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 361         if (!res)
 362                 return -EINVAL;
 363         return res;
 364 }
 365
 366 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 367                                        struct netlink_callback *cb,
 368                                        struct cfg80211_registered_device **rdev,
 369                                        struct net_device **dev)
 370 {
 371         int ifidx = cb->args[0];
 372         int err;
 373
 374         if (!ifidx)
 375                 ifidx = nl80211_get_ifidx(cb);
 376         if (ifidx < 0)
 377                 return ifidx;
 378
 379         cb->args[0] = ifidx;
 380
 381         rtnl_lock();
 382
 383         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 384         if (!*dev) {
 385                 err = -ENODEV;
 386                 goto out_rtnl;
 387         }
 388
 389         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 390         if (IS_ERR(*rdev)) {
 391                 err = PTR_ERR(*rdev);
 392                 goto out_rtnl;
 393         }
 394
 395         return 0;
 396  out_rtnl:
 397         rtnl_unlock();
 398         return err;
 399 }
 400
 401 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 402 {
 403         cfg80211_unlock_rdev(rdev);
 404         rtnl_unlock();
 405 }
 406
 407 /* IE validation */
 408 static bool is_valid_ie_attr(const struct nlattr *attr)
 409 {
 410         const u8 *pos;
 411         int len;
 412
 413         if (!attr)
 414                 return true;
 415
 416         pos = nla_data(attr);
 417         len = nla_len(attr);
 418
 419         while (len) {
 420                 u8 elemlen;
 421
 422                 if (len < 2)
 423                         return false;
 424                 len -= 2;
 425
 426                 elemlen = pos[1];
 427                 if (elemlen > len)
 428                         return false;
 429
 430                 len -= elemlen;
 431                 pos += 2 + elemlen;
 432         }
 433
 434         return true;
 435 }
 436
 437 /* message building helper */
 438 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 439                                    int flags, u8 cmd)
 440 {
 441         /* since there is no private header just add the generic one */
 442         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 443 }
 444
 445 static int nl80211_msg_put_channel(struct sk_buff *msg,
 446                                    struct ieee80211_channel *chan)
 447 {
 448         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 449                         chan->center_freq))
 450                 goto nla_put_failure;
 451
 452         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 453             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 454                 goto nla_put_failure;
 455         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 456             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 457                 goto nla_put_failure;
 458         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 459             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 460                 goto nla_put_failure;
 461         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 462             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 463                 goto nla_put_failure;
 464
 465         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 466                         DBM_TO_MBM(chan->max_power)))
 467                 goto nla_put_failure;
 468
 469         return 0;
 470
 471  nla_put_failure:
 472         return -ENOBUFS;
 473 }
 474
 475 /* netlink command implementations */
 476
 477 struct key_parse {
 478         struct key_params p;
 479         int idx;
 480         int type;
 481         bool def, defmgmt;
 482         bool def_uni, def_multi;
 483 };
 484
 485 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 486 {
 487         struct nlattr *tb[NL80211_KEY_MAX + 1];
 488         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 489                                    nl80211_key_policy);
 490         if (err)
 491                 return err;
 492
 493         k->def = !!tb[NL80211_KEY_DEFAULT];
 494         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 495
 496         if (k->def) {
 497                 k->def_uni = true;
 498                 k->def_multi = true;
 499         }
 500         if (k->defmgmt)
 501                 k->def_multi = true;
 502
 503         if (tb[NL80211_KEY_IDX])
 504                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 505
 506         if (tb[NL80211_KEY_DATA]) {
 507                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 508                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 509         }
 510
 511         if (tb[NL80211_KEY_SEQ]) {
 512                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 513                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 514         }
 515
 516         if (tb[NL80211_KEY_CIPHER])
 517                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 518
 519         if (tb[NL80211_KEY_TYPE]) {
 520                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 521                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 522                         return -EINVAL;
 523         }
 524
 525         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 526                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 527                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 528                                        tb[NL80211_KEY_DEFAULT_TYPES],
 529                                        nl80211_key_default_policy);
 530                 if (err)
 531                         return err;
 532
 533                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 534                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 535         }
 536
 537         return 0;
 538 }
 539
 540 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 541 {
 542         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 543                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 544                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 545         }
 546
 547         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 548                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 549                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 550         }
 551
 552         if (info->attrs[NL80211_ATTR_KEY_IDX])
 553                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 554
 555         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 556                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 557
 558         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 559         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 560
 561         if (k->def) {
 562                 k->def_uni = true;
 563                 k->def_multi = true;
 564         }
 565         if (k->defmgmt)
 566                 k->def_multi = true;
 567
 568         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 569                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 570                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 571                         return -EINVAL;
 572         }
 573
 574         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 575                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 576                 int err = nla_parse_nested(
 577                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 578                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 579                                 nl80211_key_default_policy);
 580                 if (err)
 581                         return err;
 582
 583                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 584                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 585         }
 586
 587         return 0;
 588 }
 589
 590 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 591 {
 592         int err;
 593
 594         memset(k, 0, sizeof(*k));
 595         k->idx = -1;
 596         k->type = -1;
 597
 598         if (info->attrs[NL80211_ATTR_KEY])
 599                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 600         else
 601                 err = nl80211_parse_key_old(info, k);
 602
 603         if (err)
 604                 return err;
 605
 606         if (k->def && k->defmgmt)
 607                 return -EINVAL;
 608
 609         if (k->defmgmt) {
 610                 if (k->def_uni || !k->def_multi)
 611                         return -EINVAL;
 612         }
 613
 614         if (k->idx != -1) {
 615                 if (k->defmgmt) {
 616                         if (k->idx < 4 || k->idx > 5)
 617                                 return -EINVAL;
 618                 } else if (k->def) {
 619                         if (k->idx < 0 || k->idx > 3)
 620                                 return -EINVAL;
 621                 } else {
 622                         if (k->idx < 0 || k->idx > 5)
 623                                 return -EINVAL;
 624                 }
 625         }
 626
 627         return 0;
 628 }
 629
 630 static struct cfg80211_cached_keys *
 631 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 632                        struct nlattr *keys)
 633 {
 634         struct key_parse parse;
 635         struct nlattr *key;
 636         struct cfg80211_cached_keys *result;
 637         int rem, err, def = 0;
 638
 639         result = kzalloc(sizeof(*result), GFP_KERNEL);
 640         if (!result)
 641                 return ERR_PTR(-ENOMEM);
 642
 643         result->def = -1;
 644         result->defmgmt = -1;
 645
 646         nla_for_each_nested(key, keys, rem) {
 647                 memset(&parse, 0, sizeof(parse));
 648                 parse.idx = -1;
 649
 650                 err = nl80211_parse_key_new(key, &parse);
 651                 if (err)
 652                         goto error;
 653                 err = -EINVAL;
 654                 if (!parse.p.key)
 655                         goto error;
 656                 if (parse.idx < 0 || parse.idx > 4)
 657                         goto error;
 658                 if (parse.def) {
 659                         if (def)
 660                                 goto error;
 661                         def = 1;
 662                         result->def = parse.idx;
 663                         if (!parse.def_uni || !parse.def_multi)
 664                                 goto error;
 665                 } else if (parse.defmgmt)
 666                         goto error;
 667                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 668                                                      parse.idx, false, NULL);
 669                 if (err)
 670                         goto error;
 671                 result->params[parse.idx].cipher = parse.p.cipher;
 672                 result->params[parse.idx].key_len = parse.p.key_len;
 673                 result->params[parse.idx].key = result->data[parse.idx];
 674                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 675         }
 676
 677         return result;
 678  error:
 679         kfree(result);
 680         return ERR_PTR(err);
 681 }
 682
 683 static int nl80211_key_allowed(struct wireless_dev *wdev)
 684 {
 685         ASSERT_WDEV_LOCK(wdev);
 686
 687         switch (wdev->iftype) {
 688         case NL80211_IFTYPE_AP:
 689         case NL80211_IFTYPE_AP_VLAN:
 690         case NL80211_IFTYPE_P2P_GO:
 691         case NL80211_IFTYPE_MESH_POINT:
 692                 break;
 693         case NL80211_IFTYPE_ADHOC:
 694                 if (!wdev->current_bss)
 695                         return -ENOLINK;
 696                 break;
 697         case NL80211_IFTYPE_STATION:
 698         case NL80211_IFTYPE_P2P_CLIENT:
 699                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 700                         return -ENOLINK;
 701                 break;
 702         default:
 703                 return -EINVAL;
 704         }
 705
 706         return 0;
 707 }
 708
 709 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 710 {
 711         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 712         int i;
 713
 714         if (!nl_modes)
 715                 goto nla_put_failure;
 716
 717         i = 0;
 718         while (ifmodes) {
 719                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 720                         goto nla_put_failure;
 721                 ifmodes >>= 1;
 722                 i++;
 723         }
 724
 725         nla_nest_end(msg, nl_modes);
 726         return 0;
 727
 728 nla_put_failure:
 729         return -ENOBUFS;
 730 }
 731
 732 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 733                                           struct sk_buff *msg)
 734 {
 735         struct nlattr *nl_combis;
 736         int i, j;
 737
 738         nl_combis = nla_nest_start(msg,
 739                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 740         if (!nl_combis)
 741                 goto nla_put_failure;
 742
 743         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 744                 const struct ieee80211_iface_combination *c;
 745                 struct nlattr *nl_combi, *nl_limits;
 746
 747                 c = &wiphy->iface_combinations[i];
 748
 749                 nl_combi = nla_nest_start(msg, i + 1);
 750                 if (!nl_combi)
 751                         goto nla_put_failure;
 752
 753                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 754                 if (!nl_limits)
 755                         goto nla_put_failure;
 756
 757                 for (j = 0; j < c->n_limits; j++) {
 758                         struct nlattr *nl_limit;
 759
 760                         nl_limit = nla_nest_start(msg, j + 1);
 761                         if (!nl_limit)
 762                                 goto nla_put_failure;
 763                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 764                                         c->limits[j].max))
 765                                 goto nla_put_failure;
 766                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 767                                                 c->limits[j].types))
 768                                 goto nla_put_failure;
 769                         nla_nest_end(msg, nl_limit);
 770                 }
 771
 772                 nla_nest_end(msg, nl_limits);
 773
 774                 if (c->beacon_int_infra_match &&
 775                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 776                         goto nla_put_failure;
 777                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 778                                 c->num_different_channels) ||
 779                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 780                                 c->max_interfaces))
 781                         goto nla_put_failure;
 782
 783                 nla_nest_end(msg, nl_combi);
 784         }
 785
 786         nla_nest_end(msg, nl_combis);
 787
 788         return 0;
 789 nla_put_failure:
 790         return -ENOBUFS;
 791 }
 792
 793 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 794                               struct cfg80211_registered_device *dev)
 795 {
 796         void *hdr;
 797         struct nlattr *nl_bands, *nl_band;
 798         struct nlattr *nl_freqs, *nl_freq;
 799         struct nlattr *nl_rates, *nl_rate;
 800         struct nlattr *nl_cmds;
 801         enum ieee80211_band band;
 802         struct ieee80211_channel *chan;
 803         struct ieee80211_rate *rate;
 804         int i;
 805         const struct ieee80211_txrx_stypes *mgmt_stypes =
 806                                 dev->wiphy.mgmt_stypes;
 807
 808         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 809         if (!hdr)
 810                 return -1;
 811
 812         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 813             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 814             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 815                         cfg80211_rdev_list_generation) ||
 816             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 817                        dev->wiphy.retry_short) ||
 818             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 819                        dev->wiphy.retry_long) ||
 820             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 821                         dev->wiphy.frag_threshold) ||
 822             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 823                         dev->wiphy.rts_threshold) ||
 824             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 825                        dev->wiphy.coverage_class) ||
 826             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 827                        dev->wiphy.max_scan_ssids) ||
 828             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 829                        dev->wiphy.max_sched_scan_ssids) ||
 830             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 831                         dev->wiphy.max_scan_ie_len) ||
 832             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 833                         dev->wiphy.max_sched_scan_ie_len) ||
 834             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 835                        dev->wiphy.max_match_sets))
 836                 goto nla_put_failure;
 837
 838         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 839             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 840                 goto nla_put_failure;
 841         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 842             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 843                 goto nla_put_failure;
 844         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 845             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 846                 goto nla_put_failure;
 847         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 848             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 849                 goto nla_put_failure;
 850         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 851             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 852                 goto nla_put_failure;
 853         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 854             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 855                 goto nla_put_failure;
 856
 857         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 858                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 859                     dev->wiphy.cipher_suites))
 860                 goto nla_put_failure;
 861
 862         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 863                        dev->wiphy.max_num_pmkids))
 864                 goto nla_put_failure;
 865
 866         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 867             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 868                 goto nla_put_failure;
 869
 870         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 871                         dev->wiphy.available_antennas_tx) ||
 872             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 873                         dev->wiphy.available_antennas_rx))
 874                 goto nla_put_failure;
 875
 876         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 877             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 878                         dev->wiphy.probe_resp_offload))
 879                 goto nla_put_failure;
 880
 881         if ((dev->wiphy.available_antennas_tx ||
 882              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 883                 u32 tx_ant = 0, rx_ant = 0;
 884                 int res;
 885                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 886                 if (!res) {
 887                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 888                                         tx_ant) ||
 889                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 890                                         rx_ant))
 891                                 goto nla_put_failure;
 892                 }
 893         }
 894
 895         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 896                                 dev->wiphy.interface_modes))
 897                 goto nla_put_failure;
 898
 899         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 900         if (!nl_bands)
 901                 goto nla_put_failure;
 902
 903         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 904                 if (!dev->wiphy.bands[band])
 905                         continue;
 906
 907                 nl_band = nla_nest_start(msg, band);
 908                 if (!nl_band)
 909                         goto nla_put_failure;
 910
 911                 /* add HT info */
 912                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 913                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 914                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 915                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 916                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 917                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 918                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 919                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 920                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 921                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 922                         goto nla_put_failure;
 923
 924                 /* add VHT info */
 925                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 926                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 927                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 928                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 929                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
 930                                  dev->wiphy.bands[band]->vht_cap.cap)))
 931                         goto nla_put_failure;
 932
 933                 /* add frequencies */
 934                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 935                 if (!nl_freqs)
 936                         goto nla_put_failure;
 937
 938                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 939                         nl_freq = nla_nest_start(msg, i);
 940                         if (!nl_freq)
 941                                 goto nla_put_failure;
 942
 943                         chan = &dev->wiphy.bands[band]->channels[i];
 944
 945                         if (nl80211_msg_put_channel(msg, chan))
 946                                 goto nla_put_failure;
 947
 948                         nla_nest_end(msg, nl_freq);
 949                 }
 950
 951                 nla_nest_end(msg, nl_freqs);
 952
 953                 /* add bitrates */
 954                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 955                 if (!nl_rates)
 956                         goto nla_put_failure;
 957
 958                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 959                         nl_rate = nla_nest_start(msg, i);
 960                         if (!nl_rate)
 961                                 goto nla_put_failure;
 962
 963                         rate = &dev->wiphy.bands[band]->bitrates[i];
 964                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
 965                                         rate->bitrate))
 966                                 goto nla_put_failure;
 967                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
 968                             nla_put_flag(msg,
 969                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
 970                                 goto nla_put_failure;
 971
 972                         nla_nest_end(msg, nl_rate);
 973                 }
 974
 975                 nla_nest_end(msg, nl_rates);
 976
 977                 nla_nest_end(msg, nl_band);
 978         }
 979         nla_nest_end(msg, nl_bands);
 980
 981         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 982         if (!nl_cmds)
 983                 goto nla_put_failure;
 984
 985         i = 0;
 986 #define CMD(op, n)                                              \
 987          do {                                                   \
 988                 if (dev->ops->op) {                             \
 989                         i++;                                    \
 990                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
 991                                 goto nla_put_failure;           \
 992                 }                                               \
 993         } while (0)
 994
 995         CMD(add_virtual_intf, NEW_INTERFACE);
 996         CMD(change_virtual_intf, SET_INTERFACE);
 997         CMD(add_key, NEW_KEY);
 998         CMD(start_ap, START_AP);
 999         CMD(add_station, NEW_STATION);
1000         CMD(add_mpath, NEW_MPATH);
1001         CMD(update_mesh_config, SET_MESH_CONFIG);
1002         CMD(change_bss, SET_BSS);
1003         CMD(auth, AUTHENTICATE);
1004         CMD(assoc, ASSOCIATE);
1005         CMD(deauth, DEAUTHENTICATE);
1006         CMD(disassoc, DISASSOCIATE);
1007         CMD(join_ibss, JOIN_IBSS);
1008         CMD(join_mesh, JOIN_MESH);
1009         CMD(set_pmksa, SET_PMKSA);
1010         CMD(del_pmksa, DEL_PMKSA);
1011         CMD(flush_pmksa, FLUSH_PMKSA);
1012         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1013                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1014         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1015         CMD(mgmt_tx, FRAME);
1016         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1017         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1018                 i++;
1019                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1020                         goto nla_put_failure;
1021         }
1022         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1023             dev->ops->join_mesh) {
1024                 i++;
1025                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1026                         goto nla_put_failure;
1027         }
1028         CMD(set_wds_peer, SET_WDS_PEER);
1029         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1030                 CMD(tdls_mgmt, TDLS_MGMT);
1031                 CMD(tdls_oper, TDLS_OPER);
1032         }
1033         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1034                 CMD(sched_scan_start, START_SCHED_SCAN);
1035         CMD(probe_client, PROBE_CLIENT);
1036         CMD(set_noack_map, SET_NOACK_MAP);
1037         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1038                 i++;
1039                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1040                         goto nla_put_failure;
1041         }
1042
1043 #ifdef CONFIG_NL80211_TESTMODE
1044         CMD(testmode_cmd, TESTMODE);
1045 #endif
1046
1047 #undef CMD
1048
1049         if (dev->ops->connect || dev->ops->auth) {
1050                 i++;
1051                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1052                         goto nla_put_failure;
1053         }
1054
1055         if (dev->ops->disconnect || dev->ops->deauth) {
1056                 i++;
1057                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1058                         goto nla_put_failure;
1059         }
1060
1061         nla_nest_end(msg, nl_cmds);
1062
1063         if (dev->ops->remain_on_channel &&
1064             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1065             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1066                         dev->wiphy.max_remain_on_channel_duration))
1067                 goto nla_put_failure;
1068
1069         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1070             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1071                 goto nla_put_failure;
1072
1073         if (mgmt_stypes) {
1074                 u16 stypes;
1075                 struct nlattr *nl_ftypes, *nl_ifs;
1076                 enum nl80211_iftype ift;
1077
1078                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1079                 if (!nl_ifs)
1080                         goto nla_put_failure;
1081
1082                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1083                         nl_ftypes = nla_nest_start(msg, ift);
1084                         if (!nl_ftypes)
1085                                 goto nla_put_failure;
1086                         i = 0;
1087                         stypes = mgmt_stypes[ift].tx;
1088                         while (stypes) {
1089                                 if ((stypes & 1) &&
1090                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1091                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1092                                         goto nla_put_failure;
1093                                 stypes >>= 1;
1094                                 i++;
1095                         }
1096                         nla_nest_end(msg, nl_ftypes);
1097                 }
1098
1099                 nla_nest_end(msg, nl_ifs);
1100
1101                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1102                 if (!nl_ifs)
1103                         goto nla_put_failure;
1104
1105                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1106                         nl_ftypes = nla_nest_start(msg, ift);
1107                         if (!nl_ftypes)
1108                                 goto nla_put_failure;
1109                         i = 0;
1110                         stypes = mgmt_stypes[ift].rx;
1111                         while (stypes) {
1112                                 if ((stypes & 1) &&
1113                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1114                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1115                                         goto nla_put_failure;
1116                                 stypes >>= 1;
1117                                 i++;
1118                         }
1119                         nla_nest_end(msg, nl_ftypes);
1120                 }
1121                 nla_nest_end(msg, nl_ifs);
1122         }
1123
1124 #ifdef CONFIG_PM
1125         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1126                 struct nlattr *nl_wowlan;
1127
1128                 nl_wowlan = nla_nest_start(msg,
1129                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1130                 if (!nl_wowlan)
1131                         goto nla_put_failure;
1132
1133                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1134                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1135                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1136                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1137                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1138                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1139                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1140                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1141                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1142                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1143                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1144                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1145                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1146                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1147                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1148                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1149                     goto nla_put_failure;
1150                 if (dev->wiphy.wowlan.n_patterns) {
1151                         struct nl80211_wowlan_pattern_support pat = {
1152                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1153                                 .min_pattern_len =
1154                                         dev->wiphy.wowlan.pattern_min_len,
1155                                 .max_pattern_len =
1156                                         dev->wiphy.wowlan.pattern_max_len,
1157                         };
1158                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1159                                     sizeof(pat), &pat))
1160                                 goto nla_put_failure;
1161                 }
1162
1163                 nla_nest_end(msg, nl_wowlan);
1164         }
1165 #endif
1166
1167         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1168                                 dev->wiphy.software_iftypes))
1169                 goto nla_put_failure;
1170
1171         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1172                 goto nla_put_failure;
1173
1174         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1175             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1176                         dev->wiphy.ap_sme_capa))
1177                 goto nla_put_failure;
1178
1179         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1180                         dev->wiphy.features))
1181                 goto nla_put_failure;
1182
1183         if (dev->wiphy.ht_capa_mod_mask &&
1184             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1185                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1186                     dev->wiphy.ht_capa_mod_mask))
1187                 goto nla_put_failure;
1188
1189         return genlmsg_end(msg, hdr);
1190
1191  nla_put_failure:
1192         genlmsg_cancel(msg, hdr);
1193         return -EMSGSIZE;
1194 }
1195
1196 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1197 {
1198         int idx = 0;
1199         int start = cb->args[0];
1200         struct cfg80211_registered_device *dev;
1201
1202         mutex_lock(&cfg80211_mutex);
1203         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1204                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1205                         continue;
1206                 if (++idx <= start)
1207                         continue;
1208                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1209                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1210                                        dev) < 0) {
1211                         idx--;
1212                         break;
1213                 }
1214         }
1215         mutex_unlock(&cfg80211_mutex);
1216
1217         cb->args[0] = idx;
1218
1219         return skb->len;
1220 }
1221
1222 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1223 {
1224         struct sk_buff *msg;
1225         struct cfg80211_registered_device *dev = info->user_ptr[0];
1226
1227         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1228         if (!msg)
1229                 return -ENOMEM;
1230
1231         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1232                 nlmsg_free(msg);
1233                 return -ENOBUFS;
1234         }
1235
1236         return genlmsg_reply(msg, info);
1237 }
1238
1239 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1240         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1241         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1242         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1243         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1244         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1245 };
1246
1247 static int parse_txq_params(struct nlattr *tb[],
1248                             struct ieee80211_txq_params *txq_params)
1249 {
1250         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1251             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1252             !tb[NL80211_TXQ_ATTR_AIFS])
1253                 return -EINVAL;
1254
1255         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1256         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1257         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1258         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1259         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1260
1261         if (txq_params->ac >= NL80211_NUM_ACS)
1262                 return -EINVAL;
1263
1264         return 0;
1265 }
1266
1267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1268 {
1269         /*
1270          * You can only set the channel explicitly for WDS interfaces,
1271          * all others have their channel managed via their respective
1272          * "establish a connection" command (connect, join, ...)
1273          *
1274          * For AP/GO and mesh mode, the channel can be set with the
1275          * channel userspace API, but is only stored and passed to the
1276          * low-level driver when the AP starts or the mesh is joined.
1277          * This is for backward compatibility, userspace can also give
1278          * the channel in the start-ap or join-mesh commands instead.
1279          *
1280          * Monitors are special as they are normally slaved to
1281          * whatever else is going on, so they have their own special
1282          * operation to set the monitor channel if possible.
1283          */
1284         return !wdev ||
1285                 wdev->iftype == NL80211_IFTYPE_AP ||
1286                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1287                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1288                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1289 }
1290
1291 static bool nl80211_valid_channel_type(struct genl_info *info,
1292                                        enum nl80211_channel_type *channel_type)
1293 {
1294         enum nl80211_channel_type tmp;
1295
1296         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1297                 return false;
1298
1299         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1300         if (tmp != NL80211_CHAN_NO_HT &&
1301             tmp != NL80211_CHAN_HT20 &&
1302             tmp != NL80211_CHAN_HT40PLUS &&
1303             tmp != NL80211_CHAN_HT40MINUS)
1304                 return false;
1305
1306         if (channel_type)
1307                 *channel_type = tmp;
1308
1309         return true;
1310 }
1311
1312 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1313                                  struct wireless_dev *wdev,
1314                                  struct genl_info *info)
1315 {
1316         struct ieee80211_channel *channel;
1317         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1318         u32 freq;
1319         int result;
1320         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1321
1322         if (wdev)
1323                 iftype = wdev->iftype;
1324
1325         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1326                 return -EINVAL;
1327
1328         if (!nl80211_can_set_dev_channel(wdev))
1329                 return -EOPNOTSUPP;
1330
1331         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1332             !nl80211_valid_channel_type(info, &channel_type))
1333                 return -EINVAL;
1334
1335         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1336
1337         mutex_lock(&rdev->devlist_mtx);
1338         switch (iftype) {
1339         case NL80211_IFTYPE_AP:
1340         case NL80211_IFTYPE_P2P_GO:
1341                 if (wdev->beacon_interval) {
1342                         result = -EBUSY;
1343                         break;
1344                 }
1345                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1346                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1347                                                               channel,
1348                                                               channel_type)) {
1349                         result = -EINVAL;
1350                         break;
1351                 }
1352                 wdev->preset_chan = channel;
1353                 wdev->preset_chantype = channel_type;
1354                 result = 0;
1355                 break;
1356         case NL80211_IFTYPE_MESH_POINT:
1357                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1358                 break;
1359         case NL80211_IFTYPE_MONITOR:
1360                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1361                 break;
1362         default:
1363                 result = -EINVAL;
1364         }
1365         mutex_unlock(&rdev->devlist_mtx);
1366
1367         return result;
1368 }
1369
1370 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1371 {
1372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1373         struct net_device *netdev = info->user_ptr[1];
1374
1375         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1376 }
1377
1378 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1379 {
1380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1381         struct net_device *dev = info->user_ptr[1];
1382         struct wireless_dev *wdev = dev->ieee80211_ptr;
1383         const u8 *bssid;
1384
1385         if (!info->attrs[NL80211_ATTR_MAC])
1386                 return -EINVAL;
1387
1388         if (netif_running(dev))
1389                 return -EBUSY;
1390
1391         if (!rdev->ops->set_wds_peer)
1392                 return -EOPNOTSUPP;
1393
1394         if (wdev->iftype != NL80211_IFTYPE_WDS)
1395                 return -EOPNOTSUPP;
1396
1397         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1398         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1399 }
1400
1401
1402 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1403 {
1404         struct cfg80211_registered_device *rdev;
1405         struct net_device *netdev = NULL;
1406         struct wireless_dev *wdev;
1407         int result = 0, rem_txq_params = 0;
1408         struct nlattr *nl_txq_params;
1409         u32 changed;
1410         u8 retry_short = 0, retry_long = 0;
1411         u32 frag_threshold = 0, rts_threshold = 0;
1412         u8 coverage_class = 0;
1413
1414         /*
1415          * Try to find the wiphy and netdev. Normally this
1416          * function shouldn't need the netdev, but this is
1417          * done for backward compatibility -- previously
1418          * setting the channel was done per wiphy, but now
1419          * it is per netdev. Previous userland like hostapd
1420          * also passed a netdev to set_wiphy, so that it is
1421          * possible to let that go to the right netdev!
