net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 193 };
 194
 195 /* policy for the key attributes */
 196 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 197         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 198         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 199         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 200         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 201         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 202         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 203         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 204         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 205 };
 206
 207 /* policy for the key default flags */
 208 static const struct nla_policy
 209 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 210         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 211         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 212 };
 213
 214 /* policy for WoWLAN attributes */
 215 static const struct nla_policy
 216 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 217         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 218         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 219         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 220         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 221         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 222         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 223         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 224         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 225 };
 226
 227 /* policy for GTK rekey offload attributes */
 228 static const struct nla_policy
 229 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 230         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 231         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 232         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 233 };
 234
 235 /* ifidx get helper */
 236 static int nl80211_get_ifidx(struct netlink_callback *cb)
 237 {
 238         int res;
 239
 240         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 241                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 242                           nl80211_policy);
 243         if (res)
 244                 return res;
 245
 246         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 247                 return -EINVAL;
 248
 249         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 250         if (!res)
 251                 return -EINVAL;
 252         return res;
 253 }
 254
 255 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 256                                        struct netlink_callback *cb,
 257                                        struct cfg80211_registered_device **rdev,
 258                                        struct net_device **dev)
 259 {
 260         int ifidx = cb->args[0];
 261         int err;
 262
 263         if (!ifidx)
 264                 ifidx = nl80211_get_ifidx(cb);
 265         if (ifidx < 0)
 266                 return ifidx;
 267
 268         cb->args[0] = ifidx;
 269
 270         rtnl_lock();
 271
 272         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 273         if (!*dev) {
 274                 err = -ENODEV;
 275                 goto out_rtnl;
 276         }
 277
 278         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 279         if (IS_ERR(*rdev)) {
 280                 err = PTR_ERR(*rdev);
 281                 goto out_rtnl;
 282         }
 283
 284         return 0;
 285  out_rtnl:
 286         rtnl_unlock();
 287         return err;
 288 }
 289
 290 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 291 {
 292         cfg80211_unlock_rdev(rdev);
 293         rtnl_unlock();
 294 }
 295
 296 /* IE validation */
 297 static bool is_valid_ie_attr(const struct nlattr *attr)
 298 {
 299         const u8 *pos;
 300         int len;
 301
 302         if (!attr)
 303                 return true;
 304
 305         pos = nla_data(attr);
 306         len = nla_len(attr);
 307
 308         while (len) {
 309                 u8 elemlen;
 310
 311                 if (len < 2)
 312                         return false;
 313                 len -= 2;
 314
 315                 elemlen = pos[1];
 316                 if (elemlen > len)
 317                         return false;
 318
 319                 len -= elemlen;
 320                 pos += 2 + elemlen;
 321         }
 322
 323         return true;
 324 }
 325
 326 /* message building helper */
 327 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 328                                    int flags, u8 cmd)
 329 {
 330         /* since there is no private header just add the generic one */
 331         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 332 }
 333
 334 static int nl80211_msg_put_channel(struct sk_buff *msg,
 335                                    struct ieee80211_channel *chan)
 336 {
 337         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 338                     chan->center_freq);
 339
 340         if (chan->flags & IEEE80211_CHAN_DISABLED)
 341                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 342         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 343                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 344         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 345                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 346         if (chan->flags & IEEE80211_CHAN_RADAR)
 347                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 348
 349         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 350                     DBM_TO_MBM(chan->max_power));
 351
 352         return 0;
 353
 354  nla_put_failure:
 355         return -ENOBUFS;
 356 }
 357
 358 /* netlink command implementations */
 359
 360 struct key_parse {
 361         struct key_params p;
 362         int idx;
 363         int type;
 364         bool def, defmgmt;
 365         bool def_uni, def_multi;
 366 };
 367
 368 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 369 {
 370         struct nlattr *tb[NL80211_KEY_MAX + 1];
 371         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 372                                    nl80211_key_policy);
 373         if (err)
 374                 return err;
 375
 376         k->def = !!tb[NL80211_KEY_DEFAULT];
 377         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 378
 379         if (k->def) {
 380                 k->def_uni = true;
 381                 k->def_multi = true;
 382         }
 383         if (k->defmgmt)
 384                 k->def_multi = true;
 385
 386         if (tb[NL80211_KEY_IDX])
 387                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 388
 389         if (tb[NL80211_KEY_DATA]) {
 390                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 391                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 392         }
 393
 394         if (tb[NL80211_KEY_SEQ]) {
 395                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 396                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 397         }
 398
 399         if (tb[NL80211_KEY_CIPHER])
 400                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 401
 402         if (tb[NL80211_KEY_TYPE]) {
 403                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 404                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 405                         return -EINVAL;
 406         }
 407
 408         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 409                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 410                 int err = nla_parse_nested(kdt,
 411                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 412                                            tb[NL80211_KEY_DEFAULT_TYPES],
 413                                            nl80211_key_default_policy);
 414                 if (err)
 415                         return err;
 416
 417                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 418                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 419         }
 420
 421         return 0;
 422 }
 423
 424 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 425 {
 426         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 427                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 428                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 429         }
 430
 431         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 432                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 433                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 434         }
 435
 436         if (info->attrs[NL80211_ATTR_KEY_IDX])
 437                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 438
 439         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 440                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 441
 442         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 443         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 444
 445         if (k->def) {
 446                 k->def_uni = true;
 447                 k->def_multi = true;
 448         }
 449         if (k->defmgmt)
 450                 k->def_multi = true;
 451
 452         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 453                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 454                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 455                         return -EINVAL;
 456         }
 457
 458         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 459                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 460                 int err = nla_parse_nested(
 461                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 462                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 463                                 nl80211_key_default_policy);
 464                 if (err)
 465                         return err;
 466
 467                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 468                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 469         }
 470
 471         return 0;
 472 }
 473
 474 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 475 {
 476         int err;
 477
 478         memset(k, 0, sizeof(*k));
 479         k->idx = -1;
 480         k->type = -1;
 481
 482         if (info->attrs[NL80211_ATTR_KEY])
 483                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 484         else
 485                 err = nl80211_parse_key_old(info, k);
 486
 487         if (err)
 488                 return err;
 489
 490         if (k->def && k->defmgmt)
 491                 return -EINVAL;
 492
 493         if (k->defmgmt) {
 494                 if (k->def_uni || !k->def_multi)
 495                         return -EINVAL;
 496         }
 497
 498         if (k->idx != -1) {
 499                 if (k->defmgmt) {
 500                         if (k->idx < 4 || k->idx > 5)
 501                                 return -EINVAL;
 502                 } else if (k->def) {
 503                         if (k->idx < 0 || k->idx > 3)
 504                                 return -EINVAL;
 505                 } else {
 506                         if (k->idx < 0 || k->idx > 5)
 507                                 return -EINVAL;
 508                 }
 509         }
 510
 511         return 0;
 512 }
 513
 514 static struct cfg80211_cached_keys *
 515 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 516                        struct nlattr *keys)
 517 {
 518         struct key_parse parse;
 519         struct nlattr *key;
 520         struct cfg80211_cached_keys *result;
 521         int rem, err, def = 0;
 522
 523         result = kzalloc(sizeof(*result), GFP_KERNEL);
 524         if (!result)
 525                 return ERR_PTR(-ENOMEM);
 526
 527         result->def = -1;
 528         result->defmgmt = -1;
 529
 530         nla_for_each_nested(key, keys, rem) {
 531                 memset(&parse, 0, sizeof(parse));
 532                 parse.idx = -1;
 533
 534                 err = nl80211_parse_key_new(key, &parse);
 535                 if (err)
 536                         goto error;
 537                 err = -EINVAL;
 538                 if (!parse.p.key)
 539                         goto error;
 540                 if (parse.idx < 0 || parse.idx > 4)
 541                         goto error;
 542                 if (parse.def) {
 543                         if (def)
 544                                 goto error;
 545                         def = 1;
 546                         result->def = parse.idx;
 547                         if (!parse.def_uni || !parse.def_multi)
 548                                 goto error;
 549                 } else if (parse.defmgmt)
 550                         goto error;
 551                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 552                                                      parse.idx, false, NULL);
 553                 if (err)
 554                         goto error;
 555                 result->params[parse.idx].cipher = parse.p.cipher;
 556                 result->params[parse.idx].key_len = parse.p.key_len;
 557                 result->params[parse.idx].key = result->data[parse.idx];
 558                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 559         }
 560
 561         return result;
 562  error:
 563         kfree(result);
 564         return ERR_PTR(err);
 565 }
 566
 567 static int nl80211_key_allowed(struct wireless_dev *wdev)
 568 {
 569         ASSERT_WDEV_LOCK(wdev);
 570
 571         switch (wdev->iftype) {
 572         case NL80211_IFTYPE_AP:
 573         case NL80211_IFTYPE_AP_VLAN:
 574         case NL80211_IFTYPE_P2P_GO:
 575         case NL80211_IFTYPE_MESH_POINT:
 576                 break;
 577         case NL80211_IFTYPE_ADHOC:
 578                 if (!wdev->current_bss)
 579                         return -ENOLINK;
 580                 break;
 581         case NL80211_IFTYPE_STATION:
 582         case NL80211_IFTYPE_P2P_CLIENT:
 583                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 584                         return -ENOLINK;
 585                 break;
 586         default:
 587                 return -EINVAL;
 588         }
 589
 590         return 0;
 591 }
 592
 593 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 594 {
 595         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 596         int i;
 597
 598         if (!nl_modes)
 599                 goto nla_put_failure;
 600
 601         i = 0;
 602         while (ifmodes) {
 603                 if (ifmodes & 1)
 604                         NLA_PUT_FLAG(msg, i);
 605                 ifmodes >>= 1;
 606                 i++;
 607         }
 608
 609         nla_nest_end(msg, nl_modes);
 610         return 0;
 611
 612 nla_put_failure:
 613         return -ENOBUFS;
 614 }
 615
 616 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 617                                           struct sk_buff *msg)
 618 {
 619         struct nlattr *nl_combis;
 620         int i, j;
 621
 622         nl_combis = nla_nest_start(msg,
 623                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 624         if (!nl_combis)
 625                 goto nla_put_failure;
 626
 627         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 628                 const struct ieee80211_iface_combination *c;
 629                 struct nlattr *nl_combi, *nl_limits;
 630
 631                 c = &wiphy->iface_combinations[i];
 632
 633                 nl_combi = nla_nest_start(msg, i + 1);
 634                 if (!nl_combi)
 635                         goto nla_put_failure;
 636
 637                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 638                 if (!nl_limits)
 639                         goto nla_put_failure;
 640
 641                 for (j = 0; j < c->n_limits; j++) {
 642                         struct nlattr *nl_limit;
 643
 644                         nl_limit = nla_nest_start(msg, j + 1);
 645                         if (!nl_limit)
 646                                 goto nla_put_failure;
 647                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 648                                     c->limits[j].max);
 649                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 650                                                 c->limits[j].types))
 651                                 goto nla_put_failure;
 652                         nla_nest_end(msg, nl_limit);
 653                 }
 654
 655                 nla_nest_end(msg, nl_limits);
 656
 657                 if (c->beacon_int_infra_match)
 658                         NLA_PUT_FLAG(msg,
 659                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 660                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 661                             c->num_different_channels);
 662                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 663                             c->max_interfaces);
 664
 665                 nla_nest_end(msg, nl_combi);
 666         }
 667
 668         nla_nest_end(msg, nl_combis);
 669
 670         return 0;
 671 nla_put_failure:
 672         return -ENOBUFS;
 673 }
 674
 675 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 676                               struct cfg80211_registered_device *dev)
 677 {
 678         void *hdr;
 679         struct nlattr *nl_bands, *nl_band;
 680         struct nlattr *nl_freqs, *nl_freq;
 681         struct nlattr *nl_rates, *nl_rate;
 682         struct nlattr *nl_cmds;
 683         enum ieee80211_band band;
 684         struct ieee80211_channel *chan;
 685         struct ieee80211_rate *rate;
 686         int i;
 687         const struct ieee80211_txrx_stypes *mgmt_stypes =
 688                                 dev->wiphy.mgmt_stypes;
 689
 690         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 691         if (!hdr)
 692                 return -1;
 693
 694         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 695         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 696
 697         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 698                     cfg80211_rdev_list_generation);
 699
 700         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 701                    dev->wiphy.retry_short);
 702         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 703                    dev->wiphy.retry_long);
 704         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 705                     dev->wiphy.frag_threshold);
 706         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 707                     dev->wiphy.rts_threshold);
 708         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 709                     dev->wiphy.coverage_class);
 710         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 711                    dev->wiphy.max_scan_ssids);
 712         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 713                    dev->wiphy.max_sched_scan_ssids);
 714         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 715                     dev->wiphy.max_scan_ie_len);
 716         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 717                     dev->wiphy.max_sched_scan_ie_len);
 718
 719         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 720                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 721         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 722                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 723         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 724                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 725
 726         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 727                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 728
 729         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 730                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 731                 dev->wiphy.cipher_suites);
 732
 733         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 734                    dev->wiphy.max_num_pmkids);
 735
 736         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 737                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 738
 739         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 740                     dev->wiphy.available_antennas_tx);
 741         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 742                     dev->wiphy.available_antennas_rx);
 743
 744         if ((dev->wiphy.available_antennas_tx ||
 745              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 746                 u32 tx_ant = 0, rx_ant = 0;
 747                 int res;
 748                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 749                 if (!res) {
 750                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 751                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 752                 }
 753         }
 754
 755         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 756                                 dev->wiphy.interface_modes))
 757                 goto nla_put_failure;
 758
 759         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 760         if (!nl_bands)
 761                 goto nla_put_failure;
 762
 763         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 764                 if (!dev->wiphy.bands[band])
 765                         continue;
 766
 767                 nl_band = nla_nest_start(msg, band);
 768                 if (!nl_band)
 769                         goto nla_put_failure;
 770
 771                 /* add HT info */
 772                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 773                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 774                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 775                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 776                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 777                                 dev->wiphy.bands[band]->ht_cap.cap);
 778                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 779                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 780                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 781                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 782                 }
 783
 784                 /* add frequencies */
 785                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 786                 if (!nl_freqs)
 787                         goto nla_put_failure;
 788
 789                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 790                         nl_freq = nla_nest_start(msg, i);
 791                         if (!nl_freq)
 792                                 goto nla_put_failure;
 793
 794                         chan = &dev->wiphy.bands[band]->channels[i];
 795
 796                         if (nl80211_msg_put_channel(msg, chan))
 797                                 goto nla_put_failure;
 798
 799                         nla_nest_end(msg, nl_freq);
 800                 }
 801
 802                 nla_nest_end(msg, nl_freqs);
 803
 804                 /* add bitrates */
 805                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 806                 if (!nl_rates)
 807                         goto nla_put_failure;
 808
 809                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 810                         nl_rate = nla_nest_start(msg, i);
 811                         if (!nl_rate)
 812                                 goto nla_put_failure;
 813
 814                         rate = &dev->wiphy.bands[band]->bitrates[i];
 815                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 816                                     rate->bitrate);
 817                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 818                                 NLA_PUT_FLAG(msg,
 819                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 820
 821                         nla_nest_end(msg, nl_rate);
 822                 }
 823
 824                 nla_nest_end(msg, nl_rates);
 825
 826                 nla_nest_end(msg, nl_band);
 827         }
 828         nla_nest_end(msg, nl_bands);
 829
 830         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 831         if (!nl_cmds)
 832                 goto nla_put_failure;
 833
 834         i = 0;
 835 #define CMD(op, n)                                              \
 836          do {                                                   \
 837                 if (dev->ops->op) {                             \
 838                         i++;                                    \
 839                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 840                 }                                               \
 841         } while (0)
 842
 843         CMD(add_virtual_intf, NEW_INTERFACE);
 844         CMD(change_virtual_intf, SET_INTERFACE);
 845         CMD(add_key, NEW_KEY);
 846         CMD(add_beacon, NEW_BEACON);
 847         CMD(add_station, NEW_STATION);
 848         CMD(add_mpath, NEW_MPATH);
 849         CMD(update_mesh_config, SET_MESH_CONFIG);
 850         CMD(change_bss, SET_BSS);
 851         CMD(auth, AUTHENTICATE);
 852         CMD(assoc, ASSOCIATE);
 853         CMD(deauth, DEAUTHENTICATE);
 854         CMD(disassoc, DISASSOCIATE);
 855         CMD(join_ibss, JOIN_IBSS);
 856         CMD(join_mesh, JOIN_MESH);
 857         CMD(set_pmksa, SET_PMKSA);
 858         CMD(del_pmksa, DEL_PMKSA);
 859         CMD(flush_pmksa, FLUSH_PMKSA);
 860         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 861         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 862         CMD(mgmt_tx, FRAME);
 863         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 864         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 865                 i++;
 866                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 867         }
 868         CMD(set_channel, SET_CHANNEL);
 869         CMD(set_wds_peer, SET_WDS_PEER);
 870         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 871                 CMD(sched_scan_start, START_SCHED_SCAN);
 872
 873 #undef CMD
 874
 875         if (dev->ops->connect || dev->ops->auth) {
 876                 i++;
 877                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 878         }
 879
 880         if (dev->ops->disconnect || dev->ops->deauth) {
 881                 i++;
 882                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 883         }
 884
 885         nla_nest_end(msg, nl_cmds);
 886
 887         if (dev->ops->remain_on_channel)
 888                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 889                             dev->wiphy.max_remain_on_channel_duration);
 890
 891         if (dev->ops->mgmt_tx_cancel_wait)
 892                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 893
 894         if (mgmt_stypes) {
 895                 u16 stypes;
 896                 struct nlattr *nl_ftypes, *nl_ifs;
 897                 enum nl80211_iftype ift;
 898
 899                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 900                 if (!nl_ifs)
 901                         goto nla_put_failure;
 902
 903                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 904                         nl_ftypes = nla_nest_start(msg, ift);
 905                         if (!nl_ftypes)
 906                                 goto nla_put_failure;
 907                         i = 0;
 908                         stypes = mgmt_stypes[ift].tx;
 909                         while (stypes) {
 910                                 if (stypes & 1)
 911                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 912                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 913                                 stypes >>= 1;
 914                                 i++;
 915                         }
 916                         nla_nest_end(msg, nl_ftypes);
 917                 }
 918
 919                 nla_nest_end(msg, nl_ifs);
 920
 921                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 922                 if (!nl_ifs)
 923                         goto nla_put_failure;
 924
 925                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 926                         nl_ftypes = nla_nest_start(msg, ift);
 927                         if (!nl_ftypes)
 928                                 goto nla_put_failure;
 929                         i = 0;
 930                         stypes = mgmt_stypes[ift].rx;
 931                         while (stypes) {
 932                                 if (stypes & 1)
 933                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 934                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 935                                 stypes >>= 1;
 936                                 i++;
 937                         }
 938                         nla_nest_end(msg, nl_ftypes);
 939                 }
 940                 nla_nest_end(msg, nl_ifs);
 941         }
 942
 943         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 944                 struct nlattr *nl_wowlan;
 945
 946                 nl_wowlan = nla_nest_start(msg,
 947                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 948                 if (!nl_wowlan)
 949                         goto nla_put_failure;
 950
 951                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 952                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 953                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 954                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 955                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 956                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 957                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 958                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 959                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 960                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 961                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 962                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 963                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 964                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 965                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 966                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 967                 if (dev->wiphy.wowlan.n_patterns) {
 968                         struct nl80211_wowlan_pattern_support pat = {
 969                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 970                                 .min_pattern_len =
 971                                         dev->wiphy.wowlan.pattern_min_len,
 972                                 .max_pattern_len =
 973                                         dev->wiphy.wowlan.pattern_max_len,
 974                         };
 975                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 976                                 sizeof(pat), &pat);
 977                 }
 978
 979                 nla_nest_end(msg, nl_wowlan);
 980         }
 981
 982         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 983                                 dev->wiphy.software_iftypes))
 984                 goto nla_put_failure;
 985
 986         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 987                 goto nla_put_failure;
 988
 989         return genlmsg_end(msg, hdr);
 990
 991  nla_put_failure:
 992         genlmsg_cancel(msg, hdr);
 993         return -EMSGSIZE;
 994 }
 995
 996 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 997 {
 998         int idx = 0;
 999         int start = cb->args[0];
1000         struct cfg80211_registered_device *dev;
1001
1002         mutex_lock(&cfg80211_mutex);
1003         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1004                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1005                         continue;
1006                 if (++idx <= start)
1007                         continue;
1008                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1009                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1010                                        dev) < 0) {
1011                         idx--;
1012                         break;
1013                 }
1014         }
1015         mutex_unlock(&cfg80211_mutex);
1016
1017         cb->args[0] = idx;
1018
1019         return skb->len;
1020 }
1021
1022 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1023 {
1024         struct sk_buff *msg;
1025         struct cfg80211_registered_device *dev = info->user_ptr[0];
1026
1027         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1028         if (!msg)
1029                 return -ENOMEM;
1030
1031         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1032                 nlmsg_free(msg);
1033                 return -ENOBUFS;
1034         }
1035
1036         return genlmsg_reply(msg, info);
1037 }
1038
1039 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1040         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1041         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1042         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1043         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1044         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1045 };
1046
1047 static int parse_txq_params(struct nlattr *tb[],
1048                             struct ieee80211_txq_params *txq_params)
1049 {
1050         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1051             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1052             !tb[NL80211_TXQ_ATTR_AIFS])
1053                 return -EINVAL;
1054
1055         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1056         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1057         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1058         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1059         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1060
1061         return 0;
1062 }
1063
1064 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1065 {
1066         /*
1067          * You can only set the channel explicitly for AP, mesh
1068          * and WDS type interfaces; all others have their channel
1069          * managed via their respective "establish a connection"
1070          * command (connect, join, ...)
1071          *
1072          * Monitors are special as they are normally slaved to
1073          * whatever else is going on, so they behave as though
1074          * you tried setting the wiphy channel itself.