1422          */
1423         mutex_lock(&cfg80211_mutex);
1424
1425         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1426                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1427
1428                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1429                 if (netdev && netdev->ieee80211_ptr) {
1430                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1431                         mutex_lock(&rdev->mtx);
1432                 } else
1433                         netdev = NULL;
1434         }
1435
1436         if (!netdev) {
1437                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1438                                                   info->attrs);
1439                 if (IS_ERR(rdev)) {
1440                         mutex_unlock(&cfg80211_mutex);
1441                         return PTR_ERR(rdev);
1442                 }
1443                 wdev = NULL;
1444                 netdev = NULL;
1445                 result = 0;
1446
1447                 mutex_lock(&rdev->mtx);
1448         } else if (nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1449                 wdev = netdev->ieee80211_ptr;
1450         else
1451                 wdev = NULL;
1452
1453         /*
1454          * end workaround code, by now the rdev is available
1455          * and locked, and wdev may or may not be NULL.
1456          */
1457
1458         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1459                 result = cfg80211_dev_rename(
1460                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1461
1462         mutex_unlock(&cfg80211_mutex);
1463
1464         if (result)
1465                 goto bad_res;
1466
1467         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1468                 struct ieee80211_txq_params txq_params;
1469                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1470
1471                 if (!rdev->ops->set_txq_params) {
1472                         result = -EOPNOTSUPP;
1473                         goto bad_res;
1474                 }
1475
1476                 if (!netdev) {
1477                         result = -EINVAL;
1478                         goto bad_res;
1479                 }
1480
1481                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1482                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1483                         result = -EINVAL;
1484                         goto bad_res;
1485                 }
1486
1487                 if (!netif_running(netdev)) {
1488                         result = -ENETDOWN;
1489                         goto bad_res;
1490                 }
1491
1492                 nla_for_each_nested(nl_txq_params,
1493                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1494                                     rem_txq_params) {
1495                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1496                                   nla_data(nl_txq_params),
1497                                   nla_len(nl_txq_params),
1498                                   txq_params_policy);
1499                         result = parse_txq_params(tb, &txq_params);
1500                         if (result)
1501                                 goto bad_res;
1502
1503                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1504                                                            netdev,
1505                                                            &txq_params);
1506                         if (result)
1507                                 goto bad_res;
1508                 }
1509         }
1510
1511         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1512                 result = __nl80211_set_channel(rdev, wdev, info);
1513                 if (result)
1514                         goto bad_res;
1515         }
1516
1517         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1518                 enum nl80211_tx_power_setting type;
1519                 int idx, mbm = 0;
1520
1521                 if (!rdev->ops->set_tx_power) {
1522                         result = -EOPNOTSUPP;
1523                         goto bad_res;
1524                 }
1525
1526                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1527                 type = nla_get_u32(info->attrs[idx]);
1528
1529                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1530                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1531                         result = -EINVAL;
1532                         goto bad_res;
1533                 }
1534
1535                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1536                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1537                         mbm = nla_get_u32(info->attrs[idx]);
1538                 }
1539
1540                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1541                 if (result)
1542                         goto bad_res;
1543         }
1544
1545         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1546             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1547                 u32 tx_ant, rx_ant;
1548                 if ((!rdev->wiphy.available_antennas_tx &&
1549                      !rdev->wiphy.available_antennas_rx) ||
1550                     !rdev->ops->set_antenna) {
1551                         result = -EOPNOTSUPP;
1552                         goto bad_res;
1553                 }
1554
1555                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1556                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1557
1558                 /* reject antenna configurations which don't match the
1559                  * available antenna masks, except for the "all" mask */
1560                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1561                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1562                         result = -EINVAL;
1563                         goto bad_res;
1564                 }
1565
1566                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1567                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1568
1569                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1570                 if (result)
1571                         goto bad_res;
1572         }
1573
1574         changed = 0;
1575
1576         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1577                 retry_short = nla_get_u8(
1578                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1579                 if (retry_short == 0) {
1580                         result = -EINVAL;
1581                         goto bad_res;
1582                 }
1583                 changed |= WIPHY_PARAM_RETRY_SHORT;
1584         }
1585
1586         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1587                 retry_long = nla_get_u8(
1588                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1589                 if (retry_long == 0) {
1590                         result = -EINVAL;
1591                         goto bad_res;
1592                 }
1593                 changed |= WIPHY_PARAM_RETRY_LONG;
1594         }
1595
1596         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1597                 frag_threshold = nla_get_u32(
1598                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1599                 if (frag_threshold < 256) {
1600                         result = -EINVAL;
1601                         goto bad_res;
1602                 }
1603                 if (frag_threshold != (u32) -1) {
1604                         /*
1605                          * Fragments (apart from the last one) are required to
1606                          * have even length. Make the fragmentation code
1607                          * simpler by stripping LSB should someone try to use
1608                          * odd threshold value.
1609                          */
1610                         frag_threshold &= ~0x1;
1611                 }
1612                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1613         }
1614
1615         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1616                 rts_threshold = nla_get_u32(
1617                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1618                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1619         }
1620
1621         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1622                 coverage_class = nla_get_u8(
1623                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1624                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1625         }
1626
1627         if (changed) {
1628                 u8 old_retry_short, old_retry_long;
1629                 u32 old_frag_threshold, old_rts_threshold;
1630                 u8 old_coverage_class;
1631
1632                 if (!rdev->ops->set_wiphy_params) {
1633                         result = -EOPNOTSUPP;
1634                         goto bad_res;
1635                 }
1636
1637                 old_retry_short = rdev->wiphy.retry_short;
1638                 old_retry_long = rdev->wiphy.retry_long;
1639                 old_frag_threshold = rdev->wiphy.frag_threshold;
1640                 old_rts_threshold = rdev->wiphy.rts_threshold;
1641                 old_coverage_class = rdev->wiphy.coverage_class;
1642
1643                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1644                         rdev->wiphy.retry_short = retry_short;
1645                 if (changed & WIPHY_PARAM_RETRY_LONG)
1646                         rdev->wiphy.retry_long = retry_long;
1647                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1648                         rdev->wiphy.frag_threshold = frag_threshold;
1649                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1650                         rdev->wiphy.rts_threshold = rts_threshold;
1651                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1652                         rdev->wiphy.coverage_class = coverage_class;
1653
1654                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1655                 if (result) {
1656                         rdev->wiphy.retry_short = old_retry_short;
1657                         rdev->wiphy.retry_long = old_retry_long;
1658                         rdev->wiphy.frag_threshold = old_frag_threshold;
1659                         rdev->wiphy.rts_threshold = old_rts_threshold;
1660                         rdev->wiphy.coverage_class = old_coverage_class;
1661                 }
1662         }
1663
1664  bad_res:
1665         mutex_unlock(&rdev->mtx);
1666         if (netdev)
1667                 dev_put(netdev);
1668         return result;
1669 }
1670
1671
1672 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1673                               struct cfg80211_registered_device *rdev,
1674                               struct net_device *dev)
1675 {
1676         void *hdr;
1677
1678         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1679         if (!hdr)
1680                 return -1;
1681
1682         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1683             nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1684             nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
1685             nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1686                         dev->ieee80211_ptr->iftype) ||
1687             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1688                         rdev->devlist_generation ^
1689                         (cfg80211_rdev_list_generation << 2)))
1690                 goto nla_put_failure;
1691
1692         if (rdev->ops->get_channel) {
1693                 struct ieee80211_channel *chan;
1694                 enum nl80211_channel_type channel_type;
1695
1696                 chan = rdev->ops->get_channel(&rdev->wiphy, &channel_type);
1697                 if (chan &&
1698                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1699                                     chan->center_freq) ||
1700                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1701                                     channel_type)))
1702                         goto nla_put_failure;
1703         }
1704
1705         return genlmsg_end(msg, hdr);
1706
1707  nla_put_failure:
1708         genlmsg_cancel(msg, hdr);
1709         return -EMSGSIZE;
1710 }
1711
1712 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1713 {
1714         int wp_idx = 0;
1715         int if_idx = 0;
1716         int wp_start = cb->args[0];
1717         int if_start = cb->args[1];
1718         struct cfg80211_registered_device *rdev;
1719         struct wireless_dev *wdev;
1720
1721         mutex_lock(&cfg80211_mutex);
1722         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1723                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1724                         continue;
1725                 if (wp_idx < wp_start) {
1726                         wp_idx++;
1727                         continue;
1728                 }
1729                 if_idx = 0;
1730
1731                 mutex_lock(&rdev->devlist_mtx);
1732                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1733                         if (if_idx < if_start) {
1734                                 if_idx++;
1735                                 continue;
1736                         }
1737                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1738                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1739                                                rdev, wdev->netdev) < 0) {
1740                                 mutex_unlock(&rdev->devlist_mtx);
1741                                 goto out;
1742                         }
1743                         if_idx++;
1744                 }
1745                 mutex_unlock(&rdev->devlist_mtx);
1746
1747                 wp_idx++;
1748         }
1749  out:
1750         mutex_unlock(&cfg80211_mutex);
1751
1752         cb->args[0] = wp_idx;
1753         cb->args[1] = if_idx;
1754
1755         return skb->len;
1756 }
1757
1758 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1759 {
1760         struct sk_buff *msg;
1761         struct cfg80211_registered_device *dev = info->user_ptr[0];
1762         struct net_device *netdev = info->user_ptr[1];
1763
1764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1765         if (!msg)
1766                 return -ENOMEM;
1767
1768         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1769                                dev, netdev) < 0) {
1770                 nlmsg_free(msg);
1771                 return -ENOBUFS;
1772         }
1773
1774         return genlmsg_reply(msg, info);
1775 }
1776
1777 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1778         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1779         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1780         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1781         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1782         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1783 };
1784
1785 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1786 {
1787         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1788         int flag;
1789
1790         *mntrflags = 0;
1791
1792         if (!nla)
1793                 return -EINVAL;
1794
1795         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1796                              nla, mntr_flags_policy))
1797                 return -EINVAL;
1798
1799         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1800                 if (flags[flag])
1801                         *mntrflags |= (1<<flag);
1802
1803         return 0;
1804 }
1805
1806 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1807                                struct net_device *netdev, u8 use_4addr,
1808                                enum nl80211_iftype iftype)
1809 {
1810         if (!use_4addr) {
1811                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1812                         return -EBUSY;
1813                 return 0;
1814         }
1815
1816         switch (iftype) {
1817         case NL80211_IFTYPE_AP_VLAN:
1818                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1819                         return 0;
1820                 break;
1821         case NL80211_IFTYPE_STATION:
1822                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1823                         return 0;
1824                 break;
1825         default:
1826                 break;
1827         }
1828
1829         return -EOPNOTSUPP;
1830 }
1831
1832 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1833 {
1834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1835         struct vif_params params;
1836         int err;
1837         enum nl80211_iftype otype, ntype;
1838         struct net_device *dev = info->user_ptr[1];
1839         u32 _flags, *flags = NULL;
1840         bool change = false;
1841
1842         memset(&params, 0, sizeof(params));
1843
1844         otype = ntype = dev->ieee80211_ptr->iftype;
1845
1846         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1847                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1848                 if (otype != ntype)
1849                         change = true;
1850                 if (ntype > NL80211_IFTYPE_MAX)
1851                         return -EINVAL;
1852         }
1853
1854         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1855                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1856
1857                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1858                         return -EINVAL;
1859                 if (netif_running(dev))
1860                         return -EBUSY;
1861
1862                 wdev_lock(wdev);
1863                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1864                              IEEE80211_MAX_MESH_ID_LEN);
1865                 wdev->mesh_id_up_len =
1866                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1867                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1868                        wdev->mesh_id_up_len);
1869                 wdev_unlock(wdev);
1870         }
1871
1872         if (info->attrs[NL80211_ATTR_4ADDR]) {
1873                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1874                 change = true;
1875                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1876                 if (err)
1877                         return err;
1878         } else {
1879                 params.use_4addr = -1;
1880         }
1881
1882         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1883                 if (ntype != NL80211_IFTYPE_MONITOR)
1884                         return -EINVAL;
1885                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1886                                           &_flags);
1887                 if (err)
1888                         return err;
1889
1890                 flags = &_flags;
1891                 change = true;
1892         }
1893
1894         if (change)
1895                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1896         else
1897                 err = 0;
1898
1899         if (!err && params.use_4addr != -1)
1900                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1901
1902         return err;
1903 }
1904
1905 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908         struct vif_params params;
1909         struct net_device *dev;
1910         int err;
1911         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1912         u32 flags;
1913
1914         memset(&params, 0, sizeof(params));
1915
1916         if (!info->attrs[NL80211_ATTR_IFNAME])
1917                 return -EINVAL;
1918
1919         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1920                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1921                 if (type > NL80211_IFTYPE_MAX)
1922                         return -EINVAL;
1923         }
1924
1925         if (!rdev->ops->add_virtual_intf ||
1926             !(rdev->wiphy.interface_modes & (1 << type)))
1927                 return -EOPNOTSUPP;
1928
1929         if (info->attrs[NL80211_ATTR_4ADDR]) {
1930                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1931                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1932                 if (err)
1933                         return err;
1934         }
1935
1936         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1937                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1938                                   &flags);
1939         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1940                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1941                 type, err ? NULL : &flags, &params);
1942         if (IS_ERR(dev))
1943                 return PTR_ERR(dev);
1944
1945         if (type == NL80211_IFTYPE_MESH_POINT &&
1946             info->attrs[NL80211_ATTR_MESH_ID]) {
1947                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1948
1949                 wdev_lock(wdev);
1950                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1951                              IEEE80211_MAX_MESH_ID_LEN);
1952                 wdev->mesh_id_up_len =
1953                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1954                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1955                        wdev->mesh_id_up_len);
1956                 wdev_unlock(wdev);
1957         }
1958
1959         return 0;
1960 }
1961
1962 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1963 {
1964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1965         struct net_device *dev = info->user_ptr[1];
1966
1967         if (!rdev->ops->del_virtual_intf)
1968                 return -EOPNOTSUPP;
1969
1970         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1971 }
1972
1973 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
1974 {
1975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1976         struct net_device *dev = info->user_ptr[1];
1977         u16 noack_map;
1978
1979         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
1980                 return -EINVAL;
1981
1982         if (!rdev->ops->set_noack_map)
1983                 return -EOPNOTSUPP;
1984
1985         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
1986
1987         return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
1988 }
1989
1990 struct get_key_cookie {
1991         struct sk_buff *msg;
1992         int error;
1993         int idx;
1994 };
1995
1996 static void get_key_callback(void *c, struct key_params *params)
1997 {
1998         struct nlattr *key;
1999         struct get_key_cookie *cookie = c;
2000
2001         if ((params->key &&
2002              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2003                      params->key_len, params->key)) ||
2004             (params->seq &&
2005              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2006                      params->seq_len, params->seq)) ||
2007             (params->cipher &&
2008              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2009                          params->cipher)))
2010                 goto nla_put_failure;
2011
2012         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2013         if (!key)
2014                 goto nla_put_failure;
2015
2016         if ((params->key &&
2017              nla_put(cookie->msg, NL80211_KEY_DATA,
2018                      params->key_len, params->key)) ||
2019             (params->seq &&
2020              nla_put(cookie->msg, NL80211_KEY_SEQ,
2021                      params->seq_len, params->seq)) ||
2022             (params->cipher &&
2023              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2024                          params->cipher)))
2025                 goto nla_put_failure;
2026
2027         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2028                 goto nla_put_failure;
2029
2030         nla_nest_end(cookie->msg, key);
2031
2032         return;
2033  nla_put_failure:
2034         cookie->error = 1;
2035 }
2036
2037 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2038 {
2039         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2040         int err;
2041         struct net_device *dev = info->user_ptr[1];
2042         u8 key_idx = 0;
2043         const u8 *mac_addr = NULL;
2044         bool pairwise;
2045         struct get_key_cookie cookie = {
2046                 .error = 0,
2047         };
2048         void *hdr;
2049         struct sk_buff *msg;
2050
2051         if (info->attrs[NL80211_ATTR_KEY_IDX])
2052                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2053
2054         if (key_idx > 5)
2055                 return -EINVAL;
2056
2057         if (info->attrs[NL80211_ATTR_MAC])
2058                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2059
2060         pairwise = !!mac_addr;
2061         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2062                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2063                 if (kt >= NUM_NL80211_KEYTYPES)
2064                         return -EINVAL;
2065                 if (kt != NL80211_KEYTYPE_GROUP &&
2066                     kt != NL80211_KEYTYPE_PAIRWISE)
2067                         return -EINVAL;
2068                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2069         }
2070
2071         if (!rdev->ops->get_key)
2072                 return -EOPNOTSUPP;
2073
2074         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2075         if (!msg)
2076                 return -ENOMEM;
2077
2078         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2079                              NL80211_CMD_NEW_KEY);
2080         if (IS_ERR(hdr))
2081                 return PTR_ERR(hdr);
2082
2083         cookie.msg = msg;
2084         cookie.idx = key_idx;
2085
2086         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2087             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2088                 goto nla_put_failure;
2089         if (mac_addr &&
2090             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2091                 goto nla_put_failure;
2092
2093         if (pairwise && mac_addr &&
2094             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2095                 return -ENOENT;
2096
2097         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
2098                                  mac_addr, &cookie, get_key_callback);
2099
2100         if (err)
2101                 goto free_msg;
2102
2103         if (cookie.error)
2104                 goto nla_put_failure;
2105
2106         genlmsg_end(msg, hdr);
2107         return genlmsg_reply(msg, info);
2108
2109  nla_put_failure:
2110         err = -ENOBUFS;
2111  free_msg:
2112         nlmsg_free(msg);
2113         return err;
2114 }
2115
2116 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2117 {
2118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2119         struct key_parse key;
2120         int err;
2121         struct net_device *dev = info->user_ptr[1];
2122
2123         err = nl80211_parse_key(info, &key);
2124         if (err)
2125                 return err;
2126
2127         if (key.idx < 0)
2128                 return -EINVAL;
2129
2130         /* only support setting default key */
2131         if (!key.def && !key.defmgmt)
2132                 return -EINVAL;
2133
2134         wdev_lock(dev->ieee80211_ptr);
2135
2136         if (key.def) {
2137                 if (!rdev->ops->set_default_key) {
2138                         err = -EOPNOTSUPP;
2139                         goto out;
2140                 }
2141
2142                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2143                 if (err)
2144                         goto out;
2145
2146                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
2147                                                  key.def_uni, key.def_multi);
2148
2149                 if (err)
2150                         goto out;
2151
2152 #ifdef CONFIG_CFG80211_WEXT
2153                 dev->ieee80211_ptr->wext.default_key = key.idx;
2154 #endif
2155         } else {
2156                 if (key.def_uni || !key.def_multi) {
2157                         err = -EINVAL;
2158                         goto out;
2159                 }
2160
2161                 if (!rdev->ops->set_default_mgmt_key) {
2162                         err = -EOPNOTSUPP;
2163                         goto out;
2164                 }
2165
2166                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2167                 if (err)
2168                         goto out;
2169
2170                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
2171                                                       dev, key.idx);
2172                 if (err)
2173                         goto out;
2174
2175 #ifdef CONFIG_CFG80211_WEXT
2176                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2177 #endif
2178         }
2179
2180  out:
2181         wdev_unlock(dev->ieee80211_ptr);
2182
2183         return err;
2184 }
2185
2186 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2187 {
2188         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2189         int err;
2190         struct net_device *dev = info->user_ptr[1];
2191         struct key_parse key;
2192         const u8 *mac_addr = NULL;
2193
2194         err = nl80211_parse_key(info, &key);
2195         if (err)
2196                 return err;
2197
2198         if (!key.p.key)
2199                 return -EINVAL;
2200
2201         if (info->attrs[NL80211_ATTR_MAC])
2202                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2203
2204         if (key.type == -1) {
2205                 if (mac_addr)
2206                         key.type = NL80211_KEYTYPE_PAIRWISE;
2207                 else
2208                         key.type = NL80211_KEYTYPE_GROUP;
2209         }
2210
2211         /* for now */
2212         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2213             key.type != NL80211_KEYTYPE_GROUP)
2214                 return -EINVAL;
2215
2216         if (!rdev->ops->add_key)
2217                 return -EOPNOTSUPP;
2218
2219         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2220                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2221                                            mac_addr))
2222                 return -EINVAL;
2223
2224         wdev_lock(dev->ieee80211_ptr);
2225         err = nl80211_key_allowed(dev->ieee80211_ptr);
2226         if (!err)
2227                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2228                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2229                                          mac_addr, &key.p);
2230         wdev_unlock(dev->ieee80211_ptr);
2231
2232         return err;
2233 }
2234
2235 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2236 {
2237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2238         int err;
2239         struct net_device *dev = info->user_ptr[1];
2240         u8 *mac_addr = NULL;
2241         struct key_parse key;
2242
2243         err = nl80211_parse_key(info, &key);
2244         if (err)
2245                 return err;
2246
2247         if (info->attrs[NL80211_ATTR_MAC])
2248                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2249
2250         if (key.type == -1) {
2251                 if (mac_addr)
2252                         key.type = NL80211_KEYTYPE_PAIRWISE;
2253                 else
2254                         key.type = NL80211_KEYTYPE_GROUP;
2255         }
2256
2257         /* for now */
2258         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2259             key.type != NL80211_KEYTYPE_GROUP)
2260                 return -EINVAL;
2261
2262         if (!rdev->ops->del_key)
2263                 return -EOPNOTSUPP;
2264
2265         wdev_lock(dev->ieee80211_ptr);
2266         err = nl80211_key_allowed(dev->ieee80211_ptr);
2267
2268         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2269             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2270                 err = -ENOENT;
2271
2272         if (!err)
2273                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2274                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2275                                          mac_addr);
2276
2277 #ifdef CONFIG_CFG80211_WEXT
2278         if (!err) {
2279                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2280                         dev->ieee80211_ptr->wext.default_key = -1;
2281                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2282                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2283         }
2284 #endif
2285         wdev_unlock(dev->ieee80211_ptr);
2286
2287         return err;
2288 }
2289
2290 static int nl80211_parse_beacon(struct genl_info *info,
2291                                 struct cfg80211_beacon_data *bcn)
2292 {
2293         bool haveinfo = false;
2294
2295         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2296             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2297             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2298             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2299                 return -EINVAL;
2300
2301         memset(bcn, 0, sizeof(*bcn));
2302
2303         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2304                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2305                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2306                 if (!bcn->head_len)
2307                         return -EINVAL;
2308                 haveinfo = true;
2309         }
2310
2311         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2312                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2313                 bcn->tail_len =
2314                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2315                 haveinfo = true;
2316         }
2317
2318         if (!haveinfo)
2319                 return -EINVAL;
2320
2321         if (info->attrs[NL80211_ATTR_IE]) {
2322                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2323                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2324         }
2325
2326         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2327                 bcn->proberesp_ies =
2328                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2329                 bcn->proberesp_ies_len =
2330                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2331         }
2332
2333         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2334                 bcn->assocresp_ies =
2335                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2336                 bcn->assocresp_ies_len =
2337                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2338         }
2339
2340         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2341                 bcn->probe_resp =
2342                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2343                 bcn->probe_resp_len =
2344                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2345         }
2346
2347         return 0;
2348 }
2349
2350 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2351                                    struct cfg80211_ap_settings *params)
2352 {
2353         struct wireless_dev *wdev;
2354         bool ret = false;
2355
2356         mutex_lock(&rdev->devlist_mtx);
2357
2358         list_for_each_entry(wdev, &rdev->netdev_list, list) {
2359                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2360                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2361                         continue;
2362
2363                 if (!wdev->preset_chan)
2364                         continue;
2365
2366                 params->channel = wdev->preset_chan;
2367                 params->channel_type = wdev->preset_chantype;
2368                 ret = true;
2369                 break;
2370         }
2371
2372         mutex_unlock(&rdev->devlist_mtx);
2373
2374         return ret;
2375 }
2376
2377 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2378 {
2379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2380         struct net_device *dev = info->user_ptr[1];
2381         struct wireless_dev *wdev = dev->ieee80211_ptr;
2382         struct cfg80211_ap_settings params;
2383         int err;
2384
2385         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2386             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2387                 return -EOPNOTSUPP;
2388
2389         if (!rdev->ops->start_ap)
2390                 return -EOPNOTSUPP;
2391
2392         if (wdev->beacon_interval)
2393                 return -EALREADY;
2394
2395         memset(&params, 0, sizeof(params));
2396
2397         /* these are required for START_AP */
2398         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2399             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2400             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2401                 return -EINVAL;
2402
2403         err = nl80211_parse_beacon(info, &params.beacon);
2404         if (err)
2405                 return err;
2406
2407         params.beacon_interval =
2408                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2409         params.dtim_period =
2410                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2411
2412         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2413         if (err)
2414                 return err;
2415
2416         /*
2417          * In theory, some of these attributes should be required here
2418          * but since they were not used when the command was originally
2419          * added, keep them optional for old user space programs to let
2420          * them continue to work with drivers that do not need the
2421          * additional information -- drivers must check!
2422          */
2423         if (info->attrs[NL80211_ATTR_SSID]) {
2424                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2425                 params.ssid_len =
2426                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2427                 if (params.ssid_len == 0 ||
2428                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2429                         return -EINVAL;
2430         }
2431
2432         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2433                 params.hidden_ssid = nla_get_u32(
2434                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2435                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2436                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2437                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2438                         return -EINVAL;
2439         }
2440
2441         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2442
2443         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2444                 params.auth_type = nla_get_u32(
2445                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2446                 if (!nl80211_valid_auth_type(params.auth_type))
2447                         return -EINVAL;
2448         } else
2449                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2450
2451         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2452                                       NL80211_MAX_NR_CIPHER_SUITES);
2453         if (err)
2454                 return err;
2455
2456         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2457                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2458                         return -EOPNOTSUPP;
2459                 params.inactivity_timeout = nla_get_u16(
2460                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2461         }
2462
2463         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2464                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2465
2466                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2467                     !nl80211_valid_channel_type(info, &channel_type))
2468                         return -EINVAL;
2469
2470                 params.channel = rdev_freq_to_chan(rdev,
2471                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2472                         channel_type);
2473                 if (!params.channel)
2474                         return -EINVAL;
2475                 params.channel_type = channel_type;
2476         } else if (wdev->preset_chan) {
2477                 params.channel = wdev->preset_chan;
2478                 params.channel_type = wdev->preset_chantype;
2479         } else if (!nl80211_get_ap_channel(rdev, &params))
2480                 return -EINVAL;
2481
2482         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2483                                           params.channel_type))
2484                 return -EINVAL;
2485
2486         err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
2487         if (!err) {
2488                 wdev->preset_chan = params.channel;
2489                 wdev->preset_chantype = params.channel_type;
2490                 wdev->beacon_interval = params.beacon_interval;
2491                 wdev->channel = params.channel;
2492         }
2493         return err;
2494 }
2495
2496 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2497 {
2498         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2499         struct net_device *dev = info->user_ptr[1];
2500         struct wireless_dev *wdev = dev->ieee80211_ptr;
2501         struct cfg80211_beacon_data params;
2502         int err;
2503
2504         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2505             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2506                 return -EOPNOTSUPP;
2507
2508         if (!rdev->ops->change_beacon)
2509                 return -EOPNOTSUPP;
2510
2511         if (!wdev->beacon_interval)
2512                 return -EINVAL;
2513
2514         err = nl80211_parse_beacon(info, &params);
2515         if (err)
2516                 return err;
2517
2518         return rdev->ops->change_beacon(&rdev->wiphy, dev, &params);
2519 }
2520
2521 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2522 {
2523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2524         struct net_device *dev = info->user_ptr[1];
2525
2526         return cfg80211_stop_ap(rdev, dev);
2527 }
2528
2529 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2530         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2531         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2532         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2533         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2534         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2535         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2536 };
2537
2538 static int parse_station_flags(struct genl_info *info,
2539                                enum nl80211_iftype iftype,
2540                                struct station_parameters *params)
2541 {
2542         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2543         struct nlattr *nla;
2544         int flag;
2545
2546         /*
2547          * Try parsing the new attribute first so userspace
2548          * can specify both for older kernels.
2549          */
2550         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2551         if (nla) {
2552                 struct nl80211_sta_flag_update *sta_flags;
2553
2554                 sta_flags = nla_data(nla);
2555                 params->sta_flags_mask = sta_flags->mask;
2556                 params->sta_flags_set = sta_flags->set;
2557                 if ((params->sta_flags_mask |
2558                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2559                         return -EINVAL;
2560                 return 0;
2561         }
2562
2563         /* if present, parse the old attribute */
2564
2565         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2566         if (!nla)
2567                 return 0;
2568
2569         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2570                              nla, sta_flags_policy))
2571                 return -EINVAL;
2572
2573         /*
2574          * Only allow certain flags for interface types so that
2575          * other attributes are silently ignored. Remember that
2576          * this is backward compatibility code with old userspace
2577          * and shouldn't be hit in other cases anyway.
2578          */
2579         switch (iftype) {
2580         case NL80211_IFTYPE_AP:
2581         case NL80211_IFTYPE_AP_VLAN:
2582         case NL80211_IFTYPE_P2P_GO:
2583                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2584                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2585                                          BIT(NL80211_STA_FLAG_WME) |
2586                                          BIT(NL80211_STA_FLAG_MFP);
2587                 break;
2588         case NL80211_IFTYPE_P2P_CLIENT:
2589         case NL80211_IFTYPE_STATION:
2590                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2591                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2592                 break;
2593         case NL80211_IFTYPE_MESH_POINT:
2594                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2595                                          BIT(NL80211_STA_FLAG_MFP) |
2596                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2597         default:
2598                 return -EINVAL;
2599         }
2600
2601         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2602                 if (flags[flag]) {
2603                         params->sta_flags_set |= (1<<flag);
2604
2605                         /* no longer support new API additions in old API */
2606                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2607                                 return -EINVAL;
2608                 }
2609         }
2610
2611         return 0;
2612 }
2613
2614 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2615                                  int attr)
2616 {
2617         struct nlattr *rate;
2618         u16 bitrate;
2619
2620         rate = nla_nest_start(msg, attr);
2621         if (!rate)
2622                 goto nla_put_failure;
2623
2624         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2625         bitrate = cfg80211_calculate_bitrate(info);
2626         if ((bitrate > 0 &&
2627              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate)) ||
2628             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2629              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2630             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2631              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2632             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2633              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2634                 goto nla_put_failure;
2635
2636         nla_nest_end(msg, rate);
2637         return true;
2638
2639 nla_put_failure:
2640         return false;
2641 }
2642
2643 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2644                                 int flags,
2645                                 struct cfg80211_registered_device *rdev,
2646                                 struct net_device *dev,
2647                                 const u8 *mac_addr, struct station_info *sinfo)
2648 {
2649         void *hdr;
2650         struct nlattr *sinfoattr, *bss_param;
2651
2652         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2653         if (!hdr)
2654                 return -1;
2655
2656         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2657             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2658             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2659                 goto nla_put_failure;
2660
2661         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2662         if (!sinfoattr)
2663                 goto nla_put_failure;
2664         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2665             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2666                         sinfo->connected_time))
2667                 goto nla_put_failure;
2668         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2669             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2670                         sinfo->inactive_time))
2671                 goto nla_put_failure;
2672         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2673             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2674                         sinfo->rx_bytes))
2675                 goto nla_put_failure;
2676         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2677             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2678                         sinfo->tx_bytes))
2679                 goto nla_put_failure;
2680         if ((sinfo->filled & STATION_INFO_LLID) &&
2681             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2682                 goto nla_put_failure;
2683         if ((sinfo->filled & STATION_INFO_PLID) &&
2684             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2685                 goto nla_put_failure;
2686         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2687             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2688                        sinfo->plink_state))
2689                 goto nla_put_failure;
2690         switch (rdev->wiphy.signal_type) {
2691         case CFG80211_SIGNAL_TYPE_MBM:
2692                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2693                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2694                                sinfo->signal))
2695                         goto nla_put_failure;
2696                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2697                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2698                                sinfo->signal_avg))
2699                         goto nla_put_failure;
2700                 break;
2701         default:
2702                 break;
2703         }
2704         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2705                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2706                                           NL80211_STA_INFO_TX_BITRATE))
2707                         goto nla_put_failure;
2708         }
2709         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2710                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2711                                           NL80211_STA_INFO_RX_BITRATE))
2712                         goto nla_put_failure;
2713         }
2714         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2715             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2716                         sinfo->rx_packets))
2717                 goto nla_put_failure;
2718         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2719             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2720                         sinfo->tx_packets))
2721                 goto nla_put_failure;
2722         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2723             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2724                         sinfo->tx_retries))
2725                 goto nla_put_failure;
2726         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2727             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2728                         sinfo->tx_failed))
2729                 goto nla_put_failure;
2730         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2731             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2732                         sinfo->beacon_loss_count))
2733                 goto nla_put_failure;
2734         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2735                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2736                 if (!bss_param)
2737                         goto nla_put_failure;
2738
2739                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2740                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2741                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2742                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2743                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2744                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2745                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2746                                sinfo->bss_param.dtim_period) ||
2747                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2748                                 sinfo->bss_param.beacon_interval))
2749                         goto nla_put_failure;
2750
2751                 nla_nest_end(msg, bss_param);
2752         }
2753         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2754             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2755                     sizeof(struct nl80211_sta_flag_update),
2756                     &sinfo->sta_flags))
2757                 goto nla_put_failure;
2758         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2759                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2760                             sinfo->t_offset))
2761                 goto nla_put_failure;
2762         nla_nest_end(msg, sinfoattr);
2763
2764         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2765             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2766                     sinfo->assoc_req_ies))
2767                 goto nla_put_failure;
2768
2769         return genlmsg_end(msg, hdr);
2770
2771  nla_put_failure:
2772         genlmsg_cancel(msg, hdr);
2773         return -EMSGSIZE;
2774 }
2775
2776 static int nl80211_dump_station(struct sk_buff *skb,
2777                                 struct netlink_callback *cb)
2778 {
2779         struct station_info sinfo;
2780         struct cfg80211_registered_device *dev;
2781         struct net_device *netdev;
2782         u8 mac_addr[ETH_ALEN];
2783         int sta_idx = cb->args[1];
2784         int err;
2785
2786         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2787         if (err)
2788                 return err;
2789
2790         if (!dev->ops->dump_station) {
2791                 err = -EOPNOTSUPP;
2792                 goto out_err;
2793         }
2794
2795         while (1) {
2796                 memset(&sinfo, 0, sizeof(sinfo));
2797                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2798                                              mac_addr, &sinfo);
2799                 if (err == -ENOENT)
2800                         break;
2801                 if (err)
2802                         goto out_err;
2803
2804                 if (nl80211_send_station(skb,
2805                                 NETLINK_CB(cb->skb).pid,
2806                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2807                                 dev, netdev, mac_addr,
2808                                 &sinfo) < 0)
2809                         goto out;
2810
2811                 sta_idx++;
2812         }
2813
2814
2815  out:
2816         cb->args[1] = sta_idx;
2817         err = skb->len;
2818  out_err:
2819         nl80211_finish_netdev_dump(dev);
2820
2821         return err;
2822 }
2823
2824 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2825 {
2826         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2827         struct net_device *dev = info->user_ptr[1];
2828         struct station_info sinfo;
2829         struct sk_buff *msg;
2830         u8 *mac_addr = NULL;
2831         int err;
2832
2833         memset(&sinfo, 0, sizeof(sinfo));
2834
2835         if (!info->attrs[NL80211_ATTR_MAC])
2836                 return -EINVAL;
2837
2838         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2839
2840         if (!rdev->ops->get_station)
2841                 return -EOPNOTSUPP;
2842
2843         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2844         if (err)
2845                 return err;
2846
2847         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2848         if (!msg)
2849                 return -ENOMEM;
2850
2851         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2852                                  rdev, dev, mac_addr, &sinfo) < 0) {
2853                 nlmsg_free(msg);
2854                 return -ENOBUFS;
2855         }
2856
2857         return genlmsg_reply(msg, info);
2858 }
2859
2860 /*
2861  * Get vlan interface making sure it is running and on the right wiphy.
2862  */
2863 static struct net_device *get_vlan(struct genl_info *info,
2864                                    struct cfg80211_registered_device *rdev)
2865 {
2866         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2867         struct net_device *v;
2868         int ret;
2869
2870         if (!vlanattr)
2871                 return NULL;
2872
2873         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
2874         if (!v)
2875                 return ERR_PTR(-ENODEV);
2876
2877         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
2878                 ret = -EINVAL;
2879                 goto error;
2880         }
2881
2882         if (!netif_running(v)) {
2883                 ret = -ENETDOWN;
2884                 goto error;
2885         }
2886
2887         return v;
2888  error:
2889         dev_put(v);
2890         return ERR_PTR(ret);
2891 }
2892
2893 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2894 {
2895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2896         int err;
2897         struct net_device *dev = info->user_ptr[1];
2898         struct station_parameters params;
2899         u8 *mac_addr = NULL;
2900
2901         memset(&params, 0, sizeof(params));
2902
2903         params.listen_interval = -1;
2904         params.plink_state = -1;
2905
2906         if (info->attrs[NL80211_ATTR_STA_AID])
2907                 return -EINVAL;
2908
2909         if (!info->attrs[NL80211_ATTR_MAC])
2910                 return -EINVAL;
2911
2912         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2913
2914         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2915                 params.supported_rates =
2916                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2917                 params.supported_rates_len =
2918                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2919         }
2920
2921         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2922                 params.listen_interval =
2923                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2924
2925         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2926                 params.ht_capa =
2927                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2928
2929         if (!rdev->ops->change_station)
2930                 return -EOPNOTSUPP;
2931
2932         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
2933                 return -EINVAL;
2934
2935         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2936                 params.plink_action =
2937                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2938
2939         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2940                 params.plink_state =
2941                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2942
2943         switch (dev->ieee80211_ptr->iftype) {
2944         case NL80211_IFTYPE_AP:
2945         case NL80211_IFTYPE_AP_VLAN:
2946         case NL80211_IFTYPE_P2P_GO:
2947                 /* disallow mesh-specific things */
2948                 if (params.plink_action)
2949                         return -EINVAL;
2950
2951                 /* TDLS can't be set, ... */
2952                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2953                         return -EINVAL;
2954                 /*
2955                  * ... but don't bother the driver with it. This works around
2956                  * a hostapd/wpa_supplicant issue -- it always includes the
2957                  * TLDS_PEER flag in the mask even for AP mode.
2958                  */
2959                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2960
2961                 /* accept only the listed bits */
2962                 if (params.sta_flags_mask &
2963                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
2964                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2965                                   BIT(NL80211_STA_FLAG_WME) |
2966                                   BIT(NL80211_STA_FLAG_MFP)))
2967                         return -EINVAL;
2968
2969                 /* must be last in here for error handling */
2970                 params.vlan = get_vlan(info, rdev);
2971                 if (IS_ERR(params.vlan))
2972                         return PTR_ERR(params.vlan);
2973                 break;
2974         case NL80211_IFTYPE_P2P_CLIENT:
2975         case NL80211_IFTYPE_STATION:
2976                 /*
2977                  * Don't allow userspace to change the TDLS_PEER flag,
2978                  * but silently ignore attempts to change it since we
2979                  * don't have state here to verify that it doesn't try
2980                  * to change the flag.
2981                  */
2982                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2983                 /* fall through */
2984         case NL80211_IFTYPE_ADHOC:
2985                 /* disallow things sta doesn't support */
2986                 if (params.plink_action)
2987                         return -EINVAL;
2988                 if (params.ht_capa)
2989                         return -EINVAL;
2990                 if (params.listen_interval >= 0)
2991                         return -EINVAL;
2992                 /* reject any changes other than AUTHORIZED */
2993                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2994                         return -EINVAL;
2995                 break;
2996         case NL80211_IFTYPE_MESH_POINT:
2997                 /* disallow things mesh doesn't support */
2998                 if (params.vlan)
2999                         return -EINVAL;
3000                 if (params.ht_capa)
3001                         return -EINVAL;
3002                 if (params.listen_interval >= 0)
3003                         return -EINVAL;
3004                 /*
3005                  * No special handling for TDLS here -- the userspace
3006                  * mesh code doesn't have this bug.
3007                  */
3008                 if (params.sta_flags_mask &
3009                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3010                                   BIT(NL80211_STA_FLAG_MFP) |
3011                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3012                         return -EINVAL;
3013                 break;
3014         default:
3015                 return -EOPNOTSUPP;
3016         }
3017
3018         /* be aware of params.vlan when changing code here */
3019
3020         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
3021
3022         if (params.vlan)
3023                 dev_put(params.vlan);
3024
3025         return err;
3026 }
3027
3028 static struct nla_policy
3029 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3030         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3031         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3032 };
3033
3034 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3035 {
3036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3037         int err;
3038         struct net_device *dev = info->user_ptr[1];
3039         struct station_parameters params;
3040         u8 *mac_addr = NULL;
3041
3042         memset(&params, 0, sizeof(params));
3043
3044         if (!info->attrs[NL80211_ATTR_MAC])
3045                 return -EINVAL;
3046
3047         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3048                 return -EINVAL;
3049
3050         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3051                 return -EINVAL;
3052
3053         if (!info->attrs[NL80211_ATTR_STA_AID])
3054                 return -EINVAL;
3055
3056         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3057         params.supported_rates =
3058                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3059         params.supported_rates_len =
3060                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3061         params.listen_interval =
3062                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3063
3064         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3065         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3066                 return -EINVAL;
3067
3068         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3069                 params.ht_capa =
3070                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3071
3072         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3073                 params.plink_action =
3074                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3075
3076         if (!rdev->ops->add_station)
3077                 return -EOPNOTSUPP;
3078
3079         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3080                 return -EINVAL;
3081
3082         switch (dev->ieee80211_ptr->iftype) {
3083         case NL80211_IFTYPE_AP:
3084         case NL80211_IFTYPE_AP_VLAN:
3085         case NL80211_IFTYPE_P2P_GO:
3086                 /* parse WME attributes if sta is WME capable */
3087                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3088                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3089                     info->attrs[NL80211_ATTR_STA_WME]) {
3090                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3091                         struct nlattr *nla;
3092
3093                         nla = info->attrs[NL80211_ATTR_STA_WME];
3094                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3095                                                nl80211_sta_wme_policy);
3096                         if (err)
3097                                 return err;
3098
3099                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3100                                 params.uapsd_queues =
3101                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3102                         if (params.uapsd_queues &
3103                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3104                                 return -EINVAL;
3105
3106                         if (tb[NL80211_STA_WME_MAX_SP])
3107                                 params.max_sp =
3108                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3109
3110                         if (params.max_sp &
3111                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3112                                 return -EINVAL;
3113
3114                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3115                 }
3116                 /* TDLS peers cannot be added */
3117                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3118                         return -EINVAL;
3119                 /* but don't bother the driver with it */
3120                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3121
3122                 /* must be last in here for error handling */
3123                 params.vlan = get_vlan(info, rdev);
3124                 if (IS_ERR(params.vlan))
3125                         return PTR_ERR(params.vlan);
3126                 break;
3127         case NL80211_IFTYPE_MESH_POINT:
3128                 /* TDLS peers cannot be added */
3129                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3130                         return -EINVAL;
3131                 break;
3132         case NL80211_IFTYPE_STATION:
3133                 /* Only TDLS peers can be added */
3134                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3135                         return -EINVAL;
3136                 /* Can only add if TDLS ... */
3137                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3138                         return -EOPNOTSUPP;
3139                 /* ... with external setup is supported */
3140                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3141                         return -EOPNOTSUPP;
3142                 break;
3143         default:
3144                 return -EOPNOTSUPP;
3145         }
3146
3147         /* be aware of params.vlan when changing code here */
3148
3149         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
3150
3151         if (params.vlan)
3152                 dev_put(params.vlan);
3153         return err;
3154 }
3155
3156 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3157 {
3158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3159         struct net_device *dev = info->user_ptr[1];
3160         u8 *mac_addr = NULL;
3161
3162         if (info->attrs[NL80211_ATTR_MAC])
3163                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3164
3165         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3166             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3167             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3168             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3169                 return -EINVAL;
3170
3171         if (!rdev->ops->del_station)
3172                 return -EOPNOTSUPP;
3173
3174         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
3175 }
3176
3177 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
3178                                 int flags, struct net_device *dev,
3179                                 u8 *dst, u8 *next_hop,
3180                                 struct mpath_info *pinfo)
3181 {
3182         void *hdr;
3183         struct nlattr *pinfoattr;
3184
3185         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
3186         if (!hdr)
3187                 return -1;
3188
3189         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3190             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3191             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3192             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3193                 goto nla_put_failure;
3194
3195         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3196         if (!pinfoattr)
3197                 goto nla_put_failure;
3198         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3199             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3200                         pinfo->frame_qlen))
3201                 goto nla_put_failure;
3202         if (((pinfo->filled & MPATH_INFO_SN) &&
3203              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3204             ((pinfo->filled & MPATH_INFO_METRIC) &&
3205              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3206                          pinfo->metric)) ||
3207             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3208              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3209                          pinfo->exptime)) ||
3210             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3211              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3212                         pinfo->flags)) ||
3213             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3214              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3215                          pinfo->discovery_timeout)) ||
3216             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3217              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3218                         pinfo->discovery_retries)))
3219                 goto nla_put_failure;
3220
3221         nla_nest_end(msg, pinfoattr);
3222
3223         return genlmsg_end(msg, hdr);
3224
3225  nla_put_failure:
3226         genlmsg_cancel(msg, hdr);
3227         return -EMSGSIZE;
3228 }
3229
3230 static int nl80211_dump_mpath(struct sk_buff *skb,
3231                               struct netlink_callback *cb)
3232 {
3233         struct mpath_info pinfo;
3234         struct cfg80211_registered_device *dev;
3235         struct net_device *netdev;
3236         u8 dst[ETH_ALEN];
3237         u8 next_hop[ETH_ALEN];
3238         int path_idx = cb->args[1];
3239         int err;
3240
3241         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3242         if (err)
3243                 return err;
3244
3245         if (!dev->ops->dump_mpath) {
3246                 err = -EOPNOTSUPP;
3247                 goto out_err;
3248         }
3249
3250         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3251                 err = -EOPNOTSUPP;
3252                 goto out_err;
3253         }
3254
3255         while (1) {
3256                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
3257                                            dst, next_hop, &pinfo);
3258                 if (err == -ENOENT)
3259                         break;
3260                 if (err)
3261                         goto out_err;
3262
3263                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
3264                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3265                                        netdev, dst, next_hop,
3266                                        &pinfo) < 0)
3267                         goto out;
3268
3269                 path_idx++;
3270         }
3271
3272
3273  out:
3274         cb->args[1] = path_idx;
3275         err = skb->len;
3276  out_err:
3277         nl80211_finish_netdev_dump(dev);
3278         return err;
3279 }
3280
3281 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3282 {
3283         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3284         int err;
3285         struct net_device *dev = info->user_ptr[1];
3286         struct mpath_info pinfo;
3287         struct sk_buff *msg;
3288         u8 *dst = NULL;
3289         u8 next_hop[ETH_ALEN];
3290
3291         memset(&pinfo, 0, sizeof(pinfo));
3292
3293         if (!info->attrs[NL80211_ATTR_MAC])
3294                 return -EINVAL;
3295
3296         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3297
3298         if (!rdev->ops->get_mpath)
3299                 return -EOPNOTSUPP;
3300
3301         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3302                 return -EOPNOTSUPP;
3303
3304         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
3305         if (err)
3306                 return err;
3307
3308         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3309         if (!msg)
3310                 return -ENOMEM;
3311
3312         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
3313                                  dev, dst, next_hop, &pinfo) < 0) {
3314                 nlmsg_free(msg);
3315                 return -ENOBUFS;
3316         }
3317
3318         return genlmsg_reply(msg, info);
3319 }
3320
3321 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3322 {
3323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3324         struct net_device *dev = info->user_ptr[1];
3325         u8 *dst = NULL;
3326         u8 *next_hop = NULL;
3327
3328         if (!info->attrs[NL80211_ATTR_MAC])
3329                 return -EINVAL;
3330
3331         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3332                 return -EINVAL;
3333
3334         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3335         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3336
3337         if (!rdev->ops->change_mpath)
3338                 return -EOPNOTSUPP;
3339
3340         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3341                 return -EOPNOTSUPP;
3342
3343         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
3344 }
3345
3346 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3347 {
3348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3349         struct net_device *dev = info->user_ptr[1];
3350         u8 *dst = NULL;
3351         u8 *next_hop = NULL;
3352
3353         if (!info->attrs[NL80211_ATTR_MAC])
3354                 return -EINVAL;
3355
3356         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3357                 return -EINVAL;
3358
3359         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3360         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3361
3362         if (!rdev->ops->add_mpath)
3363                 return -EOPNOTSUPP;
3364
3365         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3366                 return -EOPNOTSUPP;
3367
3368         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3369 }
3370
3371 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3372 {
3373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3374         struct net_device *dev = info->user_ptr[1];
3375         u8 *dst = NULL;
3376
3377         if (info->attrs[NL80211_ATTR_MAC])
3378                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3379
3380         if (!rdev->ops->del_mpath)
3381                 return -EOPNOTSUPP;
3382
3383         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3384 }
3385
3386 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3387 {
3388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3389         struct net_device *dev = info->user_ptr[1];
3390         struct bss_parameters params;
3391
3392         memset(&params, 0, sizeof(params));
3393         /* default to not changing parameters */
3394         params.use_cts_prot = -1;
3395         params.use_short_preamble = -1;
3396         params.use_short_slot_time = -1;
3397         params.ap_isolate = -1;
3398         params.ht_opmode = -1;
3399
3400         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3401                 params.use_cts_prot =
3402                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3403         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3404                 params.use_short_preamble =
3405                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3406         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3407                 params.use_short_slot_time =
3408                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3409         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3410                 params.basic_rates =
3411                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3412                 params.basic_rates_len =
3413                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3414         }
3415         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3416                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3417         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3418                 params.ht_opmode =
3419                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3420
3421         if (!rdev->ops->change_bss)
3422                 return -EOPNOTSUPP;
3423
3424         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3425             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3426                 return -EOPNOTSUPP;
3427
3428         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3429 }
3430
3431 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3432         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3433         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3434         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3435         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3436         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3437         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3438 };
3439
3440 static int parse_reg_rule(struct nlattr *tb[],
3441         struct ieee80211_reg_rule *reg_rule)
3442 {
3443         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3444         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3445
3446         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3447                 return -EINVAL;
3448         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3449                 return -EINVAL;
3450         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3451                 return -EINVAL;
3452         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3453                 return -EINVAL;
3454         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3455                 return -EINVAL;
3456
3457         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3458
3459         freq_range->start_freq_khz =
3460                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3461         freq_range->end_freq_khz =
3462                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3463         freq_range->max_bandwidth_khz =
3464                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3465
3466         power_rule->max_eirp =
3467                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3468
3469         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3470                 power_rule->max_antenna_gain =
3471                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3472
3473         return 0;
3474 }
3475
3476 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3477 {
3478         int r;
3479         char *data = NULL;
3480
3481         /*
3482          * You should only get this when cfg80211 hasn't yet initialized
3483          * completely when built-in to the kernel right between the time
3484          * window between nl80211_init() and regulatory_init(), if that is
3485          * even possible.