1075          */
1076         return !wdev ||
1077                 wdev->iftype == NL80211_IFTYPE_AP ||
1078                 wdev->iftype == NL80211_IFTYPE_WDS ||
1079                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1080                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1081                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1082 }
1083
1084 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1085                                  struct wireless_dev *wdev,
1086                                  struct genl_info *info)
1087 {
1088         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1089         u32 freq;
1090         int result;
1091
1092         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1093                 return -EINVAL;
1094
1095         if (!nl80211_can_set_dev_channel(wdev))
1096                 return -EOPNOTSUPP;
1097
1098         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1099                 channel_type = nla_get_u32(info->attrs[
1100                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1101                 if (channel_type != NL80211_CHAN_NO_HT &&
1102                     channel_type != NL80211_CHAN_HT20 &&
1103                     channel_type != NL80211_CHAN_HT40PLUS &&
1104                     channel_type != NL80211_CHAN_HT40MINUS)
1105                         return -EINVAL;
1106         }
1107
1108         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1109
1110         mutex_lock(&rdev->devlist_mtx);
1111         if (wdev) {
1112                 wdev_lock(wdev);
1113                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1114                 wdev_unlock(wdev);
1115         } else {
1116                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1117         }
1118         mutex_unlock(&rdev->devlist_mtx);
1119
1120         return result;
1121 }
1122
1123 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1124 {
1125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1126         struct net_device *netdev = info->user_ptr[1];
1127
1128         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1129 }
1130
1131 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1132 {
1133         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1134         struct net_device *dev = info->user_ptr[1];
1135         struct wireless_dev *wdev = dev->ieee80211_ptr;
1136         const u8 *bssid;
1137
1138         if (!info->attrs[NL80211_ATTR_MAC])
1139                 return -EINVAL;
1140
1141         if (netif_running(dev))
1142                 return -EBUSY;
1143
1144         if (!rdev->ops->set_wds_peer)
1145                 return -EOPNOTSUPP;
1146
1147         if (wdev->iftype != NL80211_IFTYPE_WDS)
1148                 return -EOPNOTSUPP;
1149
1150         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1151         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1152 }
1153
1154
1155 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1156 {
1157         struct cfg80211_registered_device *rdev;
1158         struct net_device *netdev = NULL;
1159         struct wireless_dev *wdev;
1160         int result = 0, rem_txq_params = 0;
1161         struct nlattr *nl_txq_params;
1162         u32 changed;
1163         u8 retry_short = 0, retry_long = 0;
1164         u32 frag_threshold = 0, rts_threshold = 0;
1165         u8 coverage_class = 0;
1166
1167         /*
1168          * Try to find the wiphy and netdev. Normally this
1169          * function shouldn't need the netdev, but this is
1170          * done for backward compatibility -- previously
1171          * setting the channel was done per wiphy, but now
1172          * it is per netdev. Previous userland like hostapd
1173          * also passed a netdev to set_wiphy, so that it is
1174          * possible to let that go to the right netdev!
1175          */
1176         mutex_lock(&cfg80211_mutex);
1177
1178         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1179                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1180
1181                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1182                 if (netdev && netdev->ieee80211_ptr) {
1183                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1184                         mutex_lock(&rdev->mtx);
1185                 } else
1186                         netdev = NULL;
1187         }
1188
1189         if (!netdev) {
1190                 rdev = __cfg80211_rdev_from_info(info);
1191                 if (IS_ERR(rdev)) {
1192                         mutex_unlock(&cfg80211_mutex);
1193                         return PTR_ERR(rdev);
1194                 }
1195                 wdev = NULL;
1196                 netdev = NULL;
1197                 result = 0;
1198
1199                 mutex_lock(&rdev->mtx);
1200         } else if (netif_running(netdev) &&
1201                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1202                 wdev = netdev->ieee80211_ptr;
1203         else
1204                 wdev = NULL;
1205
1206         /*
1207          * end workaround code, by now the rdev is available
1208          * and locked, and wdev may or may not be NULL.
1209          */
1210
1211         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1212                 result = cfg80211_dev_rename(
1213                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1214
1215         mutex_unlock(&cfg80211_mutex);
1216
1217         if (result)
1218                 goto bad_res;
1219
1220         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1221                 struct ieee80211_txq_params txq_params;
1222                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1223
1224                 if (!rdev->ops->set_txq_params) {
1225                         result = -EOPNOTSUPP;
1226                         goto bad_res;
1227                 }
1228
1229                 nla_for_each_nested(nl_txq_params,
1230                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1231                                     rem_txq_params) {
1232                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1233                                   nla_data(nl_txq_params),
1234                                   nla_len(nl_txq_params),
1235                                   txq_params_policy);
1236                         result = parse_txq_params(tb, &txq_params);
1237                         if (result)
1238                                 goto bad_res;
1239
1240                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1241                                                            &txq_params);
1242                         if (result)
1243                                 goto bad_res;
1244                 }
1245         }
1246
1247         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1248                 result = __nl80211_set_channel(rdev, wdev, info);
1249                 if (result)
1250                         goto bad_res;
1251         }
1252
1253         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1254                 enum nl80211_tx_power_setting type;
1255                 int idx, mbm = 0;
1256
1257                 if (!rdev->ops->set_tx_power) {
1258                         result = -EOPNOTSUPP;
1259                         goto bad_res;
1260                 }
1261
1262                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1263                 type = nla_get_u32(info->attrs[idx]);
1264
1265                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1266                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1267                         result = -EINVAL;
1268                         goto bad_res;
1269                 }
1270
1271                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1272                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1273                         mbm = nla_get_u32(info->attrs[idx]);
1274                 }
1275
1276                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1277                 if (result)
1278                         goto bad_res;
1279         }
1280
1281         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1282             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1283                 u32 tx_ant, rx_ant;
1284                 if ((!rdev->wiphy.available_antennas_tx &&
1285                      !rdev->wiphy.available_antennas_rx) ||
1286                     !rdev->ops->set_antenna) {
1287                         result = -EOPNOTSUPP;
1288                         goto bad_res;
1289                 }
1290
1291                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1292                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1293
1294                 /* reject antenna configurations which don't match the
1295                  * available antenna masks, except for the "all" mask */
1296                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1297                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1298                         result = -EINVAL;
1299                         goto bad_res;
1300                 }
1301
1302                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1303                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1304
1305                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1306                 if (result)
1307                         goto bad_res;
1308         }
1309
1310         changed = 0;
1311
1312         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1313                 retry_short = nla_get_u8(
1314                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1315                 if (retry_short == 0) {
1316                         result = -EINVAL;
1317                         goto bad_res;
1318                 }
1319                 changed |= WIPHY_PARAM_RETRY_SHORT;
1320         }
1321
1322         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1323                 retry_long = nla_get_u8(
1324                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1325                 if (retry_long == 0) {
1326                         result = -EINVAL;
1327                         goto bad_res;
1328                 }
1329                 changed |= WIPHY_PARAM_RETRY_LONG;
1330         }
1331
1332         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1333                 frag_threshold = nla_get_u32(
1334                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1335                 if (frag_threshold < 256) {
1336                         result = -EINVAL;
1337                         goto bad_res;
1338                 }
1339                 if (frag_threshold != (u32) -1) {
1340                         /*
1341                          * Fragments (apart from the last one) are required to
1342                          * have even length. Make the fragmentation code
1343                          * simpler by stripping LSB should someone try to use
1344                          * odd threshold value.
1345                          */
1346                         frag_threshold &= ~0x1;
1347                 }
1348                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1349         }
1350
1351         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1352                 rts_threshold = nla_get_u32(
1353                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1354                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1355         }
1356
1357         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1358                 coverage_class = nla_get_u8(
1359                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1360                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1361         }
1362
1363         if (changed) {
1364                 u8 old_retry_short, old_retry_long;
1365                 u32 old_frag_threshold, old_rts_threshold;
1366                 u8 old_coverage_class;
1367
1368                 if (!rdev->ops->set_wiphy_params) {
1369                         result = -EOPNOTSUPP;
1370                         goto bad_res;
1371                 }
1372
1373                 old_retry_short = rdev->wiphy.retry_short;
1374                 old_retry_long = rdev->wiphy.retry_long;
1375                 old_frag_threshold = rdev->wiphy.frag_threshold;
1376                 old_rts_threshold = rdev->wiphy.rts_threshold;
1377                 old_coverage_class = rdev->wiphy.coverage_class;
1378
1379                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1380                         rdev->wiphy.retry_short = retry_short;
1381                 if (changed & WIPHY_PARAM_RETRY_LONG)
1382                         rdev->wiphy.retry_long = retry_long;
1383                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1384                         rdev->wiphy.frag_threshold = frag_threshold;
1385                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1386                         rdev->wiphy.rts_threshold = rts_threshold;
1387                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1388                         rdev->wiphy.coverage_class = coverage_class;
1389
1390                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1391                 if (result) {
1392                         rdev->wiphy.retry_short = old_retry_short;
1393                         rdev->wiphy.retry_long = old_retry_long;
1394                         rdev->wiphy.frag_threshold = old_frag_threshold;
1395                         rdev->wiphy.rts_threshold = old_rts_threshold;
1396                         rdev->wiphy.coverage_class = old_coverage_class;
1397                 }
1398         }
1399
1400  bad_res:
1401         mutex_unlock(&rdev->mtx);
1402         if (netdev)
1403                 dev_put(netdev);
1404         return result;
1405 }
1406
1407
1408 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1409                               struct cfg80211_registered_device *rdev,
1410                               struct net_device *dev)
1411 {
1412         void *hdr;
1413
1414         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1415         if (!hdr)
1416                 return -1;
1417
1418         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1419         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1420         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1421         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1422
1423         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1424                     rdev->devlist_generation ^
1425                         (cfg80211_rdev_list_generation << 2));
1426
1427         return genlmsg_end(msg, hdr);
1428
1429  nla_put_failure:
1430         genlmsg_cancel(msg, hdr);
1431         return -EMSGSIZE;
1432 }
1433
1434 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1435 {
1436         int wp_idx = 0;
1437         int if_idx = 0;
1438         int wp_start = cb->args[0];
1439         int if_start = cb->args[1];
1440         struct cfg80211_registered_device *rdev;
1441         struct wireless_dev *wdev;
1442
1443         mutex_lock(&cfg80211_mutex);
1444         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1445                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1446                         continue;
1447                 if (wp_idx < wp_start) {
1448                         wp_idx++;
1449                         continue;
1450                 }
1451                 if_idx = 0;
1452
1453                 mutex_lock(&rdev->devlist_mtx);
1454                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1455                         if (if_idx < if_start) {
1456                                 if_idx++;
1457                                 continue;
1458                         }
1459                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1460                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1461                                                rdev, wdev->netdev) < 0) {
1462                                 mutex_unlock(&rdev->devlist_mtx);
1463                                 goto out;
1464                         }
1465                         if_idx++;
1466                 }
1467                 mutex_unlock(&rdev->devlist_mtx);
1468
1469                 wp_idx++;
1470         }
1471  out:
1472         mutex_unlock(&cfg80211_mutex);
1473
1474         cb->args[0] = wp_idx;
1475         cb->args[1] = if_idx;
1476
1477         return skb->len;
1478 }
1479
1480 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1481 {
1482         struct sk_buff *msg;
1483         struct cfg80211_registered_device *dev = info->user_ptr[0];
1484         struct net_device *netdev = info->user_ptr[1];
1485
1486         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1487         if (!msg)
1488                 return -ENOMEM;
1489
1490         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1491                                dev, netdev) < 0) {
1492                 nlmsg_free(msg);
1493                 return -ENOBUFS;
1494         }
1495
1496         return genlmsg_reply(msg, info);
1497 }
1498
1499 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1500         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1501         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1502         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1503         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1504         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1505 };
1506
1507 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1508 {
1509         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1510         int flag;
1511
1512         *mntrflags = 0;
1513
1514         if (!nla)
1515                 return -EINVAL;
1516
1517         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1518                              nla, mntr_flags_policy))
1519                 return -EINVAL;
1520
1521         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1522                 if (flags[flag])
1523                         *mntrflags |= (1<<flag);
1524
1525         return 0;
1526 }
1527
1528 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1529                                struct net_device *netdev, u8 use_4addr,
1530                                enum nl80211_iftype iftype)
1531 {
1532         if (!use_4addr) {
1533                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1534                         return -EBUSY;
1535                 return 0;
1536         }
1537
1538         switch (iftype) {
1539         case NL80211_IFTYPE_AP_VLAN:
1540                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1541                         return 0;
1542                 break;
1543         case NL80211_IFTYPE_STATION:
1544                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1545                         return 0;
1546                 break;
1547         default:
1548                 break;
1549         }
1550
1551         return -EOPNOTSUPP;
1552 }
1553
1554 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1555 {
1556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1557         struct vif_params params;
1558         int err;
1559         enum nl80211_iftype otype, ntype;
1560         struct net_device *dev = info->user_ptr[1];
1561         u32 _flags, *flags = NULL;
1562         bool change = false;
1563
1564         memset(&params, 0, sizeof(params));
1565
1566         otype = ntype = dev->ieee80211_ptr->iftype;
1567
1568         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1569                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1570                 if (otype != ntype)
1571                         change = true;
1572                 if (ntype > NL80211_IFTYPE_MAX)
1573                         return -EINVAL;
1574         }
1575
1576         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1577                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1578
1579                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1580                         return -EINVAL;
1581                 if (netif_running(dev))
1582                         return -EBUSY;
1583
1584                 wdev_lock(wdev);
1585                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1586                              IEEE80211_MAX_MESH_ID_LEN);
1587                 wdev->mesh_id_up_len =
1588                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1589                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1590                        wdev->mesh_id_up_len);
1591                 wdev_unlock(wdev);
1592         }
1593
1594         if (info->attrs[NL80211_ATTR_4ADDR]) {
1595                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1596                 change = true;
1597                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1598                 if (err)
1599                         return err;
1600         } else {
1601                 params.use_4addr = -1;
1602         }
1603
1604         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1605                 if (ntype != NL80211_IFTYPE_MONITOR)
1606                         return -EINVAL;
1607                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1608                                           &_flags);
1609                 if (err)
1610                         return err;
1611
1612                 flags = &_flags;
1613                 change = true;
1614         }
1615
1616         if (change)
1617                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1618         else
1619                 err = 0;
1620
1621         if (!err && params.use_4addr != -1)
1622                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1623
1624         return err;
1625 }
1626
1627 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1628 {
1629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1630         struct vif_params params;
1631         struct net_device *dev;
1632         int err;
1633         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1634         u32 flags;
1635
1636         memset(&params, 0, sizeof(params));
1637
1638         if (!info->attrs[NL80211_ATTR_IFNAME])
1639                 return -EINVAL;
1640
1641         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1642                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1643                 if (type > NL80211_IFTYPE_MAX)
1644                         return -EINVAL;
1645         }
1646
1647         if (!rdev->ops->add_virtual_intf ||
1648             !(rdev->wiphy.interface_modes & (1 << type)))
1649                 return -EOPNOTSUPP;
1650
1651         if (info->attrs[NL80211_ATTR_4ADDR]) {
1652                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1653                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1654                 if (err)
1655                         return err;
1656         }
1657
1658         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1659                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1660                                   &flags);
1661         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1662                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1663                 type, err ? NULL : &flags, &params);
1664         if (IS_ERR(dev))
1665                 return PTR_ERR(dev);
1666
1667         if (type == NL80211_IFTYPE_MESH_POINT &&
1668             info->attrs[NL80211_ATTR_MESH_ID]) {
1669                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1670
1671                 wdev_lock(wdev);
1672                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1673                              IEEE80211_MAX_MESH_ID_LEN);
1674                 wdev->mesh_id_up_len =
1675                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1676                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1677                        wdev->mesh_id_up_len);
1678                 wdev_unlock(wdev);
1679         }
1680
1681         return 0;
1682 }
1683
1684 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1685 {
1686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1687         struct net_device *dev = info->user_ptr[1];
1688
1689         if (!rdev->ops->del_virtual_intf)
1690                 return -EOPNOTSUPP;
1691
1692         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1693 }
1694
1695 struct get_key_cookie {
1696         struct sk_buff *msg;
1697         int error;
1698         int idx;
1699 };
1700
1701 static void get_key_callback(void *c, struct key_params *params)
1702 {
1703         struct nlattr *key;
1704         struct get_key_cookie *cookie = c;
1705
1706         if (params->key)
1707                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1708                         params->key_len, params->key);
1709
1710         if (params->seq)
1711                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1712                         params->seq_len, params->seq);
1713
1714         if (params->cipher)
1715                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1716                             params->cipher);
1717
1718         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1719         if (!key)
1720                 goto nla_put_failure;
1721
1722         if (params->key)
1723                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1724                         params->key_len, params->key);
1725
1726         if (params->seq)
1727                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1728                         params->seq_len, params->seq);
1729
1730         if (params->cipher)
1731                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1732                             params->cipher);
1733
1734         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1735
1736         nla_nest_end(cookie->msg, key);
1737
1738         return;
1739  nla_put_failure:
1740         cookie->error = 1;
1741 }
1742
1743 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1744 {
1745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1746         int err;
1747         struct net_device *dev = info->user_ptr[1];
1748         u8 key_idx = 0;
1749         const u8 *mac_addr = NULL;
1750         bool pairwise;
1751         struct get_key_cookie cookie = {
1752                 .error = 0,
1753         };
1754         void *hdr;
1755         struct sk_buff *msg;
1756
1757         if (info->attrs[NL80211_ATTR_KEY_IDX])
1758                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1759
1760         if (key_idx > 5)
1761                 return -EINVAL;
1762
1763         if (info->attrs[NL80211_ATTR_MAC])
1764                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1765
1766         pairwise = !!mac_addr;
1767         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1768                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1769                 if (kt >= NUM_NL80211_KEYTYPES)
1770                         return -EINVAL;
1771                 if (kt != NL80211_KEYTYPE_GROUP &&
1772                     kt != NL80211_KEYTYPE_PAIRWISE)
1773                         return -EINVAL;
1774                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1775         }
1776
1777         if (!rdev->ops->get_key)
1778                 return -EOPNOTSUPP;
1779
1780         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1781         if (!msg)
1782                 return -ENOMEM;
1783
1784         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1785                              NL80211_CMD_NEW_KEY);
1786         if (IS_ERR(hdr))
1787                 return PTR_ERR(hdr);
1788
1789         cookie.msg = msg;
1790         cookie.idx = key_idx;
1791
1792         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1793         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1794         if (mac_addr)
1795                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1796
1797         if (pairwise && mac_addr &&
1798             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1799                 return -ENOENT;
1800
1801         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1802                                  mac_addr, &cookie, get_key_callback);
1803
1804         if (err)
1805                 goto free_msg;
1806
1807         if (cookie.error)
1808                 goto nla_put_failure;
1809
1810         genlmsg_end(msg, hdr);
1811         return genlmsg_reply(msg, info);
1812
1813  nla_put_failure:
1814         err = -ENOBUFS;
1815  free_msg:
1816         nlmsg_free(msg);
1817         return err;
1818 }
1819
1820 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1821 {
1822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1823         struct key_parse key;
1824         int err;
1825         struct net_device *dev = info->user_ptr[1];
1826
1827         err = nl80211_parse_key(info, &key);
1828         if (err)
1829                 return err;
1830
1831         if (key.idx < 0)
1832                 return -EINVAL;
1833
1834         /* only support setting default key */
1835         if (!key.def && !key.defmgmt)
1836                 return -EINVAL;
1837
1838         wdev_lock(dev->ieee80211_ptr);
1839
1840         if (key.def) {
1841                 if (!rdev->ops->set_default_key) {
1842                         err = -EOPNOTSUPP;
1843                         goto out;
1844                 }
1845
1846                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1847                 if (err)
1848                         goto out;
1849
1850                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1851                                                  key.def_uni, key.def_multi);
1852
1853                 if (err)
1854                         goto out;
1855
1856 #ifdef CONFIG_CFG80211_WEXT
1857                 dev->ieee80211_ptr->wext.default_key = key.idx;
1858 #endif
1859         } else {
1860                 if (key.def_uni || !key.def_multi) {
1861                         err = -EINVAL;
1862                         goto out;
1863                 }
1864
1865                 if (!rdev->ops->set_default_mgmt_key) {
1866                         err = -EOPNOTSUPP;
1867                         goto out;
1868                 }
1869
1870                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1871                 if (err)
1872                         goto out;
1873
1874                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1875                                                       dev, key.idx);
1876                 if (err)
1877                         goto out;
1878
1879 #ifdef CONFIG_CFG80211_WEXT
1880                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1881 #endif
1882         }
1883
1884  out:
1885         wdev_unlock(dev->ieee80211_ptr);
1886
1887         return err;
1888 }
1889
1890 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1891 {
1892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1893         int err;
1894         struct net_device *dev = info->user_ptr[1];
1895         struct key_parse key;
1896         const u8 *mac_addr = NULL;
1897
1898         err = nl80211_parse_key(info, &key);
1899         if (err)
1900                 return err;
1901
1902         if (!key.p.key)
1903                 return -EINVAL;
1904
1905         if (info->attrs[NL80211_ATTR_MAC])
1906                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1907
1908         if (key.type == -1) {
1909                 if (mac_addr)
1910                         key.type = NL80211_KEYTYPE_PAIRWISE;
1911                 else
1912                         key.type = NL80211_KEYTYPE_GROUP;
1913         }
1914
1915         /* for now */
1916         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1917             key.type != NL80211_KEYTYPE_GROUP)
1918                 return -EINVAL;
1919
1920         if (!rdev->ops->add_key)
1921                 return -EOPNOTSUPP;
1922
1923         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1924                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1925                                            mac_addr))
1926                 return -EINVAL;
1927
1928         wdev_lock(dev->ieee80211_ptr);
1929         err = nl80211_key_allowed(dev->ieee80211_ptr);
1930         if (!err)
1931                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1932                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1933                                          mac_addr, &key.p);
1934         wdev_unlock(dev->ieee80211_ptr);
1935
1936         return err;
1937 }
1938
1939 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1940 {
1941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1942         int err;
1943         struct net_device *dev = info->user_ptr[1];
1944         u8 *mac_addr = NULL;
1945         struct key_parse key;
1946
1947         err = nl80211_parse_key(info, &key);
1948         if (err)
1949                 return err;
1950
1951         if (info->attrs[NL80211_ATTR_MAC])
1952                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1953
1954         if (key.type == -1) {
1955                 if (mac_addr)
1956                         key.type = NL80211_KEYTYPE_PAIRWISE;
1957                 else
1958                         key.type = NL80211_KEYTYPE_GROUP;
1959         }
1960
1961         /* for now */
1962         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1963             key.type != NL80211_KEYTYPE_GROUP)
1964                 return -EINVAL;
1965
1966         if (!rdev->ops->del_key)
1967                 return -EOPNOTSUPP;
1968
1969         wdev_lock(dev->ieee80211_ptr);
1970         err = nl80211_key_allowed(dev->ieee80211_ptr);
1971
1972         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1973             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1974                 err = -ENOENT;
1975
1976         if (!err)
1977                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1978                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1979                                          mac_addr);
1980
1981 #ifdef CONFIG_CFG80211_WEXT
1982         if (!err) {
1983                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1984                         dev->ieee80211_ptr->wext.default_key = -1;
1985                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1986                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1987         }
1988 #endif
1989         wdev_unlock(dev->ieee80211_ptr);
1990
1991         return err;
1992 }
1993
1994 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1995 {
1996         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1997                     struct beacon_parameters *info);
1998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1999         struct net_device *dev = info->user_ptr[1];
2000         struct wireless_dev *wdev = dev->ieee80211_ptr;
2001         struct beacon_parameters params;
2002         int haveinfo = 0, err;
2003
2004         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2005             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2006             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2007             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2008                 return -EINVAL;
2009
2010         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2011             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2012                 return -EOPNOTSUPP;
2013
2014         memset(&params, 0, sizeof(params));
2015
2016         switch (info->genlhdr->cmd) {
2017         case NL80211_CMD_NEW_BEACON:
2018                 /* these are required for NEW_BEACON */
2019                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2020                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2021                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2022                         return -EINVAL;
2023
2024                 params.interval =
2025                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2026                 params.dtim_period =
2027                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2028
2029                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2030                 if (err)
2031                         return err;
2032
2033                 /*
2034                  * In theory, some of these attributes could be required for
2035                  * NEW_BEACON, but since they were not used when the command was
2036                  * originally added, keep them optional for old user space
2037                  * programs to work with drivers that do not need the additional
2038                  * information.