3486          */
3487         mutex_lock(&cfg80211_mutex);
3488         if (unlikely(!cfg80211_regdomain)) {
3489                 mutex_unlock(&cfg80211_mutex);
3490                 return -EINPROGRESS;
3491         }
3492         mutex_unlock(&cfg80211_mutex);
3493
3494         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3495                 return -EINVAL;
3496
3497         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3498
3499         r = regulatory_hint_user(data);
3500
3501         return r;
3502 }
3503
3504 static int nl80211_get_mesh_config(struct sk_buff *skb,
3505                                    struct genl_info *info)
3506 {
3507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3508         struct net_device *dev = info->user_ptr[1];
3509         struct wireless_dev *wdev = dev->ieee80211_ptr;
3510         struct mesh_config cur_params;
3511         int err = 0;
3512         void *hdr;
3513         struct nlattr *pinfoattr;
3514         struct sk_buff *msg;
3515
3516         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3517                 return -EOPNOTSUPP;
3518
3519         if (!rdev->ops->get_mesh_config)
3520                 return -EOPNOTSUPP;
3521
3522         wdev_lock(wdev);
3523         /* If not connected, get default parameters */
3524         if (!wdev->mesh_id_len)
3525                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3526         else
3527                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3528                                                  &cur_params);
3529         wdev_unlock(wdev);
3530
3531         if (err)
3532                 return err;
3533
3534         /* Draw up a netlink message to send back */
3535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3536         if (!msg)
3537                 return -ENOMEM;
3538         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3539                              NL80211_CMD_GET_MESH_CONFIG);
3540         if (!hdr)
3541                 goto out;
3542         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3543         if (!pinfoattr)
3544                 goto nla_put_failure;
3545         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3546             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3547                         cur_params.dot11MeshRetryTimeout) ||
3548             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3549                         cur_params.dot11MeshConfirmTimeout) ||
3550             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3551                         cur_params.dot11MeshHoldingTimeout) ||
3552             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3553                         cur_params.dot11MeshMaxPeerLinks) ||
3554             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3555                        cur_params.dot11MeshMaxRetries) ||
3556             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3557                        cur_params.dot11MeshTTL) ||
3558             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3559                        cur_params.element_ttl) ||
3560             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3561                        cur_params.auto_open_plinks) ||
3562             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3563                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3564             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3565                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3566             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3567                         cur_params.path_refresh_time) ||
3568             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3569                         cur_params.min_discovery_timeout) ||
3570             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3571                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3572             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3573                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3574             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3575                         cur_params.dot11MeshHWMPperrMinInterval) ||
3576             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3577                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3578             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3579                        cur_params.dot11MeshHWMPRootMode) ||
3580             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3581                         cur_params.dot11MeshHWMPRannInterval) ||
3582             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3583                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3584             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3585                        cur_params.dot11MeshForwarding) ||
3586             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3587                         cur_params.rssi_threshold) ||
3588             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3589                         cur_params.ht_opmode) ||
3590             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3591                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3592             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3593                         cur_params.dot11MeshHWMProotInterval) ||
3594             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3595                         cur_params.dot11MeshHWMPconfirmationInterval))
3596                 goto nla_put_failure;
3597         nla_nest_end(msg, pinfoattr);
3598         genlmsg_end(msg, hdr);
3599         return genlmsg_reply(msg, info);
3600
3601  nla_put_failure:
3602         genlmsg_cancel(msg, hdr);
3603  out:
3604         nlmsg_free(msg);
3605         return -ENOBUFS;
3606 }
3607
3608 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3609         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3610         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3611         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3612         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3613         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3614         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3615         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3616         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3617         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3618         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3619         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3620         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3621         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3622         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3623         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3624         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3625         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3626         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3627         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3628         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3629         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3630         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3631         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3632         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3633         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3634 };
3635
3636 static const struct nla_policy
3637         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3638         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3639         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3640         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3641         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3642         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3643                                     .len = IEEE80211_MAX_DATA_LEN },
3644         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3645 };
3646
3647 static int nl80211_parse_mesh_config(struct genl_info *info,
3648                                      struct mesh_config *cfg,
3649                                      u32 *mask_out)
3650 {
3651         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3652         u32 mask = 0;
3653
3654 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3655 do {\
3656         if (table[attr_num]) {\
3657                 cfg->param = nla_fn(table[attr_num]); \
3658                 mask |= (1 << (attr_num - 1)); \
3659         } \
3660 } while (0);\
3661
3662
3663         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3664                 return -EINVAL;
3665         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3666                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3667                              nl80211_meshconf_params_policy))
3668                 return -EINVAL;
3669
3670         /* This makes sure that there aren't more than 32 mesh config
3671          * parameters (otherwise our bitfield scheme would not work.) */
3672         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3673
3674         /* Fill in the params struct */
3675         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3676                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3677                                   nla_get_u16);
3678         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3679                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3680                                   nla_get_u16);
3681         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3682                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3683                                   nla_get_u16);
3684         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3685                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3686                                   nla_get_u16);
3687         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3688                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3689                                   nla_get_u8);
3690         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3691                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3692         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3693                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3694                                   nla_get_u8);
3695         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3696                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3697                                   nla_get_u8);
3698         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3699                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3700                                   nla_get_u32);
3701         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3702                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3703                                   nla_get_u8);
3704         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3705                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3706                                   nla_get_u32);
3707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3708                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3709                                   nla_get_u16);
3710         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3711                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3712                                   nla_get_u32);
3713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3714                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3715                                   nla_get_u16);
3716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3717                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3718                                   nla_get_u16);
3719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3720                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3721                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3722                                   nla_get_u16);
3723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3724                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3726                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3727                                   nla_get_u16);
3728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3729                                   dot11MeshGateAnnouncementProtocol, mask,
3730                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3731                                   nla_get_u8);
3732         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3733                                   mask, NL80211_MESHCONF_FORWARDING,
3734                                   nla_get_u8);
3735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3736                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3737                                   nla_get_u32);
3738         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3739                                   mask, NL80211_MESHCONF_HT_OPMODE,
3740                                   nla_get_u16);
3741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3742                                   mask,
3743                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3744                                   nla_get_u32);
3745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3746                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3747                                   nla_get_u16);
3748         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3749                                   dot11MeshHWMPconfirmationInterval, mask,
3750                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3751                                   nla_get_u16);
3752         if (mask_out)
3753                 *mask_out = mask;
3754
3755         return 0;
3756
3757 #undef FILL_IN_MESH_PARAM_IF_SET
3758 }
3759
3760 static int nl80211_parse_mesh_setup(struct genl_info *info,
3761                                      struct mesh_setup *setup)
3762 {
3763         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3764
3765         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3766                 return -EINVAL;
3767         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3768                              info->attrs[NL80211_ATTR_MESH_SETUP],
3769                              nl80211_mesh_setup_params_policy))
3770                 return -EINVAL;
3771
3772         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3773                 setup->sync_method =
3774                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3775                  IEEE80211_SYNC_METHOD_VENDOR :
3776                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3777
3778         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3779                 setup->path_sel_proto =
3780                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3781                  IEEE80211_PATH_PROTOCOL_VENDOR :
3782                  IEEE80211_PATH_PROTOCOL_HWMP;
3783
3784         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3785                 setup->path_metric =
3786                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3787                  IEEE80211_PATH_METRIC_VENDOR :
3788                  IEEE80211_PATH_METRIC_AIRTIME;
3789
3790
3791         if (tb[NL80211_MESH_SETUP_IE]) {
3792                 struct nlattr *ieattr =
3793                         tb[NL80211_MESH_SETUP_IE];
3794                 if (!is_valid_ie_attr(ieattr))
3795                         return -EINVAL;
3796                 setup->ie = nla_data(ieattr);
3797                 setup->ie_len = nla_len(ieattr);
3798         }
3799         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3800         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3801
3802         return 0;
3803 }
3804
3805 static int nl80211_update_mesh_config(struct sk_buff *skb,
3806                                       struct genl_info *info)
3807 {
3808         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3809         struct net_device *dev = info->user_ptr[1];
3810         struct wireless_dev *wdev = dev->ieee80211_ptr;
3811         struct mesh_config cfg;
3812         u32 mask;
3813         int err;
3814
3815         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3816                 return -EOPNOTSUPP;
3817
3818         if (!rdev->ops->update_mesh_config)
3819                 return -EOPNOTSUPP;
3820
3821         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3822         if (err)
3823                 return err;
3824
3825         wdev_lock(wdev);
3826         if (!wdev->mesh_id_len)
3827                 err = -ENOLINK;
3828
3829         if (!err)
3830                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3831                                                     mask, &cfg);
3832
3833         wdev_unlock(wdev);
3834
3835         return err;
3836 }
3837
3838 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3839 {
3840         struct sk_buff *msg;
3841         void *hdr = NULL;
3842         struct nlattr *nl_reg_rules;
3843         unsigned int i;
3844         int err = -EINVAL;
3845
3846         mutex_lock(&cfg80211_mutex);
3847
3848         if (!cfg80211_regdomain)
3849                 goto out;
3850
3851         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3852         if (!msg) {
3853                 err = -ENOBUFS;
3854                 goto out;
3855         }
3856
3857         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3858                              NL80211_CMD_GET_REG);
3859         if (!hdr)
3860                 goto put_failure;
3861
3862         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
3863                            cfg80211_regdomain->alpha2) ||
3864             (cfg80211_regdomain->dfs_region &&
3865              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
3866                         cfg80211_regdomain->dfs_region)))
3867                 goto nla_put_failure;
3868
3869         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3870         if (!nl_reg_rules)
3871                 goto nla_put_failure;
3872
3873         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3874                 struct nlattr *nl_reg_rule;
3875                 const struct ieee80211_reg_rule *reg_rule;
3876                 const struct ieee80211_freq_range *freq_range;
3877                 const struct ieee80211_power_rule *power_rule;
3878
3879                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3880                 freq_range = &reg_rule->freq_range;
3881                 power_rule = &reg_rule->power_rule;
3882
3883                 nl_reg_rule = nla_nest_start(msg, i);
3884                 if (!nl_reg_rule)
3885                         goto nla_put_failure;
3886
3887                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3888                                 reg_rule->flags) ||
3889                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
3890                                 freq_range->start_freq_khz) ||
3891                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
3892                                 freq_range->end_freq_khz) ||
3893                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3894                                 freq_range->max_bandwidth_khz) ||
3895                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3896                                 power_rule->max_antenna_gain) ||
3897                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3898                                 power_rule->max_eirp))
3899                         goto nla_put_failure;
3900
3901                 nla_nest_end(msg, nl_reg_rule);
3902         }
3903
3904         nla_nest_end(msg, nl_reg_rules);
3905
3906         genlmsg_end(msg, hdr);
3907         err = genlmsg_reply(msg, info);
3908         goto out;
3909
3910 nla_put_failure:
3911         genlmsg_cancel(msg, hdr);
3912 put_failure:
3913         nlmsg_free(msg);
3914         err = -EMSGSIZE;
3915 out:
3916         mutex_unlock(&cfg80211_mutex);
3917         return err;
3918 }
3919
3920 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3921 {
3922         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3923         struct nlattr *nl_reg_rule;
3924         char *alpha2 = NULL;
3925         int rem_reg_rules = 0, r = 0;
3926         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3927         u8 dfs_region = 0;
3928         struct ieee80211_regdomain *rd = NULL;
3929
3930         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3931                 return -EINVAL;
3932
3933         if (!info->attrs[NL80211_ATTR_REG_RULES])
3934                 return -EINVAL;
3935
3936         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3937
3938         if (info->attrs[NL80211_ATTR_DFS_REGION])
3939                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
3940
3941         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3942                         rem_reg_rules) {
3943                 num_rules++;
3944                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3945                         return -EINVAL;
3946         }
3947
3948         mutex_lock(&cfg80211_mutex);
3949
3950         if (!reg_is_valid_request(alpha2)) {
3951                 r = -EINVAL;
3952                 goto bad_reg;
3953         }
3954
3955         size_of_regd = sizeof(struct ieee80211_regdomain) +
3956                 (num_rules * sizeof(struct ieee80211_reg_rule));
3957
3958         rd = kzalloc(size_of_regd, GFP_KERNEL);
3959         if (!rd) {
3960                 r = -ENOMEM;
3961                 goto bad_reg;
3962         }
3963
3964         rd->n_reg_rules = num_rules;
3965         rd->alpha2[0] = alpha2[0];
3966         rd->alpha2[1] = alpha2[1];
3967
3968         /*
3969          * Disable DFS master mode if the DFS region was
3970          * not supported or known on this kernel.
3971          */
3972         if (reg_supported_dfs_region(dfs_region))
3973                 rd->dfs_region = dfs_region;
3974
3975         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3976                         rem_reg_rules) {
3977                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3978                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3979                         reg_rule_policy);
3980                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3981                 if (r)
3982                         goto bad_reg;
3983
3984                 rule_idx++;
3985
3986                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3987                         r = -EINVAL;
3988                         goto bad_reg;
3989                 }
3990         }
3991
3992         BUG_ON(rule_idx != num_rules);
3993
3994         r = set_regdom(rd);
3995
3996         mutex_unlock(&cfg80211_mutex);
3997
3998         return r;
3999
4000  bad_reg:
4001         mutex_unlock(&cfg80211_mutex);
4002         kfree(rd);
4003         return r;
4004 }
4005
4006 static int validate_scan_freqs(struct nlattr *freqs)
4007 {
4008         struct nlattr *attr1, *attr2;
4009         int n_channels = 0, tmp1, tmp2;
4010
4011         nla_for_each_nested(attr1, freqs, tmp1) {
4012                 n_channels++;
4013                 /*
4014                  * Some hardware has a limited channel list for
4015                  * scanning, and it is pretty much nonsensical
4016                  * to scan for a channel twice, so disallow that
4017                  * and don't require drivers to check that the
4018                  * channel list they get isn't longer than what
4019                  * they can scan, as long as they can scan all
4020                  * the channels they registered at once.
4021                  */
4022                 nla_for_each_nested(attr2, freqs, tmp2)
4023                         if (attr1 != attr2 &&
4024                             nla_get_u32(attr1) == nla_get_u32(attr2))
4025                                 return 0;
4026         }
4027
4028         return n_channels;
4029 }
4030
4031 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4032 {
4033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4034         struct net_device *dev = info->user_ptr[1];
4035         struct cfg80211_scan_request *request;
4036         struct nlattr *attr;
4037         struct wiphy *wiphy;
4038         int err, tmp, n_ssids = 0, n_channels, i;
4039         size_t ie_len;
4040
4041         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4042                 return -EINVAL;
4043
4044         wiphy = &rdev->wiphy;
4045
4046         if (!rdev->ops->scan)
4047                 return -EOPNOTSUPP;
4048
4049         if (rdev->scan_req)
4050                 return -EBUSY;
4051
4052         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4053                 n_channels = validate_scan_freqs(
4054                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4055                 if (!n_channels)
4056                         return -EINVAL;
4057         } else {
4058                 enum ieee80211_band band;
4059                 n_channels = 0;
4060
4061                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4062                         if (wiphy->bands[band])
4063                                 n_channels += wiphy->bands[band]->n_channels;
4064         }
4065
4066         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4067                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4068                         n_ssids++;
4069
4070         if (n_ssids > wiphy->max_scan_ssids)
4071                 return -EINVAL;
4072
4073         if (info->attrs[NL80211_ATTR_IE])
4074                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4075         else
4076                 ie_len = 0;
4077
4078         if (ie_len > wiphy->max_scan_ie_len)
4079                 return -EINVAL;
4080
4081         request = kzalloc(sizeof(*request)
4082                         + sizeof(*request->ssids) * n_ssids
4083                         + sizeof(*request->channels) * n_channels
4084                         + ie_len, GFP_KERNEL);
4085         if (!request)
4086                 return -ENOMEM;
4087
4088         if (n_ssids)
4089                 request->ssids = (void *)&request->channels[n_channels];
4090         request->n_ssids = n_ssids;
4091         if (ie_len) {
4092                 if (request->ssids)
4093                         request->ie = (void *)(request->ssids + n_ssids);
4094                 else
4095                         request->ie = (void *)(request->channels + n_channels);
4096         }
4097
4098         i = 0;
4099         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4100                 /* user specified, bail out if channel not found */
4101                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4102                         struct ieee80211_channel *chan;
4103
4104                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4105
4106                         if (!chan) {
4107                                 err = -EINVAL;
4108                                 goto out_free;
4109                         }
4110
4111                         /* ignore disabled channels */
4112                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4113                                 continue;
4114
4115                         request->channels[i] = chan;
4116                         i++;
4117                 }
4118         } else {
4119                 enum ieee80211_band band;
4120
4121                 /* all channels */
4122                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4123                         int j;
4124                         if (!wiphy->bands[band])
4125                                 continue;
4126                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4127                                 struct ieee80211_channel *chan;
4128
4129                                 chan = &wiphy->bands[band]->channels[j];
4130
4131                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4132                                         continue;
4133
4134                                 request->channels[i] = chan;
4135                                 i++;
4136                         }
4137                 }
4138         }
4139
4140         if (!i) {
4141                 err = -EINVAL;
4142                 goto out_free;
4143         }
4144
4145         request->n_channels = i;
4146
4147         i = 0;
4148         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4149                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4150                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4151                                 err = -EINVAL;
4152                                 goto out_free;
4153                         }
4154                         request->ssids[i].ssid_len = nla_len(attr);
4155                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4156                         i++;
4157                 }
4158         }
4159
4160         if (info->attrs[NL80211_ATTR_IE]) {
4161                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4162                 memcpy((void *)request->ie,
4163                        nla_data(info->attrs[NL80211_ATTR_IE]),
4164                        request->ie_len);
4165         }
4166
4167         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4168                 if (wiphy->bands[i])
4169                         request->rates[i] =
4170                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4171
4172         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4173                 nla_for_each_nested(attr,
4174                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4175                                     tmp) {
4176                         enum ieee80211_band band = nla_type(attr);
4177
4178                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4179                                 err = -EINVAL;
4180                                 goto out_free;
4181                         }
4182                         err = ieee80211_get_ratemask(wiphy->bands[band],
4183                                                      nla_data(attr),
4184                                                      nla_len(attr),
4185                                                      &request->rates[band]);
4186                         if (err)
4187                                 goto out_free;
4188                 }
4189         }
4190
4191         request->no_cck =
4192                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4193
4194         request->dev = dev;
4195         request->wiphy = &rdev->wiphy;
4196
4197         rdev->scan_req = request;
4198         err = rdev->ops->scan(&rdev->wiphy, dev, request);
4199
4200         if (!err) {
4201                 nl80211_send_scan_start(rdev, dev);
4202                 dev_hold(dev);
4203         } else {
4204  out_free:
4205                 rdev->scan_req = NULL;
4206                 kfree(request);
4207         }
4208
4209         return err;
4210 }
4211
4212 static int nl80211_start_sched_scan(struct sk_buff *skb,
4213                                     struct genl_info *info)
4214 {
4215         struct cfg80211_sched_scan_request *request;
4216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4217         struct net_device *dev = info->user_ptr[1];
4218         struct nlattr *attr;
4219         struct wiphy *wiphy;
4220         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4221         u32 interval;
4222         enum ieee80211_band band;
4223         size_t ie_len;
4224         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4225
4226         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4227             !rdev->ops->sched_scan_start)
4228                 return -EOPNOTSUPP;
4229
4230         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4231                 return -EINVAL;
4232
4233         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4234                 return -EINVAL;
4235
4236         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4237         if (interval == 0)
4238                 return -EINVAL;
4239
4240         wiphy = &rdev->wiphy;
4241
4242         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4243                 n_channels = validate_scan_freqs(
4244                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4245                 if (!n_channels)
4246                         return -EINVAL;
4247         } else {
4248                 n_channels = 0;
4249
4250                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4251                         if (wiphy->bands[band])
4252                                 n_channels += wiphy->bands[band]->n_channels;
4253         }
4254
4255         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4256                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4257                                     tmp)
4258                         n_ssids++;
4259
4260         if (n_ssids > wiphy->max_sched_scan_ssids)
4261                 return -EINVAL;
4262
4263         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4264                 nla_for_each_nested(attr,
4265                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4266                                     tmp)
4267                         n_match_sets++;
4268
4269         if (n_match_sets > wiphy->max_match_sets)
4270                 return -EINVAL;
4271
4272         if (info->attrs[NL80211_ATTR_IE])
4273                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4274         else
4275                 ie_len = 0;
4276
4277         if (ie_len > wiphy->max_sched_scan_ie_len)
4278                 return -EINVAL;
4279
4280         mutex_lock(&rdev->sched_scan_mtx);
4281
4282         if (rdev->sched_scan_req) {
4283                 err = -EINPROGRESS;
4284                 goto out;
4285         }
4286
4287         request = kzalloc(sizeof(*request)
4288                         + sizeof(*request->ssids) * n_ssids
4289                         + sizeof(*request->match_sets) * n_match_sets
4290                         + sizeof(*request->channels) * n_channels
4291                         + ie_len, GFP_KERNEL);
4292         if (!request) {
4293                 err = -ENOMEM;
4294                 goto out;
4295         }
4296
4297         if (n_ssids)
4298                 request->ssids = (void *)&request->channels[n_channels];
4299         request->n_ssids = n_ssids;
4300         if (ie_len) {
4301                 if (request->ssids)
4302                         request->ie = (void *)(request->ssids + n_ssids);
4303                 else
4304                         request->ie = (void *)(request->channels + n_channels);
4305         }
4306
4307         if (n_match_sets) {
4308                 if (request->ie)
4309                         request->match_sets = (void *)(request->ie + ie_len);
4310                 else if (request->ssids)
4311                         request->match_sets =
4312                                 (void *)(request->ssids + n_ssids);
4313                 else
4314                         request->match_sets =
4315                                 (void *)(request->channels + n_channels);
4316         }
4317         request->n_match_sets = n_match_sets;
4318
4319         i = 0;
4320         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4321                 /* user specified, bail out if channel not found */
4322                 nla_for_each_nested(attr,
4323                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4324                                     tmp) {
4325                         struct ieee80211_channel *chan;
4326
4327                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4328
4329                         if (!chan) {
4330                                 err = -EINVAL;
4331                                 goto out_free;
4332                         }
4333
4334                         /* ignore disabled channels */
4335                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4336                                 continue;
4337
4338                         request->channels[i] = chan;
4339                         i++;
4340                 }
4341         } else {
4342                 /* all channels */
4343                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4344                         int j;
4345                         if (!wiphy->bands[band])
4346                                 continue;
4347                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4348                                 struct ieee80211_channel *chan;
4349
4350                                 chan = &wiphy->bands[band]->channels[j];
4351
4352                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4353                                         continue;
4354
4355                                 request->channels[i] = chan;
4356                                 i++;
4357                         }
4358                 }
4359         }
4360
4361         if (!i) {
4362                 err = -EINVAL;
4363                 goto out_free;
4364         }
4365
4366         request->n_channels = i;
4367
4368         i = 0;
4369         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4370                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4371                                     tmp) {
4372                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4373                                 err = -EINVAL;
4374                                 goto out_free;
4375                         }
4376                         request->ssids[i].ssid_len = nla_len(attr);
4377                         memcpy(request->ssids[i].ssid, nla_data(attr),
4378                                nla_len(attr));
4379                         i++;
4380                 }
4381         }
4382
4383         i = 0;
4384         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4385                 nla_for_each_nested(attr,
4386                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4387                                     tmp) {
4388                         struct nlattr *ssid, *rssi;
4389
4390                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4391                                   nla_data(attr), nla_len(attr),
4392                                   nl80211_match_policy);
4393                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4394                         if (ssid) {
4395                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4396                                         err = -EINVAL;
4397                                         goto out_free;
4398                                 }
4399                                 memcpy(request->match_sets[i].ssid.ssid,
4400                                        nla_data(ssid), nla_len(ssid));
4401                                 request->match_sets[i].ssid.ssid_len =
4402                                         nla_len(ssid);
4403                         }
4404                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4405                         if (rssi)
4406                                 request->rssi_thold = nla_get_u32(rssi);
4407                         else
4408                                 request->rssi_thold =
4409                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4410                         i++;
4411                 }
4412         }
4413
4414         if (info->attrs[NL80211_ATTR_IE]) {
4415                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4416                 memcpy((void *)request->ie,
4417                        nla_data(info->attrs[NL80211_ATTR_IE]),
4418                        request->ie_len);
4419         }
4420
4421         request->dev = dev;
4422         request->wiphy = &rdev->wiphy;
4423         request->interval = interval;
4424
4425         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4426         if (!err) {
4427                 rdev->sched_scan_req = request;
4428                 nl80211_send_sched_scan(rdev, dev,
4429                                         NL80211_CMD_START_SCHED_SCAN);
4430                 goto out;
4431         }
4432
4433 out_free:
4434         kfree(request);
4435 out:
4436         mutex_unlock(&rdev->sched_scan_mtx);
4437         return err;
4438 }
4439
4440 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4441                                    struct genl_info *info)
4442 {
4443         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4444         int err;
4445
4446         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4447             !rdev->ops->sched_scan_stop)
4448                 return -EOPNOTSUPP;
4449
4450         mutex_lock(&rdev->sched_scan_mtx);
4451         err = __cfg80211_stop_sched_scan(rdev, false);
4452         mutex_unlock(&rdev->sched_scan_mtx);
4453
4454         return err;
4455 }
4456
4457 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4458                             u32 seq, int flags,
4459                             struct cfg80211_registered_device *rdev,
4460                             struct wireless_dev *wdev,
4461                             struct cfg80211_internal_bss *intbss)
4462 {
4463         struct cfg80211_bss *res = &intbss->pub;
4464         void *hdr;
4465         struct nlattr *bss;
4466
4467         ASSERT_WDEV_LOCK(wdev);
4468
4469         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
4470                              NL80211_CMD_NEW_SCAN_RESULTS);
4471         if (!hdr)
4472                 return -1;
4473
4474         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4475
4476         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4477             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4478                 goto nla_put_failure;
4479
4480         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4481         if (!bss)
4482                 goto nla_put_failure;
4483         if ((!is_zero_ether_addr(res->bssid) &&
4484              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4485             (res->information_elements && res->len_information_elements &&
4486              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4487                      res->len_information_elements,
4488                      res->information_elements)) ||
4489             (res->beacon_ies && res->len_beacon_ies &&
4490              res->beacon_ies != res->information_elements &&
4491              nla_put(msg, NL80211_BSS_BEACON_IES,
4492                      res->len_beacon_ies, res->beacon_ies)))
4493                 goto nla_put_failure;
4494         if (res->tsf &&
4495             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4496                 goto nla_put_failure;
4497         if (res->beacon_interval &&
4498             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4499                 goto nla_put_failure;
4500         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4501             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4502             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4503                         jiffies_to_msecs(jiffies - intbss->ts)))
4504                 goto nla_put_failure;
4505
4506         switch (rdev->wiphy.signal_type) {
4507         case CFG80211_SIGNAL_TYPE_MBM:
4508                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4509                         goto nla_put_failure;
4510                 break;
4511         case CFG80211_SIGNAL_TYPE_UNSPEC:
4512                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4513                         goto nla_put_failure;
4514                 break;
4515         default:
4516                 break;
4517         }
4518
4519         switch (wdev->iftype) {
4520         case NL80211_IFTYPE_P2P_CLIENT:
4521         case NL80211_IFTYPE_STATION:
4522                 if (intbss == wdev->current_bss &&
4523                     nla_put_u32(msg, NL80211_BSS_STATUS,
4524                                 NL80211_BSS_STATUS_ASSOCIATED))
4525                         goto nla_put_failure;
4526                 break;
4527         case NL80211_IFTYPE_ADHOC:
4528                 if (intbss == wdev->current_bss &&
4529                     nla_put_u32(msg, NL80211_BSS_STATUS,
4530                                 NL80211_BSS_STATUS_IBSS_JOINED))
4531                         goto nla_put_failure;
4532                 break;
4533         default:
4534                 break;
4535         }
4536
4537         nla_nest_end(msg, bss);
4538
4539         return genlmsg_end(msg, hdr);
4540
4541  nla_put_failure:
4542         genlmsg_cancel(msg, hdr);
4543         return -EMSGSIZE;
4544 }
4545
4546 static int nl80211_dump_scan(struct sk_buff *skb,
4547                              struct netlink_callback *cb)
4548 {
4549         struct cfg80211_registered_device *rdev;
4550         struct net_device *dev;
4551         struct cfg80211_internal_bss *scan;
4552         struct wireless_dev *wdev;
4553         int start = cb->args[1], idx = 0;
4554         int err;
4555
4556         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4557         if (err)
4558                 return err;
4559
4560         wdev = dev->ieee80211_ptr;
4561
4562         wdev_lock(wdev);
4563         spin_lock_bh(&rdev->bss_lock);
4564         cfg80211_bss_expire(rdev);
4565
4566         cb->seq = rdev->bss_generation;
4567
4568         list_for_each_entry(scan, &rdev->bss_list, list) {
4569                 if (++idx <= start)
4570                         continue;
4571                 if (nl80211_send_bss(skb, cb,
4572                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4573                                 rdev, wdev, scan) < 0) {
4574                         idx--;
4575                         break;
4576                 }
4577         }
4578
4579         spin_unlock_bh(&rdev->bss_lock);
4580         wdev_unlock(wdev);
4581
4582         cb->args[1] = idx;
4583         nl80211_finish_netdev_dump(rdev);
4584
4585         return skb->len;
4586 }
4587
4588 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4589                                 int flags, struct net_device *dev,
4590                                 struct survey_info *survey)
4591 {
4592         void *hdr;
4593         struct nlattr *infoattr;
4594
4595         hdr = nl80211hdr_put(msg, pid, seq, flags,
4596                              NL80211_CMD_NEW_SURVEY_RESULTS);
4597         if (!hdr)
4598                 return -ENOMEM;
4599
4600         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4601                 goto nla_put_failure;
4602
4603         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4604         if (!infoattr)
4605                 goto nla_put_failure;
4606
4607         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4608                         survey->channel->center_freq))
4609                 goto nla_put_failure;
4610
4611         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4612             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4613                 goto nla_put_failure;
4614         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4615             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4616                 goto nla_put_failure;
4617         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4618             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4619                         survey->channel_time))
4620                 goto nla_put_failure;
4621         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4622             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4623                         survey->channel_time_busy))
4624                 goto nla_put_failure;
4625         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4626             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4627                         survey->channel_time_ext_busy))
4628                 goto nla_put_failure;
4629         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4630             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4631                         survey->channel_time_rx))
4632                 goto nla_put_failure;
4633         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4634             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4635                         survey->channel_time_tx))
4636                 goto nla_put_failure;
4637
4638         nla_nest_end(msg, infoattr);
4639
4640         return genlmsg_end(msg, hdr);
4641
4642  nla_put_failure:
4643         genlmsg_cancel(msg, hdr);
4644         return -EMSGSIZE;
4645 }
4646
4647 static int nl80211_dump_survey(struct sk_buff *skb,
4648                         struct netlink_callback *cb)
4649 {
4650         struct survey_info survey;
4651         struct cfg80211_registered_device *dev;
4652         struct net_device *netdev;
4653         int survey_idx = cb->args[1];
4654         int res;
4655
4656         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4657         if (res)
4658                 return res;
4659
4660         if (!dev->ops->dump_survey) {
4661                 res = -EOPNOTSUPP;
4662                 goto out_err;
4663         }
4664
4665         while (1) {
4666                 struct ieee80211_channel *chan;
4667
4668                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4669                                             &survey);
4670                 if (res == -ENOENT)
4671                         break;
4672                 if (res)
4673                         goto out_err;
4674
4675                 /* Survey without a channel doesn't make sense */
4676                 if (!survey.channel) {
4677                         res = -EINVAL;
4678                         goto out;
4679                 }
4680
4681                 chan = ieee80211_get_channel(&dev->wiphy,
4682                                              survey.channel->center_freq);
4683                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4684                         survey_idx++;
4685                         continue;
4686                 }
4687
4688                 if (nl80211_send_survey(skb,
4689                                 NETLINK_CB(cb->skb).pid,
4690                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4691                                 netdev,
4692                                 &survey) < 0)
4693                         goto out;
4694                 survey_idx++;
4695         }
4696
4697  out:
4698         cb->args[1] = survey_idx;
4699         res = skb->len;
4700  out_err:
4701         nl80211_finish_netdev_dump(dev);
4702         return res;
4703 }
4704
4705 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4706 {
4707         return auth_type <= NL80211_AUTHTYPE_MAX;
4708 }
4709
4710 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4711 {
4712         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4713                                   NL80211_WPA_VERSION_2));
4714 }
4715
4716 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4717 {
4718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4719         struct net_device *dev = info->user_ptr[1];
4720         struct ieee80211_channel *chan;
4721         const u8 *bssid, *ssid, *ie = NULL;
4722         int err, ssid_len, ie_len = 0;
4723         enum nl80211_auth_type auth_type;
4724         struct key_parse key;
4725         bool local_state_change;
4726
4727         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4728                 return -EINVAL;
4729
4730         if (!info->attrs[NL80211_ATTR_MAC])
4731                 return -EINVAL;
4732
4733         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4734                 return -EINVAL;
4735
4736         if (!info->attrs[NL80211_ATTR_SSID])
4737                 return -EINVAL;
4738
4739         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4740                 return -EINVAL;
4741
4742         err = nl80211_parse_key(info, &key);
4743         if (err)
4744                 return err;
4745
4746         if (key.idx >= 0) {
4747                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4748                         return -EINVAL;
4749                 if (!key.p.key || !key.p.key_len)
4750                         return -EINVAL;
4751                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4752                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4753                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4754                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4755                         return -EINVAL;
4756                 if (key.idx > 4)
4757                         return -EINVAL;
4758         } else {
4759                 key.p.key_len = 0;
4760                 key.p.key = NULL;
4761         }
4762
4763         if (key.idx >= 0) {
4764                 int i;
4765                 bool ok = false;
4766                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4767                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4768                                 ok = true;
4769                                 break;
4770                         }
4771                 }
4772                 if (!ok)
4773                         return -EINVAL;
4774         }
4775
4776         if (!rdev->ops->auth)
4777                 return -EOPNOTSUPP;
4778
4779         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4780             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4781                 return -EOPNOTSUPP;
4782
4783         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4784         chan = ieee80211_get_channel(&rdev->wiphy,
4785                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4786         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4787                 return -EINVAL;
4788
4789         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4790         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4791
4792         if (info->attrs[NL80211_ATTR_IE]) {
4793                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4794                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4795         }
4796
4797         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4798         if (!nl80211_valid_auth_type(auth_type))
4799                 return -EINVAL;
4800
4801         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4802
4803         /*
4804          * Since we no longer track auth state, ignore
4805          * requests to only change local state.
4806          */
4807         if (local_state_change)
4808                 return 0;
4809
4810         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4811                                   ssid, ssid_len, ie, ie_len,
4812                                   key.p.key, key.p.key_len, key.idx);
4813 }
4814
4815 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4816                                    struct genl_info *info,
4817                                    struct cfg80211_crypto_settings *settings,
4818                                    int cipher_limit)
4819 {
4820         memset(settings, 0, sizeof(*settings));
4821
4822         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4823
4824         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4825                 u16 proto;
4826                 proto = nla_get_u16(
4827                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4828                 settings->control_port_ethertype = cpu_to_be16(proto);
4829                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4830                     proto != ETH_P_PAE)
4831                         return -EINVAL;
4832                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4833                         settings->control_port_no_encrypt = true;
4834         } else
4835                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4836
4837         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4838                 void *data;
4839                 int len, i;
4840
4841                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4842                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4843                 settings->n_ciphers_pairwise = len / sizeof(u32);
4844
4845                 if (len % sizeof(u32))
4846                         return -EINVAL;
4847
4848                 if (settings->n_ciphers_pairwise > cipher_limit)
4849                         return -EINVAL;
4850
4851                 memcpy(settings->ciphers_pairwise, data, len);
4852
4853                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4854                         if (!cfg80211_supported_cipher_suite(
4855                                         &rdev->wiphy,
4856                                         settings->ciphers_pairwise[i]))
4857                                 return -EINVAL;
4858         }
4859
4860         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4861                 settings->cipher_group =
4862                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4863                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
4864                                                      settings->cipher_group))
4865                         return -EINVAL;
4866         }
4867
4868         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4869                 settings->wpa_versions =
4870                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4871                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4872                         return -EINVAL;
4873         }
4874
4875         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4876                 void *data;
4877                 int len;
4878
4879                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4880                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4881                 settings->n_akm_suites = len / sizeof(u32);
4882
4883                 if (len % sizeof(u32))
4884                         return -EINVAL;
4885
4886                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
4887                         return -EINVAL;
4888
4889                 memcpy(settings->akm_suites, data, len);
4890         }
4891
4892         return 0;
4893 }
4894
4895 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4896 {
4897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4898         struct net_device *dev = info->user_ptr[1];
4899         struct cfg80211_crypto_settings crypto;
4900         struct ieee80211_channel *chan;
4901         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4902         int err, ssid_len, ie_len = 0;
4903         bool use_mfp = false;
4904         u32 flags = 0;
4905         struct ieee80211_ht_cap *ht_capa = NULL;
4906         struct ieee80211_ht_cap *ht_capa_mask = NULL;
4907
4908         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4909                 return -EINVAL;
4910
4911         if (!info->attrs[NL80211_ATTR_MAC] ||
4912             !info->attrs[NL80211_ATTR_SSID] ||
4913             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4914                 return -EINVAL;
4915
4916         if (!rdev->ops->assoc)
4917                 return -EOPNOTSUPP;
4918
4919         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4920             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4921                 return -EOPNOTSUPP;
4922
4923         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4924
4925         chan = ieee80211_get_channel(&rdev->wiphy,
4926                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4927         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4928                 return -EINVAL;
4929
4930         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4931         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4932
4933         if (info->attrs[NL80211_ATTR_IE]) {
4934                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4935                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4936         }
4937
4938         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4939                 enum nl80211_mfp mfp =
4940                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4941                 if (mfp == NL80211_MFP_REQUIRED)
4942                         use_mfp = true;
4943                 else if (mfp != NL80211_MFP_NO)
4944                         return -EINVAL;
4945         }
4946
4947         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4948                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4949
4950         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
4951                 flags |= ASSOC_REQ_DISABLE_HT;
4952
4953         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
4954                 ht_capa_mask =
4955                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
4956
4957         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
4958                 if (!ht_capa_mask)
4959                         return -EINVAL;
4960                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4961         }
4962
4963         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4964         if (!err)
4965                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4966                                           ssid, ssid_len, ie, ie_len, use_mfp,
4967                                           &crypto, flags, ht_capa,
4968                                           ht_capa_mask);
4969
4970         return err;
4971 }
4972
4973 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4974 {
4975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4976         struct net_device *dev = info->user_ptr[1];
4977         const u8 *ie = NULL, *bssid;
4978         int ie_len = 0;
4979         u16 reason_code;
4980         bool local_state_change;
4981
4982         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4983                 return -EINVAL;
4984
4985         if (!info->attrs[NL80211_ATTR_MAC])
4986                 return -EINVAL;
4987
4988         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4989                 return -EINVAL;
4990
4991         if (!rdev->ops->deauth)
4992                 return -EOPNOTSUPP;
4993
4994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4996                 return -EOPNOTSUPP;
4997
4998         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4999
5000         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5001         if (reason_code == 0) {
5002                 /* Reason Code 0 is reserved */
5003                 return -EINVAL;
5004         }
5005
5006         if (info->attrs[NL80211_ATTR_IE]) {
5007                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5008                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5009         }
5010
5011         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5012
5013         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5014                                     local_state_change);
5015 }
5016
5017 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5018 {
5019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5020         struct net_device *dev = info->user_ptr[1];
5021         const u8 *ie = NULL, *bssid;
5022         int ie_len = 0;
5023         u16 reason_code;
5024         bool local_state_change;
5025
5026         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5027                 return -EINVAL;
5028
5029         if (!info->attrs[NL80211_ATTR_MAC])
5030                 return -EINVAL;
5031
5032         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5033                 return -EINVAL;
5034
5035         if (!rdev->ops->disassoc)
5036                 return -EOPNOTSUPP;
5037
5038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5040                 return -EOPNOTSUPP;
5041
5042         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5043
5044         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5045         if (reason_code == 0) {
5046                 /* Reason Code 0 is reserved */
5047                 return -EINVAL;
5048         }
5049
5050         if (info->attrs[NL80211_ATTR_IE]) {
5051                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5052                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5053         }
5054
5055         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5056
5057         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5058                                       local_state_change);
5059 }
5060
5061 static bool
5062 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5063                          int mcast_rate[IEEE80211_NUM_BANDS],
5064                          int rateval)
5065 {
5066         struct wiphy *wiphy = &rdev->wiphy;
5067         bool found = false;
5068         int band, i;
5069
5070         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5071                 struct ieee80211_supported_band *sband;
5072
5073                 sband = wiphy->bands[band];
5074                 if (!sband)
5075                         continue;
5076
5077                 for (i = 0; i < sband->n_bitrates; i++) {
5078                         if (sband->bitrates[i].bitrate == rateval) {
5079                                 mcast_rate[band] = i + 1;
5080                                 found = true;
5081                                 break;
5082                         }
5083                 }
5084         }
5085
5086         return found;
5087 }
5088
5089 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5090 {
5091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5092         struct net_device *dev = info->user_ptr[1];
5093         struct cfg80211_ibss_params ibss;
5094         struct wiphy *wiphy;
5095         struct cfg80211_cached_keys *connkeys = NULL;
5096         int err;
5097
5098         memset(&ibss, 0, sizeof(ibss));
5099
5100         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5101                 return -EINVAL;
5102
5103         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5104             !info->attrs[NL80211_ATTR_SSID] ||
5105             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5106                 return -EINVAL;
5107
5108         ibss.beacon_interval = 100;
5109
5110         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5111                 ibss.beacon_interval =
5112                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5113                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5114                         return -EINVAL;
5115         }
5116
5117         if (!rdev->ops->join_ibss)
5118                 return -EOPNOTSUPP;
5119
5120         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5121                 return -EOPNOTSUPP;
5122
5123         wiphy = &rdev->wiphy;
5124
5125         if (info->attrs[NL80211_ATTR_MAC]) {
5126                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5127
5128                 if (!is_valid_ether_addr(ibss.bssid))
5129                         return -EINVAL;
5130         }
5131         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5132         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5133
5134         if (info->attrs[NL80211_ATTR_IE]) {
5135                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5136                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5137         }
5138
5139         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5140                 enum nl80211_channel_type channel_type;
5141
5142                 if (!nl80211_valid_channel_type(info, &channel_type))
5143                         return -EINVAL;
5144
5145                 if (channel_type != NL80211_CHAN_NO_HT &&
5146                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5147                         return -EINVAL;
5148
5149                 ibss.channel_type = channel_type;
5150         } else {
5151                 ibss.channel_type = NL80211_CHAN_NO_HT;
5152         }
5153
5154         ibss.channel = rdev_freq_to_chan(rdev,
5155                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5156                 ibss.channel_type);
5157         if (!ibss.channel ||
5158             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5159             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5160                 return -EINVAL;
5161
5162         /* Both channels should be able to initiate communication */
5163         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5164              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5165             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5166                                           ibss.channel_type))
5167                 return -EINVAL;
5168
5169         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5170         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5171
5172         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5173                 u8 *rates =
5174                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5175                 int n_rates =
5176                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5177                 struct ieee80211_supported_band *sband =
5178                         wiphy->bands[ibss.channel->band];
5179
5180                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5181                                              &ibss.basic_rates);
5182                 if (err)
5183                         return err;
5184         }
5185
5186         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5187             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5188                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5189                 return -EINVAL;
5190
5191         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5192                 connkeys = nl80211_parse_connkeys(rdev,
5193                                         info->attrs[NL80211_ATTR_KEYS]);
5194                 if (IS_ERR(connkeys))
5195                         return PTR_ERR(connkeys);
5196         }
5197
5198         ibss.control_port =
5199                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5200
5201         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5202         if (err)
5203                 kfree(connkeys);
5204         return err;
5205 }
5206
5207 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5208 {
5209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5210         struct net_device *dev = info->user_ptr[1];
5211
5212         if (!rdev->ops->leave_ibss)
5213                 return -EOPNOTSUPP;
5214
5215         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5216                 return -EOPNOTSUPP;
5217
5218         return cfg80211_leave_ibss(rdev, dev, false);
5219 }
5220
5221 #ifdef CONFIG_NL80211_TESTMODE
5222 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5223         .name = "testmode",
5224 };
5225
5226 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5227 {
5228         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5229         int err;
5230
5231         if (!info->attrs[NL80211_ATTR_TESTDATA])
5232                 return -EINVAL;
5233
5234         err = -EOPNOTSUPP;
5235         if (rdev->ops->testmode_cmd) {
5236                 rdev->testmode_info = info;
5237                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
5238                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5239                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5240                 rdev->testmode_info = NULL;
5241         }
5242
5243         return err;
5244 }
5245
5246 static int nl80211_testmode_dump(struct sk_buff *skb,
5247                                  struct netlink_callback *cb)
5248 {
5249         struct cfg80211_registered_device *rdev;
5250         int err;
5251         long phy_idx;
5252         void *data = NULL;
5253         int data_len = 0;
5254
5255         if (cb->args[0]) {
5256                 /*
5257                  * 0 is a valid index, but not valid for args[0],
5258                  * so we need to offset by 1.
5259                  */
5260                 phy_idx = cb->args[0] - 1;
5261         } else {
5262                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5263                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5264                                   nl80211_policy);
5265                 if (err)
5266                         return err;
5267
5268                 mutex_lock(&cfg80211_mutex);
5269                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5270                                                   nl80211_fam.attrbuf);
5271                 if (IS_ERR(rdev)) {
5272                         mutex_unlock(&cfg80211_mutex);
5273                         return PTR_ERR(rdev);
5274                 }
5275                 phy_idx = rdev->wiphy_idx;
5276                 rdev = NULL;
5277                 mutex_unlock(&cfg80211_mutex);
5278
5279                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5280                         cb->args[1] =
5281                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5282         }
5283
5284         if (cb->args[1]) {
5285                 data = nla_data((void *)cb->args[1]);
5286                 data_len = nla_len((void *)cb->args[1]);
5287         }
5288
5289         mutex_lock(&cfg80211_mutex);
5290         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5291         if (!rdev) {
5292                 mutex_unlock(&cfg80211_mutex);
5293                 return -ENOENT;
5294         }
5295         cfg80211_lock_rdev(rdev);
5296         mutex_unlock(&cfg80211_mutex);
5297
5298         if (!rdev->ops->testmode_dump) {
5299                 err = -EOPNOTSUPP;
5300                 goto out_err;
5301         }
5302
5303         while (1) {
5304                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
5305                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5306                                            NL80211_CMD_TESTMODE);
5307                 struct nlattr *tmdata;
5308
5309                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5310                         genlmsg_cancel(skb, hdr);
5311                         break;
5312                 }
5313
5314                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5315                 if (!tmdata) {
5316                         genlmsg_cancel(skb, hdr);
5317                         break;
5318                 }
5319                 err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
5320                                                data, data_len);
5321                 nla_nest_end(skb, tmdata);
5322
5323                 if (err == -ENOBUFS || err == -ENOENT) {
5324                         genlmsg_cancel(skb, hdr);
5325                         break;
5326                 } else if (err) {
5327                         genlmsg_cancel(skb, hdr);
5328                         goto out_err;
5329                 }
5330
5331                 genlmsg_end(skb, hdr);
5332         }
5333
5334         err = skb->len;
5335         /* see above */
5336         cb->args[0] = phy_idx + 1;
5337  out_err:
5338         cfg80211_unlock_rdev(rdev);
5339         return err;
5340 }
5341
5342 static struct sk_buff *
5343 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5344                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
5345 {
5346         struct sk_buff *skb;
5347         void *hdr;
5348         struct nlattr *data;
5349
5350         skb = nlmsg_new(approxlen + 100, gfp);
5351         if (!skb)
5352                 return NULL;
5353
5354         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
5355         if (!hdr) {
5356                 kfree_skb(skb);
5357                 return NULL;
5358         }
5359
5360         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5361                 goto nla_put_failure;
5362         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5363
5364         ((void **)skb->cb)[0] = rdev;
5365         ((void **)skb->cb)[1] = hdr;
5366         ((void **)skb->cb)[2] = data;
5367
5368         return skb;
5369
5370  nla_put_failure:
5371         kfree_skb(skb);
5372         return NULL;
5373 }
5374
5375 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5376                                                   int approxlen)
5377 {
5378         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5379
5380         if (WARN_ON(!rdev->testmode_info))
5381                 return NULL;
5382
5383         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5384                                 rdev->testmode_info->snd_pid,
5385                                 rdev->testmode_info->snd_seq,
5386                                 GFP_KERNEL);
5387 }
5388 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5389
5390 int cfg80211_testmode_reply(struct sk_buff *skb)
5391 {
5392         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5393         void *hdr = ((void **)skb->cb)[1];
5394         struct nlattr *data = ((void **)skb->cb)[2];
5395
5396         if (WARN_ON(!rdev->testmode_info)) {
5397                 kfree_skb(skb);
5398                 return -EINVAL;
5399         }
5400
5401         nla_nest_end(skb, data);
5402         genlmsg_end(skb, hdr);
5403         return genlmsg_reply(skb, rdev->testmode_info);
5404 }
5405 EXPORT_SYMBOL(cfg80211_testmode_reply);
5406
5407 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5408                                                   int approxlen, gfp_t gfp)
5409 {
5410         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5411
5412         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5413 }
5414 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5415
5416 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5417 {
5418         void *hdr = ((void **)skb->cb)[1];
5419         struct nlattr *data = ((void **)skb->cb)[2];
5420
5421         nla_nest_end(skb, data);
5422         genlmsg_end(skb, hdr);
5423         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5424 }
5425 EXPORT_SYMBOL(cfg80211_testmode_event);
5426 #endif
5427
5428 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5429 {
5430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5431         struct net_device *dev = info->user_ptr[1];
5432         struct cfg80211_connect_params connect;
5433         struct wiphy *wiphy;
5434         struct cfg80211_cached_keys *connkeys = NULL;
5435         int err;
5436
5437         memset(&connect, 0, sizeof(connect));
5438
5439         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5440                 return -EINVAL;
5441
5442         if (!info->attrs[NL80211_ATTR_SSID] ||
5443             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5444                 return -EINVAL;
5445
5446         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5447                 connect.auth_type =
5448                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5449                 if (!nl80211_valid_auth_type(connect.auth_type))
5450                         return -EINVAL;
5451         } else
5452                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5453
5454         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5455
5456         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5457                                       NL80211_MAX_NR_CIPHER_SUITES);
5458         if (err)
5459                 return err;
5460
5461         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5462             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5463                 return -EOPNOTSUPP;
5464
5465         wiphy = &rdev->wiphy;
5466
5467         connect.bg_scan_period = -1;
5468         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5469                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5470                 connect.bg_scan_period =
5471                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5472         }
5473
5474         if (info->attrs[NL80211_ATTR_MAC])
5475                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5476         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5477         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5478
5479         if (info->attrs[NL80211_ATTR_IE]) {
5480                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5481                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5482         }
5483
5484         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5485                 connect.channel =
5486                         ieee80211_get_channel(wiphy,
5487                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5488                 if (!connect.channel ||
5489                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5490                         return -EINVAL;
5491         }
5492
5493         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5494                 connkeys = nl80211_parse_connkeys(rdev,
5495                                         info->attrs[NL80211_ATTR_KEYS]);
5496                 if (IS_ERR(connkeys))
5497                         return PTR_ERR(connkeys);
5498         }
5499
5500         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5501                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5502
5503         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5504                 memcpy(&connect.ht_capa_mask,
5505                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5506                        sizeof(connect.ht_capa_mask));
5507
5508         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5509                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5510                         return -EINVAL;
5511                 memcpy(&connect.ht_capa,
5512                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5513                        sizeof(connect.ht_capa));
5514         }
5515
5516         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5517         if (err)
5518                 kfree(connkeys);
5519         return err;
5520 }
5521
5522 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5523 {
5524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5525         struct net_device *dev = info->user_ptr[1];
5526         u16 reason;
5527
5528         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5529                 reason = WLAN_REASON_DEAUTH_LEAVING;
5530         else
5531                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5532
5533         if (reason == 0)
5534                 return -EINVAL;
5535
5536         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5537             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5538                 return -EOPNOTSUPP;
5539
5540         return cfg80211_disconnect(rdev, dev, reason, true);
5541 }
5542
5543 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5544 {
5545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5546         struct net *net;
5547         int err;
5548         u32 pid;
5549
5550         if (!info->attrs[NL80211_ATTR_PID])
5551                 return -EINVAL;
5552
5553         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5554
5555         net = get_net_ns_by_pid(pid);
5556         if (IS_ERR(net))
5557                 return PTR_ERR(net);
5558
5559         err = 0;
5560
5561         /* check if anything to do */
5562         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5563                 err = cfg80211_switch_netns(rdev, net);
5564
5565         put_net(net);
5566         return err;
5567 }
5568
5569 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5570 {
5571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5572         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5573                         struct cfg80211_pmksa *pmksa) = NULL;
5574         struct net_device *dev = info->user_ptr[1];
5575         struct cfg80211_pmksa pmksa;
5576
5577         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5578
5579         if (!info->attrs[NL80211_ATTR_MAC])
5580                 return -EINVAL;
5581
5582         if (!info->attrs[NL80211_ATTR_PMKID])
5583                 return -EINVAL;
5584
5585         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5586         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5587
5588         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5589             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5590                 return -EOPNOTSUPP;
5591
5592         switch (info->genlhdr->cmd) {
5593         case NL80211_CMD_SET_PMKSA:
5594                 rdev_ops = rdev->ops->set_pmksa;
5595                 break;
5596         case NL80211_CMD_DEL_PMKSA:
5597                 rdev_ops = rdev->ops->del_pmksa;
5598                 break;
5599         default:
5600                 WARN_ON(1);
5601                 break;
5602         }
5603
5604         if (!rdev_ops)
5605                 return -EOPNOTSUPP;
5606
5607         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5608 }
5609
5610 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5611 {
5612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5613         struct net_device *dev = info->user_ptr[1];
5614
5615         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5616             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5617                 return -EOPNOTSUPP;
5618
5619         if (!rdev->ops->flush_pmksa)
5620                 return -EOPNOTSUPP;
5621
5622         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5623 }
5624
5625 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5626 {
5627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5628         struct net_device *dev = info->user_ptr[1];
5629         u8 action_code, dialog_token;
5630         u16 status_code;
5631         u8 *peer;
5632
5633         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5634             !rdev->ops->tdls_mgmt)
5635                 return -EOPNOTSUPP;
5636
5637         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5638             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5639             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5640             !info->attrs[NL80211_ATTR_IE] ||
5641             !info->attrs[NL80211_ATTR_MAC])
5642                 return -EINVAL;
5643
5644         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5645         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5646         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5647         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5648
5649         return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5650                                     dialog_token, status_code,
5651                                     nla_data(info->attrs[NL80211_ATTR_IE]),
5652                                     nla_len(info->attrs[NL80211_ATTR_IE]));
5653 }
5654
5655 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5656 {
5657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5658         struct net_device *dev = info->user_ptr[1];
5659         enum nl80211_tdls_operation operation;
5660         u8 *peer;
5661
5662         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5663             !rdev->ops->tdls_oper)
5664                 return -EOPNOTSUPP;
5665
5666         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5667             !info->attrs[NL80211_ATTR_MAC])
5668                 return -EINVAL;
5669
5670         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5671         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5672
5673         return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5674 }
5675
5676 static int nl80211_remain_on_channel(struct sk_buff *skb,
5677                                      struct genl_info *info)
5678 {
5679         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5680         struct net_device *dev = info->user_ptr[1];
5681         struct ieee80211_channel *chan;
5682         struct sk_buff *msg;
5683         void *hdr;
5684         u64 cookie;
5685         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5686         u32 freq, duration;
5687         int err;
5688
5689         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5690             !info->attrs[NL80211_ATTR_DURATION])
5691                 return -EINVAL;
5692
5693         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5694
5695         if (!rdev->ops->remain_on_channel ||
5696             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5697                 return -EOPNOTSUPP;
5698
5699         /*
5700          * We should be on that channel for at least a minimum amount of
5701          * time (10ms) but no longer than the driver supports.