2039                  */
2040                 if (info->attrs[NL80211_ATTR_SSID]) {
2041                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2042                         params.ssid_len =
2043                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2044                         if (params.ssid_len == 0 ||
2045                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2046                                 return -EINVAL;
2047                 }
2048
2049                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2050                         params.hidden_ssid = nla_get_u32(
2051                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2052                         if (params.hidden_ssid !=
2053                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2054                             params.hidden_ssid !=
2055                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2056                             params.hidden_ssid !=
2057                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2058                                 return -EINVAL;
2059                 }
2060
2061                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2062
2063                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2064                         params.auth_type = nla_get_u32(
2065                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2066                         if (!nl80211_valid_auth_type(params.auth_type))
2067                                 return -EINVAL;
2068                 } else
2069                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2070
2071                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2072                                               NL80211_MAX_NR_CIPHER_SUITES);
2073                 if (err)
2074                         return err;
2075
2076                 call = rdev->ops->add_beacon;
2077                 break;
2078         case NL80211_CMD_SET_BEACON:
2079                 call = rdev->ops->set_beacon;
2080                 break;
2081         default:
2082                 WARN_ON(1);
2083                 return -EOPNOTSUPP;
2084         }
2085
2086         if (!call)
2087                 return -EOPNOTSUPP;
2088
2089         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2090                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2091                 params.head_len =
2092                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2093                 haveinfo = 1;
2094         }
2095
2096         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2097                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2098                 params.tail_len =
2099                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2100                 haveinfo = 1;
2101         }
2102
2103         if (!haveinfo)
2104                 return -EINVAL;
2105
2106         if (info->attrs[NL80211_ATTR_IE]) {
2107                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2108                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2109         }
2110
2111         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2112                 params.proberesp_ies =
2113                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2114                 params.proberesp_ies_len =
2115                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2116         }
2117
2118         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2119                 params.assocresp_ies =
2120                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2121                 params.assocresp_ies_len =
2122                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2123         }
2124
2125         err = call(&rdev->wiphy, dev, &params);
2126         if (!err && params.interval)
2127                 wdev->beacon_interval = params.interval;
2128         return err;
2129 }
2130
2131 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2132 {
2133         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2134         struct net_device *dev = info->user_ptr[1];
2135         struct wireless_dev *wdev = dev->ieee80211_ptr;
2136         int err;
2137
2138         if (!rdev->ops->del_beacon)
2139                 return -EOPNOTSUPP;
2140
2141         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2142             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2143                 return -EOPNOTSUPP;
2144
2145         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2146         if (!err)
2147                 wdev->beacon_interval = 0;
2148         return err;
2149 }
2150
2151 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2152         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2153         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2154         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2155         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2156         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2157 };
2158
2159 static int parse_station_flags(struct genl_info *info,
2160                                struct station_parameters *params)
2161 {
2162         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2163         struct nlattr *nla;
2164         int flag;
2165
2166         /*
2167          * Try parsing the new attribute first so userspace
2168          * can specify both for older kernels.
2169          */
2170         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2171         if (nla) {
2172                 struct nl80211_sta_flag_update *sta_flags;
2173
2174                 sta_flags = nla_data(nla);
2175                 params->sta_flags_mask = sta_flags->mask;
2176                 params->sta_flags_set = sta_flags->set;
2177                 if ((params->sta_flags_mask |
2178                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2179                         return -EINVAL;
2180                 return 0;
2181         }
2182
2183         /* if present, parse the old attribute */
2184
2185         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2186         if (!nla)
2187                 return 0;
2188
2189         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2190                              nla, sta_flags_policy))
2191                 return -EINVAL;
2192
2193         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2194         params->sta_flags_mask &= ~1;
2195
2196         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2197                 if (flags[flag])
2198                         params->sta_flags_set |= (1<<flag);
2199
2200         return 0;
2201 }
2202
2203 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2204                                  int attr)
2205 {
2206         struct nlattr *rate;
2207         u16 bitrate;
2208
2209         rate = nla_nest_start(msg, attr);
2210         if (!rate)
2211                 goto nla_put_failure;
2212
2213         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2214         bitrate = cfg80211_calculate_bitrate(info);
2215         if (bitrate > 0)
2216                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2217
2218         if (info->flags & RATE_INFO_FLAGS_MCS)
2219                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2220         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2221                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2222         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2223                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2224
2225         nla_nest_end(msg, rate);
2226         return true;
2227
2228 nla_put_failure:
2229         return false;
2230 }
2231
2232 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2233                                 int flags, struct net_device *dev,
2234                                 const u8 *mac_addr, struct station_info *sinfo)
2235 {
2236         void *hdr;
2237         struct nlattr *sinfoattr, *bss_param;
2238
2239         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2240         if (!hdr)
2241                 return -1;
2242
2243         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2244         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2245
2246         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2247
2248         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2249         if (!sinfoattr)
2250                 goto nla_put_failure;
2251         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2252                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2253                             sinfo->connected_time);
2254         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2255                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2256                             sinfo->inactive_time);
2257         if (sinfo->filled & STATION_INFO_RX_BYTES)
2258                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2259                             sinfo->rx_bytes);
2260         if (sinfo->filled & STATION_INFO_TX_BYTES)
2261                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2262                             sinfo->tx_bytes);
2263         if (sinfo->filled & STATION_INFO_LLID)
2264                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2265                             sinfo->llid);
2266         if (sinfo->filled & STATION_INFO_PLID)
2267                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2268                             sinfo->plid);
2269         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2270                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2271                             sinfo->plink_state);
2272         if (sinfo->filled & STATION_INFO_SIGNAL)
2273                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2274                            sinfo->signal);
2275         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2276                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2277                            sinfo->signal_avg);
2278         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2279                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2280                                           NL80211_STA_INFO_TX_BITRATE))
2281                         goto nla_put_failure;
2282         }
2283         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2284                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2285                                           NL80211_STA_INFO_RX_BITRATE))
2286                         goto nla_put_failure;
2287         }
2288         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2289                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2290                             sinfo->rx_packets);
2291         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2292                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2293                             sinfo->tx_packets);
2294         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2295                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2296                             sinfo->tx_retries);
2297         if (sinfo->filled & STATION_INFO_TX_FAILED)
2298                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2299                             sinfo->tx_failed);
2300         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2301                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2302                 if (!bss_param)
2303                         goto nla_put_failure;
2304
2305                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2306                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2307                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2308                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2309                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2310                         NLA_PUT_FLAG(msg,
2311                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2312                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2313                            sinfo->bss_param.dtim_period);
2314                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2315                             sinfo->bss_param.beacon_interval);
2316
2317                 nla_nest_end(msg, bss_param);
2318         }
2319         nla_nest_end(msg, sinfoattr);
2320
2321         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2322                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2323                         sinfo->assoc_req_ies);
2324
2325         return genlmsg_end(msg, hdr);
2326
2327  nla_put_failure:
2328         genlmsg_cancel(msg, hdr);
2329         return -EMSGSIZE;
2330 }
2331
2332 static int nl80211_dump_station(struct sk_buff *skb,
2333                                 struct netlink_callback *cb)
2334 {
2335         struct station_info sinfo;
2336         struct cfg80211_registered_device *dev;
2337         struct net_device *netdev;
2338         u8 mac_addr[ETH_ALEN];
2339         int sta_idx = cb->args[1];
2340         int err;
2341
2342         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2343         if (err)
2344                 return err;
2345
2346         if (!dev->ops->dump_station) {
2347                 err = -EOPNOTSUPP;
2348                 goto out_err;
2349         }
2350
2351         while (1) {
2352                 memset(&sinfo, 0, sizeof(sinfo));
2353                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2354                                              mac_addr, &sinfo);
2355                 if (err == -ENOENT)
2356                         break;
2357                 if (err)
2358                         goto out_err;
2359
2360                 if (nl80211_send_station(skb,
2361                                 NETLINK_CB(cb->skb).pid,
2362                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2363                                 netdev, mac_addr,
2364                                 &sinfo) < 0)
2365                         goto out;
2366
2367                 sta_idx++;
2368         }
2369
2370
2371  out:
2372         cb->args[1] = sta_idx;
2373         err = skb->len;
2374  out_err:
2375         nl80211_finish_netdev_dump(dev);
2376
2377         return err;
2378 }
2379
2380 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2381 {
2382         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2383         struct net_device *dev = info->user_ptr[1];
2384         struct station_info sinfo;
2385         struct sk_buff *msg;
2386         u8 *mac_addr = NULL;
2387         int err;
2388
2389         memset(&sinfo, 0, sizeof(sinfo));
2390
2391         if (!info->attrs[NL80211_ATTR_MAC])
2392                 return -EINVAL;
2393
2394         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2395
2396         if (!rdev->ops->get_station)
2397                 return -EOPNOTSUPP;
2398
2399         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2400         if (err)
2401                 return err;
2402
2403         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2404         if (!msg)
2405                 return -ENOMEM;
2406
2407         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2408                                  dev, mac_addr, &sinfo) < 0) {
2409                 nlmsg_free(msg);
2410                 return -ENOBUFS;
2411         }
2412
2413         return genlmsg_reply(msg, info);
2414 }
2415
2416 /*
2417  * Get vlan interface making sure it is running and on the right wiphy.
2418  */
2419 static int get_vlan(struct genl_info *info,
2420                     struct cfg80211_registered_device *rdev,
2421                     struct net_device **vlan)
2422 {
2423         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2424         *vlan = NULL;
2425
2426         if (vlanattr) {
2427                 *vlan = dev_get_by_index(genl_info_net(info),
2428                                          nla_get_u32(vlanattr));
2429                 if (!*vlan)
2430                         return -ENODEV;
2431                 if (!(*vlan)->ieee80211_ptr)
2432                         return -EINVAL;
2433                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2434                         return -EINVAL;
2435                 if (!netif_running(*vlan))
2436                         return -ENETDOWN;
2437         }
2438         return 0;
2439 }
2440
2441 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2442 {
2443         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2444         int err;
2445         struct net_device *dev = info->user_ptr[1];
2446         struct station_parameters params;
2447         u8 *mac_addr = NULL;
2448
2449         memset(&params, 0, sizeof(params));
2450
2451         params.listen_interval = -1;
2452         params.plink_state = -1;
2453
2454         if (info->attrs[NL80211_ATTR_STA_AID])
2455                 return -EINVAL;
2456
2457         if (!info->attrs[NL80211_ATTR_MAC])
2458                 return -EINVAL;
2459
2460         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2461
2462         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2463                 params.supported_rates =
2464                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2465                 params.supported_rates_len =
2466                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2467         }
2468
2469         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2470                 params.listen_interval =
2471                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2472
2473         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2474                 params.ht_capa =
2475                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2476
2477         if (parse_station_flags(info, &params))
2478                 return -EINVAL;
2479
2480         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2481                 params.plink_action =
2482                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2483
2484         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2485                 params.plink_state =
2486                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2487
2488         err = get_vlan(info, rdev, &params.vlan);
2489         if (err)
2490                 goto out;
2491
2492         /* validate settings */
2493         err = 0;
2494
2495         switch (dev->ieee80211_ptr->iftype) {
2496         case NL80211_IFTYPE_AP:
2497         case NL80211_IFTYPE_AP_VLAN:
2498         case NL80211_IFTYPE_P2P_GO:
2499                 /* disallow mesh-specific things */
2500                 if (params.plink_action)
2501                         err = -EINVAL;
2502                 break;
2503         case NL80211_IFTYPE_P2P_CLIENT:
2504         case NL80211_IFTYPE_STATION:
2505                 /* disallow everything but AUTHORIZED flag */
2506                 if (params.plink_action)
2507                         err = -EINVAL;
2508                 if (params.vlan)
2509                         err = -EINVAL;
2510                 if (params.supported_rates)
2511                         err = -EINVAL;
2512                 if (params.ht_capa)
2513                         err = -EINVAL;
2514                 if (params.listen_interval >= 0)
2515                         err = -EINVAL;
2516                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2517                         err = -EINVAL;
2518                 break;
2519         case NL80211_IFTYPE_MESH_POINT:
2520                 /* disallow things mesh doesn't support */
2521                 if (params.vlan)
2522                         err = -EINVAL;
2523                 if (params.ht_capa)
2524                         err = -EINVAL;
2525                 if (params.listen_interval >= 0)
2526                         err = -EINVAL;
2527                 if (params.sta_flags_mask &
2528                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2529                                   BIT(NL80211_STA_FLAG_MFP) |
2530                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2531                         err = -EINVAL;
2532                 break;
2533         default:
2534                 err = -EINVAL;
2535         }
2536
2537         if (err)
2538                 goto out;
2539
2540         if (!rdev->ops->change_station) {
2541                 err = -EOPNOTSUPP;
2542                 goto out;
2543         }
2544
2545         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2546
2547  out:
2548         if (params.vlan)
2549                 dev_put(params.vlan);
2550
2551         return err;
2552 }
2553
2554 static struct nla_policy
2555 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2556         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2557         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2558 };
2559
2560 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2561 {
2562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2563         int err;
2564         struct net_device *dev = info->user_ptr[1];
2565         struct station_parameters params;
2566         u8 *mac_addr = NULL;
2567
2568         memset(&params, 0, sizeof(params));
2569
2570         if (!info->attrs[NL80211_ATTR_MAC])
2571                 return -EINVAL;
2572
2573         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2574                 return -EINVAL;
2575
2576         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2577                 return -EINVAL;
2578
2579         if (!info->attrs[NL80211_ATTR_STA_AID])
2580                 return -EINVAL;
2581
2582         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2583         params.supported_rates =
2584                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2585         params.supported_rates_len =
2586                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2587         params.listen_interval =
2588                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2589
2590         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2591         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2592                 return -EINVAL;
2593
2594         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2595                 params.ht_capa =
2596                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2597
2598         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2599                 params.plink_action =
2600                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2601
2602         if (parse_station_flags(info, &params))
2603                 return -EINVAL;
2604
2605         /* parse WME attributes if sta is WME capable */
2606         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2607             (params.sta_flags_set & NL80211_STA_FLAG_WME) &&
2608             info->attrs[NL80211_ATTR_STA_WME]) {
2609                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2610                 struct nlattr *nla;
2611
2612                 nla = info->attrs[NL80211_ATTR_STA_WME];
2613                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2614                                        nl80211_sta_wme_policy);
2615                 if (err)
2616                         return err;
2617
2618                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2619                         params.uapsd_queues =
2620                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2621
2622                 if (tb[NL80211_STA_WME_MAX_SP])
2623                         params.max_sp =
2624                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2625         }
2626
2627         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2628             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2629             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2630             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2631                 return -EINVAL;
2632
2633         err = get_vlan(info, rdev, &params.vlan);
2634         if (err)
2635                 goto out;
2636
2637         /* validate settings */
2638         err = 0;
2639
2640         if (!rdev->ops->add_station) {
2641                 err = -EOPNOTSUPP;
2642                 goto out;
2643         }
2644
2645         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2646
2647  out:
2648         if (params.vlan)
2649                 dev_put(params.vlan);
2650         return err;
2651 }
2652
2653 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2654 {
2655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2656         struct net_device *dev = info->user_ptr[1];
2657         u8 *mac_addr = NULL;
2658
2659         if (info->attrs[NL80211_ATTR_MAC])
2660                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2661
2662         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2663             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2664             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2665             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2666                 return -EINVAL;
2667
2668         if (!rdev->ops->del_station)
2669                 return -EOPNOTSUPP;
2670
2671         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2672 }
2673
2674 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2675                                 int flags, struct net_device *dev,
2676                                 u8 *dst, u8 *next_hop,
2677                                 struct mpath_info *pinfo)
2678 {
2679         void *hdr;
2680         struct nlattr *pinfoattr;
2681
2682         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2683         if (!hdr)
2684                 return -1;
2685
2686         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2687         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2688         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2689
2690         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2691
2692         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2693         if (!pinfoattr)
2694                 goto nla_put_failure;
2695         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2696                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2697                             pinfo->frame_qlen);
2698         if (pinfo->filled & MPATH_INFO_SN)
2699                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2700                             pinfo->sn);
2701         if (pinfo->filled & MPATH_INFO_METRIC)
2702                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2703                             pinfo->metric);
2704         if (pinfo->filled & MPATH_INFO_EXPTIME)
2705                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2706                             pinfo->exptime);
2707         if (pinfo->filled & MPATH_INFO_FLAGS)
2708                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2709                             pinfo->flags);
2710         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2711                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2712                             pinfo->discovery_timeout);
2713         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2714                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2715                             pinfo->discovery_retries);
2716
2717         nla_nest_end(msg, pinfoattr);
2718
2719         return genlmsg_end(msg, hdr);
2720
2721  nla_put_failure:
2722         genlmsg_cancel(msg, hdr);
2723         return -EMSGSIZE;
2724 }
2725
2726 static int nl80211_dump_mpath(struct sk_buff *skb,
2727                               struct netlink_callback *cb)
2728 {
2729         struct mpath_info pinfo;
2730         struct cfg80211_registered_device *dev;
2731         struct net_device *netdev;
2732         u8 dst[ETH_ALEN];
2733         u8 next_hop[ETH_ALEN];
2734         int path_idx = cb->args[1];
2735         int err;
2736
2737         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2738         if (err)
2739                 return err;
2740
2741         if (!dev->ops->dump_mpath) {
2742                 err = -EOPNOTSUPP;
2743                 goto out_err;
2744         }
2745
2746         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2747                 err = -EOPNOTSUPP;
2748                 goto out_err;
2749         }
2750
2751         while (1) {
2752                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2753                                            dst, next_hop, &pinfo);
2754                 if (err == -ENOENT)
2755                         break;
2756                 if (err)
2757                         goto out_err;
2758
2759                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2760                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2761                                        netdev, dst, next_hop,
2762                                        &pinfo) < 0)
2763                         goto out;
2764
2765                 path_idx++;
2766         }
2767
2768
2769  out:
2770         cb->args[1] = path_idx;
2771         err = skb->len;
2772  out_err:
2773         nl80211_finish_netdev_dump(dev);
2774         return err;
2775 }
2776
2777 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2778 {
2779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2780         int err;
2781         struct net_device *dev = info->user_ptr[1];
2782         struct mpath_info pinfo;
2783         struct sk_buff *msg;
2784         u8 *dst = NULL;
2785         u8 next_hop[ETH_ALEN];
2786
2787         memset(&pinfo, 0, sizeof(pinfo));
2788
2789         if (!info->attrs[NL80211_ATTR_MAC])
2790                 return -EINVAL;
2791
2792         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2793
2794         if (!rdev->ops->get_mpath)
2795                 return -EOPNOTSUPP;
2796
2797         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2798                 return -EOPNOTSUPP;
2799
2800         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2801         if (err)
2802                 return err;
2803
2804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2805         if (!msg)
2806                 return -ENOMEM;
2807
2808         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2809                                  dev, dst, next_hop, &pinfo) < 0) {
2810                 nlmsg_free(msg);
2811                 return -ENOBUFS;
2812         }
2813
2814         return genlmsg_reply(msg, info);
2815 }
2816
2817 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2818 {
2819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2820         struct net_device *dev = info->user_ptr[1];
2821         u8 *dst = NULL;
2822         u8 *next_hop = NULL;
2823
2824         if (!info->attrs[NL80211_ATTR_MAC])
2825                 return -EINVAL;
2826
2827         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2828                 return -EINVAL;
2829
2830         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2831         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2832
2833         if (!rdev->ops->change_mpath)
2834                 return -EOPNOTSUPP;
2835
2836         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2837                 return -EOPNOTSUPP;
2838
2839         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2840 }
2841
2842 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2843 {
2844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2845         struct net_device *dev = info->user_ptr[1];
2846         u8 *dst = NULL;
2847         u8 *next_hop = NULL;
2848
2849         if (!info->attrs[NL80211_ATTR_MAC])
2850                 return -EINVAL;
2851
2852         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2853                 return -EINVAL;
2854
2855         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2856         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2857
2858         if (!rdev->ops->add_mpath)
2859                 return -EOPNOTSUPP;
2860
2861         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2862                 return -EOPNOTSUPP;
2863
2864         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2865 }
2866
2867 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2868 {
2869         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2870         struct net_device *dev = info->user_ptr[1];
2871         u8 *dst = NULL;
2872
2873         if (info->attrs[NL80211_ATTR_MAC])
2874                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2875
2876         if (!rdev->ops->del_mpath)
2877                 return -EOPNOTSUPP;
2878
2879         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2880 }
2881
2882 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2883 {
2884         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2885         struct net_device *dev = info->user_ptr[1];
2886         struct bss_parameters params;
2887
2888         memset(&params, 0, sizeof(params));
2889         /* default to not changing parameters */
2890         params.use_cts_prot = -1;
2891         params.use_short_preamble = -1;
2892         params.use_short_slot_time = -1;
2893         params.ap_isolate = -1;
2894         params.ht_opmode = -1;
2895
2896         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2897                 params.use_cts_prot =
2898                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2899         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2900                 params.use_short_preamble =
2901                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2902         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2903                 params.use_short_slot_time =
2904                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2905         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2906                 params.basic_rates =
2907                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2908                 params.basic_rates_len =
2909                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2910         }
2911         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2912                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2913         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2914                 params.ht_opmode =
2915                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2916
2917         if (!rdev->ops->change_bss)
2918                 return -EOPNOTSUPP;
2919
2920         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2921             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2922                 return -EOPNOTSUPP;
2923
2924         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2925 }
2926
2927 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2928         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2929         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2930         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2931         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2932         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2933         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2934 };
2935
2936 static int parse_reg_rule(struct nlattr *tb[],
2937         struct ieee80211_reg_rule *reg_rule)
2938 {
2939         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2940         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2941
2942         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2943                 return -EINVAL;
2944         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2945                 return -EINVAL;
2946         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2947                 return -EINVAL;
2948         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2949                 return -EINVAL;
2950         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2951                 return -EINVAL;
2952
2953         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2954
2955         freq_range->start_freq_khz =
2956                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2957         freq_range->end_freq_khz =
2958                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2959         freq_range->max_bandwidth_khz =
2960                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2961
2962         power_rule->max_eirp =
2963                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2964
2965         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2966                 power_rule->max_antenna_gain =
2967                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2968
2969         return 0;
2970 }
2971
2972 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2973 {
2974         int r;
2975         char *data = NULL;
2976
2977         /*
2978          * You should only get this when cfg80211 hasn't yet initialized
2979          * completely when built-in to the kernel right between the time
2980          * window between nl80211_init() and regulatory_init(), if that is
2981          * even possible.