5702          */
5703         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5704             duration > rdev->wiphy.max_remain_on_channel_duration)
5705                 return -EINVAL;
5706
5707         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5708             !nl80211_valid_channel_type(info, &channel_type))
5709                 return -EINVAL;
5710
5711         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5712         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5713         if (chan == NULL)
5714                 return -EINVAL;
5715
5716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5717         if (!msg)
5718                 return -ENOMEM;
5719
5720         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5721                              NL80211_CMD_REMAIN_ON_CHANNEL);
5722
5723         if (IS_ERR(hdr)) {
5724                 err = PTR_ERR(hdr);
5725                 goto free_msg;
5726         }
5727
5728         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5729                                            channel_type, duration, &cookie);
5730
5731         if (err)
5732                 goto free_msg;
5733
5734         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
5735                 goto nla_put_failure;
5736
5737         genlmsg_end(msg, hdr);
5738
5739         return genlmsg_reply(msg, info);
5740
5741  nla_put_failure:
5742         err = -ENOBUFS;
5743  free_msg:
5744         nlmsg_free(msg);
5745         return err;
5746 }
5747
5748 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5749                                             struct genl_info *info)
5750 {
5751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5752         struct net_device *dev = info->user_ptr[1];
5753         u64 cookie;
5754
5755         if (!info->attrs[NL80211_ATTR_COOKIE])
5756                 return -EINVAL;
5757
5758         if (!rdev->ops->cancel_remain_on_channel)
5759                 return -EOPNOTSUPP;
5760
5761         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5762
5763         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5764 }
5765
5766 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5767                            u8 *rates, u8 rates_len)
5768 {
5769         u8 i;
5770         u32 mask = 0;
5771
5772         for (i = 0; i < rates_len; i++) {
5773                 int rate = (rates[i] & 0x7f) * 5;
5774                 int ridx;
5775                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5776                         struct ieee80211_rate *srate =
5777                                 &sband->bitrates[ridx];
5778                         if (rate == srate->bitrate) {
5779                                 mask |= 1 << ridx;
5780                                 break;
5781                         }
5782                 }
5783                 if (ridx == sband->n_bitrates)
5784                         return 0; /* rate not found */
5785         }
5786
5787         return mask;
5788 }
5789
5790 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5791                                u8 *rates, u8 rates_len,
5792                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5793 {
5794         u8 i;
5795
5796         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5797
5798         for (i = 0; i < rates_len; i++) {
5799                 int ridx, rbit;
5800
5801                 ridx = rates[i] / 8;
5802                 rbit = BIT(rates[i] % 8);
5803
5804                 /* check validity */
5805                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5806                         return false;
5807
5808                 /* check availability */
5809                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5810                         mcs[ridx] |= rbit;
5811                 else
5812                         return false;
5813         }
5814
5815         return true;
5816 }
5817
5818 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5819         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5820                                     .len = NL80211_MAX_SUPP_RATES },
5821         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
5822                                  .len = NL80211_MAX_SUPP_HT_RATES },
5823 };
5824
5825 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5826                                        struct genl_info *info)
5827 {
5828         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5830         struct cfg80211_bitrate_mask mask;
5831         int rem, i;
5832         struct net_device *dev = info->user_ptr[1];
5833         struct nlattr *tx_rates;
5834         struct ieee80211_supported_band *sband;
5835
5836         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5837                 return -EINVAL;
5838
5839         if (!rdev->ops->set_bitrate_mask)
5840                 return -EOPNOTSUPP;
5841
5842         memset(&mask, 0, sizeof(mask));
5843         /* Default to all rates enabled */
5844         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5845                 sband = rdev->wiphy.bands[i];
5846                 mask.control[i].legacy =
5847                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5848                 if (sband)
5849                         memcpy(mask.control[i].mcs,
5850                                sband->ht_cap.mcs.rx_mask,
5851                                sizeof(mask.control[i].mcs));
5852                 else
5853                         memset(mask.control[i].mcs, 0,
5854                                sizeof(mask.control[i].mcs));
5855         }
5856
5857         /*
5858          * The nested attribute uses enum nl80211_band as the index. This maps
5859          * directly to the enum ieee80211_band values used in cfg80211.
5860          */
5861         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5862         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5863         {
5864                 enum ieee80211_band band = nla_type(tx_rates);
5865                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5866                         return -EINVAL;
5867                 sband = rdev->wiphy.bands[band];
5868                 if (sband == NULL)
5869                         return -EINVAL;
5870                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5871                           nla_len(tx_rates), nl80211_txattr_policy);
5872                 if (tb[NL80211_TXRATE_LEGACY]) {
5873                         mask.control[band].legacy = rateset_to_mask(
5874                                 sband,
5875                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5876                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5877                         if ((mask.control[band].legacy == 0) &&
5878                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5879                                 return -EINVAL;
5880                 }
5881                 if (tb[NL80211_TXRATE_MCS]) {
5882                         if (!ht_rateset_to_mask(
5883                                         sband,
5884                                         nla_data(tb[NL80211_TXRATE_MCS]),
5885                                         nla_len(tb[NL80211_TXRATE_MCS]),
5886                                         mask.control[band].mcs))
5887                                 return -EINVAL;
5888                 }
5889
5890                 if (mask.control[band].legacy == 0) {
5891                         /* don't allow empty legacy rates if HT
5892                          * is not even supported. */
5893                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
5894                                 return -EINVAL;
5895
5896                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5897                                 if (mask.control[band].mcs[i])
5898                                         break;
5899
5900                         /* legacy and mcs rates may not be both empty */
5901                         if (i == IEEE80211_HT_MCS_MASK_LEN)
5902                                 return -EINVAL;
5903                 }
5904         }
5905
5906         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5907 }
5908
5909 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5910 {
5911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5912         struct net_device *dev = info->user_ptr[1];
5913         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5914
5915         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5916                 return -EINVAL;
5917
5918         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5919                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5920
5921         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5922             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5923             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5924             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5925             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5926             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5927             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5928                 return -EOPNOTSUPP;
5929
5930         /* not much point in registering if we can't reply */
5931         if (!rdev->ops->mgmt_tx)
5932                 return -EOPNOTSUPP;
5933
5934         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5935                         frame_type,
5936                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5937                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5938 }
5939
5940 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5941 {
5942         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5943         struct net_device *dev = info->user_ptr[1];
5944         struct ieee80211_channel *chan;
5945         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5946         bool channel_type_valid = false;
5947         u32 freq;
5948         int err;
5949         void *hdr = NULL;
5950         u64 cookie;
5951         struct sk_buff *msg = NULL;
5952         unsigned int wait = 0;
5953         bool offchan, no_cck, dont_wait_for_ack;
5954
5955         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
5956
5957         if (!info->attrs[NL80211_ATTR_FRAME] ||
5958             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5959                 return -EINVAL;
5960
5961         if (!rdev->ops->mgmt_tx)
5962                 return -EOPNOTSUPP;
5963
5964         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5965             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5966             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5967             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5968             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5969             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5970             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5971                 return -EOPNOTSUPP;
5972
5973         if (info->attrs[NL80211_ATTR_DURATION]) {
5974                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5975                         return -EINVAL;
5976                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5977
5978                 /*
5979                  * We should wait on the channel for at least a minimum amount
5980                  * of time (10ms) but no longer than the driver supports.
5981                  */
5982                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5983                     wait > rdev->wiphy.max_remain_on_channel_duration)
5984                         return -EINVAL;
5985
5986         }
5987
5988         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5989                 if (!nl80211_valid_channel_type(info, &channel_type))
5990                         return -EINVAL;
5991                 channel_type_valid = true;
5992         }
5993
5994         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5995
5996         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
5997                 return -EINVAL;
5998
5999         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6000
6001         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6002         chan = rdev_freq_to_chan(rdev, freq, channel_type);
6003         if (chan == NULL)
6004                 return -EINVAL;
6005
6006         if (!dont_wait_for_ack) {
6007                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6008                 if (!msg)
6009                         return -ENOMEM;
6010
6011                 hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
6012                                      NL80211_CMD_FRAME);
6013
6014                 if (IS_ERR(hdr)) {
6015                         err = PTR_ERR(hdr);
6016                         goto free_msg;
6017                 }
6018         }
6019
6020         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
6021                                     channel_type_valid, wait,
6022                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6023                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6024                                     no_cck, dont_wait_for_ack, &cookie);
6025         if (err)
6026                 goto free_msg;
6027
6028         if (msg) {
6029                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6030                         goto nla_put_failure;
6031
6032                 genlmsg_end(msg, hdr);
6033                 return genlmsg_reply(msg, info);
6034         }
6035
6036         return 0;
6037
6038  nla_put_failure:
6039         err = -ENOBUFS;
6040  free_msg:
6041         nlmsg_free(msg);
6042         return err;
6043 }
6044
6045 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6046 {
6047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6048         struct net_device *dev = info->user_ptr[1];
6049         u64 cookie;
6050
6051         if (!info->attrs[NL80211_ATTR_COOKIE])
6052                 return -EINVAL;
6053
6054         if (!rdev->ops->mgmt_tx_cancel_wait)
6055                 return -EOPNOTSUPP;
6056
6057         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6058             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6059             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
6060             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6061             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6062             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6063                 return -EOPNOTSUPP;
6064
6065         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6066
6067         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
6068 }
6069
6070 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6071 {
6072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6073         struct wireless_dev *wdev;
6074         struct net_device *dev = info->user_ptr[1];
6075         u8 ps_state;
6076         bool state;
6077         int err;
6078
6079         if (!info->attrs[NL80211_ATTR_PS_STATE])
6080                 return -EINVAL;
6081
6082         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6083
6084         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6085                 return -EINVAL;
6086
6087         wdev = dev->ieee80211_ptr;
6088
6089         if (!rdev->ops->set_power_mgmt)
6090                 return -EOPNOTSUPP;
6091
6092         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6093
6094         if (state == wdev->ps)
6095                 return 0;
6096
6097         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
6098                                         wdev->ps_timeout);
6099         if (!err)
6100                 wdev->ps = state;
6101         return err;
6102 }
6103
6104 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6105 {
6106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6107         enum nl80211_ps_state ps_state;
6108         struct wireless_dev *wdev;
6109         struct net_device *dev = info->user_ptr[1];
6110         struct sk_buff *msg;
6111         void *hdr;
6112         int err;
6113
6114         wdev = dev->ieee80211_ptr;
6115
6116         if (!rdev->ops->set_power_mgmt)
6117                 return -EOPNOTSUPP;
6118
6119         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6120         if (!msg)
6121                 return -ENOMEM;
6122
6123         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
6124                              NL80211_CMD_GET_POWER_SAVE);
6125         if (!hdr) {
6126                 err = -ENOBUFS;
6127                 goto free_msg;
6128         }
6129
6130         if (wdev->ps)
6131                 ps_state = NL80211_PS_ENABLED;
6132         else
6133                 ps_state = NL80211_PS_DISABLED;
6134
6135         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6136                 goto nla_put_failure;
6137
6138         genlmsg_end(msg, hdr);
6139         return genlmsg_reply(msg, info);
6140
6141  nla_put_failure:
6142         err = -ENOBUFS;
6143  free_msg:
6144         nlmsg_free(msg);
6145         return err;
6146 }
6147
6148 static struct nla_policy
6149 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6150         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6151         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6152         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6153 };
6154
6155 static int nl80211_set_cqm_rssi(struct genl_info *info,
6156                                 s32 threshold, u32 hysteresis)
6157 {
6158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6159         struct wireless_dev *wdev;
6160         struct net_device *dev = info->user_ptr[1];
6161
6162         if (threshold > 0)
6163                 return -EINVAL;
6164
6165         wdev = dev->ieee80211_ptr;
6166
6167         if (!rdev->ops->set_cqm_rssi_config)
6168                 return -EOPNOTSUPP;
6169
6170         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6171             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6172                 return -EOPNOTSUPP;
6173
6174         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
6175                                               threshold, hysteresis);
6176 }
6177
6178 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6179 {
6180         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6181         struct nlattr *cqm;
6182         int err;
6183
6184         cqm = info->attrs[NL80211_ATTR_CQM];
6185         if (!cqm) {
6186                 err = -EINVAL;
6187                 goto out;
6188         }
6189
6190         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6191                                nl80211_attr_cqm_policy);
6192         if (err)
6193                 goto out;
6194
6195         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6196             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6197                 s32 threshold;
6198                 u32 hysteresis;
6199                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6200                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6201                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6202         } else
6203                 err = -EINVAL;
6204
6205 out:
6206         return err;
6207 }
6208
6209 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6210 {
6211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6212         struct net_device *dev = info->user_ptr[1];
6213         struct mesh_config cfg;
6214         struct mesh_setup setup;
6215         int err;
6216
6217         /* start with default */
6218         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6219         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6220
6221         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6222                 /* and parse parameters if given */
6223                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6224                 if (err)
6225                         return err;
6226         }
6227
6228         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6229             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6230                 return -EINVAL;
6231
6232         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6233         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6234
6235         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6236             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6237                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6238                         return -EINVAL;
6239
6240         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6241                 /* parse additional setup parameters if given */
6242                 err = nl80211_parse_mesh_setup(info, &setup);
6243                 if (err)
6244                         return err;
6245         }
6246
6247         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6248                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6249
6250                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6251                     !nl80211_valid_channel_type(info, &channel_type))
6252                         return -EINVAL;
6253
6254                 setup.channel = rdev_freq_to_chan(rdev,
6255                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6256                         channel_type);
6257                 if (!setup.channel)
6258                         return -EINVAL;
6259                 setup.channel_type = channel_type;
6260         } else {
6261                 /* cfg80211_join_mesh() will sort it out */
6262                 setup.channel = NULL;
6263         }
6264
6265         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6266 }
6267
6268 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6269 {
6270         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6271         struct net_device *dev = info->user_ptr[1];
6272
6273         return cfg80211_leave_mesh(rdev, dev);
6274 }
6275
6276 #ifdef CONFIG_PM
6277 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6278 {
6279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6280         struct sk_buff *msg;
6281         void *hdr;
6282
6283         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6284                 return -EOPNOTSUPP;
6285
6286         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6287         if (!msg)
6288                 return -ENOMEM;
6289
6290         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
6291                              NL80211_CMD_GET_WOWLAN);
6292         if (!hdr)
6293                 goto nla_put_failure;
6294
6295         if (rdev->wowlan) {
6296                 struct nlattr *nl_wowlan;
6297
6298                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6299                 if (!nl_wowlan)
6300                         goto nla_put_failure;
6301
6302                 if ((rdev->wowlan->any &&
6303                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6304                     (rdev->wowlan->disconnect &&
6305                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6306                     (rdev->wowlan->magic_pkt &&
6307                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6308                     (rdev->wowlan->gtk_rekey_failure &&
6309                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6310                     (rdev->wowlan->eap_identity_req &&
6311                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6312                     (rdev->wowlan->four_way_handshake &&
6313                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6314                     (rdev->wowlan->rfkill_release &&
6315                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6316                         goto nla_put_failure;
6317                 if (rdev->wowlan->n_patterns) {
6318                         struct nlattr *nl_pats, *nl_pat;
6319                         int i, pat_len;
6320
6321                         nl_pats = nla_nest_start(msg,
6322                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6323                         if (!nl_pats)
6324                                 goto nla_put_failure;
6325
6326                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6327                                 nl_pat = nla_nest_start(msg, i + 1);
6328                                 if (!nl_pat)
6329                                         goto nla_put_failure;
6330                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6331                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6332                                             DIV_ROUND_UP(pat_len, 8),
6333                                             rdev->wowlan->patterns[i].mask) ||
6334                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6335                                             pat_len,
6336                                             rdev->wowlan->patterns[i].pattern))
6337                                         goto nla_put_failure;
6338                                 nla_nest_end(msg, nl_pat);
6339                         }
6340                         nla_nest_end(msg, nl_pats);
6341                 }
6342
6343                 nla_nest_end(msg, nl_wowlan);
6344         }
6345
6346         genlmsg_end(msg, hdr);
6347         return genlmsg_reply(msg, info);
6348
6349 nla_put_failure:
6350         nlmsg_free(msg);
6351         return -ENOBUFS;
6352 }
6353
6354 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6355 {
6356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6357         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6358         struct cfg80211_wowlan no_triggers = {};
6359         struct cfg80211_wowlan new_triggers = {};
6360         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6361         int err, i;
6362         bool prev_enabled = rdev->wowlan;
6363
6364         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6365                 return -EOPNOTSUPP;
6366
6367         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
6368                 goto no_triggers;
6369
6370         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6371                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6372                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6373                         nl80211_wowlan_policy);
6374         if (err)
6375                 return err;
6376
6377         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6378                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6379                         return -EINVAL;
6380                 new_triggers.any = true;
6381         }
6382
6383         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6384                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6385                         return -EINVAL;
6386                 new_triggers.disconnect = true;
6387         }
6388
6389         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6390                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6391                         return -EINVAL;
6392                 new_triggers.magic_pkt = true;
6393         }
6394
6395         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6396                 return -EINVAL;
6397
6398         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6399                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6400                         return -EINVAL;
6401                 new_triggers.gtk_rekey_failure = true;
6402         }
6403
6404         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6405                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6406                         return -EINVAL;
6407                 new_triggers.eap_identity_req = true;
6408         }
6409
6410         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6411                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6412                         return -EINVAL;
6413                 new_triggers.four_way_handshake = true;
6414         }
6415
6416         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6417                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6418                         return -EINVAL;
6419                 new_triggers.rfkill_release = true;
6420         }
6421
6422         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6423                 struct nlattr *pat;
6424                 int n_patterns = 0;
6425                 int rem, pat_len, mask_len;
6426                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6427
6428                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6429                                     rem)
6430                         n_patterns++;
6431                 if (n_patterns > wowlan->n_patterns)
6432                         return -EINVAL;
6433
6434                 new_triggers.patterns = kcalloc(n_patterns,
6435                                                 sizeof(new_triggers.patterns[0]),
6436                                                 GFP_KERNEL);
6437                 if (!new_triggers.patterns)
6438                         return -ENOMEM;
6439
6440                 new_triggers.n_patterns = n_patterns;
6441                 i = 0;
6442
6443                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6444                                     rem) {
6445                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6446                                   nla_data(pat), nla_len(pat), NULL);
6447                         err = -EINVAL;
6448                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6449                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6450                                 goto error;
6451                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6452                         mask_len = DIV_ROUND_UP(pat_len, 8);
6453                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6454                             mask_len)
6455                                 goto error;
6456                         if (pat_len > wowlan->pattern_max_len ||
6457                             pat_len < wowlan->pattern_min_len)
6458                                 goto error;
6459
6460                         new_triggers.patterns[i].mask =
6461                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6462                         if (!new_triggers.patterns[i].mask) {
6463                                 err = -ENOMEM;
6464                                 goto error;
6465                         }
6466                         new_triggers.patterns[i].pattern =
6467                                 new_triggers.patterns[i].mask + mask_len;
6468                         memcpy(new_triggers.patterns[i].mask,
6469                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6470                                mask_len);
6471                         new_triggers.patterns[i].pattern_len = pat_len;
6472                         memcpy(new_triggers.patterns[i].pattern,
6473                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6474                                pat_len);
6475                         i++;
6476                 }
6477         }
6478
6479         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
6480                 struct cfg80211_wowlan *ntrig;
6481                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
6482                                 GFP_KERNEL);
6483                 if (!ntrig) {
6484                         err = -ENOMEM;
6485                         goto error;
6486                 }
6487                 cfg80211_rdev_free_wowlan(rdev);
6488                 rdev->wowlan = ntrig;
6489         } else {
6490  no_triggers:
6491                 cfg80211_rdev_free_wowlan(rdev);
6492                 rdev->wowlan = NULL;
6493         }
6494
6495         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6496                 rdev->ops->set_wakeup(&rdev->wiphy, rdev->wowlan);
6497
6498         return 0;
6499  error:
6500         for (i = 0; i < new_triggers.n_patterns; i++)
6501                 kfree(new_triggers.patterns[i].mask);
6502         kfree(new_triggers.patterns);
6503         return err;
6504 }
6505 #endif
6506
6507 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6508 {
6509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6510         struct net_device *dev = info->user_ptr[1];
6511         struct wireless_dev *wdev = dev->ieee80211_ptr;
6512         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6513         struct cfg80211_gtk_rekey_data rekey_data;
6514         int err;
6515
6516         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6517                 return -EINVAL;
6518
6519         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6520                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6521                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6522                         nl80211_rekey_policy);
6523         if (err)
6524                 return err;
6525
6526         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6527                 return -ERANGE;
6528         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6529                 return -ERANGE;
6530         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6531                 return -ERANGE;
6532
6533         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6534                NL80211_KEK_LEN);
6535         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6536                NL80211_KCK_LEN);
6537         memcpy(rekey_data.replay_ctr,
6538                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6539                NL80211_REPLAY_CTR_LEN);
6540
6541         wdev_lock(wdev);
6542         if (!wdev->current_bss) {
6543                 err = -ENOTCONN;
6544                 goto out;
6545         }
6546
6547         if (!rdev->ops->set_rekey_data) {
6548                 err = -EOPNOTSUPP;
6549                 goto out;
6550         }
6551
6552         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
6553  out:
6554         wdev_unlock(wdev);
6555         return err;
6556 }
6557
6558 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6559                                              struct genl_info *info)
6560 {
6561         struct net_device *dev = info->user_ptr[1];
6562         struct wireless_dev *wdev = dev->ieee80211_ptr;
6563
6564         if (wdev->iftype != NL80211_IFTYPE_AP &&
6565             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6566                 return -EINVAL;
6567
6568         if (wdev->ap_unexpected_nlpid)
6569                 return -EBUSY;
6570
6571         wdev->ap_unexpected_nlpid = info->snd_pid;
6572         return 0;
6573 }
6574
6575 static int nl80211_probe_client(struct sk_buff *skb,
6576                                 struct genl_info *info)
6577 {
6578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6579         struct net_device *dev = info->user_ptr[1];
6580         struct wireless_dev *wdev = dev->ieee80211_ptr;
6581         struct sk_buff *msg;
6582         void *hdr;
6583         const u8 *addr;