2982          */
2983         mutex_lock(&cfg80211_mutex);
2984         if (unlikely(!cfg80211_regdomain)) {
2985                 mutex_unlock(&cfg80211_mutex);
2986                 return -EINPROGRESS;
2987         }
2988         mutex_unlock(&cfg80211_mutex);
2989
2990         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2991                 return -EINVAL;
2992
2993         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2994
2995         r = regulatory_hint_user(data);
2996
2997         return r;
2998 }
2999
3000 static int nl80211_get_mesh_config(struct sk_buff *skb,
3001                                    struct genl_info *info)
3002 {
3003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3004         struct net_device *dev = info->user_ptr[1];
3005         struct wireless_dev *wdev = dev->ieee80211_ptr;
3006         struct mesh_config cur_params;
3007         int err = 0;
3008         void *hdr;
3009         struct nlattr *pinfoattr;
3010         struct sk_buff *msg;
3011
3012         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3013                 return -EOPNOTSUPP;
3014
3015         if (!rdev->ops->get_mesh_config)
3016                 return -EOPNOTSUPP;
3017
3018         wdev_lock(wdev);
3019         /* If not connected, get default parameters */
3020         if (!wdev->mesh_id_len)
3021                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3022         else
3023                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3024                                                  &cur_params);
3025         wdev_unlock(wdev);
3026
3027         if (err)
3028                 return err;
3029
3030         /* Draw up a netlink message to send back */
3031         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3032         if (!msg)
3033                 return -ENOMEM;
3034         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3035                              NL80211_CMD_GET_MESH_CONFIG);
3036         if (!hdr)
3037                 goto out;
3038         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3039         if (!pinfoattr)
3040                 goto nla_put_failure;
3041         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3042         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3043                         cur_params.dot11MeshRetryTimeout);
3044         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3045                         cur_params.dot11MeshConfirmTimeout);
3046         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3047                         cur_params.dot11MeshHoldingTimeout);
3048         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3049                         cur_params.dot11MeshMaxPeerLinks);
3050         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3051                         cur_params.dot11MeshMaxRetries);
3052         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3053                         cur_params.dot11MeshTTL);
3054         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3055                         cur_params.element_ttl);
3056         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3057                         cur_params.auto_open_plinks);
3058         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3059                         cur_params.dot11MeshHWMPmaxPREQretries);
3060         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3061                         cur_params.path_refresh_time);
3062         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3063                         cur_params.min_discovery_timeout);
3064         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3065                         cur_params.dot11MeshHWMPactivePathTimeout);
3066         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3067                         cur_params.dot11MeshHWMPpreqMinInterval);
3068         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3069                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3070         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3071                         cur_params.dot11MeshHWMPRootMode);
3072         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3073                         cur_params.dot11MeshHWMPRannInterval);
3074         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3075                         cur_params.dot11MeshGateAnnouncementProtocol);
3076         nla_nest_end(msg, pinfoattr);
3077         genlmsg_end(msg, hdr);
3078         return genlmsg_reply(msg, info);
3079
3080  nla_put_failure:
3081         genlmsg_cancel(msg, hdr);
3082  out:
3083         nlmsg_free(msg);
3084         return -ENOBUFS;
3085 }
3086
3087 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3088         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3089         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3090         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3091         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3092         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3093         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3094         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3095         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3096
3097         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3098         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3099         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3100         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3101         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3102         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3103         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3104         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3105         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3106 };
3107
3108 static const struct nla_policy
3109         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3110         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3111         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3112         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3113         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3114                 .len = IEEE80211_MAX_DATA_LEN },
3115         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3116 };
3117
3118 static int nl80211_parse_mesh_config(struct genl_info *info,
3119                                      struct mesh_config *cfg,
3120                                      u32 *mask_out)
3121 {
3122         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3123         u32 mask = 0;
3124
3125 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3126 do {\
3127         if (table[attr_num]) {\
3128                 cfg->param = nla_fn(table[attr_num]); \
3129                 mask |= (1 << (attr_num - 1)); \
3130         } \
3131 } while (0);\
3132
3133
3134         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3135                 return -EINVAL;
3136         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3137                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3138                              nl80211_meshconf_params_policy))
3139                 return -EINVAL;
3140
3141         /* This makes sure that there aren't more than 32 mesh config
3142          * parameters (otherwise our bitfield scheme would not work.) */
3143         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3144
3145         /* Fill in the params struct */
3146         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3147                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3148         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3149                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3150         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3151                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3152         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3153                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3154         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3155                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3156         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3157                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3158         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3159                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3161                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3162         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3163                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3164                         nla_get_u8);
3165         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3166                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3167         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3168                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3169                         nla_get_u16);
3170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3171                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3172                         nla_get_u32);
3173         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3174                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3175                         nla_get_u16);
3176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3177                         dot11MeshHWMPnetDiameterTraversalTime,
3178                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3179                         nla_get_u16);
3180         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3181                         dot11MeshHWMPRootMode, mask,
3182                         NL80211_MESHCONF_HWMP_ROOTMODE,
3183                         nla_get_u8);
3184         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3185                         dot11MeshHWMPRannInterval, mask,
3186                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3187                         nla_get_u16);
3188         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3189                         dot11MeshGateAnnouncementProtocol, mask,
3190                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3191                         nla_get_u8);
3192         if (mask_out)
3193                 *mask_out = mask;
3194
3195         return 0;
3196
3197 #undef FILL_IN_MESH_PARAM_IF_SET
3198 }
3199
3200 static int nl80211_parse_mesh_setup(struct genl_info *info,
3201                                      struct mesh_setup *setup)
3202 {
3203         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3204
3205         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3206                 return -EINVAL;
3207         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3208                              info->attrs[NL80211_ATTR_MESH_SETUP],
3209                              nl80211_mesh_setup_params_policy))
3210                 return -EINVAL;
3211
3212         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3213                 setup->path_sel_proto =
3214                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3215                  IEEE80211_PATH_PROTOCOL_VENDOR :
3216                  IEEE80211_PATH_PROTOCOL_HWMP;
3217
3218         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3219                 setup->path_metric =
3220                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3221                  IEEE80211_PATH_METRIC_VENDOR :
3222                  IEEE80211_PATH_METRIC_AIRTIME;
3223
3224
3225         if (tb[NL80211_MESH_SETUP_IE]) {
3226                 struct nlattr *ieattr =
3227                         tb[NL80211_MESH_SETUP_IE];
3228                 if (!is_valid_ie_attr(ieattr))
3229                         return -EINVAL;
3230                 setup->ie = nla_data(ieattr);
3231                 setup->ie_len = nla_len(ieattr);
3232         }
3233         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3234         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3235
3236         return 0;
3237 }
3238
3239 static int nl80211_update_mesh_config(struct sk_buff *skb,
3240                                       struct genl_info *info)
3241 {
3242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3243         struct net_device *dev = info->user_ptr[1];
3244         struct wireless_dev *wdev = dev->ieee80211_ptr;
3245         struct mesh_config cfg;
3246         u32 mask;
3247         int err;
3248
3249         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3250                 return -EOPNOTSUPP;
3251
3252         if (!rdev->ops->update_mesh_config)
3253                 return -EOPNOTSUPP;
3254
3255         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3256         if (err)
3257                 return err;
3258
3259         wdev_lock(wdev);
3260         if (!wdev->mesh_id_len)
3261                 err = -ENOLINK;
3262
3263         if (!err)
3264                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3265                                                     mask, &cfg);
3266
3267         wdev_unlock(wdev);
3268
3269         return err;
3270 }
3271
3272 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3273 {
3274         struct sk_buff *msg;
3275         void *hdr = NULL;
3276         struct nlattr *nl_reg_rules;
3277         unsigned int i;
3278         int err = -EINVAL;
3279
3280         mutex_lock(&cfg80211_mutex);
3281
3282         if (!cfg80211_regdomain)
3283                 goto out;
3284
3285         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3286         if (!msg) {
3287                 err = -ENOBUFS;
3288                 goto out;
3289         }
3290
3291         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3292                              NL80211_CMD_GET_REG);
3293         if (!hdr)
3294                 goto put_failure;
3295
3296         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3297                 cfg80211_regdomain->alpha2);
3298
3299         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3300         if (!nl_reg_rules)
3301                 goto nla_put_failure;
3302
3303         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3304                 struct nlattr *nl_reg_rule;
3305                 const struct ieee80211_reg_rule *reg_rule;
3306                 const struct ieee80211_freq_range *freq_range;
3307                 const struct ieee80211_power_rule *power_rule;
3308
3309                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3310                 freq_range = &reg_rule->freq_range;
3311                 power_rule = &reg_rule->power_rule;
3312
3313                 nl_reg_rule = nla_nest_start(msg, i);
3314                 if (!nl_reg_rule)
3315                         goto nla_put_failure;
3316
3317                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3318                         reg_rule->flags);
3319                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3320                         freq_range->start_freq_khz);
3321                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3322                         freq_range->end_freq_khz);
3323                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3324                         freq_range->max_bandwidth_khz);
3325                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3326                         power_rule->max_antenna_gain);
3327                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3328                         power_rule->max_eirp);
3329
3330                 nla_nest_end(msg, nl_reg_rule);
3331         }
3332
3333         nla_nest_end(msg, nl_reg_rules);
3334
3335         genlmsg_end(msg, hdr);
3336         err = genlmsg_reply(msg, info);
3337         goto out;
3338
3339 nla_put_failure:
3340         genlmsg_cancel(msg, hdr);
3341 put_failure:
3342         nlmsg_free(msg);
3343         err = -EMSGSIZE;
3344 out:
3345         mutex_unlock(&cfg80211_mutex);
3346         return err;
3347 }
3348
3349 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3350 {
3351         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3352         struct nlattr *nl_reg_rule;
3353         char *alpha2 = NULL;
3354         int rem_reg_rules = 0, r = 0;
3355         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3356         struct ieee80211_regdomain *rd = NULL;
3357
3358         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3359                 return -EINVAL;
3360
3361         if (!info->attrs[NL80211_ATTR_REG_RULES])
3362                 return -EINVAL;
3363
3364         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3365
3366         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3367                         rem_reg_rules) {
3368                 num_rules++;
3369                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3370                         return -EINVAL;
3371         }
3372
3373         mutex_lock(&cfg80211_mutex);
3374
3375         if (!reg_is_valid_request(alpha2)) {
3376                 r = -EINVAL;
3377                 goto bad_reg;
3378         }
3379
3380         size_of_regd = sizeof(struct ieee80211_regdomain) +
3381                 (num_rules * sizeof(struct ieee80211_reg_rule));
3382
3383         rd = kzalloc(size_of_regd, GFP_KERNEL);
3384         if (!rd) {
3385                 r = -ENOMEM;
3386                 goto bad_reg;
3387         }
3388
3389         rd->n_reg_rules = num_rules;
3390         rd->alpha2[0] = alpha2[0];
3391         rd->alpha2[1] = alpha2[1];
3392
3393         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3394                         rem_reg_rules) {
3395                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3396                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3397                         reg_rule_policy);
3398                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3399                 if (r)
3400                         goto bad_reg;
3401
3402                 rule_idx++;
3403
3404                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3405                         r = -EINVAL;
3406                         goto bad_reg;
3407                 }
3408         }
3409
3410         BUG_ON(rule_idx != num_rules);
3411
3412         r = set_regdom(rd);
3413
3414         mutex_unlock(&cfg80211_mutex);
3415
3416         return r;
3417
3418  bad_reg:
3419         mutex_unlock(&cfg80211_mutex);
3420         kfree(rd);
3421         return r;
3422 }
3423
3424 static int validate_scan_freqs(struct nlattr *freqs)
3425 {
3426         struct nlattr *attr1, *attr2;
3427         int n_channels = 0, tmp1, tmp2;
3428
3429         nla_for_each_nested(attr1, freqs, tmp1) {
3430                 n_channels++;
3431                 /*
3432                  * Some hardware has a limited channel list for
3433                  * scanning, and it is pretty much nonsensical
3434                  * to scan for a channel twice, so disallow that
3435                  * and don't require drivers to check that the
3436                  * channel list they get isn't longer than what
3437                  * they can scan, as long as they can scan all
3438                  * the channels they registered at once.
3439                  */
3440                 nla_for_each_nested(attr2, freqs, tmp2)
3441                         if (attr1 != attr2 &&
3442                             nla_get_u32(attr1) == nla_get_u32(attr2))
3443                                 return 0;
3444         }
3445
3446         return n_channels;
3447 }
3448
3449 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3450 {
3451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3452         struct net_device *dev = info->user_ptr[1];
3453         struct cfg80211_scan_request *request;
3454         struct nlattr *attr;
3455         struct wiphy *wiphy;
3456         int err, tmp, n_ssids = 0, n_channels, i;
3457         size_t ie_len;
3458
3459         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3460                 return -EINVAL;
3461
3462         wiphy = &rdev->wiphy;
3463
3464         if (!rdev->ops->scan)
3465                 return -EOPNOTSUPP;
3466
3467         if (rdev->scan_req)
3468                 return -EBUSY;
3469
3470         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3471                 n_channels = validate_scan_freqs(
3472                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3473                 if (!n_channels)
3474                         return -EINVAL;
3475         } else {
3476                 enum ieee80211_band band;
3477                 n_channels = 0;
3478
3479                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3480                         if (wiphy->bands[band])
3481                                 n_channels += wiphy->bands[band]->n_channels;
3482         }
3483
3484         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3485                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3486                         n_ssids++;
3487
3488         if (n_ssids > wiphy->max_scan_ssids)
3489                 return -EINVAL;
3490
3491         if (info->attrs[NL80211_ATTR_IE])
3492                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3493         else
3494                 ie_len = 0;
3495
3496         if (ie_len > wiphy->max_scan_ie_len)
3497                 return -EINVAL;
3498
3499         request = kzalloc(sizeof(*request)
3500                         + sizeof(*request->ssids) * n_ssids
3501                         + sizeof(*request->channels) * n_channels
3502                         + ie_len, GFP_KERNEL);
3503         if (!request)
3504                 return -ENOMEM;
3505
3506         if (n_ssids)
3507                 request->ssids = (void *)&request->channels[n_channels];
3508         request->n_ssids = n_ssids;
3509         if (ie_len) {
3510                 if (request->ssids)
3511                         request->ie = (void *)(request->ssids + n_ssids);
3512                 else
3513                         request->ie = (void *)(request->channels + n_channels);
3514         }
3515
3516         i = 0;
3517         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3518                 /* user specified, bail out if channel not found */
3519                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3520                         struct ieee80211_channel *chan;
3521
3522                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3523
3524                         if (!chan) {
3525                                 err = -EINVAL;
3526                                 goto out_free;
3527                         }
3528
3529                         /* ignore disabled channels */
3530                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3531                                 continue;
3532
3533                         request->channels[i] = chan;
3534                         i++;
3535                 }
3536         } else {
3537                 enum ieee80211_band band;
3538
3539                 /* all channels */
3540                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3541                         int j;
3542                         if (!wiphy->bands[band])
3543                                 continue;
3544                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3545                                 struct ieee80211_channel *chan;
3546
3547                                 chan = &wiphy->bands[band]->channels[j];
3548
3549                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3550                                         continue;
3551
3552                                 request->channels[i] = chan;
3553                                 i++;
3554                         }
3555                 }
3556         }
3557
3558         if (!i) {
3559                 err = -EINVAL;
3560                 goto out_free;
3561         }
3562
3563         request->n_channels = i;
3564
3565         i = 0;
3566         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3567                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3568                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3569                                 err = -EINVAL;
3570                                 goto out_free;
3571                         }
3572                         request->ssids[i].ssid_len = nla_len(attr);
3573                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3574                         i++;
3575                 }
3576         }
3577
3578         if (info->attrs[NL80211_ATTR_IE]) {
3579                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3580                 memcpy((void *)request->ie,
3581                        nla_data(info->attrs[NL80211_ATTR_IE]),
3582                        request->ie_len);
3583         }
3584
3585         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3586                 if (wiphy->bands[i])
3587                         request->rates[i] =
3588                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3589
3590         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3591                 nla_for_each_nested(attr,
3592                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3593                                     tmp) {
3594                         enum ieee80211_band band = nla_type(attr);
3595
3596                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3597                                 err = -EINVAL;
3598                                 goto out_free;
3599                         }
3600                         err = ieee80211_get_ratemask(wiphy->bands[band],
3601                                                      nla_data(attr),
3602                                                      nla_len(attr),
3603                                                      &request->rates[band]);
3604                         if (err)
3605                                 goto out_free;
3606                 }
3607         }
3608
3609         request->dev = dev;
3610         request->wiphy = &rdev->wiphy;
3611
3612         rdev->scan_req = request;
3613         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3614
3615         if (!err) {
3616                 nl80211_send_scan_start(rdev, dev);
3617                 dev_hold(dev);
3618         } else {
3619  out_free:
3620                 rdev->scan_req = NULL;
3621                 kfree(request);
3622         }
3623
3624         return err;
3625 }
3626
3627 static int nl80211_start_sched_scan(struct sk_buff *skb,
3628                                     struct genl_info *info)
3629 {
3630         struct cfg80211_sched_scan_request *request;
3631         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3632         struct net_device *dev = info->user_ptr[1];
3633         struct nlattr *attr;
3634         struct wiphy *wiphy;
3635         int err, tmp, n_ssids = 0, n_channels, i;
3636         u32 interval;
3637         enum ieee80211_band band;
3638         size_t ie_len;
3639
3640         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3641             !rdev->ops->sched_scan_start)
3642                 return -EOPNOTSUPP;
3643
3644         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3645                 return -EINVAL;
3646
3647         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3648                 return -EINVAL;
3649
3650         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3651         if (interval == 0)
3652                 return -EINVAL;
3653
3654         wiphy = &rdev->wiphy;
3655
3656         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3657                 n_channels = validate_scan_freqs(
3658                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3659                 if (!n_channels)
3660                         return -EINVAL;
3661         } else {
3662                 n_channels = 0;
3663
3664                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3665                         if (wiphy->bands[band])
3666                                 n_channels += wiphy->bands[band]->n_channels;
3667         }
3668
3669         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3670                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3671                                     tmp)
3672                         n_ssids++;
3673
3674         if (n_ssids > wiphy->max_sched_scan_ssids)
3675                 return -EINVAL;
3676
3677         if (info->attrs[NL80211_ATTR_IE])
3678                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3679         else
3680                 ie_len = 0;
3681
3682         if (ie_len > wiphy->max_sched_scan_ie_len)
3683                 return -EINVAL;
3684
3685         mutex_lock(&rdev->sched_scan_mtx);
3686
3687         if (rdev->sched_scan_req) {
3688                 err = -EINPROGRESS;
3689                 goto out;
3690         }
3691
3692         request = kzalloc(sizeof(*request)
3693                         + sizeof(*request->ssids) * n_ssids
3694                         + sizeof(*request->channels) * n_channels
3695                         + ie_len, GFP_KERNEL);
3696         if (!request) {
3697                 err = -ENOMEM;
3698                 goto out;
3699         }
3700
3701         if (n_ssids)
3702                 request->ssids = (void *)&request->channels[n_channels];
3703         request->n_ssids = n_ssids;
3704         if (ie_len) {
3705                 if (request->ssids)
3706                         request->ie = (void *)(request->ssids + n_ssids);
3707                 else
3708                         request->ie = (void *)(request->channels + n_channels);
3709         }
3710
3711         i = 0;
3712         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3713                 /* user specified, bail out if channel not found */
3714                 nla_for_each_nested(attr,
3715                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3716                                     tmp) {
3717                         struct ieee80211_channel *chan;
3718
3719                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3720
3721                         if (!chan) {
3722                                 err = -EINVAL;
3723                                 goto out_free;
3724                         }
3725
3726                         /* ignore disabled channels */
3727                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3728                                 continue;
3729
3730                         request->channels[i] = chan;
3731                         i++;
3732                 }
3733         } else {
3734                 /* all channels */
3735                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3736                         int j;
3737                         if (!wiphy->bands[band])
3738                                 continue;
3739                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3740                                 struct ieee80211_channel *chan;
3741
3742                                 chan = &wiphy->bands[band]->channels[j];
3743
3744                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3745                                         continue;
3746
3747                                 request->channels[i] = chan;
3748                                 i++;
3749                         }
3750                 }
3751         }
3752
3753         if (!i) {
3754                 err = -EINVAL;
3755                 goto out_free;
3756         }
3757
3758         request->n_channels = i;
3759
3760         i = 0;
3761         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3762                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3763                                     tmp) {
3764                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3765                                 err = -EINVAL;
3766                                 goto out_free;
3767                         }
3768                         request->ssids[i].ssid_len = nla_len(attr);
3769                         memcpy(request->ssids[i].ssid, nla_data(attr),
3770                                nla_len(attr));
3771                         i++;
3772                 }
3773         }
3774
3775         if (info->attrs[NL80211_ATTR_IE]) {
3776                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3777                 memcpy((void *)request->ie,
3778                        nla_data(info->attrs[NL80211_ATTR_IE]),
3779                        request->ie_len);
3780         }
3781
3782         request->dev = dev;
3783         request->wiphy = &rdev->wiphy;
3784         request->interval = interval;
3785
3786         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3787         if (!err) {
3788                 rdev->sched_scan_req = request;
3789                 nl80211_send_sched_scan(rdev, dev,
3790                                         NL80211_CMD_START_SCHED_SCAN);
3791                 goto out;
3792         }
3793
3794 out_free:
3795         kfree(request);
3796 out:
3797         mutex_unlock(&rdev->sched_scan_mtx);
3798         return err;
3799 }
3800
3801 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3802                                    struct genl_info *info)
3803 {
3804         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3805         int err;
3806
3807         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3808             !rdev->ops->sched_scan_stop)
3809                 return -EOPNOTSUPP;
3810
3811         mutex_lock(&rdev->sched_scan_mtx);
3812         err = __cfg80211_stop_sched_scan(rdev, false);
3813         mutex_unlock(&rdev->sched_scan_mtx);
3814
3815         return err;
3816 }
3817
3818 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3819                             u32 seq, int flags,
3820                             struct cfg80211_registered_device *rdev,
3821                             struct wireless_dev *wdev,
3822                             struct cfg80211_internal_bss *intbss)
3823 {
3824         struct cfg80211_bss *res = &intbss->pub;
3825         void *hdr;
3826         struct nlattr *bss;
3827         int i;
3828
3829         ASSERT_WDEV_LOCK(wdev);
3830
3831         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3832                              NL80211_CMD_NEW_SCAN_RESULTS);
3833         if (!hdr)
3834                 return -1;
3835
3836         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3837
3838         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3839         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3840
3841         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3842         if (!bss)
3843                 goto nla_put_failure;
3844         if (!is_zero_ether_addr(res->bssid))
3845                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3846         if (res->information_elements && res->len_information_elements)
3847                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3848                         res->len_information_elements,
3849                         res->information_elements);
3850         if (res->beacon_ies && res->len_beacon_ies &&
3851             res->beacon_ies != res->information_elements)
3852                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3853                         res->len_beacon_ies, res->beacon_ies);
3854         if (res->tsf)
3855                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3856         if (res->beacon_interval)
3857                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3858         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3859         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3860         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3861                 jiffies_to_msecs(jiffies - intbss->ts));
3862
3863         switch (rdev->wiphy.signal_type) {
3864         case CFG80211_SIGNAL_TYPE_MBM:
3865                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3866                 break;
3867         case CFG80211_SIGNAL_TYPE_UNSPEC:
3868                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3869                 break;
3870         default:
3871                 break;
3872         }
3873
3874         switch (wdev->iftype) {
3875         case NL80211_IFTYPE_P2P_CLIENT:
3876         case NL80211_IFTYPE_STATION:
3877                 if (intbss == wdev->current_bss)
3878                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3879                                     NL80211_BSS_STATUS_ASSOCIATED);
3880                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3881                         if (intbss != wdev->auth_bsses[i])
3882                                 continue;
3883                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3884                                     NL80211_BSS_STATUS_AUTHENTICATED);
3885                         break;
3886                 }
3887                 break;
3888         case NL80211_IFTYPE_ADHOC:
3889                 if (intbss == wdev->current_bss)
3890                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3891                                     NL80211_BSS_STATUS_IBSS_JOINED);
3892                 break;
3893         default:
3894                 break;
3895         }
3896
3897         nla_nest_end(msg, bss);
3898
3899         return genlmsg_end(msg, hdr);
3900
3901  nla_put_failure:
3902         genlmsg_cancel(msg, hdr);
3903         return -EMSGSIZE;
3904 }
3905
3906 static int nl80211_dump_scan(struct sk_buff *skb,
3907                              struct netlink_callback *cb)
3908 {
3909         struct cfg80211_registered_device *rdev;
3910         struct net_device *dev;
3911         struct cfg80211_internal_bss *scan;
3912         struct wireless_dev *wdev;
3913         int start = cb->args[1], idx = 0;
3914         int err;
3915
3916         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3917         if (err)
3918                 return err;
3919
3920         wdev = dev->ieee80211_ptr;
3921
3922         wdev_lock(wdev);
3923         spin_lock_bh(&rdev->bss_lock);
3924         cfg80211_bss_expire(rdev);
3925
3926         cb->seq = rdev->bss_generation;
3927
3928         list_for_each_entry(scan, &rdev->bss_list, list) {
3929                 if (++idx <= start)
3930                         continue;
3931                 if (nl80211_send_bss(skb, cb,
3932                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3933                                 rdev, wdev, scan) < 0) {
3934                         idx--;
3935                         break;
3936                 }
3937         }
3938
3939         spin_unlock_bh(&rdev->bss_lock);
3940         wdev_unlock(wdev);
3941
3942         cb->args[1] = idx;
3943         nl80211_finish_netdev_dump(rdev);
3944
3945         return skb->len;
3946 }
3947
3948 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3949                                 int flags, struct net_device *dev,
3950                                 struct survey_info *survey)
3951 {
3952         void *hdr;
3953         struct nlattr *infoattr;
3954
3955         hdr = nl80211hdr_put(msg, pid, seq, flags,
3956                              NL80211_CMD_NEW_SURVEY_RESULTS);
3957         if (!hdr)
3958                 return -ENOMEM;
3959
3960         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3961
3962         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3963         if (!infoattr)
3964                 goto nla_put_failure;
3965
3966         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3967                     survey->channel->center_freq);
3968         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3969                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3970                             survey->noise);
3971         if (survey->filled & SURVEY_INFO_IN_USE)
3972                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3973         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3974                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3975                             survey->channel_time);
3976         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3977                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3978                             survey->channel_time_busy);
3979         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3980                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3981                             survey->channel_time_ext_busy);
3982         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3983                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3984                             survey->channel_time_rx);
3985         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3986                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3987                             survey->channel_time_tx);
3988
3989         nla_nest_end(msg, infoattr);
3990
3991         return genlmsg_end(msg, hdr);
3992
3993  nla_put_failure:
3994         genlmsg_cancel(msg, hdr);
3995         return -EMSGSIZE;
3996 }
3997
3998 static int nl80211_dump_survey(struct sk_buff *skb,
3999                         struct netlink_callback *cb)
4000 {
4001         struct survey_info survey;
4002         struct cfg80211_registered_device *dev;
4003         struct net_device *netdev;
4004         int survey_idx = cb->args[1];
4005         int res;
4006
4007         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4008         if (res)
4009                 return res;
4010
4011         if (!dev->ops->dump_survey) {
4012                 res = -EOPNOTSUPP;
4013                 goto out_err;
4014         }
4015
4016         while (1) {
4017                 struct ieee80211_channel *chan;
4018
4019                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4020                                             &survey);
4021                 if (res == -ENOENT)
4022                         break;
4023                 if (res)
4024                         goto out_err;
4025
4026                 /* Survey without a channel doesn't make sense */
4027                 if (!survey.channel) {
4028                         res = -EINVAL;
4029                         goto out;
4030                 }
4031
4032                 chan = ieee80211_get_channel(&dev->wiphy,
4033                                              survey.channel->center_freq);
4034                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4035                         survey_idx++;
4036                         continue;
4037                 }
4038
4039                 if (nl80211_send_survey(skb,
4040                                 NETLINK_CB(cb->skb).pid,
4041                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4042                                 netdev,
4043                                 &survey) < 0)
4044                         goto out;
4045                 survey_idx++;
4046         }
4047
4048  out:
4049         cb->args[1] = survey_idx;
4050         res = skb->len;
4051  out_err:
4052         nl80211_finish_netdev_dump(dev);
4053         return res;
4054 }
4055
4056 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4057 {
4058         return auth_type <= NL80211_AUTHTYPE_MAX;
4059 }
4060
4061 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4062 {
4063         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4064                                   NL80211_WPA_VERSION_2));
4065 }
4066
4067 static bool nl80211_valid_akm_suite(u32 akm)
4068 {
4069         return akm == WLAN_AKM_SUITE_8021X ||
4070                 akm == WLAN_AKM_SUITE_PSK;
4071 }
4072
4073 static bool nl80211_valid_cipher_suite(u32 cipher)
4074 {
4075         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
4076                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
4077                 cipher == WLAN_CIPHER_SUITE_TKIP ||
4078                 cipher == WLAN_CIPHER_SUITE_CCMP ||
4079                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
4080 }
4081
4082
4083 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4084 {
4085         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4086         struct net_device *dev = info->user_ptr[1];
4087         struct ieee80211_channel *chan;
4088         const u8 *bssid, *ssid, *ie = NULL;
4089         int err, ssid_len, ie_len = 0;
4090         enum nl80211_auth_type auth_type;
4091         struct key_parse key;
4092         bool local_state_change;
4093
4094         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4095                 return -EINVAL;
4096
4097         if (!info->attrs[NL80211_ATTR_MAC])
4098                 return -EINVAL;
4099
4100         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4101                 return -EINVAL;
4102
4103         if (!info->attrs[NL80211_ATTR_SSID])
4104                 return -EINVAL;
4105
4106         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4107                 return -EINVAL;
4108
4109         err = nl80211_parse_key(info, &key);
4110         if (err)
4111                 return err;
4112
4113         if (key.idx >= 0) {
4114                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4115                         return -EINVAL;
4116                 if (!key.p.key || !key.p.key_len)
4117                         return -EINVAL;
4118                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4119                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4120                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4121                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4122                         return -EINVAL;
4123                 if (key.idx > 4)
4124                         return -EINVAL;
4125         } else {
4126                 key.p.key_len = 0;
4127                 key.p.key = NULL;
4128         }
4129
4130         if (key.idx >= 0) {
4131                 int i;
4132                 bool ok = false;
4133                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4134                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4135                                 ok = true;
4136                                 break;
4137                         }
4138                 }
4139                 if (!ok)
4140                         return -EINVAL;
4141         }
4142
4143         if (!rdev->ops->auth)
4144                 return -EOPNOTSUPP;
4145
4146         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4147             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4148                 return -EOPNOTSUPP;
4149
4150         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4151         chan = ieee80211_get_channel(&rdev->wiphy,
4152                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4153         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4154                 return -EINVAL;
4155
4156         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4157         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4158
4159         if (info->attrs[NL80211_ATTR_IE]) {
4160                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4161                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4162         }
4163
4164         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4165         if (!nl80211_valid_auth_type(auth_type))
4166                 return -EINVAL;
4167
4168         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4169
4170         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4171                                   ssid, ssid_len, ie, ie_len,
4172                                   key.p.key, key.p.key_len, key.idx,
4173                                   local_state_change);
4174 }
4175
4176 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4177                                    struct genl_info *info,
4178                                    struct cfg80211_crypto_settings *settings,
4179                                    int cipher_limit)
4180 {
4181         memset(settings, 0, sizeof(*settings));
4182
4183         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4184
4185         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4186                 u16 proto;
4187                 proto = nla_get_u16(
4188                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4189                 settings->control_port_ethertype = cpu_to_be16(proto);
4190                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4191                     proto != ETH_P_PAE)
4192                         return -EINVAL;
4193                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4194                         settings->control_port_no_encrypt = true;
4195         } else
4196                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4197
4198         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4199                 void *data;
4200                 int len, i;
4201
4202                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4203                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4204                 settings->n_ciphers_pairwise = len / sizeof(u32);
4205
4206                 if (len % sizeof(u32))
4207                         return -EINVAL;
4208
4209                 if (settings->n_ciphers_pairwise > cipher_limit)
4210                         return -EINVAL;
4211
4212                 memcpy(settings->ciphers_pairwise, data, len);
4213
4214                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4215                         if (!nl80211_valid_cipher_suite(
4216                                         settings->ciphers_pairwise[i]))
4217                                 return -EINVAL;
4218         }
4219
4220         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4221                 settings->cipher_group =
4222                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4223                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4224                         return -EINVAL;
4225         }
4226
4227         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4228                 settings->wpa_versions =
4229                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4230                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4231                         return -EINVAL;
4232         }
4233
4234         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4235                 void *data;
4236                 int len, i;
4237
4238                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4239                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4240                 settings->n_akm_suites = len / sizeof(u32);
4241
4242                 if (len % sizeof(u32))
4243                         return -EINVAL;
4244
4245                 memcpy(settings->akm_suites, data, len);
4246
4247                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4248                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4249                                 return -EINVAL;
4250         }
4251
4252         return 0;
4253 }
4254
4255 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4256 {
4257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4258         struct net_device *dev = info->user_ptr[1];
4259         struct cfg80211_crypto_settings crypto;
4260         struct ieee80211_channel *chan;
4261         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4262         int err, ssid_len, ie_len = 0;
4263         bool use_mfp = false;
4264
4265         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4266                 return -EINVAL;
4267
4268         if (!info->attrs[NL80211_ATTR_MAC] ||
4269             !info->attrs[NL80211_ATTR_SSID] ||
4270             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4271                 return -EINVAL;
4272
4273         if (!rdev->ops->assoc)
4274                 return -EOPNOTSUPP;
4275
4276         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4277             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4278                 return -EOPNOTSUPP;
4279
4280         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4281
4282         chan = ieee80211_get_channel(&rdev->wiphy,
4283                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4284         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4285                 return -EINVAL;
4286
4287         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4288         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4289
4290         if (info->attrs[NL80211_ATTR_IE]) {
4291                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4292                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4293         }
4294
4295         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4296                 enum nl80211_mfp mfp =
4297                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4298                 if (mfp == NL80211_MFP_REQUIRED)
4299                         use_mfp = true;
4300                 else if (mfp != NL80211_MFP_NO)
4301                         return -EINVAL;
4302         }
4303
4304         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4305                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4306
4307         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4308         if (!err)
4309                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4310                                           ssid, ssid_len, ie, ie_len, use_mfp,
4311                                           &crypto);
4312
4313         return err;
4314 }
4315
4316 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4317 {
4318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4319         struct net_device *dev = info->user_ptr[1];
4320         const u8 *ie = NULL, *bssid;
4321         int ie_len = 0;
4322         u16 reason_code;
4323         bool local_state_change;
4324
4325         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4326                 return -EINVAL;
4327
4328         if (!info->attrs[NL80211_ATTR_MAC])
4329                 return -EINVAL;
4330
4331         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4332                 return -EINVAL;
4333
4334         if (!rdev->ops->deauth)
4335                 return -EOPNOTSUPP;
4336
4337         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4338             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4339                 return -EOPNOTSUPP;
4340
4341         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4342
4343         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4344         if (reason_code == 0) {
4345                 /* Reason Code 0 is reserved */
4346                 return -EINVAL;
4347         }
4348
4349         if (info->attrs[NL80211_ATTR_IE]) {
4350                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4351                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4352         }
4353
4354         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4355
4356         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4357                                     local_state_change);
4358 }
4359
4360 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4361 {
4362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4363         struct net_device *dev = info->user_ptr[1];
4364         const u8 *ie = NULL, *bssid;
4365         int ie_len = 0;
4366         u16 reason_code;
4367         bool local_state_change;
4368
4369         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4370                 return -EINVAL;
4371
4372         if (!info->attrs[NL80211_ATTR_MAC])
4373                 return -EINVAL;
4374
4375         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4376                 return -EINVAL;
4377
4378         if (!rdev->ops->disassoc)
4379                 return -EOPNOTSUPP;
4380
4381         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4382             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4383                 return -EOPNOTSUPP;
4384
4385         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4386
4387         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4388         if (reason_code == 0) {
4389                 /* Reason Code 0 is reserved */
4390                 return -EINVAL;
4391         }
4392
4393         if (info->attrs[NL80211_ATTR_IE]) {
4394                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4395                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4396         }
4397
4398         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4399
4400         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4401                                       local_state_change);
4402 }
4403
4404 static bool
4405 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4406                          int mcast_rate[IEEE80211_NUM_BANDS],
4407                          int rateval)
4408 {
4409         struct wiphy *wiphy = &rdev->wiphy;
4410         bool found = false;
4411         int band, i;
4412
4413         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4414                 struct ieee80211_supported_band *sband;
4415
4416                 sband = wiphy->bands[band];
4417                 if (!sband)
4418                         continue;
4419
4420                 for (i = 0; i < sband->n_bitrates; i++) {
4421                         if (sband->bitrates[i].bitrate == rateval) {
4422                                 mcast_rate[band] = i + 1;
4423                                 found = true;
4424                                 break;
4425                         }
4426                 }
4427         }
4428
4429         return found;
4430 }
4431
4432 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4433 {
4434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4435         struct net_device *dev = info->user_ptr[1];
4436         struct cfg80211_ibss_params ibss;
4437         struct wiphy *wiphy;
4438         struct cfg80211_cached_keys *connkeys = NULL;
4439         int err;
4440
4441         memset(&ibss, 0, sizeof(ibss));
4442
4443         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4444                 return -EINVAL;
4445
4446         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4447             !info->attrs[NL80211_ATTR_SSID] ||
4448             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4449                 return -EINVAL;
4450
4451         ibss.beacon_interval = 100;
4452
4453         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4454                 ibss.beacon_interval =
4455                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4456                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4457                         return -EINVAL;
4458         }
4459
4460         if (!rdev->ops->join_ibss)
4461                 return -EOPNOTSUPP;
4462
4463         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4464                 return -EOPNOTSUPP;
4465
4466         wiphy = &rdev->wiphy;
4467
4468         if (info->attrs[NL80211_ATTR_MAC])
4469                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4470         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4471         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4472
4473         if (info->attrs[NL80211_ATTR_IE]) {
4474                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4475                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4476         }
4477
4478         ibss.channel = ieee80211_get_channel(wiphy,
4479                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4480         if (!ibss.channel ||
4481             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4482             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4483                 return -EINVAL;
4484
4485         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4486         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4487
4488         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4489                 u8 *rates =
4490                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4491                 int n_rates =
4492                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4493                 struct ieee80211_supported_band *sband =
4494                         wiphy->bands[ibss.channel->band];
4495                 int err;
4496
4497                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4498                                              &ibss.basic_rates);
4499                 if (err)
4500                         return err;
4501         }
4502
4503         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4504             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4505                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4506                 return -EINVAL;
4507
4508         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4509                 connkeys = nl80211_parse_connkeys(rdev,
4510                                         info->attrs[NL80211_ATTR_KEYS]);
4511                 if (IS_ERR(connkeys))
4512                         return PTR_ERR(connkeys);
4513         }
4514
4515         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4516         if (err)
4517                 kfree(connkeys);
4518         return err;
4519 }
4520
4521 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4522 {
4523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4524         struct net_device *dev = info->user_ptr[1];
4525
4526         if (!rdev->ops->leave_ibss)
4527                 return -EOPNOTSUPP;
4528
4529         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4530                 return -EOPNOTSUPP;
4531
4532         return cfg80211_leave_ibss(rdev, dev, false);
4533 }
4534
4535 #ifdef CONFIG_NL80211_TESTMODE
4536 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4537         .name = "testmode",
4538 };
4539
4540 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4541 {
4542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4543         int err;
4544
4545         if (!info->attrs[NL80211_ATTR_TESTDATA])
4546                 return -EINVAL;
4547
4548         err = -EOPNOTSUPP;
4549         if (rdev->ops->testmode_cmd) {
4550                 rdev->testmode_info = info;
4551                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4552                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4553                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4554                 rdev->testmode_info = NULL;
4555         }
4556
4557         return err;
4558 }
4559
4560 static int nl80211_testmode_dump(struct sk_buff *skb,
4561                                  struct netlink_callback *cb)
4562 {
4563         struct cfg80211_registered_device *dev;
4564         int err;
4565         long phy_idx;
4566         void *data = NULL;
4567         int data_len = 0;
4568
4569         if (cb->args[0]) {
4570                 /*
4571                  * 0 is a valid index, but not valid for args[0],
4572                  * so we need to offset by 1.