6584         u64 cookie;
6585         int err;
6586
6587         if (wdev->iftype != NL80211_IFTYPE_AP &&
6588             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6589                 return -EOPNOTSUPP;
6590
6591         if (!info->attrs[NL80211_ATTR_MAC])
6592                 return -EINVAL;
6593
6594         if (!rdev->ops->probe_client)
6595                 return -EOPNOTSUPP;
6596
6597         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6598         if (!msg)
6599                 return -ENOMEM;
6600
6601         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
6602                              NL80211_CMD_PROBE_CLIENT);
6603
6604         if (IS_ERR(hdr)) {
6605                 err = PTR_ERR(hdr);
6606                 goto free_msg;
6607         }
6608
6609         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6610
6611         err = rdev->ops->probe_client(&rdev->wiphy, dev, addr, &cookie);
6612         if (err)
6613                 goto free_msg;
6614
6615         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6616                 goto nla_put_failure;
6617
6618         genlmsg_end(msg, hdr);
6619
6620         return genlmsg_reply(msg, info);
6621
6622  nla_put_failure:
6623         err = -ENOBUFS;
6624  free_msg:
6625         nlmsg_free(msg);
6626         return err;
6627 }
6628
6629 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6630 {
6631         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6632
6633         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6634                 return -EOPNOTSUPP;
6635
6636         if (rdev->ap_beacons_nlpid)
6637                 return -EBUSY;
6638
6639         rdev->ap_beacons_nlpid = info->snd_pid;
6640
6641         return 0;
6642 }
6643
6644 #define NL80211_FLAG_NEED_WIPHY         0x01
6645 #define NL80211_FLAG_NEED_NETDEV        0x02
6646 #define NL80211_FLAG_NEED_RTNL          0x04
6647 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
6648 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
6649                                          NL80211_FLAG_CHECK_NETDEV_UP)
6650
6651 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
6652                             struct genl_info *info)
6653 {
6654         struct cfg80211_registered_device *rdev;
6655         struct net_device *dev;
6656         int err;
6657         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
6658
6659         if (rtnl)
6660                 rtnl_lock();
6661
6662         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
6663                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6664                 if (IS_ERR(rdev)) {
6665                         if (rtnl)
6666                                 rtnl_unlock();
6667                         return PTR_ERR(rdev);
6668                 }
6669                 info->user_ptr[0] = rdev;
6670         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
6671                 err = get_rdev_dev_by_ifindex(genl_info_net(info), info->attrs,
6672                                               &rdev, &dev);
6673                 if (err) {
6674                         if (rtnl)
6675                                 rtnl_unlock();
6676                         return err;
6677                 }
6678                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
6679                     !netif_running(dev)) {
6680                         cfg80211_unlock_rdev(rdev);
6681                         dev_put(dev);
6682                         if (rtnl)
6683                                 rtnl_unlock();
6684                         return -ENETDOWN;
6685                 }
6686                 info->user_ptr[0] = rdev;
6687                 info->user_ptr[1] = dev;
6688         }
6689
6690         return 0;
6691 }
6692
6693 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
6694                               struct genl_info *info)
6695 {
6696         if (info->user_ptr[0])
6697                 cfg80211_unlock_rdev(info->user_ptr[0]);
6698         if (info->user_ptr[1])
6699                 dev_put(info->user_ptr[1]);
6700         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
6701                 rtnl_unlock();
6702 }
6703
6704 static struct genl_ops nl80211_ops[] = {
6705         {
6706                 .cmd = NL80211_CMD_GET_WIPHY,
6707                 .doit = nl80211_get_wiphy,
6708                 .dumpit = nl80211_dump_wiphy,
6709                 .policy = nl80211_policy,
6710                 /* can be retrieved by unprivileged users */
6711                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
6712         },
6713         {
6714                 .cmd = NL80211_CMD_SET_WIPHY,
6715                 .doit = nl80211_set_wiphy,
6716                 .policy = nl80211_policy,
6717                 .flags = GENL_ADMIN_PERM,
6718                 .internal_flags = NL80211_FLAG_NEED_RTNL,
6719         },
6720         {
6721                 .cmd = NL80211_CMD_GET_INTERFACE,
6722                 .doit = nl80211_get_interface,
6723                 .dumpit = nl80211_dump_interface,
6724                 .policy = nl80211_policy,
6725                 /* can be retrieved by unprivileged users */
6726                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
6727         },
6728         {
6729                 .cmd = NL80211_CMD_SET_INTERFACE,
6730                 .doit = nl80211_set_interface,
6731                 .policy = nl80211_policy,
6732                 .flags = GENL_ADMIN_PERM,
6733                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6734                                   NL80211_FLAG_NEED_RTNL,
6735         },
6736         {
6737                 .cmd = NL80211_CMD_NEW_INTERFACE,
6738                 .doit = nl80211_new_interface,
6739                 .policy = nl80211_policy,
6740                 .flags = GENL_ADMIN_PERM,
6741                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6742                                   NL80211_FLAG_NEED_RTNL,
6743         },
6744         {
6745                 .cmd = NL80211_CMD_DEL_INTERFACE,
6746                 .doit = nl80211_del_interface,
6747                 .policy = nl80211_policy,
6748                 .flags = GENL_ADMIN_PERM,
6749                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6750                                   NL80211_FLAG_NEED_RTNL,
6751         },
6752         {
6753                 .cmd = NL80211_CMD_GET_KEY,
6754                 .doit = nl80211_get_key,
6755                 .policy = nl80211_policy,
6756                 .flags = GENL_ADMIN_PERM,
6757                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6758                                   NL80211_FLAG_NEED_RTNL,
6759         },
6760         {
6761                 .cmd = NL80211_CMD_SET_KEY,
6762                 .doit = nl80211_set_key,
6763                 .policy = nl80211_policy,
6764                 .flags = GENL_ADMIN_PERM,
6765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6766                                   NL80211_FLAG_NEED_RTNL,
6767         },
6768         {
6769                 .cmd = NL80211_CMD_NEW_KEY,
6770                 .doit = nl80211_new_key,
6771                 .policy = nl80211_policy,
6772                 .flags = GENL_ADMIN_PERM,
6773                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6774                                   NL80211_FLAG_NEED_RTNL,
6775         },
6776         {
6777                 .cmd = NL80211_CMD_DEL_KEY,
6778                 .doit = nl80211_del_key,
6779                 .policy = nl80211_policy,
6780                 .flags = GENL_ADMIN_PERM,
6781                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6782                                   NL80211_FLAG_NEED_RTNL,
6783         },
6784         {
6785                 .cmd = NL80211_CMD_SET_BEACON,
6786                 .policy = nl80211_policy,
6787                 .flags = GENL_ADMIN_PERM,
6788                 .doit = nl80211_set_beacon,
6789                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6790                                   NL80211_FLAG_NEED_RTNL,
6791         },
6792         {
6793                 .cmd = NL80211_CMD_START_AP,
6794                 .policy = nl80211_policy,
6795                 .flags = GENL_ADMIN_PERM,
6796                 .doit = nl80211_start_ap,
6797                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6798                                   NL80211_FLAG_NEED_RTNL,
6799         },
6800         {
6801                 .cmd = NL80211_CMD_STOP_AP,
6802                 .policy = nl80211_policy,
6803                 .flags = GENL_ADMIN_PERM,
6804                 .doit = nl80211_stop_ap,
6805                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6806                                   NL80211_FLAG_NEED_RTNL,
6807         },
6808         {
6809                 .cmd = NL80211_CMD_GET_STATION,
6810                 .doit = nl80211_get_station,
6811                 .dumpit = nl80211_dump_station,
6812                 .policy = nl80211_policy,
6813                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6814                                   NL80211_FLAG_NEED_RTNL,
6815         },
6816         {
6817                 .cmd = NL80211_CMD_SET_STATION,
6818                 .doit = nl80211_set_station,
6819                 .policy = nl80211_policy,
6820                 .flags = GENL_ADMIN_PERM,
6821                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6822                                   NL80211_FLAG_NEED_RTNL,
6823         },
6824         {
6825                 .cmd = NL80211_CMD_NEW_STATION,
6826                 .doit = nl80211_new_station,
6827                 .policy = nl80211_policy,
6828                 .flags = GENL_ADMIN_PERM,
6829                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6830                                   NL80211_FLAG_NEED_RTNL,
6831         },
6832         {
6833                 .cmd = NL80211_CMD_DEL_STATION,
6834                 .doit = nl80211_del_station,
6835                 .policy = nl80211_policy,
6836                 .flags = GENL_ADMIN_PERM,
6837                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6838                                   NL80211_FLAG_NEED_RTNL,
6839         },
6840         {
6841                 .cmd = NL80211_CMD_GET_MPATH,
6842                 .doit = nl80211_get_mpath,
6843                 .dumpit = nl80211_dump_mpath,
6844                 .policy = nl80211_policy,
6845                 .flags = GENL_ADMIN_PERM,
6846                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6847                                   NL80211_FLAG_NEED_RTNL,
6848         },
6849         {
6850                 .cmd = NL80211_CMD_SET_MPATH,
6851                 .doit = nl80211_set_mpath,
6852                 .policy = nl80211_policy,
6853                 .flags = GENL_ADMIN_PERM,
6854                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6855                                   NL80211_FLAG_NEED_RTNL,
6856         },
6857         {
6858                 .cmd = NL80211_CMD_NEW_MPATH,
6859                 .doit = nl80211_new_mpath,
6860                 .policy = nl80211_policy,
6861                 .flags = GENL_ADMIN_PERM,
6862                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6863                                   NL80211_FLAG_NEED_RTNL,
6864         },
6865         {
6866                 .cmd = NL80211_CMD_DEL_MPATH,
6867                 .doit = nl80211_del_mpath,
6868                 .policy = nl80211_policy,
6869                 .flags = GENL_ADMIN_PERM,
6870                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6871                                   NL80211_FLAG_NEED_RTNL,
6872         },
6873         {
6874                 .cmd = NL80211_CMD_SET_BSS,
6875                 .doit = nl80211_set_bss,
6876                 .policy = nl80211_policy,
6877                 .flags = GENL_ADMIN_PERM,
6878                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6879                                   NL80211_FLAG_NEED_RTNL,
6880         },
6881         {
6882                 .cmd = NL80211_CMD_GET_REG,
6883                 .doit = nl80211_get_reg,
6884                 .policy = nl80211_policy,
6885                 /* can be retrieved by unprivileged users */
6886         },
6887         {
6888                 .cmd = NL80211_CMD_SET_REG,
6889                 .doit = nl80211_set_reg,
6890                 .policy = nl80211_policy,
6891                 .flags = GENL_ADMIN_PERM,
6892         },
6893         {
6894                 .cmd = NL80211_CMD_REQ_SET_REG,
6895                 .doit = nl80211_req_set_reg,
6896                 .policy = nl80211_policy,
6897                 .flags = GENL_ADMIN_PERM,
6898         },
6899         {
6900                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
6901                 .doit = nl80211_get_mesh_config,
6902                 .policy = nl80211_policy,
6903                 /* can be retrieved by unprivileged users */
6904                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6905                                   NL80211_FLAG_NEED_RTNL,
6906         },
6907         {
6908                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
6909                 .doit = nl80211_update_mesh_config,
6910                 .policy = nl80211_policy,
6911                 .flags = GENL_ADMIN_PERM,
6912                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6913                                   NL80211_FLAG_NEED_RTNL,
6914         },
6915         {
6916                 .cmd = NL80211_CMD_TRIGGER_SCAN,
6917                 .doit = nl80211_trigger_scan,
6918                 .policy = nl80211_policy,
6919                 .flags = GENL_ADMIN_PERM,
6920                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6921                                   NL80211_FLAG_NEED_RTNL,
6922         },
6923         {
6924                 .cmd = NL80211_CMD_GET_SCAN,
6925                 .policy = nl80211_policy,
6926                 .dumpit = nl80211_dump_scan,
6927         },
6928         {
6929                 .cmd = NL80211_CMD_START_SCHED_SCAN,
6930                 .doit = nl80211_start_sched_scan,
6931                 .policy = nl80211_policy,
6932                 .flags = GENL_ADMIN_PERM,
6933                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6934                                   NL80211_FLAG_NEED_RTNL,
6935         },
6936         {
6937                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
6938                 .doit = nl80211_stop_sched_scan,
6939                 .policy = nl80211_policy,
6940                 .flags = GENL_ADMIN_PERM,
6941                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6942                                   NL80211_FLAG_NEED_RTNL,
6943         },
6944         {
6945                 .cmd = NL80211_CMD_AUTHENTICATE,
6946                 .doit = nl80211_authenticate,
6947                 .policy = nl80211_policy,
6948                 .flags = GENL_ADMIN_PERM,
6949                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6950                                   NL80211_FLAG_NEED_RTNL,
6951         },
6952         {
6953                 .cmd = NL80211_CMD_ASSOCIATE,
6954                 .doit = nl80211_associate,
6955                 .policy = nl80211_policy,
6956                 .flags = GENL_ADMIN_PERM,
6957                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6958                                   NL80211_FLAG_NEED_RTNL,
6959         },
6960         {
6961                 .cmd = NL80211_CMD_DEAUTHENTICATE,
6962                 .doit = nl80211_deauthenticate,
6963                 .policy = nl80211_policy,
6964                 .flags = GENL_ADMIN_PERM,
6965                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6966                                   NL80211_FLAG_NEED_RTNL,
6967         },
6968         {
6969                 .cmd = NL80211_CMD_DISASSOCIATE,
6970                 .doit = nl80211_disassociate,
6971                 .policy = nl80211_policy,
6972                 .flags = GENL_ADMIN_PERM,
6973                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6974                                   NL80211_FLAG_NEED_RTNL,
6975         },
6976         {
6977                 .cmd = NL80211_CMD_JOIN_IBSS,
6978                 .doit = nl80211_join_ibss,
6979                 .policy = nl80211_policy,
6980                 .flags = GENL_ADMIN_PERM,
6981                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6982                                   NL80211_FLAG_NEED_RTNL,
6983         },
6984         {
6985                 .cmd = NL80211_CMD_LEAVE_IBSS,
6986                 .doit = nl80211_leave_ibss,
6987                 .policy = nl80211_policy,
6988                 .flags = GENL_ADMIN_PERM,
6989                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6990                                   NL80211_FLAG_NEED_RTNL,
6991         },
6992 #ifdef CONFIG_NL80211_TESTMODE
6993         {
6994                 .cmd = NL80211_CMD_TESTMODE,
6995                 .doit = nl80211_testmode_do,
6996                 .dumpit = nl80211_testmode_dump,
6997                 .policy = nl80211_policy,
6998                 .flags = GENL_ADMIN_PERM,
6999                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7000                                   NL80211_FLAG_NEED_RTNL,
7001         },
7002 #endif
7003         {
7004                 .cmd = NL80211_CMD_CONNECT,
7005                 .doit = nl80211_connect,
7006                 .policy = nl80211_policy,
7007                 .flags = GENL_ADMIN_PERM,
7008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7009                                   NL80211_FLAG_NEED_RTNL,
7010         },
7011         {
7012                 .cmd = NL80211_CMD_DISCONNECT,
7013                 .doit = nl80211_disconnect,
7014                 .policy = nl80211_policy,
7015                 .flags = GENL_ADMIN_PERM,
7016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7017                                   NL80211_FLAG_NEED_RTNL,
7018         },
7019         {
7020                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7021                 .doit = nl80211_wiphy_netns,
7022                 .policy = nl80211_policy,
7023                 .flags = GENL_ADMIN_PERM,
7024                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7025                                   NL80211_FLAG_NEED_RTNL,
7026         },
7027         {
7028                 .cmd = NL80211_CMD_GET_SURVEY,
7029                 .policy = nl80211_policy,
7030                 .dumpit = nl80211_dump_survey,
7031         },
7032         {
7033                 .cmd = NL80211_CMD_SET_PMKSA,
7034                 .doit = nl80211_setdel_pmksa,
7035                 .policy = nl80211_policy,
7036                 .flags = GENL_ADMIN_PERM,
7037                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7038                                   NL80211_FLAG_NEED_RTNL,
7039         },
7040         {
7041                 .cmd = NL80211_CMD_DEL_PMKSA,
7042                 .doit = nl80211_setdel_pmksa,
7043                 .policy = nl80211_policy,
7044                 .flags = GENL_ADMIN_PERM,
7045                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7046                                   NL80211_FLAG_NEED_RTNL,
7047         },
7048         {
7049                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7050                 .doit = nl80211_flush_pmksa,
7051                 .policy = nl80211_policy,
7052                 .flags = GENL_ADMIN_PERM,
7053                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7054                                   NL80211_FLAG_NEED_RTNL,
7055         },
7056         {
7057                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7058                 .doit = nl80211_remain_on_channel,
7059                 .policy = nl80211_policy,
7060                 .flags = GENL_ADMIN_PERM,
7061                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7062                                   NL80211_FLAG_NEED_RTNL,
7063         },
7064         {
7065                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7066                 .doit = nl80211_cancel_remain_on_channel,
7067                 .policy = nl80211_policy,
7068                 .flags = GENL_ADMIN_PERM,
7069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7070                                   NL80211_FLAG_NEED_RTNL,
7071         },
7072         {
7073                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7074                 .doit = nl80211_set_tx_bitrate_mask,
7075                 .policy = nl80211_policy,
7076                 .flags = GENL_ADMIN_PERM,
7077                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7078                                   NL80211_FLAG_NEED_RTNL,
7079         },
7080         {
7081                 .cmd = NL80211_CMD_REGISTER_FRAME,
7082                 .doit = nl80211_register_mgmt,
7083                 .policy = nl80211_policy,
7084                 .flags = GENL_ADMIN_PERM,
7085                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7086                                   NL80211_FLAG_NEED_RTNL,
7087         },
7088         {
7089                 .cmd = NL80211_CMD_FRAME,
7090                 .doit = nl80211_tx_mgmt,
7091                 .policy = nl80211_policy,
7092                 .flags = GENL_ADMIN_PERM,
7093                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7094                                   NL80211_FLAG_NEED_RTNL,
7095         },
7096         {
7097                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7098                 .doit = nl80211_tx_mgmt_cancel_wait,
7099                 .policy = nl80211_policy,
7100                 .flags = GENL_ADMIN_PERM,
7101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7102                                   NL80211_FLAG_NEED_RTNL,
7103         },
7104         {
7105                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7106                 .doit = nl80211_set_power_save,
7107                 .policy = nl80211_policy,
7108                 .flags = GENL_ADMIN_PERM,
7109                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7110                                   NL80211_FLAG_NEED_RTNL,
7111         },
7112         {
7113                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7114                 .doit = nl80211_get_power_save,
7115                 .policy = nl80211_policy,
7116                 /* can be retrieved by unprivileged users */
7117                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7118                                   NL80211_FLAG_NEED_RTNL,
7119         },
7120         {
7121                 .cmd = NL80211_CMD_SET_CQM,
7122                 .doit = nl80211_set_cqm,
7123                 .policy = nl80211_policy,
7124                 .flags = GENL_ADMIN_PERM,
7125                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7126                                   NL80211_FLAG_NEED_RTNL,
7127         },
7128         {
7129                 .cmd = NL80211_CMD_SET_CHANNEL,
7130                 .doit = nl80211_set_channel,
7131                 .policy = nl80211_policy,
7132                 .flags = GENL_ADMIN_PERM,
7133                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7134                                   NL80211_FLAG_NEED_RTNL,
7135         },
7136         {
7137                 .cmd = NL80211_CMD_SET_WDS_PEER,
7138                 .doit = nl80211_set_wds_peer,
7139                 .policy = nl80211_policy,
7140                 .flags = GENL_ADMIN_PERM,
7141                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7142                                   NL80211_FLAG_NEED_RTNL,
7143         },
7144         {
7145                 .cmd = NL80211_CMD_JOIN_MESH,
7146                 .doit = nl80211_join_mesh,
7147                 .policy = nl80211_policy,
7148                 .flags = GENL_ADMIN_PERM,
7149                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7150                                   NL80211_FLAG_NEED_RTNL,
7151         },
7152         {
7153                 .cmd = NL80211_CMD_LEAVE_MESH,
7154                 .doit = nl80211_leave_mesh,
7155                 .policy = nl80211_policy,
7156                 .flags = GENL_ADMIN_PERM,
7157                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7158                                   NL80211_FLAG_NEED_RTNL,
7159         },
7160 #ifdef CONFIG_PM
7161         {
7162                 .cmd = NL80211_CMD_GET_WOWLAN,
7163                 .doit = nl80211_get_wowlan,
7164                 .policy = nl80211_policy,
7165                 /* can be retrieved by unprivileged users */
7166                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7167                                   NL80211_FLAG_NEED_RTNL,
7168         },
7169         {
7170                 .cmd = NL80211_CMD_SET_WOWLAN,
7171                 .doit = nl80211_set_wowlan,
7172                 .policy = nl80211_policy,
7173                 .flags = GENL_ADMIN_PERM,
7174                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7175                                   NL80211_FLAG_NEED_RTNL,
7176         },
7177 #endif
7178         {
7179                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7180                 .doit = nl80211_set_rekey_data,
7181                 .policy = nl80211_policy,
7182                 .flags = GENL_ADMIN_PERM,
7183                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7184                                   NL80211_FLAG_NEED_RTNL,
7185         },
7186         {
7187                 .cmd = NL80211_CMD_TDLS_MGMT,
7188                 .doit = nl80211_tdls_mgmt,
7189                 .policy = nl80211_policy,
7190                 .flags = GENL_ADMIN_PERM,
7191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7192                                   NL80211_FLAG_NEED_RTNL,
7193         },
7194         {
7195                 .cmd = NL80211_CMD_TDLS_OPER,
7196                 .doit = nl80211_tdls_oper,
7197                 .policy = nl80211_policy,
7198                 .flags = GENL_ADMIN_PERM,
7199                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7200                                   NL80211_FLAG_NEED_RTNL,
7201         },
7202         {
7203                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7204                 .doit = nl80211_register_unexpected_frame,
7205                 .policy = nl80211_policy,
7206                 .flags = GENL_ADMIN_PERM,
7207                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7208                                   NL80211_FLAG_NEED_RTNL,
7209         },
7210         {
7211                 .cmd = NL80211_CMD_PROBE_CLIENT,
7212                 .doit = nl80211_probe_client,
7213                 .policy = nl80211_policy,
7214                 .flags = GENL_ADMIN_PERM,
7215                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7216                                   NL80211_FLAG_NEED_RTNL,
7217         },
7218         {
7219                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7220                 .doit = nl80211_register_beacons,
7221                 .policy = nl80211_policy,
7222                 .flags = GENL_ADMIN_PERM,
7223                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7224                                   NL80211_FLAG_NEED_RTNL,
7225         },
7226         {
7227                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7228                 .doit = nl80211_set_noack_map,
7229                 .policy = nl80211_policy,
7230                 .flags = GENL_ADMIN_PERM,
7231                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7232                                   NL80211_FLAG_NEED_RTNL,
7233         },
7234
7235 };
7236
7237 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7238         .name = "mlme",
7239 };
7240
7241 /* multicast groups */
7242 static struct genl_multicast_group nl80211_config_mcgrp = {
7243         .name = "config",
7244 };
7245 static struct genl_multicast_group nl80211_scan_mcgrp = {
7246         .name = "scan",
7247 };
7248 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7249         .name = "regulatory",
7250 };
7251
7252 /* notification functions */
7253
7254 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7255 {
7256         struct sk_buff *msg;
7257
7258         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7259         if (!msg)
7260                 return;
7261
7262         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7263                 nlmsg_free(msg);
7264                 return;
7265         }
7266
7267         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7268                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7269 }
7270
7271 static int nl80211_add_scan_req(struct sk_buff *msg,
7272                                 struct cfg80211_registered_device *rdev)
7273 {
7274         struct cfg80211_scan_request *req = rdev->scan_req;
7275         struct nlattr *nest;
7276         int i;
7277
7278         ASSERT_RDEV_LOCK(rdev);
7279
7280         if (WARN_ON(!req))
7281                 return 0;
7282
7283         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7284         if (!nest)
7285                 goto nla_put_failure;
7286         for (i = 0; i < req->n_ssids; i++) {
7287                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7288                         goto nla_put_failure;
7289         }
7290         nla_nest_end(msg, nest);
7291
7292         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7293         if (!nest)
7294                 goto nla_put_failure;
7295         for (i = 0; i < req->n_channels; i++) {
7296                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7297                         goto nla_put_failure;
7298         }
7299         nla_nest_end(msg, nest);
7300
7301         if (req->ie &&
7302             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7303                 goto nla_put_failure;
7304
7305         return 0;
7306  nla_put_failure:
7307         return -ENOBUFS;
7308 }
7309
7310 static int nl80211_send_scan_msg(struct sk_buff *msg,
7311                                  struct cfg80211_registered_device *rdev,
7312                                  struct net_device *netdev,
7313                                  u32 pid, u32 seq, int flags,
7314                                  u32 cmd)
7315 {
7316         void *hdr;
7317
7318         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
7319         if (!hdr)
7320                 return -1;
7321
7322         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7323             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7324                 goto nla_put_failure;
7325
7326         /* ignore errors and send incomplete event anyway */
7327         nl80211_add_scan_req(msg, rdev);
7328
7329         return genlmsg_end(msg, hdr);
7330
7331  nla_put_failure:
7332         genlmsg_cancel(msg, hdr);
7333         return -EMSGSIZE;
7334 }
7335
7336 static int
7337 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7338                             struct cfg80211_registered_device *rdev,
7339                             struct net_device *netdev,
7340                             u32 pid, u32 seq, int flags, u32 cmd)
7341 {
7342         void *hdr;
7343
7344         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
7345         if (!hdr)
7346                 return -1;
7347
7348         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7349             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7350                 goto nla_put_failure;
7351
7352         return genlmsg_end(msg, hdr);
7353
7354  nla_put_failure:
7355         genlmsg_cancel(msg, hdr);
7356         return -EMSGSIZE;
7357 }
7358
7359 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7360                              struct net_device *netdev)
7361 {
7362         struct sk_buff *msg;
7363
7364         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7365         if (!msg)
7366                 return;
7367
7368         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
7369                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7370                 nlmsg_free(msg);
7371                 return;
7372         }
7373
7374         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7375                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7376 }
7377
7378 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7379                             struct net_device *netdev)
7380 {
7381         struct sk_buff *msg;
7382
7383         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7384         if (!msg)
7385                 return;
7386
7387         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
7388                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7389                 nlmsg_free(msg);
7390                 return;
7391         }
7392
7393         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7394                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7395 }
7396
7397 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7398                                struct net_device *netdev)
7399 {
7400         struct sk_buff *msg;
7401
7402         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7403         if (!msg)
7404                 return;
7405
7406         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
7407                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7408                 nlmsg_free(msg);
7409                 return;
7410         }
7411
7412         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7413                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7414 }
7415
7416 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7417                                      struct net_device *netdev)
7418 {
7419         struct sk_buff *msg;
7420
7421         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7422         if (!msg)
7423                 return;
7424
7425         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7426                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7427                 nlmsg_free(msg);
7428                 return;
7429         }
7430
7431         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7432                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7433 }
7434
7435 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7436                              struct net_device *netdev, u32 cmd)
7437 {
7438         struct sk_buff *msg;
7439
7440         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7441         if (!msg)
7442                 return;
7443
7444         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7445                 nlmsg_free(msg);
7446                 return;
7447         }
7448
7449         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7450                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7451 }
7452
7453 /*
7454  * This can happen on global regulatory changes or device specific settings
7455  * based on custom world regulatory domains.