4573                  */
4574                 phy_idx = cb->args[0] - 1;
4575         } else {
4576                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4577                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4578                                   nl80211_policy);
4579                 if (err)
4580                         return err;
4581                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4582                         return -EINVAL;
4583                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4584                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4585                         cb->args[1] =
4586                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4587         }
4588
4589         if (cb->args[1]) {
4590                 data = nla_data((void *)cb->args[1]);
4591                 data_len = nla_len((void *)cb->args[1]);
4592         }
4593
4594         mutex_lock(&cfg80211_mutex);
4595         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4596         if (!dev) {
4597                 mutex_unlock(&cfg80211_mutex);
4598                 return -ENOENT;
4599         }
4600         cfg80211_lock_rdev(dev);
4601         mutex_unlock(&cfg80211_mutex);
4602
4603         if (!dev->ops->testmode_dump) {
4604                 err = -EOPNOTSUPP;
4605                 goto out_err;
4606         }
4607
4608         while (1) {
4609                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4610                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4611                                            NL80211_CMD_TESTMODE);
4612                 struct nlattr *tmdata;
4613
4614                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4615                         genlmsg_cancel(skb, hdr);
4616                         break;
4617                 }
4618
4619                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4620                 if (!tmdata) {
4621                         genlmsg_cancel(skb, hdr);
4622                         break;
4623                 }
4624                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4625                                               data, data_len);
4626                 nla_nest_end(skb, tmdata);
4627
4628                 if (err == -ENOBUFS || err == -ENOENT) {
4629                         genlmsg_cancel(skb, hdr);
4630                         break;
4631                 } else if (err) {
4632                         genlmsg_cancel(skb, hdr);
4633                         goto out_err;
4634                 }
4635
4636                 genlmsg_end(skb, hdr);
4637         }
4638
4639         err = skb->len;
4640         /* see above */
4641         cb->args[0] = phy_idx + 1;
4642  out_err:
4643         cfg80211_unlock_rdev(dev);
4644         return err;
4645 }
4646
4647 static struct sk_buff *
4648 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4649                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4650 {
4651         struct sk_buff *skb;
4652         void *hdr;
4653         struct nlattr *data;
4654
4655         skb = nlmsg_new(approxlen + 100, gfp);
4656         if (!skb)
4657                 return NULL;
4658
4659         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4660         if (!hdr) {
4661                 kfree_skb(skb);
4662                 return NULL;
4663         }
4664
4665         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4666         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4667
4668         ((void **)skb->cb)[0] = rdev;
4669         ((void **)skb->cb)[1] = hdr;
4670         ((void **)skb->cb)[2] = data;
4671
4672         return skb;
4673
4674  nla_put_failure:
4675         kfree_skb(skb);
4676         return NULL;
4677 }
4678
4679 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4680                                                   int approxlen)
4681 {
4682         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4683
4684         if (WARN_ON(!rdev->testmode_info))
4685                 return NULL;
4686
4687         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4688                                 rdev->testmode_info->snd_pid,
4689                                 rdev->testmode_info->snd_seq,
4690                                 GFP_KERNEL);
4691 }
4692 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4693
4694 int cfg80211_testmode_reply(struct sk_buff *skb)
4695 {
4696         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4697         void *hdr = ((void **)skb->cb)[1];
4698         struct nlattr *data = ((void **)skb->cb)[2];
4699
4700         if (WARN_ON(!rdev->testmode_info)) {
4701                 kfree_skb(skb);
4702                 return -EINVAL;
4703         }
4704
4705         nla_nest_end(skb, data);
4706         genlmsg_end(skb, hdr);
4707         return genlmsg_reply(skb, rdev->testmode_info);
4708 }
4709 EXPORT_SYMBOL(cfg80211_testmode_reply);
4710
4711 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4712                                                   int approxlen, gfp_t gfp)
4713 {
4714         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4715
4716         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4717 }
4718 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4719
4720 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4721 {
4722         void *hdr = ((void **)skb->cb)[1];
4723         struct nlattr *data = ((void **)skb->cb)[2];
4724
4725         nla_nest_end(skb, data);
4726         genlmsg_end(skb, hdr);
4727         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4728 }
4729 EXPORT_SYMBOL(cfg80211_testmode_event);
4730 #endif
4731
4732 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4733 {
4734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4735         struct net_device *dev = info->user_ptr[1];
4736         struct cfg80211_connect_params connect;
4737         struct wiphy *wiphy;
4738         struct cfg80211_cached_keys *connkeys = NULL;
4739         int err;
4740
4741         memset(&connect, 0, sizeof(connect));
4742
4743         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4744                 return -EINVAL;
4745
4746         if (!info->attrs[NL80211_ATTR_SSID] ||
4747             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4748                 return -EINVAL;
4749
4750         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4751                 connect.auth_type =
4752                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4753                 if (!nl80211_valid_auth_type(connect.auth_type))
4754                         return -EINVAL;
4755         } else
4756                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4757
4758         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4759
4760         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4761                                       NL80211_MAX_NR_CIPHER_SUITES);
4762         if (err)
4763                 return err;
4764
4765         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4766             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4767                 return -EOPNOTSUPP;
4768
4769         wiphy = &rdev->wiphy;
4770
4771         if (info->attrs[NL80211_ATTR_MAC])
4772                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4773         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4774         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4775
4776         if (info->attrs[NL80211_ATTR_IE]) {
4777                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4778                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4779         }
4780
4781         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4782                 connect.channel =
4783                         ieee80211_get_channel(wiphy,
4784                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4785                 if (!connect.channel ||
4786                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4787                         return -EINVAL;
4788         }
4789
4790         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4791                 connkeys = nl80211_parse_connkeys(rdev,
4792                                         info->attrs[NL80211_ATTR_KEYS]);
4793                 if (IS_ERR(connkeys))
4794                         return PTR_ERR(connkeys);
4795         }
4796
4797         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4798         if (err)
4799                 kfree(connkeys);
4800         return err;
4801 }
4802
4803 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4804 {
4805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4806         struct net_device *dev = info->user_ptr[1];
4807         u16 reason;
4808
4809         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4810                 reason = WLAN_REASON_DEAUTH_LEAVING;
4811         else
4812                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4813
4814         if (reason == 0)
4815                 return -EINVAL;
4816
4817         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4818             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4819                 return -EOPNOTSUPP;
4820
4821         return cfg80211_disconnect(rdev, dev, reason, true);
4822 }
4823
4824 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4825 {
4826         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4827         struct net *net;
4828         int err;
4829         u32 pid;
4830
4831         if (!info->attrs[NL80211_ATTR_PID])
4832                 return -EINVAL;
4833
4834         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4835
4836         net = get_net_ns_by_pid(pid);
4837         if (IS_ERR(net))
4838                 return PTR_ERR(net);
4839
4840         err = 0;
4841
4842         /* check if anything to do */
4843         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4844                 err = cfg80211_switch_netns(rdev, net);
4845
4846         put_net(net);
4847         return err;
4848 }
4849
4850 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4851 {
4852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4853         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4854                         struct cfg80211_pmksa *pmksa) = NULL;
4855         struct net_device *dev = info->user_ptr[1];
4856         struct cfg80211_pmksa pmksa;
4857
4858         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4859
4860         if (!info->attrs[NL80211_ATTR_MAC])
4861                 return -EINVAL;
4862
4863         if (!info->attrs[NL80211_ATTR_PMKID])
4864                 return -EINVAL;
4865
4866         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4867         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4868
4869         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4870             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4871                 return -EOPNOTSUPP;
4872
4873         switch (info->genlhdr->cmd) {
4874         case NL80211_CMD_SET_PMKSA:
4875                 rdev_ops = rdev->ops->set_pmksa;
4876                 break;
4877         case NL80211_CMD_DEL_PMKSA:
4878                 rdev_ops = rdev->ops->del_pmksa;
4879                 break;
4880         default:
4881                 WARN_ON(1);
4882                 break;
4883         }
4884
4885         if (!rdev_ops)
4886                 return -EOPNOTSUPP;
4887
4888         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4889 }
4890
4891 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4892 {
4893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4894         struct net_device *dev = info->user_ptr[1];
4895
4896         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4897             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4898                 return -EOPNOTSUPP;
4899
4900         if (!rdev->ops->flush_pmksa)
4901                 return -EOPNOTSUPP;
4902
4903         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4904 }
4905
4906 static int nl80211_remain_on_channel(struct sk_buff *skb,
4907                                      struct genl_info *info)
4908 {
4909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4910         struct net_device *dev = info->user_ptr[1];
4911         struct ieee80211_channel *chan;
4912         struct sk_buff *msg;
4913         void *hdr;
4914         u64 cookie;
4915         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4916         u32 freq, duration;
4917         int err;
4918
4919         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4920             !info->attrs[NL80211_ATTR_DURATION])
4921                 return -EINVAL;
4922
4923         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4924
4925         /*
4926          * We should be on that channel for at least one jiffie,
4927          * and more than 5 seconds seems excessive.
4928          */
4929         if (!duration || !msecs_to_jiffies(duration) ||
4930             duration > rdev->wiphy.max_remain_on_channel_duration)
4931                 return -EINVAL;
4932
4933         if (!rdev->ops->remain_on_channel)
4934                 return -EOPNOTSUPP;
4935
4936         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4937                 channel_type = nla_get_u32(
4938                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4939                 if (channel_type != NL80211_CHAN_NO_HT &&
4940                     channel_type != NL80211_CHAN_HT20 &&
4941                     channel_type != NL80211_CHAN_HT40PLUS &&
4942                     channel_type != NL80211_CHAN_HT40MINUS)
4943                         return -EINVAL;
4944         }
4945
4946         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4947         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4948         if (chan == NULL)
4949                 return -EINVAL;
4950
4951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4952         if (!msg)
4953                 return -ENOMEM;
4954
4955         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4956                              NL80211_CMD_REMAIN_ON_CHANNEL);
4957
4958         if (IS_ERR(hdr)) {
4959                 err = PTR_ERR(hdr);
4960                 goto free_msg;
4961         }
4962
4963         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4964                                            channel_type, duration, &cookie);
4965
4966         if (err)
4967                 goto free_msg;
4968
4969         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4970
4971         genlmsg_end(msg, hdr);
4972
4973         return genlmsg_reply(msg, info);
4974
4975  nla_put_failure:
4976         err = -ENOBUFS;
4977  free_msg:
4978         nlmsg_free(msg);
4979         return err;
4980 }
4981
4982 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4983                                             struct genl_info *info)
4984 {
4985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4986         struct net_device *dev = info->user_ptr[1];
4987         u64 cookie;
4988
4989         if (!info->attrs[NL80211_ATTR_COOKIE])
4990                 return -EINVAL;
4991
4992         if (!rdev->ops->cancel_remain_on_channel)
4993                 return -EOPNOTSUPP;
4994
4995         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4996
4997         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4998 }
4999
5000 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5001                            u8 *rates, u8 rates_len)
5002 {
5003         u8 i;
5004         u32 mask = 0;
5005
5006         for (i = 0; i < rates_len; i++) {
5007                 int rate = (rates[i] & 0x7f) * 5;
5008                 int ridx;
5009                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5010                         struct ieee80211_rate *srate =
5011                                 &sband->bitrates[ridx];
5012                         if (rate == srate->bitrate) {
5013                                 mask |= 1 << ridx;
5014                                 break;
5015                         }
5016                 }
5017                 if (ridx == sband->n_bitrates)
5018                         return 0; /* rate not found */
5019         }
5020
5021         return mask;
5022 }
5023
5024 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5025         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5026                                     .len = NL80211_MAX_SUPP_RATES },
5027 };
5028
5029 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5030                                        struct genl_info *info)
5031 {
5032         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5034         struct cfg80211_bitrate_mask mask;
5035         int rem, i;
5036         struct net_device *dev = info->user_ptr[1];
5037         struct nlattr *tx_rates;
5038         struct ieee80211_supported_band *sband;
5039
5040         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5041                 return -EINVAL;
5042
5043         if (!rdev->ops->set_bitrate_mask)
5044                 return -EOPNOTSUPP;
5045
5046         memset(&mask, 0, sizeof(mask));
5047         /* Default to all rates enabled */
5048         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5049                 sband = rdev->wiphy.bands[i];
5050                 mask.control[i].legacy =
5051                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5052         }
5053
5054         /*
5055          * The nested attribute uses enum nl80211_band as the index. This maps
5056          * directly to the enum ieee80211_band values used in cfg80211.
5057          */
5058         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5059         {
5060                 enum ieee80211_band band = nla_type(tx_rates);
5061                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5062                         return -EINVAL;
5063                 sband = rdev->wiphy.bands[band];
5064                 if (sband == NULL)
5065                         return -EINVAL;
5066                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5067                           nla_len(tx_rates), nl80211_txattr_policy);
5068                 if (tb[NL80211_TXRATE_LEGACY]) {
5069                         mask.control[band].legacy = rateset_to_mask(
5070                                 sband,
5071                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5072                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5073                         if (mask.control[band].legacy == 0)
5074                                 return -EINVAL;
5075                 }
5076         }
5077
5078         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5079 }
5080
5081 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5082 {
5083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5084         struct net_device *dev = info->user_ptr[1];
5085         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5086
5087         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5088                 return -EINVAL;
5089
5090         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5091                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5092
5093         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5094             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5095             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5097             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5098             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5099             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5100                 return -EOPNOTSUPP;
5101
5102         /* not much point in registering if we can't reply */
5103         if (!rdev->ops->mgmt_tx)
5104                 return -EOPNOTSUPP;
5105
5106         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5107                         frame_type,
5108                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5109                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5110 }
5111
5112 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5113 {
5114         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5115         struct net_device *dev = info->user_ptr[1];
5116         struct ieee80211_channel *chan;
5117         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5118         bool channel_type_valid = false;
5119         u32 freq;
5120         int err;
5121         void *hdr;
5122         u64 cookie;
5123         struct sk_buff *msg;
5124         unsigned int wait = 0;
5125         bool offchan;
5126
5127         if (!info->attrs[NL80211_ATTR_FRAME] ||
5128             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5129                 return -EINVAL;
5130
5131         if (!rdev->ops->mgmt_tx)
5132                 return -EOPNOTSUPP;
5133
5134         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5135             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5136             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5137             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5138             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5139             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5140             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5141                 return -EOPNOTSUPP;
5142
5143         if (info->attrs[NL80211_ATTR_DURATION]) {
5144                 if (!rdev->ops->mgmt_tx_cancel_wait)
5145                         return -EINVAL;
5146                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5147         }
5148
5149         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5150                 channel_type = nla_get_u32(
5151                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5152                 if (channel_type != NL80211_CHAN_NO_HT &&
5153                     channel_type != NL80211_CHAN_HT20 &&
5154                     channel_type != NL80211_CHAN_HT40PLUS &&
5155                     channel_type != NL80211_CHAN_HT40MINUS)
5156                         return -EINVAL;
5157                 channel_type_valid = true;
5158         }
5159
5160         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5161
5162         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5163         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5164         if (chan == NULL)
5165                 return -EINVAL;
5166
5167         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5168         if (!msg)
5169                 return -ENOMEM;
5170
5171         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5172                              NL80211_CMD_FRAME);
5173
5174         if (IS_ERR(hdr)) {
5175                 err = PTR_ERR(hdr);
5176                 goto free_msg;
5177         }
5178         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5179                                     channel_type_valid, wait,
5180                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5181                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5182                                     &cookie);
5183         if (err)
5184                 goto free_msg;
5185
5186         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5187
5188         genlmsg_end(msg, hdr);
5189         return genlmsg_reply(msg, info);
5190
5191  nla_put_failure:
5192         err = -ENOBUFS;
5193  free_msg:
5194         nlmsg_free(msg);
5195         return err;
5196 }
5197
5198 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5199 {
5200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5201         struct net_device *dev = info->user_ptr[1];
5202         u64 cookie;
5203
5204         if (!info->attrs[NL80211_ATTR_COOKIE])
5205                 return -EINVAL;
5206
5207         if (!rdev->ops->mgmt_tx_cancel_wait)
5208                 return -EOPNOTSUPP;
5209
5210         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5211             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5212             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5213             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5214             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5215             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5216                 return -EOPNOTSUPP;
5217
5218         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5219
5220         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5221 }
5222
5223 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5224 {
5225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5226         struct wireless_dev *wdev;
5227         struct net_device *dev = info->user_ptr[1];
5228         u8 ps_state;
5229         bool state;
5230         int err;
5231
5232         if (!info->attrs[NL80211_ATTR_PS_STATE])
5233                 return -EINVAL;
5234
5235         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5236
5237         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5238                 return -EINVAL;
5239
5240         wdev = dev->ieee80211_ptr;
5241
5242         if (!rdev->ops->set_power_mgmt)
5243                 return -EOPNOTSUPP;
5244
5245         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5246
5247         if (state == wdev->ps)
5248                 return 0;
5249
5250         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5251                                         wdev->ps_timeout);
5252         if (!err)
5253                 wdev->ps = state;
5254         return err;
5255 }
5256
5257 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5258 {
5259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5260         enum nl80211_ps_state ps_state;
5261         struct wireless_dev *wdev;
5262         struct net_device *dev = info->user_ptr[1];
5263         struct sk_buff *msg;
5264         void *hdr;
5265         int err;
5266
5267         wdev = dev->ieee80211_ptr;
5268
5269         if (!rdev->ops->set_power_mgmt)
5270                 return -EOPNOTSUPP;
5271
5272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5273         if (!msg)
5274                 return -ENOMEM;
5275
5276         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5277                              NL80211_CMD_GET_POWER_SAVE);
5278         if (!hdr) {
5279                 err = -ENOBUFS;
5280                 goto free_msg;
5281         }
5282
5283         if (wdev->ps)
5284                 ps_state = NL80211_PS_ENABLED;
5285         else
5286                 ps_state = NL80211_PS_DISABLED;
5287
5288         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5289
5290         genlmsg_end(msg, hdr);
5291         return genlmsg_reply(msg, info);
5292
5293  nla_put_failure:
5294         err = -ENOBUFS;
5295  free_msg:
5296         nlmsg_free(msg);
5297         return err;
5298 }
5299
5300 static struct nla_policy
5301 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5302         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5303         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5304         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5305 };
5306
5307 static int nl80211_set_cqm_rssi(struct genl_info *info,
5308                                 s32 threshold, u32 hysteresis)
5309 {
5310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5311         struct wireless_dev *wdev;
5312         struct net_device *dev = info->user_ptr[1];
5313
5314         if (threshold > 0)
5315                 return -EINVAL;
5316
5317         wdev = dev->ieee80211_ptr;
5318
5319         if (!rdev->ops->set_cqm_rssi_config)
5320                 return -EOPNOTSUPP;
5321
5322         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5323             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5324                 return -EOPNOTSUPP;
5325
5326         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5327                                               threshold, hysteresis);
5328 }
5329
5330 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5331 {
5332         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5333         struct nlattr *cqm;
5334         int err;
5335
5336         cqm = info->attrs[NL80211_ATTR_CQM];
5337         if (!cqm) {
5338                 err = -EINVAL;
5339                 goto out;
5340         }
5341
5342         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5343                                nl80211_attr_cqm_policy);
5344         if (err)
5345                 goto out;
5346
5347         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5348             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5349                 s32 threshold;
5350                 u32 hysteresis;
5351                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5352                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5353                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5354         } else
5355                 err = -EINVAL;
5356
5357 out:
5358         return err;
5359 }
5360
5361 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5362 {
5363         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5364         struct net_device *dev = info->user_ptr[1];
5365         struct mesh_config cfg;
5366         struct mesh_setup setup;
5367         int err;
5368
5369         /* start with default */
5370         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5371         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5372
5373         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5374                 /* and parse parameters if given */
5375                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5376                 if (err)
5377                         return err;
5378         }
5379
5380         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5381             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5382                 return -EINVAL;
5383
5384         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5385         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5386
5387         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5388                 /* parse additional setup parameters if given */
5389                 err = nl80211_parse_mesh_setup(info, &setup);
5390                 if (err)
5391                         return err;
5392         }
5393
5394         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5395 }
5396
5397 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5398 {
5399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5400         struct net_device *dev = info->user_ptr[1];
5401
5402         return cfg80211_leave_mesh(rdev, dev);
5403 }
5404
5405 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5406 {
5407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5408         struct sk_buff *msg;
5409         void *hdr;
5410
5411         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5412                 return -EOPNOTSUPP;
5413
5414         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5415         if (!msg)
5416                 return -ENOMEM;
5417
5418         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5419                              NL80211_CMD_GET_WOWLAN);
5420         if (!hdr)
5421                 goto nla_put_failure;
5422
5423         if (rdev->wowlan) {
5424                 struct nlattr *nl_wowlan;
5425
5426                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5427                 if (!nl_wowlan)
5428                         goto nla_put_failure;
5429
5430                 if (rdev->wowlan->any)
5431                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5432                 if (rdev->wowlan->disconnect)
5433                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5434                 if (rdev->wowlan->magic_pkt)
5435                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5436                 if (rdev->wowlan->gtk_rekey_failure)
5437                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5438                 if (rdev->wowlan->eap_identity_req)
5439                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5440                 if (rdev->wowlan->four_way_handshake)
5441                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5442                 if (rdev->wowlan->rfkill_release)
5443                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5444                 if (rdev->wowlan->n_patterns) {
5445                         struct nlattr *nl_pats, *nl_pat;
5446                         int i, pat_len;
5447
5448                         nl_pats = nla_nest_start(msg,
5449                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5450                         if (!nl_pats)
5451                                 goto nla_put_failure;
5452
5453                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5454                                 nl_pat = nla_nest_start(msg, i + 1);
5455                                 if (!nl_pat)
5456                                         goto nla_put_failure;
5457                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5458                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5459                                         DIV_ROUND_UP(pat_len, 8),
5460                                         rdev->wowlan->patterns[i].mask);
5461                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5462                                         pat_len,
5463                                         rdev->wowlan->patterns[i].pattern);
5464                                 nla_nest_end(msg, nl_pat);
5465                         }
5466                         nla_nest_end(msg, nl_pats);
5467                 }
5468
5469                 nla_nest_end(msg, nl_wowlan);
5470         }
5471
5472         genlmsg_end(msg, hdr);
5473         return genlmsg_reply(msg, info);
5474
5475 nla_put_failure:
5476         nlmsg_free(msg);
5477         return -ENOBUFS;
5478 }
5479
5480 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5481 {
5482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5483         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5484         struct cfg80211_wowlan no_triggers = {};
5485         struct cfg80211_wowlan new_triggers = {};
5486         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5487         int err, i;
5488
5489         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5490                 return -EOPNOTSUPP;
5491
5492         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5493                 goto no_triggers;
5494
5495         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5496                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5497                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5498                         nl80211_wowlan_policy);
5499         if (err)
5500                 return err;
5501
5502         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5503                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5504                         return -EINVAL;
5505                 new_triggers.any = true;
5506         }
5507
5508         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5509                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5510                         return -EINVAL;
5511                 new_triggers.disconnect = true;
5512         }
5513
5514         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5515                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5516                         return -EINVAL;
5517                 new_triggers.magic_pkt = true;
5518         }
5519
5520         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5521                 return -EINVAL;
5522
5523         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5524                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5525                         return -EINVAL;
5526                 new_triggers.gtk_rekey_failure = true;
5527         }
5528
5529         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5530                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5531                         return -EINVAL;
5532                 new_triggers.eap_identity_req = true;
5533         }
5534
5535         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5536                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5537                         return -EINVAL;
5538                 new_triggers.four_way_handshake = true;
5539         }
5540
5541         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5542                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5543                         return -EINVAL;
5544                 new_triggers.rfkill_release = true;
5545         }
5546
5547         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5548                 struct nlattr *pat;
5549                 int n_patterns = 0;
5550                 int rem, pat_len, mask_len;
5551                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5552
5553                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5554                                     rem)
5555                         n_patterns++;
5556                 if (n_patterns > wowlan->n_patterns)
5557                         return -EINVAL;
5558
5559                 new_triggers.patterns = kcalloc(n_patterns,
5560                                                 sizeof(new_triggers.patterns[0]),
5561                                                 GFP_KERNEL);
5562                 if (!new_triggers.patterns)
5563                         return -ENOMEM;
5564
5565                 new_triggers.n_patterns = n_patterns;
5566                 i = 0;
5567
5568                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5569                                     rem) {
5570                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5571                                   nla_data(pat), nla_len(pat), NULL);
5572                         err = -EINVAL;
5573                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5574                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5575                                 goto error;
5576                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5577                         mask_len = DIV_ROUND_UP(pat_len, 8);
5578                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5579                             mask_len)
5580                                 goto error;
5581                         if (pat_len > wowlan->pattern_max_len ||
5582                             pat_len < wowlan->pattern_min_len)
5583                                 goto error;
5584
5585                         new_triggers.patterns[i].mask =
5586                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5587                         if (!new_triggers.patterns[i].mask) {
5588                                 err = -ENOMEM;
5589                                 goto error;
5590                         }
5591                         new_triggers.patterns[i].pattern =
5592                                 new_triggers.patterns[i].mask + mask_len;
5593                         memcpy(new_triggers.patterns[i].mask,
5594                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5595                                mask_len);
5596                         new_triggers.patterns[i].pattern_len = pat_len;
5597                         memcpy(new_triggers.patterns[i].pattern,
5598                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5599                                pat_len);
5600                         i++;
5601                 }
5602         }
5603
5604         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5605                 struct cfg80211_wowlan *ntrig;
5606                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5607                                 GFP_KERNEL);
5608                 if (!ntrig) {
5609                         err = -ENOMEM;
5610                         goto error;
5611                 }
5612                 cfg80211_rdev_free_wowlan(rdev);
5613                 rdev->wowlan = ntrig;
5614         } else {
5615  no_triggers:
5616                 cfg80211_rdev_free_wowlan(rdev);
5617                 rdev->wowlan = NULL;
5618         }
5619
5620         return 0;
5621  error:
5622         for (i = 0; i < new_triggers.n_patterns; i++)
5623                 kfree(new_triggers.patterns[i].mask);
5624         kfree(new_triggers.patterns);
5625         return err;
5626 }
5627
5628 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5629 {
5630         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5631         struct net_device *dev = info->user_ptr[1];
5632         struct wireless_dev *wdev = dev->ieee80211_ptr;
5633         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5634         struct cfg80211_gtk_rekey_data rekey_data;
5635         int err;
5636
5637         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5638                 return -EINVAL;
5639
5640         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5641                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5642                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5643                         nl80211_rekey_policy);
5644         if (err)
5645                 return err;
5646
5647         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5648                 return -ERANGE;
5649         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5650                 return -ERANGE;
5651         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5652                 return -ERANGE;
5653
5654         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5655                NL80211_KEK_LEN);
5656         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5657                NL80211_KCK_LEN);
5658         memcpy(rekey_data.replay_ctr,
5659                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5660                NL80211_REPLAY_CTR_LEN);
5661
5662         wdev_lock(wdev);
5663         if (!wdev->current_bss) {
5664                 err = -ENOTCONN;
5665                 goto out;
5666         }
5667
5668         if (!rdev->ops->set_rekey_data) {
5669                 err = -EOPNOTSUPP;
5670                 goto out;
5671         }
5672
5673         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5674  out:
5675         wdev_unlock(wdev);
5676         return err;
5677 }
5678
5679 #define NL80211_FLAG_NEED_WIPHY         0x01
5680 #define NL80211_FLAG_NEED_NETDEV        0x02
5681 #define NL80211_FLAG_NEED_RTNL          0x04
5682 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5683 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5684                                          NL80211_FLAG_CHECK_NETDEV_UP)
5685
5686 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5687                             struct genl_info *info)
5688 {
5689         struct cfg80211_registered_device *rdev;
5690         struct net_device *dev;
5691         int err;
5692         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5693
5694         if (rtnl)
5695                 rtnl_lock();
5696
5697         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5698                 rdev = cfg80211_get_dev_from_info(info);
5699                 if (IS_ERR(rdev)) {
5700                         if (rtnl)
5701                                 rtnl_unlock();
5702                         return PTR_ERR(rdev);
5703                 }
5704                 info->user_ptr[0] = rdev;
5705         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5706                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5707                 if (err) {
5708                         if (rtnl)
5709                                 rtnl_unlock();
5710                         return err;
5711                 }
5712                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5713                     !netif_running(dev)) {
5714                         cfg80211_unlock_rdev(rdev);
5715                         dev_put(dev);
5716                         if (rtnl)
5717                                 rtnl_unlock();
5718                         return -ENETDOWN;
5719                 }
5720                 info->user_ptr[0] = rdev;
5721                 info->user_ptr[1] = dev;
5722         }
5723
5724         return 0;
5725 }
5726
5727 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5728                               struct genl_info *info)
5729 {
5730         if (info->user_ptr[0])
5731                 cfg80211_unlock_rdev(info->user_ptr[0]);
5732         if (info->user_ptr[1])
5733                 dev_put(info->user_ptr[1]);
5734         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5735                 rtnl_unlock();
5736 }
5737
5738 static struct genl_ops nl80211_ops[] = {
5739         {
5740                 .cmd = NL80211_CMD_GET_WIPHY,
5741                 .doit = nl80211_get_wiphy,
5742                 .dumpit = nl80211_dump_wiphy,
5743                 .policy = nl80211_policy,
5744                 /* can be retrieved by unprivileged users */
5745                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5746         },
5747         {
5748                 .cmd = NL80211_CMD_SET_WIPHY,
5749                 .doit = nl80211_set_wiphy,
5750                 .policy = nl80211_policy,
5751                 .flags = GENL_ADMIN_PERM,
5752                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5753         },
5754         {
5755                 .cmd = NL80211_CMD_GET_INTERFACE,
5756                 .doit = nl80211_get_interface,
5757                 .dumpit = nl80211_dump_interface,
5758                 .policy = nl80211_policy,
5759                 /* can be retrieved by unprivileged users */
5760                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5761         },
5762         {
5763                 .cmd = NL80211_CMD_SET_INTERFACE,
5764                 .doit = nl80211_set_interface,
5765                 .policy = nl80211_policy,
5766                 .flags = GENL_ADMIN_PERM,
5767                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5768                                   NL80211_FLAG_NEED_RTNL,
5769         },
5770         {
5771                 .cmd = NL80211_CMD_NEW_INTERFACE,
5772                 .doit = nl80211_new_interface,
5773                 .policy = nl80211_policy,
5774                 .flags = GENL_ADMIN_PERM,
5775                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5776                                   NL80211_FLAG_NEED_RTNL,
5777         },
5778         {
5779                 .cmd = NL80211_CMD_DEL_INTERFACE,
5780                 .doit = nl80211_del_interface,
5781                 .policy = nl80211_policy,
5782                 .flags = GENL_ADMIN_PERM,
5783                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5784                                   NL80211_FLAG_NEED_RTNL,
5785         },
5786         {
5787                 .cmd = NL80211_CMD_GET_KEY,
5788                 .doit = nl80211_get_key,
5789                 .policy = nl80211_policy,
5790                 .flags = GENL_ADMIN_PERM,
5791                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5792                                   NL80211_FLAG_NEED_RTNL,
5793         },
5794         {
5795                 .cmd = NL80211_CMD_SET_KEY,
5796                 .doit = nl80211_set_key,
5797                 .policy = nl80211_policy,
5798                 .flags = GENL_ADMIN_PERM,
5799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5800                                   NL80211_FLAG_NEED_RTNL,
5801         },
5802         {
5803                 .cmd = NL80211_CMD_NEW_KEY,
5804                 .doit = nl80211_new_key,
5805                 .policy = nl80211_policy,
5806                 .flags = GENL_ADMIN_PERM,
5807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5808                                   NL80211_FLAG_NEED_RTNL,
5809         },
5810         {
5811                 .cmd = NL80211_CMD_DEL_KEY,
5812                 .doit = nl80211_del_key,
5813                 .policy = nl80211_policy,
5814                 .flags = GENL_ADMIN_PERM,
5815                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5816                                   NL80211_FLAG_NEED_RTNL,
5817         },
5818         {
5819                 .cmd = NL80211_CMD_SET_BEACON,
5820                 .policy = nl80211_policy,
5821                 .flags = GENL_ADMIN_PERM,
5822                 .doit = nl80211_addset_beacon,
5823                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5824                                   NL80211_FLAG_NEED_RTNL,
5825         },
5826         {
5827                 .cmd = NL80211_CMD_NEW_BEACON,
5828                 .policy = nl80211_policy,
5829                 .flags = GENL_ADMIN_PERM,
5830                 .doit = nl80211_addset_beacon,
5831                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5832                                   NL80211_FLAG_NEED_RTNL,
5833         },
5834         {
5835                 .cmd = NL80211_CMD_DEL_BEACON,
5836                 .policy = nl80211_policy,
5837                 .flags = GENL_ADMIN_PERM,
5838                 .doit = nl80211_del_beacon,
5839                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5840                                   NL80211_FLAG_NEED_RTNL,
5841         },
5842         {
5843                 .cmd = NL80211_CMD_GET_STATION,
5844                 .doit = nl80211_get_station,
5845                 .dumpit = nl80211_dump_station,
5846                 .policy = nl80211_policy,
5847                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5848                                   NL80211_FLAG_NEED_RTNL,
5849         },
5850         {
5851                 .cmd = NL80211_CMD_SET_STATION,
5852                 .doit = nl80211_set_station,
5853                 .policy = nl80211_policy,
5854                 .flags = GENL_ADMIN_PERM,
5855                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5856                                   NL80211_FLAG_NEED_RTNL,
5857         },
5858         {
5859                 .cmd = NL80211_CMD_NEW_STATION,
5860                 .doit = nl80211_new_station,
5861                 .policy = nl80211_policy,
5862                 .flags = GENL_ADMIN_PERM,
5863                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5864                                   NL80211_FLAG_NEED_RTNL,
5865         },
5866         {
5867                 .cmd = NL80211_CMD_DEL_STATION,
5868                 .doit = nl80211_del_station,
5869                 .policy = nl80211_policy,
5870                 .flags = GENL_ADMIN_PERM,
5871                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5872                                   NL80211_FLAG_NEED_RTNL,
5873         },
5874         {
5875                 .cmd = NL80211_CMD_GET_MPATH,
5876                 .doit = nl80211_get_mpath,
5877                 .dumpit = nl80211_dump_mpath,
5878                 .policy = nl80211_policy,
5879                 .flags = GENL_ADMIN_PERM,
5880                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5881                                   NL80211_FLAG_NEED_RTNL,
5882         },
5883         {
5884                 .cmd = NL80211_CMD_SET_MPATH,
5885                 .doit = nl80211_set_mpath,
5886                 .policy = nl80211_policy,
5887                 .flags = GENL_ADMIN_PERM,
5888                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5889                                   NL80211_FLAG_NEED_RTNL,
5890         },
5891         {
5892                 .cmd = NL80211_CMD_NEW_MPATH,
5893                 .doit = nl80211_new_mpath,
5894                 .policy = nl80211_policy,
5895                 .flags = GENL_ADMIN_PERM,
5896                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5897                                   NL80211_FLAG_NEED_RTNL,
5898         },
5899         {
5900                 .cmd = NL80211_CMD_DEL_MPATH,
5901                 .doit = nl80211_del_mpath,
5902                 .policy = nl80211_policy,
5903                 .flags = GENL_ADMIN_PERM,
5904                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5905                                   NL80211_FLAG_NEED_RTNL,
5906         },
5907         {
5908                 .cmd = NL80211_CMD_SET_BSS,
5909                 .doit = nl80211_set_bss,
5910                 .policy = nl80211_policy,
5911                 .flags = GENL_ADMIN_PERM,
5912                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5913                                   NL80211_FLAG_NEED_RTNL,
5914         },
5915         {
5916                 .cmd = NL80211_CMD_GET_REG,
5917                 .doit = nl80211_get_reg,
5918                 .policy = nl80211_policy,
5919                 /* can be retrieved by unprivileged users */
5920         },
5921         {
5922                 .cmd = NL80211_CMD_SET_REG,
5923                 .doit = nl80211_set_reg,
5924                 .policy = nl80211_policy,
5925                 .flags = GENL_ADMIN_PERM,
5926         },
5927         {
5928                 .cmd = NL80211_CMD_REQ_SET_REG,
5929                 .doit = nl80211_req_set_reg,
5930                 .policy = nl80211_policy,
5931                 .flags = GENL_ADMIN_PERM,
5932         },
5933         {
5934                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5935                 .doit = nl80211_get_mesh_config,
5936                 .policy = nl80211_policy,
5937                 /* can be retrieved by unprivileged users */
5938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5939                                   NL80211_FLAG_NEED_RTNL,
5940         },
5941         {
5942                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5943                 .doit = nl80211_update_mesh_config,
5944                 .policy = nl80211_policy,
5945                 .flags = GENL_ADMIN_PERM,
5946                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5947                                   NL80211_FLAG_NEED_RTNL,
5948         },
5949         {
5950                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5951                 .doit = nl80211_trigger_scan,
5952                 .policy = nl80211_policy,
5953                 .flags = GENL_ADMIN_PERM,
5954                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5955                                   NL80211_FLAG_NEED_RTNL,
5956         },
5957         {
5958                 .cmd = NL80211_CMD_GET_SCAN,
5959                 .policy = nl80211_policy,
5960                 .dumpit = nl80211_dump_scan,
5961         },
5962         {
5963                 .cmd = NL80211_CMD_START_SCHED_SCAN,
5964                 .doit = nl80211_start_sched_scan,
5965                 .policy = nl80211_policy,
5966                 .flags = GENL_ADMIN_PERM,
5967                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5968                                   NL80211_FLAG_NEED_RTNL,
5969         },
5970         {
5971                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
5972                 .doit = nl80211_stop_sched_scan,
5973                 .policy = nl80211_policy,
5974                 .flags = GENL_ADMIN_PERM,
5975                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5976                                   NL80211_FLAG_NEED_RTNL,
5977         },
5978         {
5979                 .cmd = NL80211_CMD_AUTHENTICATE,
5980                 .doit = nl80211_authenticate,
5981                 .policy = nl80211_policy,
5982                 .flags = GENL_ADMIN_PERM,
5983                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5984                                   NL80211_FLAG_NEED_RTNL,
5985         },
5986         {
5987                 .cmd = NL80211_CMD_ASSOCIATE,
5988                 .doit = nl80211_associate,
5989                 .policy = nl80211_policy,
5990                 .flags = GENL_ADMIN_PERM,
5991                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5992                                   NL80211_FLAG_NEED_RTNL,
5993         },
5994         {
5995                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5996                 .doit = nl80211_deauthenticate,
5997                 .policy = nl80211_policy,
5998                 .flags = GENL_ADMIN_PERM,
5999                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6000                                   NL80211_FLAG_NEED_RTNL,
6001         },
6002         {
6003                 .cmd = NL80211_CMD_DISASSOCIATE,
6004                 .doit = nl80211_disassociate,
6005                 .policy = nl80211_policy,
6006                 .flags = GENL_ADMIN_PERM,
6007                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6008                                   NL80211_FLAG_NEED_RTNL,
6009         },
6010         {
6011                 .cmd = NL80211_CMD_JOIN_IBSS,
6012                 .doit = nl80211_join_ibss,
6013                 .policy = nl80211_policy,
6014                 .flags = GENL_ADMIN_PERM,
6015                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6016                                   NL80211_FLAG_NEED_RTNL,
6017         },
6018         {
6019                 .cmd = NL80211_CMD_LEAVE_IBSS,
6020                 .doit = nl80211_leave_ibss,
6021                 .policy = nl80211_policy,
6022                 .flags = GENL_ADMIN_PERM,
6023                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6024                                   NL80211_FLAG_NEED_RTNL,
6025         },
6026 #ifdef CONFIG_NL80211_TESTMODE
6027         {
6028                 .cmd = NL80211_CMD_TESTMODE,
6029                 .doit = nl80211_testmode_do,
6030                 .dumpit = nl80211_testmode_dump,
6031                 .policy = nl80211_policy,
6032                 .flags = GENL_ADMIN_PERM,
6033                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6034                                   NL80211_FLAG_NEED_RTNL,
6035         },
6036 #endif
6037         {
6038                 .cmd = NL80211_CMD_CONNECT,
6039                 .doit = nl80211_connect,
6040                 .policy = nl80211_policy,
6041                 .flags = GENL_ADMIN_PERM,
6042                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6043                                   NL80211_FLAG_NEED_RTNL,
6044         },
6045         {
6046                 .cmd = NL80211_CMD_DISCONNECT,
6047                 .doit = nl80211_disconnect,
6048                 .policy = nl80211_policy,
6049                 .flags = GENL_ADMIN_PERM,
6050                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6051                                   NL80211_FLAG_NEED_RTNL,
6052         },
6053         {
6054                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6055                 .doit = nl80211_wiphy_netns,
6056                 .policy = nl80211_policy,
6057                 .flags = GENL_ADMIN_PERM,
6058                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6059                                   NL80211_FLAG_NEED_RTNL,
6060         },
6061         {
6062                 .cmd = NL80211_CMD_GET_SURVEY,
6063                 .policy = nl80211_policy,
6064                 .dumpit = nl80211_dump_survey,
6065         },
6066         {
6067                 .cmd = NL80211_CMD_SET_PMKSA,
6068                 .doit = nl80211_setdel_pmksa,
6069                 .policy = nl80211_policy,
6070                 .flags = GENL_ADMIN_PERM,
6071                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6072                                   NL80211_FLAG_NEED_RTNL,
6073         },
6074         {
6075                 .cmd = NL80211_CMD_DEL_PMKSA,
6076                 .doit = nl80211_setdel_pmksa,
6077                 .policy = nl80211_policy,
6078                 .flags = GENL_ADMIN_PERM,
6079                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6080                                   NL80211_FLAG_NEED_RTNL,
6081         },
6082         {
6083                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6084                 .doit = nl80211_flush_pmksa,
6085                 .policy = nl80211_policy,
6086                 .flags = GENL_ADMIN_PERM,
6087                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6088                                   NL80211_FLAG_NEED_RTNL,
6089         },
6090         {
6091                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6092                 .doit = nl80211_remain_on_channel,
6093                 .policy = nl80211_policy,
6094                 .flags = GENL_ADMIN_PERM,
6095                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6096                                   NL80211_FLAG_NEED_RTNL,
6097         },
6098         {
6099                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6100                 .doit = nl80211_cancel_remain_on_channel,
6101                 .policy = nl80211_policy,
6102                 .flags = GENL_ADMIN_PERM,
6103                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6104                                   NL80211_FLAG_NEED_RTNL,
6105         },
6106         {
6107                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6108                 .doit = nl80211_set_tx_bitrate_mask,
6109                 .policy = nl80211_policy,
6110                 .flags = GENL_ADMIN_PERM,
6111                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6112                                   NL80211_FLAG_NEED_RTNL,
6113         },
6114         {
6115                 .cmd = NL80211_CMD_REGISTER_FRAME,
6116                 .doit = nl80211_register_mgmt,
6117                 .policy = nl80211_policy,
6118                 .flags = GENL_ADMIN_PERM,
6119                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6120                                   NL80211_FLAG_NEED_RTNL,
6121         },
6122         {
6123                 .cmd = NL80211_CMD_FRAME,
6124                 .doit = nl80211_tx_mgmt,
6125                 .policy = nl80211_policy,
6126                 .flags = GENL_ADMIN_PERM,
6127                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6128                                   NL80211_FLAG_NEED_RTNL,
6129         },
6130         {
6131                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6132                 .doit = nl80211_tx_mgmt_cancel_wait,
6133                 .policy = nl80211_policy,
6134                 .flags = GENL_ADMIN_PERM,
6135                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6136                                   NL80211_FLAG_NEED_RTNL,
6137         },
6138         {
6139                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6140                 .doit = nl80211_set_power_save,
6141                 .policy = nl80211_policy,
6142                 .flags = GENL_ADMIN_PERM,
6143                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6144                                   NL80211_FLAG_NEED_RTNL,
6145         },
6146         {
6147                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6148                 .doit = nl80211_get_power_save,
6149                 .policy = nl80211_policy,
6150                 /* can be retrieved by unprivileged users */
6151                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6152                                   NL80211_FLAG_NEED_RTNL,
6153         },
6154         {
6155                 .cmd = NL80211_CMD_SET_CQM,
6156                 .doit = nl80211_set_cqm,
6157                 .policy = nl80211_policy,
6158                 .flags = GENL_ADMIN_PERM,
6159                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6160                                   NL80211_FLAG_NEED_RTNL,
6161         },
6162         {
6163                 .cmd = NL80211_CMD_SET_CHANNEL,
6164                 .doit = nl80211_set_channel,
6165                 .policy = nl80211_policy,
6166                 .flags = GENL_ADMIN_PERM,
6167                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6168                                   NL80211_FLAG_NEED_RTNL,
6169         },
6170         {
6171                 .cmd = NL80211_CMD_SET_WDS_PEER,
6172                 .doit = nl80211_set_wds_peer,
6173                 .policy = nl80211_policy,
6174                 .flags = GENL_ADMIN_PERM,
6175                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6176                                   NL80211_FLAG_NEED_RTNL,
6177         },
6178         {
6179                 .cmd = NL80211_CMD_JOIN_MESH,
6180                 .doit = nl80211_join_mesh,
6181                 .policy = nl80211_policy,
6182                 .flags = GENL_ADMIN_PERM,
6183                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6184                                   NL80211_FLAG_NEED_RTNL,
6185         },
6186         {
6187                 .cmd = NL80211_CMD_LEAVE_MESH,
6188                 .doit = nl80211_leave_mesh,
6189                 .policy = nl80211_policy,
6190                 .flags = GENL_ADMIN_PERM,
6191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6192                                   NL80211_FLAG_NEED_RTNL,
6193         },
6194         {
6195                 .cmd = NL80211_CMD_GET_WOWLAN,
6196                 .doit = nl80211_get_wowlan,
6197                 .policy = nl80211_policy,
6198                 /* can be retrieved by unprivileged users */
6199                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6200                                   NL80211_FLAG_NEED_RTNL,
6201         },
6202         {
6203                 .cmd = NL80211_CMD_SET_WOWLAN,
6204                 .doit = nl80211_set_wowlan,
6205                 .policy = nl80211_policy,
6206                 .flags = GENL_ADMIN_PERM,
6207                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6208                                   NL80211_FLAG_NEED_RTNL,
6209         },
6210         {
6211                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6212                 .doit = nl80211_set_rekey_data,
6213                 .policy = nl80211_policy,
6214                 .flags = GENL_ADMIN_PERM,
6215                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6216                                   NL80211_FLAG_NEED_RTNL,
6217         },
6218 };
6219
6220 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6221         .name = "mlme",
6222 };
6223
6224 /* multicast groups */
6225 static struct genl_multicast_group nl80211_config_mcgrp = {
6226         .name = "config",
6227 };
6228 static struct genl_multicast_group nl80211_scan_mcgrp = {
6229         .name = "scan",
6230 };
6231 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6232         .name = "regulatory",
6233 };
6234
6235 /* notification functions */
6236
6237 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6238 {
6239         struct sk_buff *msg;
6240
6241         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6242         if (!msg)
6243                 return;
6244
6245         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6246                 nlmsg_free(msg);
6247                 return;
6248         }
6249
6250         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6251                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6252 }
6253
6254 static int nl80211_add_scan_req(struct sk_buff *msg,
6255                                 struct cfg80211_registered_device *rdev)
6256 {
6257         struct cfg80211_scan_request *req = rdev->scan_req;
6258         struct nlattr *nest;
6259         int i;
6260
6261         ASSERT_RDEV_LOCK(rdev);
6262
6263         if (WARN_ON(!req))
6264                 return 0;
6265
6266         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6267         if (!nest)
6268                 goto nla_put_failure;
6269         for (i = 0; i < req->n_ssids; i++)
6270                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6271         nla_nest_end(msg, nest);
6272
6273         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6274         if (!nest)
6275                 goto nla_put_failure;
6276         for (i = 0; i < req->n_channels; i++)
6277                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6278         nla_nest_end(msg, nest);
6279
6280         if (req->ie)
6281                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6282
6283         return 0;
6284  nla_put_failure:
6285         return -ENOBUFS;
6286 }
6287
6288 static int nl80211_send_scan_msg(struct sk_buff *msg,
6289                                  struct cfg80211_registered_device *rdev,
6290                                  struct net_device *netdev,
6291                                  u32 pid, u32 seq, int flags,
6292                                  u32 cmd)
6293 {
6294         void *hdr;
6295
6296         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6297         if (!hdr)
6298                 return -1;
6299
6300         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6301         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6302
6303         /* ignore errors and send incomplete event anyway */
6304         nl80211_add_scan_req(msg, rdev);
6305
6306         return genlmsg_end(msg, hdr);
6307
6308  nla_put_failure:
6309         genlmsg_cancel(msg, hdr);
6310         return -EMSGSIZE;
6311 }
6312
6313 static int
6314 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6315                             struct cfg80211_registered_device *rdev,
6316                             struct net_device *netdev,
6317                             u32 pid, u32 seq, int flags, u32 cmd)
6318 {
6319         void *hdr;
6320
6321         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6322         if (!hdr)
6323                 return -1;
6324
6325         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6326         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6327
6328         return genlmsg_end(msg, hdr);
6329
6330  nla_put_failure:
6331         genlmsg_cancel(msg, hdr);
6332         return -EMSGSIZE;
6333 }
6334
6335 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6336                              struct net_device *netdev)
6337 {
6338         struct sk_buff *msg;
6339
6340         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6341         if (!msg)
6342                 return;
6343
6344         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6345                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6346                 nlmsg_free(msg);
6347                 return;
6348         }
6349
6350         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6351                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6352 }
6353
6354 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6355                             struct net_device *netdev)
6356 {
6357         struct sk_buff *msg;
6358
6359         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6360         if (!msg)
6361                 return;
6362
6363         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6364                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6365                 nlmsg_free(msg);
6366                 return;
6367         }
6368
6369         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6370                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6371 }
6372
6373 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6374                                struct net_device *netdev)
6375 {
6376         struct sk_buff *msg;
6377
6378         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6379         if (!msg)
6380                 return;
6381
6382         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6383                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6384                 nlmsg_free(msg);
6385                 return;
6386         }
6387
6388         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6389                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6390 }
6391
6392 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6393                                      struct net_device *netdev)
6394 {
6395         struct sk_buff *msg;
6396
6397         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6398         if (!msg)
6399                 return;
6400
6401         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6402                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6403                 nlmsg_free(msg);
6404                 return;
6405         }
6406
6407         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6408                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6409 }
6410
6411 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6412                              struct net_device *netdev, u32 cmd)
6413 {
6414         struct sk_buff *msg;
6415
6416         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6417         if (!msg)
6418                 return;
6419
6420         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6421                 nlmsg_free(msg);
6422                 return;
6423         }
6424
6425         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6426                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6427 }
6428
6429 /*
6430  * This can happen on global regulatory changes or device specific settings
6431  * based on custom world regulatory domains.