7456  */
7457 void nl80211_send_reg_change_event(struct regulatory_request *request)
7458 {
7459         struct sk_buff *msg;
7460         void *hdr;
7461
7462         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7463         if (!msg)
7464                 return;
7465
7466         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7467         if (!hdr) {
7468                 nlmsg_free(msg);
7469                 return;
7470         }
7471
7472         /* Userspace can always count this one always being set */
7473         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7474                 goto nla_put_failure;
7475
7476         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7477                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7478                                NL80211_REGDOM_TYPE_WORLD))
7479                         goto nla_put_failure;
7480         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7481                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7482                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7483                         goto nla_put_failure;
7484         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7485                    request->intersect) {
7486                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7487                                NL80211_REGDOM_TYPE_INTERSECTION))
7488                         goto nla_put_failure;
7489         } else {
7490                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7491                                NL80211_REGDOM_TYPE_COUNTRY) ||
7492                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7493                                    request->alpha2))
7494                         goto nla_put_failure;
7495         }
7496
7497         if (wiphy_idx_valid(request->wiphy_idx) &&
7498             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7499                 goto nla_put_failure;
7500
7501         genlmsg_end(msg, hdr);
7502
7503         rcu_read_lock();
7504         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7505                                 GFP_ATOMIC);
7506         rcu_read_unlock();
7507
7508         return;
7509
7510 nla_put_failure:
7511         genlmsg_cancel(msg, hdr);
7512         nlmsg_free(msg);
7513 }
7514
7515 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7516                                     struct net_device *netdev,
7517                                     const u8 *buf, size_t len,
7518                                     enum nl80211_commands cmd, gfp_t gfp)
7519 {
7520         struct sk_buff *msg;
7521         void *hdr;
7522
7523         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7524         if (!msg)
7525                 return;
7526
7527         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7528         if (!hdr) {
7529                 nlmsg_free(msg);
7530                 return;
7531         }
7532
7533         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7534             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7535             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7536                 goto nla_put_failure;
7537
7538         genlmsg_end(msg, hdr);
7539
7540         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7541                                 nl80211_mlme_mcgrp.id, gfp);
7542         return;
7543
7544  nla_put_failure:
7545         genlmsg_cancel(msg, hdr);
7546         nlmsg_free(msg);
7547 }
7548
7549 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
7550                           struct net_device *netdev, const u8 *buf,
7551                           size_t len, gfp_t gfp)
7552 {
7553         nl80211_send_mlme_event(rdev, netdev, buf, len,
7554                                 NL80211_CMD_AUTHENTICATE, gfp);
7555 }
7556
7557 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
7558                            struct net_device *netdev, const u8 *buf,
7559                            size_t len, gfp_t gfp)
7560 {
7561         nl80211_send_mlme_event(rdev, netdev, buf, len,
7562                                 NL80211_CMD_ASSOCIATE, gfp);
7563 }
7564
7565 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
7566                          struct net_device *netdev, const u8 *buf,
7567                          size_t len, gfp_t gfp)
7568 {
7569         nl80211_send_mlme_event(rdev, netdev, buf, len,
7570                                 NL80211_CMD_DEAUTHENTICATE, gfp);
7571 }
7572
7573 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
7574                            struct net_device *netdev, const u8 *buf,
7575                            size_t len, gfp_t gfp)
7576 {
7577         nl80211_send_mlme_event(rdev, netdev, buf, len,
7578                                 NL80211_CMD_DISASSOCIATE, gfp);
7579 }
7580
7581 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
7582                                 struct net_device *netdev, const u8 *buf,
7583                                 size_t len, gfp_t gfp)
7584 {
7585         nl80211_send_mlme_event(rdev, netdev, buf, len,
7586                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
7587 }
7588
7589 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
7590                                   struct net_device *netdev, const u8 *buf,
7591                                   size_t len, gfp_t gfp)
7592 {
7593         nl80211_send_mlme_event(rdev, netdev, buf, len,
7594                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
7595 }
7596
7597 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
7598                                       struct net_device *netdev, int cmd,
7599                                       const u8 *addr, gfp_t gfp)
7600 {
7601         struct sk_buff *msg;
7602         void *hdr;
7603
7604         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7605         if (!msg)
7606                 return;
7607
7608         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7609         if (!hdr) {
7610                 nlmsg_free(msg);
7611                 return;
7612         }
7613
7614         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7615             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7616             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
7617             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
7618                 goto nla_put_failure;
7619
7620         genlmsg_end(msg, hdr);
7621
7622         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7623                                 nl80211_mlme_mcgrp.id, gfp);
7624         return;
7625
7626  nla_put_failure:
7627         genlmsg_cancel(msg, hdr);
7628         nlmsg_free(msg);
7629 }
7630
7631 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
7632                                struct net_device *netdev, const u8 *addr,
7633                                gfp_t gfp)
7634 {
7635         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
7636                                   addr, gfp);
7637 }
7638
7639 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
7640                                 struct net_device *netdev, const u8 *addr,
7641                                 gfp_t gfp)
7642 {
7643         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
7644                                   addr, gfp);
7645 }
7646
7647 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
7648                                  struct net_device *netdev, const u8 *bssid,
7649                                  const u8 *req_ie, size_t req_ie_len,
7650                                  const u8 *resp_ie, size_t resp_ie_len,
7651                                  u16 status, gfp_t gfp)
7652 {
7653         struct sk_buff *msg;
7654         void *hdr;
7655
7656         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7657         if (!msg)
7658                 return;
7659
7660         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
7661         if (!hdr) {
7662                 nlmsg_free(msg);
7663                 return;
7664         }
7665
7666         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7667             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7668             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
7669             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
7670             (req_ie &&
7671              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
7672             (resp_ie &&
7673              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
7674                 goto nla_put_failure;
7675
7676         genlmsg_end(msg, hdr);
7677
7678         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7679                                 nl80211_mlme_mcgrp.id, gfp);
7680         return;
7681
7682  nla_put_failure:
7683         genlmsg_cancel(msg, hdr);
7684         nlmsg_free(msg);
7685
7686 }
7687
7688 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
7689                          struct net_device *netdev, const u8 *bssid,
7690                          const u8 *req_ie, size_t req_ie_len,
7691                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
7692 {
7693         struct sk_buff *msg;
7694         void *hdr;
7695
7696         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7697         if (!msg)
7698                 return;
7699
7700         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
7701         if (!hdr) {
7702                 nlmsg_free(msg);
7703                 return;
7704         }
7705
7706         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7707             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7708             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
7709             (req_ie &&
7710              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
7711             (resp_ie &&
7712              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
7713                 goto nla_put_failure;
7714
7715         genlmsg_end(msg, hdr);
7716
7717         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7718                                 nl80211_mlme_mcgrp.id, gfp);
7719         return;
7720
7721  nla_put_failure:
7722         genlmsg_cancel(msg, hdr);
7723         nlmsg_free(msg);
7724
7725 }
7726
7727 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
7728                                struct net_device *netdev, u16 reason,
7729                                const u8 *ie, size_t ie_len, bool from_ap)
7730 {
7731         struct sk_buff *msg;
7732         void *hdr;
7733
7734         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7735         if (!msg)
7736                 return;
7737
7738         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
7739         if (!hdr) {
7740                 nlmsg_free(msg);
7741                 return;
7742         }
7743
7744         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7745             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7746             (from_ap && reason &&
7747              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
7748             (from_ap &&
7749              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
7750             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
7751                 goto nla_put_failure;
7752
7753         genlmsg_end(msg, hdr);
7754
7755         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7756                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
7757         return;
7758
7759  nla_put_failure:
7760         genlmsg_cancel(msg, hdr);
7761         nlmsg_free(msg);
7762
7763 }
7764
7765 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
7766                              struct net_device *netdev, const u8 *bssid,
7767                              gfp_t gfp)
7768 {
7769         struct sk_buff *msg;
7770         void *hdr;
7771
7772         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7773         if (!msg)
7774                 return;
7775
7776         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
7777         if (!hdr) {
7778                 nlmsg_free(msg);
7779                 return;
7780         }
7781
7782         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7783             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7784             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
7785                 goto nla_put_failure;
7786
7787         genlmsg_end(msg, hdr);
7788
7789         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7790                                 nl80211_mlme_mcgrp.id, gfp);
7791         return;
7792
7793  nla_put_failure:
7794         genlmsg_cancel(msg, hdr);
7795         nlmsg_free(msg);
7796 }
7797
7798 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
7799                 struct net_device *netdev,
7800                 const u8 *macaddr, const u8* ie, u8 ie_len,
7801                 gfp_t gfp)
7802 {
7803         struct sk_buff *msg;
7804         void *hdr;
7805
7806         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7807         if (!msg)
7808                 return;
7809
7810         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
7811         if (!hdr) {
7812                 nlmsg_free(msg);
7813                 return;
7814         }
7815
7816         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7817             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7818             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
7819             (ie_len && ie &&
7820              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
7821                 goto nla_put_failure;
7822
7823         genlmsg_end(msg, hdr);
7824
7825         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7826                                 nl80211_mlme_mcgrp.id, gfp);
7827         return;
7828
7829  nla_put_failure:
7830         genlmsg_cancel(msg, hdr);
7831         nlmsg_free(msg);
7832 }
7833
7834 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
7835                                  struct net_device *netdev, const u8 *addr,
7836                                  enum nl80211_key_type key_type, int key_id,
7837                                  const u8 *tsc, gfp_t gfp)
7838 {
7839         struct sk_buff *msg;
7840         void *hdr;
7841
7842         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7843         if (!msg)
7844                 return;
7845
7846         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
7847         if (!hdr) {
7848                 nlmsg_free(msg);
7849                 return;
7850         }
7851
7852         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7853             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7854             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
7855             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
7856             (key_id != -1 &&
7857              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
7858             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
7859                 goto nla_put_failure;
7860
7861         genlmsg_end(msg, hdr);
7862
7863         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7864                                 nl80211_mlme_mcgrp.id, gfp);
7865         return;
7866
7867  nla_put_failure:
7868         genlmsg_cancel(msg, hdr);
7869         nlmsg_free(msg);
7870 }
7871
7872 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
7873                                     struct ieee80211_channel *channel_before,
7874                                     struct ieee80211_channel *channel_after)
7875 {
7876         struct sk_buff *msg;
7877         void *hdr;
7878         struct nlattr *nl_freq;
7879
7880         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
7881         if (!msg)
7882                 return;
7883
7884         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
7885         if (!hdr) {
7886                 nlmsg_free(msg);
7887                 return;
7888         }
7889
7890         /*
7891          * Since we are applying the beacon hint to a wiphy we know its
7892          * wiphy_idx is valid
7893          */
7894         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7895                 goto nla_put_failure;
7896
7897         /* Before */
7898         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
7899         if (!nl_freq)
7900                 goto nla_put_failure;
7901         if (nl80211_msg_put_channel(msg, channel_before))
7902                 goto nla_put_failure;
7903         nla_nest_end(msg, nl_freq);
7904
7905         /* After */
7906         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
7907         if (!nl_freq)
7908                 goto nla_put_failure;
7909         if (nl80211_msg_put_channel(msg, channel_after))
7910                 goto nla_put_failure;
7911         nla_nest_end(msg, nl_freq);
7912
7913         genlmsg_end(msg, hdr);
7914
7915         rcu_read_lock();
7916         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7917                                 GFP_ATOMIC);
7918         rcu_read_unlock();
7919
7920         return;
7921
7922 nla_put_failure:
7923         genlmsg_cancel(msg, hdr);
7924         nlmsg_free(msg);
7925 }
7926
7927 static void nl80211_send_remain_on_chan_event(
7928         int cmd, struct cfg80211_registered_device *rdev,
7929         struct net_device *netdev, u64 cookie,
7930         struct ieee80211_channel *chan,
7931         enum nl80211_channel_type channel_type,
7932         unsigned int duration, gfp_t gfp)
7933 {
7934         struct sk_buff *msg;
7935         void *hdr;
7936
7937         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7938         if (!msg)
7939                 return;
7940
7941         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7942         if (!hdr) {
7943                 nlmsg_free(msg);
7944                 return;
7945         }
7946
7947         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7948             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7949             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
7950             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
7951             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7952                 goto nla_put_failure;
7953
7954         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
7955             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
7956                 goto nla_put_failure;
7957
7958         genlmsg_end(msg, hdr);
7959
7960         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7961                                 nl80211_mlme_mcgrp.id, gfp);
7962         return;
7963
7964  nla_put_failure:
7965         genlmsg_cancel(msg, hdr);
7966         nlmsg_free(msg);
7967 }
7968
7969 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
7970                                     struct net_device *netdev, u64 cookie,
7971                                     struct ieee80211_channel *chan,
7972                                     enum nl80211_channel_type channel_type,
7973                                     unsigned int duration, gfp_t gfp)
7974 {
7975         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
7976                                           rdev, netdev, cookie, chan,
7977                                           channel_type, duration, gfp);
7978 }
7979
7980 void nl80211_send_remain_on_channel_cancel(
7981         struct cfg80211_registered_device *rdev, struct net_device *netdev,
7982         u64 cookie, struct ieee80211_channel *chan,
7983         enum nl80211_channel_type channel_type, gfp_t gfp)
7984 {
7985         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7986                                           rdev, netdev, cookie, chan,
7987                                           channel_type, 0, gfp);
7988 }
7989
7990 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
7991                             struct net_device *dev, const u8 *mac_addr,
7992                             struct station_info *sinfo, gfp_t gfp)
7993 {
7994         struct sk_buff *msg;
7995
7996         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7997         if (!msg)
7998                 return;
7999
8000         if (nl80211_send_station(msg, 0, 0, 0,
8001                                  rdev, dev, mac_addr, sinfo) < 0) {
8002                 nlmsg_free(msg);
8003                 return;
8004         }
8005
8006         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8007                                 nl80211_mlme_mcgrp.id, gfp);
8008 }
8009
8010 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8011                                 struct net_device *dev, const u8 *mac_addr,
8012                                 gfp_t gfp)
8013 {
8014         struct sk_buff *msg;
8015         void *hdr;
8016
8017         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8018         if (!msg)
8019                 return;
8020
8021         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8022         if (!hdr) {
8023                 nlmsg_free(msg);
8024                 return;
8025         }
8026
8027         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8028             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8029                 goto nla_put_failure;
8030
8031         genlmsg_end(msg, hdr);
8032
8033         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8034                                 nl80211_mlme_mcgrp.id, gfp);
8035         return;
8036
8037  nla_put_failure:
8038         genlmsg_cancel(msg, hdr);
8039         nlmsg_free(msg);
8040 }
8041
8042 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8043                                        const u8 *addr, gfp_t gfp)
8044 {
8045         struct wireless_dev *wdev = dev->ieee80211_ptr;
8046         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8047         struct sk_buff *msg;
8048         void *hdr;
8049         int err;
8050         u32 nlpid = ACCESS_ONCE(wdev->ap_unexpected_nlpid);
8051
8052         if (!nlpid)
8053                 return false;
8054
8055         msg = nlmsg_new(100, gfp);
8056         if (!msg)
8057                 return true;
8058
8059         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8060         if (!hdr) {
8061                 nlmsg_free(msg);
8062                 return true;
8063         }
8064
8065         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8066             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8067             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8068                 goto nla_put_failure;
8069
8070         err = genlmsg_end(msg, hdr);
8071         if (err < 0) {
8072                 nlmsg_free(msg);
8073                 return true;
8074         }
8075
8076         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
8077         return true;
8078
8079  nla_put_failure:
8080         genlmsg_cancel(msg, hdr);
8081         nlmsg_free(msg);
8082         return true;
8083 }
8084
8085 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8086 {
8087         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8088                                           addr, gfp);
8089 }
8090
8091 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8092                                     const u8 *addr, gfp_t gfp)
8093 {
8094         return __nl80211_unexpected_frame(dev,
8095                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8096                                           addr, gfp);
8097 }
8098
8099 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8100                       struct net_device *netdev, u32 nlpid,
8101                       int freq, int sig_dbm,
8102                       const u8 *buf, size_t len, gfp_t gfp)
8103 {
8104         struct sk_buff *msg;
8105         void *hdr;
8106
8107         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8108         if (!msg)
8109                 return -ENOMEM;
8110
8111         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8112         if (!hdr) {
8113                 nlmsg_free(msg);
8114                 return -ENOMEM;
8115         }
8116
8117         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8118             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8119             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8120             (sig_dbm &&
8121              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8122             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8123                 goto nla_put_failure;
8124
8125         genlmsg_end(msg, hdr);
8126
8127         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
8128
8129  nla_put_failure:
8130         genlmsg_cancel(msg, hdr);
8131         nlmsg_free(msg);
8132         return -ENOBUFS;
8133 }
8134
8135 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8136                                  struct net_device *netdev, u64 cookie,
8137                                  const u8 *buf, size_t len, bool ack,
8138                                  gfp_t gfp)
8139 {
8140         struct sk_buff *msg;
8141         void *hdr;
8142
8143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8144         if (!msg)
8145                 return;
8146
8147         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8148         if (!hdr) {
8149                 nlmsg_free(msg);
8150                 return;
8151         }
8152
8153         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8154             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8155             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8156             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8157             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8158                 goto nla_put_failure;
8159
8160         genlmsg_end(msg, hdr);
8161
8162         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8163         return;
8164
8165  nla_put_failure:
8166         genlmsg_cancel(msg, hdr);
8167         nlmsg_free(msg);
8168 }
8169
8170 void
8171 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8172                              struct net_device *netdev,
8173                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8174                              gfp_t gfp)
8175 {
8176         struct sk_buff *msg;
8177         struct nlattr *pinfoattr;
8178         void *hdr;
8179
8180         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8181         if (!msg)
8182                 return;
8183
8184         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8185         if (!hdr) {
8186                 nlmsg_free(msg);
8187                 return;
8188         }
8189
8190         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8191             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8192                 goto nla_put_failure;
8193
8194         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8195         if (!pinfoattr)
8196                 goto nla_put_failure;
8197
8198         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8199                         rssi_event))
8200                 goto nla_put_failure;
8201
8202         nla_nest_end(msg, pinfoattr);
8203
8204         genlmsg_end(msg, hdr);
8205
8206         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8207                                 nl80211_mlme_mcgrp.id, gfp);
8208         return;
8209
8210  nla_put_failure:
8211         genlmsg_cancel(msg, hdr);
8212         nlmsg_free(msg);
8213 }
8214
8215 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8216                               struct net_device *netdev, const u8 *bssid,
8217                               const u8 *replay_ctr, gfp_t gfp)
8218 {
8219         struct sk_buff *msg;
8220         struct nlattr *rekey_attr;
8221         void *hdr;
8222
8223         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8224         if (!msg)
8225                 return;
8226
8227         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8228         if (!hdr) {
8229                 nlmsg_free(msg);
8230                 return;
8231         }
8232
8233         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8234             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8235             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8236                 goto nla_put_failure;
8237
8238         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8239         if (!rekey_attr)
8240                 goto nla_put_failure;
8241
8242         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8243                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8244                 goto nla_put_failure;
8245
8246         nla_nest_end(msg, rekey_attr);
8247
8248         genlmsg_end(msg, hdr);
8249
8250         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8251                                 nl80211_mlme_mcgrp.id, gfp);
8252         return;
8253
8254  nla_put_failure:
8255         genlmsg_cancel(msg, hdr);
8256         nlmsg_free(msg);
8257 }
8258
8259 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8260                                     struct net_device *netdev, int index,
8261                                     const u8 *bssid, bool preauth, gfp_t gfp)
8262 {
8263         struct sk_buff *msg;
8264         struct nlattr *attr;
8265         void *hdr;
8266
8267         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8268         if (!msg)
8269                 return;
8270
8271         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8272         if (!hdr) {
8273                 nlmsg_free(msg);
8274                 return;
8275         }
8276
8277         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8278             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8279                 goto nla_put_failure;
8280
8281         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8282         if (!attr)
8283                 goto nla_put_failure;
8284
8285         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8286             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8287             (preauth &&
8288              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8289                 goto nla_put_failure;
8290
8291         nla_nest_end(msg, attr);
8292
8293         genlmsg_end(msg, hdr);
8294
8295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8296                                 nl80211_mlme_mcgrp.id, gfp);
8297         return;
8298
8299  nla_put_failure:
8300         genlmsg_cancel(msg, hdr);
8301         nlmsg_free(msg);
8302 }
8303
8304 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8305                               struct net_device *netdev, int freq,
8306                               enum nl80211_channel_type type, gfp_t gfp)
8307 {
8308         struct sk_buff *msg;
8309         void *hdr;
8310
8311         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8312         if (!msg)
8313                 return;
8314
8315         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8316         if (!hdr) {
8317                 nlmsg_free(msg);
8318                 return;
8319         }
8320
8321         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8322             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8323             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8324                 goto nla_put_failure;
8325
8326         genlmsg_end(msg, hdr);
8327
8328         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8329                                 nl80211_mlme_mcgrp.id, gfp);
8330         return;
8331
8332  nla_put_failure:
8333         genlmsg_cancel(msg, hdr);
8334         nlmsg_free(msg);
8335 }
8336
8337 void
8338 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8339                                 struct net_device *netdev, const u8 *peer,
8340                                 u32 num_packets, gfp_t gfp)
8341 {
8342         struct sk_buff *msg;
8343         struct nlattr *pinfoattr;
8344         void *hdr;
8345
8346         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8347         if (!msg)
8348                 return;
8349
8350         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8351         if (!hdr) {
8352                 nlmsg_free(msg);
8353                 return;
8354         }
8355
8356         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8357             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8358             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8359                 goto nla_put_failure;
8360
8361         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8362         if (!pinfoattr)
8363                 goto nla_put_failure;
8364
8365         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8366                 goto nla_put_failure;
8367
8368         nla_nest_end(msg, pinfoattr);
8369
8370         genlmsg_end(msg, hdr);
8371
8372         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8373                                 nl80211_mlme_mcgrp.id, gfp);
8374         return;
8375
8376  nla_put_failure:
8377         genlmsg_cancel(msg, hdr);
8378         nlmsg_free(msg);
8379 }
8380
8381 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8382                            u64 cookie, bool acked, gfp_t gfp)
8383 {
8384         struct wireless_dev *wdev = dev->ieee80211_ptr;
8385         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8386         struct sk_buff *msg;
8387         void *hdr;
8388         int err;
8389
8390         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8391         if (!msg)
8392                 return;
8393
8394         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8395         if (!hdr) {
8396                 nlmsg_free(msg);
8397                 return;
8398         }
8399
8400         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8401             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8402             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8403             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8404             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8405                 goto nla_put_failure;
8406
8407         err = genlmsg_end(msg, hdr);
8408         if (err < 0) {
8409                 nlmsg_free(msg);
8410                 return;
8411         }
8412
8413         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8414                                 nl80211_mlme_mcgrp.id, gfp);
8415         return;
8416
8417  nla_put_failure:
8418         genlmsg_cancel(msg, hdr);
8419         nlmsg_free(msg);
8420 }
8421 EXPORT_SYMBOL(cfg80211_probe_status);
8422
8423 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8424                                  const u8 *frame, size_t len,
8425                                  int freq, int sig_dbm, gfp_t gfp)
8426 {
8427         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8428         struct sk_buff *msg;
8429         void *hdr;
8430         u32 nlpid = ACCESS_ONCE(rdev->ap_beacons_nlpid);
8431
8432         if (!nlpid)
8433                 return;
8434
8435         msg = nlmsg_new(len + 100, gfp);
8436         if (!msg)
8437                 return;
8438
8439         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8440         if (!hdr) {
8441                 nlmsg_free(msg);
8442                 return;
8443         }
8444
8445         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8446             (freq &&
8447              nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
8448             (sig_dbm &&
8449              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8450             nla_put(msg, NL80211_ATTR_FRAME, len, frame))
8451                 goto nla_put_failure;
8452
8453         genlmsg_end(msg, hdr);
8454
8455         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
8456         return;
8457
8458  nla_put_failure:
8459         genlmsg_cancel(msg, hdr);
8460         nlmsg_free(msg);
8461 }
8462 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
8463
8464 static int nl80211_netlink_notify(struct notifier_block * nb,
8465                                   unsigned long state,
8466                                   void *_notify)
8467 {
8468         struct netlink_notify *notify = _notify;
8469         struct cfg80211_registered_device *rdev;
8470         struct wireless_dev *wdev;
8471
8472         if (state != NETLINK_URELEASE)
8473                 return NOTIFY_DONE;
8474
8475         rcu_read_lock();
8476
8477         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8478                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
8479                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
8480                 if (rdev->ap_beacons_nlpid == notify->pid)
8481                         rdev->ap_beacons_nlpid = 0;
8482         }
8483
8484         rcu_read_unlock();
8485
8486         return NOTIFY_DONE;
8487 }
8488
8489 static struct notifier_block nl80211_netlink_notifier = {
8490         .notifier_call = nl80211_netlink_notify,
8491 };
8492
8493 /* initialisation/exit functions */
8494
8495 int nl80211_init(void)
8496 {
8497         int err;
8498
8499         err = genl_register_family_with_ops(&nl80211_fam,
8500                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
8501         if (err)
8502                 return err;
8503
8504         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
8505         if (err)
8506                 goto err_out;
8507
8508         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
8509         if (err)
8510                 goto err_out;
8511
8512         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
8513         if (err)
8514                 goto err_out;
8515
8516         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
8517         if (err)
8518                 goto err_out;
8519
8520 #ifdef CONFIG_NL80211_TESTMODE
8521         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
8522         if (err)
8523                 goto err_out;
8524 #endif
8525
8526         err = netlink_register_notifier(&nl80211_netlink_notifier);
8527         if (err)
8528                 goto err_out;
8529
8530         return 0;
8531  err_out:
8532         genl_unregister_family(&nl80211_fam);
8533         return err;
8534 }
8535
8536 void nl80211_exit(void)
8537 {
8538         netlink_unregister_notifier(&nl80211_netlink_notifier);
8539         genl_unregister_family(&nl80211_fam);
8540 }