6432  */
6433 void nl80211_send_reg_change_event(struct regulatory_request *request)
6434 {
6435         struct sk_buff *msg;
6436         void *hdr;
6437
6438         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6439         if (!msg)
6440                 return;
6441
6442         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6443         if (!hdr) {
6444                 nlmsg_free(msg);
6445                 return;
6446         }
6447
6448         /* Userspace can always count this one always being set */
6449         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6450
6451         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6452                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6453                            NL80211_REGDOM_TYPE_WORLD);
6454         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6455                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6456                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6457         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6458                  request->intersect)
6459                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6460                            NL80211_REGDOM_TYPE_INTERSECTION);
6461         else {
6462                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6463                            NL80211_REGDOM_TYPE_COUNTRY);
6464                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6465         }
6466
6467         if (wiphy_idx_valid(request->wiphy_idx))
6468                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6469
6470         if (genlmsg_end(msg, hdr) < 0) {
6471                 nlmsg_free(msg);
6472                 return;
6473         }
6474
6475         rcu_read_lock();
6476         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6477                                 GFP_ATOMIC);
6478         rcu_read_unlock();
6479
6480         return;
6481
6482 nla_put_failure:
6483         genlmsg_cancel(msg, hdr);
6484         nlmsg_free(msg);
6485 }
6486
6487 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6488                                     struct net_device *netdev,
6489                                     const u8 *buf, size_t len,
6490                                     enum nl80211_commands cmd, gfp_t gfp)
6491 {
6492         struct sk_buff *msg;
6493         void *hdr;
6494
6495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6496         if (!msg)
6497                 return;
6498
6499         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6500         if (!hdr) {
6501                 nlmsg_free(msg);
6502                 return;
6503         }
6504
6505         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6506         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6507         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6508
6509         if (genlmsg_end(msg, hdr) < 0) {
6510                 nlmsg_free(msg);
6511                 return;
6512         }
6513
6514         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6515                                 nl80211_mlme_mcgrp.id, gfp);
6516         return;
6517
6518  nla_put_failure:
6519         genlmsg_cancel(msg, hdr);
6520         nlmsg_free(msg);
6521 }
6522
6523 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6524                           struct net_device *netdev, const u8 *buf,
6525                           size_t len, gfp_t gfp)
6526 {
6527         nl80211_send_mlme_event(rdev, netdev, buf, len,
6528                                 NL80211_CMD_AUTHENTICATE, gfp);
6529 }
6530
6531 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6532                            struct net_device *netdev, const u8 *buf,
6533                            size_t len, gfp_t gfp)
6534 {
6535         nl80211_send_mlme_event(rdev, netdev, buf, len,
6536                                 NL80211_CMD_ASSOCIATE, gfp);
6537 }
6538
6539 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6540                          struct net_device *netdev, const u8 *buf,
6541                          size_t len, gfp_t gfp)
6542 {
6543         nl80211_send_mlme_event(rdev, netdev, buf, len,
6544                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6545 }
6546
6547 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6548                            struct net_device *netdev, const u8 *buf,
6549                            size_t len, gfp_t gfp)
6550 {
6551         nl80211_send_mlme_event(rdev, netdev, buf, len,
6552                                 NL80211_CMD_DISASSOCIATE, gfp);
6553 }
6554
6555 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6556                                 struct net_device *netdev, const u8 *buf,
6557                                 size_t len, gfp_t gfp)
6558 {
6559         nl80211_send_mlme_event(rdev, netdev, buf, len,
6560                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6561 }
6562
6563 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6564                                   struct net_device *netdev, const u8 *buf,
6565                                   size_t len, gfp_t gfp)
6566 {
6567         nl80211_send_mlme_event(rdev, netdev, buf, len,
6568                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6569 }
6570
6571 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6572                                       struct net_device *netdev, int cmd,
6573                                       const u8 *addr, gfp_t gfp)
6574 {
6575         struct sk_buff *msg;
6576         void *hdr;
6577
6578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6579         if (!msg)
6580                 return;
6581
6582         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6583         if (!hdr) {
6584                 nlmsg_free(msg);
6585                 return;
6586         }
6587
6588         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6589         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6590         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6591         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6592
6593         if (genlmsg_end(msg, hdr) < 0) {
6594                 nlmsg_free(msg);
6595                 return;
6596         }
6597
6598         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6599                                 nl80211_mlme_mcgrp.id, gfp);
6600         return;
6601
6602  nla_put_failure:
6603         genlmsg_cancel(msg, hdr);
6604         nlmsg_free(msg);
6605 }
6606
6607 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6608                                struct net_device *netdev, const u8 *addr,
6609                                gfp_t gfp)
6610 {
6611         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6612                                   addr, gfp);
6613 }
6614
6615 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6616                                 struct net_device *netdev, const u8 *addr,
6617                                 gfp_t gfp)
6618 {
6619         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6620                                   addr, gfp);
6621 }
6622
6623 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6624                                  struct net_device *netdev, const u8 *bssid,
6625                                  const u8 *req_ie, size_t req_ie_len,
6626                                  const u8 *resp_ie, size_t resp_ie_len,
6627                                  u16 status, gfp_t gfp)
6628 {
6629         struct sk_buff *msg;
6630         void *hdr;
6631
6632         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6633         if (!msg)
6634                 return;
6635
6636         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6637         if (!hdr) {
6638                 nlmsg_free(msg);
6639                 return;
6640         }
6641
6642         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6643         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6644         if (bssid)
6645                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6646         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6647         if (req_ie)
6648                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6649         if (resp_ie)
6650                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6651
6652         if (genlmsg_end(msg, hdr) < 0) {
6653                 nlmsg_free(msg);
6654                 return;
6655         }
6656
6657         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6658                                 nl80211_mlme_mcgrp.id, gfp);
6659         return;
6660
6661  nla_put_failure:
6662         genlmsg_cancel(msg, hdr);
6663         nlmsg_free(msg);
6664
6665 }
6666
6667 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6668                          struct net_device *netdev, const u8 *bssid,
6669                          const u8 *req_ie, size_t req_ie_len,
6670                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6671 {
6672         struct sk_buff *msg;
6673         void *hdr;
6674
6675         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6676         if (!msg)
6677                 return;
6678
6679         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6680         if (!hdr) {
6681                 nlmsg_free(msg);
6682                 return;
6683         }
6684
6685         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6686         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6687         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6688         if (req_ie)
6689                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6690         if (resp_ie)
6691                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6692
6693         if (genlmsg_end(msg, hdr) < 0) {
6694                 nlmsg_free(msg);
6695                 return;
6696         }
6697
6698         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6699                                 nl80211_mlme_mcgrp.id, gfp);
6700         return;
6701
6702  nla_put_failure:
6703         genlmsg_cancel(msg, hdr);
6704         nlmsg_free(msg);
6705
6706 }
6707
6708 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6709                                struct net_device *netdev, u16 reason,
6710                                const u8 *ie, size_t ie_len, bool from_ap)
6711 {
6712         struct sk_buff *msg;
6713         void *hdr;
6714
6715         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6716         if (!msg)
6717                 return;
6718
6719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6720         if (!hdr) {
6721                 nlmsg_free(msg);
6722                 return;
6723         }
6724
6725         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6726         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6727         if (from_ap && reason)
6728                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6729         if (from_ap)
6730                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6731         if (ie)
6732                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6733
6734         if (genlmsg_end(msg, hdr) < 0) {
6735                 nlmsg_free(msg);
6736                 return;
6737         }
6738
6739         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6740                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6741         return;
6742
6743  nla_put_failure:
6744         genlmsg_cancel(msg, hdr);
6745         nlmsg_free(msg);
6746
6747 }
6748
6749 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6750                              struct net_device *netdev, const u8 *bssid,
6751                              gfp_t gfp)
6752 {
6753         struct sk_buff *msg;
6754         void *hdr;
6755
6756         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6757         if (!msg)
6758                 return;
6759
6760         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6761         if (!hdr) {
6762                 nlmsg_free(msg);
6763                 return;
6764         }
6765
6766         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6767         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6768         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6769
6770         if (genlmsg_end(msg, hdr) < 0) {
6771                 nlmsg_free(msg);
6772                 return;
6773         }
6774
6775         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6776                                 nl80211_mlme_mcgrp.id, gfp);
6777         return;
6778
6779  nla_put_failure:
6780         genlmsg_cancel(msg, hdr);
6781         nlmsg_free(msg);
6782 }
6783
6784 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6785                 struct net_device *netdev,
6786                 const u8 *macaddr, const u8* ie, u8 ie_len,
6787                 gfp_t gfp)
6788 {
6789         struct sk_buff *msg;
6790         void *hdr;
6791
6792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6793         if (!msg)
6794                 return;
6795
6796         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6797         if (!hdr) {
6798                 nlmsg_free(msg);
6799                 return;
6800         }
6801
6802         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6803         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6804         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6805         if (ie_len && ie)
6806                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6807
6808         if (genlmsg_end(msg, hdr) < 0) {
6809                 nlmsg_free(msg);
6810                 return;
6811         }
6812
6813         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6814                                 nl80211_mlme_mcgrp.id, gfp);
6815         return;
6816
6817  nla_put_failure:
6818         genlmsg_cancel(msg, hdr);
6819         nlmsg_free(msg);
6820 }
6821
6822 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6823                                  struct net_device *netdev, const u8 *addr,
6824                                  enum nl80211_key_type key_type, int key_id,
6825                                  const u8 *tsc, gfp_t gfp)
6826 {
6827         struct sk_buff *msg;
6828         void *hdr;
6829
6830         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6831         if (!msg)
6832                 return;
6833
6834         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6835         if (!hdr) {
6836                 nlmsg_free(msg);
6837                 return;
6838         }
6839
6840         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6841         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6842         if (addr)
6843                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6844         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6845         if (key_id != -1)
6846                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6847         if (tsc)
6848                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6849
6850         if (genlmsg_end(msg, hdr) < 0) {
6851                 nlmsg_free(msg);
6852                 return;
6853         }
6854
6855         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6856                                 nl80211_mlme_mcgrp.id, gfp);
6857         return;
6858
6859  nla_put_failure:
6860         genlmsg_cancel(msg, hdr);
6861         nlmsg_free(msg);
6862 }
6863
6864 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6865                                     struct ieee80211_channel *channel_before,
6866                                     struct ieee80211_channel *channel_after)
6867 {
6868         struct sk_buff *msg;
6869         void *hdr;
6870         struct nlattr *nl_freq;
6871
6872         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6873         if (!msg)
6874                 return;
6875
6876         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6877         if (!hdr) {
6878                 nlmsg_free(msg);
6879                 return;
6880         }
6881
6882         /*
6883          * Since we are applying the beacon hint to a wiphy we know its
6884          * wiphy_idx is valid
6885          */
6886         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6887
6888         /* Before */
6889         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6890         if (!nl_freq)
6891                 goto nla_put_failure;
6892         if (nl80211_msg_put_channel(msg, channel_before))
6893                 goto nla_put_failure;
6894         nla_nest_end(msg, nl_freq);
6895
6896         /* After */
6897         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6898         if (!nl_freq)
6899                 goto nla_put_failure;
6900         if (nl80211_msg_put_channel(msg, channel_after))
6901                 goto nla_put_failure;
6902         nla_nest_end(msg, nl_freq);
6903
6904         if (genlmsg_end(msg, hdr) < 0) {
6905                 nlmsg_free(msg);
6906                 return;
6907         }
6908
6909         rcu_read_lock();
6910         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6911                                 GFP_ATOMIC);
6912         rcu_read_unlock();
6913
6914         return;
6915
6916 nla_put_failure:
6917         genlmsg_cancel(msg, hdr);
6918         nlmsg_free(msg);
6919 }
6920
6921 static void nl80211_send_remain_on_chan_event(
6922         int cmd, struct cfg80211_registered_device *rdev,
6923         struct net_device *netdev, u64 cookie,
6924         struct ieee80211_channel *chan,
6925         enum nl80211_channel_type channel_type,
6926         unsigned int duration, gfp_t gfp)
6927 {
6928         struct sk_buff *msg;
6929         void *hdr;
6930
6931         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6932         if (!msg)
6933                 return;
6934
6935         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6936         if (!hdr) {
6937                 nlmsg_free(msg);
6938                 return;
6939         }
6940
6941         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6942         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6943         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
6944         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
6945         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6946
6947         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
6948                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
6949
6950         if (genlmsg_end(msg, hdr) < 0) {
6951                 nlmsg_free(msg);
6952                 return;
6953         }
6954
6955         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6956                                 nl80211_mlme_mcgrp.id, gfp);
6957         return;
6958
6959  nla_put_failure:
6960         genlmsg_cancel(msg, hdr);
6961         nlmsg_free(msg);
6962 }
6963
6964 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
6965                                     struct net_device *netdev, u64 cookie,
6966                                     struct ieee80211_channel *chan,
6967                                     enum nl80211_channel_type channel_type,
6968                                     unsigned int duration, gfp_t gfp)
6969 {
6970         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
6971                                           rdev, netdev, cookie, chan,
6972                                           channel_type, duration, gfp);
6973 }
6974
6975 void nl80211_send_remain_on_channel_cancel(
6976         struct cfg80211_registered_device *rdev, struct net_device *netdev,
6977         u64 cookie, struct ieee80211_channel *chan,
6978         enum nl80211_channel_type channel_type, gfp_t gfp)
6979 {
6980         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6981                                           rdev, netdev, cookie, chan,
6982                                           channel_type, 0, gfp);
6983 }
6984
6985 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
6986                             struct net_device *dev, const u8 *mac_addr,
6987                             struct station_info *sinfo, gfp_t gfp)
6988 {
6989         struct sk_buff *msg;
6990
6991         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6992         if (!msg)
6993                 return;
6994
6995         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
6996                 nlmsg_free(msg);
6997                 return;
6998         }
6999
7000         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7001                                 nl80211_mlme_mcgrp.id, gfp);
7002 }
7003
7004 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7005                                 struct net_device *dev, const u8 *mac_addr,
7006                                 gfp_t gfp)
7007 {
7008         struct sk_buff *msg;
7009         void *hdr;
7010
7011         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7012         if (!msg)
7013                 return;
7014
7015         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7016         if (!hdr) {
7017                 nlmsg_free(msg);
7018                 return;
7019         }
7020
7021         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7022         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7023
7024         if (genlmsg_end(msg, hdr) < 0) {
7025                 nlmsg_free(msg);
7026                 return;
7027         }
7028
7029         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7030                                 nl80211_mlme_mcgrp.id, gfp);
7031         return;
7032
7033  nla_put_failure:
7034         genlmsg_cancel(msg, hdr);
7035         nlmsg_free(msg);
7036 }
7037
7038 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7039                       struct net_device *netdev, u32 nlpid,
7040                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7041 {
7042         struct sk_buff *msg;
7043         void *hdr;
7044         int err;
7045
7046         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7047         if (!msg)
7048                 return -ENOMEM;
7049
7050         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7051         if (!hdr) {
7052                 nlmsg_free(msg);
7053                 return -ENOMEM;
7054         }
7055
7056         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7057         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7058         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7059         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7060
7061         err = genlmsg_end(msg, hdr);
7062         if (err < 0) {
7063                 nlmsg_free(msg);
7064                 return err;
7065         }
7066
7067         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7068         if (err < 0)
7069                 return err;
7070         return 0;
7071
7072  nla_put_failure:
7073         genlmsg_cancel(msg, hdr);
7074         nlmsg_free(msg);
7075         return -ENOBUFS;
7076 }
7077
7078 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7079                                  struct net_device *netdev, u64 cookie,
7080                                  const u8 *buf, size_t len, bool ack,
7081                                  gfp_t gfp)
7082 {
7083         struct sk_buff *msg;
7084         void *hdr;
7085
7086         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7087         if (!msg)
7088                 return;
7089
7090         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7091         if (!hdr) {
7092                 nlmsg_free(msg);
7093                 return;
7094         }
7095
7096         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7097         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7098         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7099         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7100         if (ack)
7101                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7102
7103         if (genlmsg_end(msg, hdr) < 0) {
7104                 nlmsg_free(msg);
7105                 return;
7106         }
7107
7108         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7109         return;
7110
7111  nla_put_failure:
7112         genlmsg_cancel(msg, hdr);
7113         nlmsg_free(msg);
7114 }
7115
7116 void
7117 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7118                              struct net_device *netdev,
7119                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7120                              gfp_t gfp)
7121 {
7122         struct sk_buff *msg;
7123         struct nlattr *pinfoattr;
7124         void *hdr;
7125
7126         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7127         if (!msg)
7128                 return;
7129
7130         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7131         if (!hdr) {
7132                 nlmsg_free(msg);
7133                 return;
7134         }
7135
7136         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7137         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7138
7139         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7140         if (!pinfoattr)
7141                 goto nla_put_failure;
7142
7143         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7144                     rssi_event);
7145
7146         nla_nest_end(msg, pinfoattr);
7147
7148         if (genlmsg_end(msg, hdr) < 0) {
7149                 nlmsg_free(msg);
7150                 return;
7151         }
7152
7153         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7154                                 nl80211_mlme_mcgrp.id, gfp);
7155         return;
7156
7157  nla_put_failure:
7158         genlmsg_cancel(msg, hdr);
7159         nlmsg_free(msg);
7160 }
7161
7162 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7163                               struct net_device *netdev, const u8 *bssid,
7164                               const u8 *replay_ctr, gfp_t gfp)
7165 {
7166         struct sk_buff *msg;
7167         struct nlattr *rekey_attr;
7168         void *hdr;
7169
7170         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7171         if (!msg)
7172                 return;
7173
7174         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7175         if (!hdr) {
7176                 nlmsg_free(msg);
7177                 return;
7178         }
7179
7180         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7181         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7182         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7183
7184         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7185         if (!rekey_attr)
7186                 goto nla_put_failure;
7187
7188         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7189                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7190
7191         nla_nest_end(msg, rekey_attr);
7192
7193         if (genlmsg_end(msg, hdr) < 0) {
7194                 nlmsg_free(msg);
7195                 return;
7196         }
7197
7198         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7199                                 nl80211_mlme_mcgrp.id, gfp);
7200         return;
7201
7202  nla_put_failure:
7203         genlmsg_cancel(msg, hdr);
7204         nlmsg_free(msg);
7205 }
7206
7207 void
7208 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7209                                 struct net_device *netdev, const u8 *peer,
7210                                 u32 num_packets, gfp_t gfp)
7211 {
7212         struct sk_buff *msg;
7213         struct nlattr *pinfoattr;
7214         void *hdr;
7215
7216         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7217         if (!msg)
7218                 return;
7219
7220         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7221         if (!hdr) {
7222                 nlmsg_free(msg);
7223                 return;
7224         }
7225
7226         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7227         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7228         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7229
7230         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7231         if (!pinfoattr)
7232                 goto nla_put_failure;
7233
7234         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7235
7236         nla_nest_end(msg, pinfoattr);
7237
7238         if (genlmsg_end(msg, hdr) < 0) {
7239                 nlmsg_free(msg);
7240                 return;
7241         }
7242
7243         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7244                                 nl80211_mlme_mcgrp.id, gfp);
7245         return;
7246
7247  nla_put_failure:
7248         genlmsg_cancel(msg, hdr);
7249         nlmsg_free(msg);
7250 }
7251
7252 static int nl80211_netlink_notify(struct notifier_block * nb,
7253                                   unsigned long state,
7254                                   void *_notify)
7255 {
7256         struct netlink_notify *notify = _notify;
7257         struct cfg80211_registered_device *rdev;
7258         struct wireless_dev *wdev;
7259
7260         if (state != NETLINK_URELEASE)
7261                 return NOTIFY_DONE;
7262
7263         rcu_read_lock();
7264
7265         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7266                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7267                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7268
7269         rcu_read_unlock();
7270
7271         return NOTIFY_DONE;
7272 }
7273
7274 static struct notifier_block nl80211_netlink_notifier = {
7275         .notifier_call = nl80211_netlink_notify,
7276 };
7277
7278 /* initialisation/exit functions */
7279
7280 int nl80211_init(void)
7281 {
7282         int err;
7283
7284         err = genl_register_family_with_ops(&nl80211_fam,
7285                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7286         if (err)
7287                 return err;
7288
7289         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7290         if (err)
7291                 goto err_out;
7292
7293         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7294         if (err)
7295                 goto err_out;
7296
7297         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7298         if (err)
7299                 goto err_out;
7300
7301         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7302         if (err)
7303                 goto err_out;
7304
7305 #ifdef CONFIG_NL80211_TESTMODE
7306         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7307         if (err)
7308                 goto err_out;
7309 #endif
7310
7311         err = netlink_register_notifier(&nl80211_netlink_notifier);
7312         if (err)
7313                 goto err_out;
7314
7315         return 0;
7316  err_out:
7317         genl_unregister_family(&nl80211_fam);
7318         return err;
7319 }
7320
7321 void nl80211_exit(void)
7322 {
7323         netlink_unregister_notifier(&nl80211_netlink_notifier);
7324         genl_unregister_family(&nl80211_fam);
7325 }