net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* internal helper: get rdev and dev */
  50 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  51                                        struct cfg80211_registered_device **rdev,
  52                                        struct net_device **dev)
  53 {
  54         struct nlattr **attrs = info->attrs;
  55         int ifindex;
  56
  57         if (!attrs[NL80211_ATTR_IFINDEX])
  58                 return -EINVAL;
  59
  60         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  61         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  62         if (!*dev)
  63                 return -ENODEV;
  64
  65         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  66         if (IS_ERR(*rdev)) {
  67                 dev_put(*dev);
  68                 return PTR_ERR(*rdev);
  69         }
  70
  71         return 0;
  72 }
  73
  74 /* policy for the attributes */
  75 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  76         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  77         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  78                                       .len = 20-1 },
  79         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  80         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  81         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  82         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  83         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  84         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  87
  88         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  89         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  90         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  91
  92         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  93         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  94
  95         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  96         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  97                                     .len = WLAN_MAX_KEY_LEN },
  98         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  99         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 100         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 101         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 102         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 103
 104         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 105         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 106         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 107                                        .len = IEEE80211_MAX_DATA_LEN },
 108         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 109                                        .len = IEEE80211_MAX_DATA_LEN },
 110         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 111         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 112         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 113         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 114                                                .len = NL80211_MAX_SUPP_RATES },
 115         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 116         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 117         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 118         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 119                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 120         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 121
 122         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 123         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 124
 125         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 126         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 127         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 128         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 129                                            .len = NL80211_MAX_SUPP_RATES },
 130         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 131
 132         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 134
 135         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 136                                          .len = NL80211_HT_CAPABILITY_LEN },
 137
 138         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 139         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 140                               .len = IEEE80211_MAX_DATA_LEN },
 141         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 142         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 143
 144         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 145                                 .len = IEEE80211_MAX_SSID_LEN },
 146         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 147         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_STA_FLAGS2] = {
 152                 .len = sizeof(struct nl80211_sta_flag_update),
 153         },
 154         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 156         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 157         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 158         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 159         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 160         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 161         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 162         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 163                                  .len = WLAN_PMKID_LEN },
 164         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 165         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 166         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 167         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 168                                  .len = IEEE80211_MAX_DATA_LEN },
 169         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 170         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 171         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 172         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 173         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 174         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 175         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 176         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 177         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 178         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 179         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 180         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 181         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 182         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 183         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 184         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 185         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 186         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 187         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 188         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 189                                          .len = IEEE80211_MAX_DATA_LEN },
 190         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 191                                          .len = IEEE80211_MAX_DATA_LEN },
 192         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 193         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 194 };
 195
 196 /* policy for the key attributes */
 197 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 198         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 199         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 200         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 201         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 202         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 203         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 204         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 205         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 206 };
 207
 208 /* policy for the key default flags */
 209 static const struct nla_policy
 210 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 211         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 212         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 213 };
 214
 215 /* policy for WoWLAN attributes */
 216 static const struct nla_policy
 217 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 218         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 219         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 220         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 221         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 222         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 223         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 224         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 225         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 226 };
 227
 228 /* policy for GTK rekey offload attributes */
 229 static const struct nla_policy
 230 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 231         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 232         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 233         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 234 };
 235
 236 static const struct nla_policy
 237 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 238         [NL80211_ATTR_SCHED_SCAN_MATCH_SSID] = { .type = NLA_BINARY,
 239                                                  .len = IEEE80211_MAX_SSID_LEN },
 240 };
 241
 242 /* ifidx get helper */
 243 static int nl80211_get_ifidx(struct netlink_callback *cb)
 244 {
 245         int res;
 246
 247         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 248                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 249                           nl80211_policy);
 250         if (res)
 251                 return res;
 252
 253         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 254                 return -EINVAL;
 255
 256         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 257         if (!res)
 258                 return -EINVAL;
 259         return res;
 260 }
 261
 262 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 263                                        struct netlink_callback *cb,
 264                                        struct cfg80211_registered_device **rdev,
 265                                        struct net_device **dev)
 266 {
 267         int ifidx = cb->args[0];
 268         int err;
 269
 270         if (!ifidx)
 271                 ifidx = nl80211_get_ifidx(cb);
 272         if (ifidx < 0)
 273                 return ifidx;
 274
 275         cb->args[0] = ifidx;
 276
 277         rtnl_lock();
 278
 279         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 280         if (!*dev) {
 281                 err = -ENODEV;
 282                 goto out_rtnl;
 283         }
 284
 285         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 286         if (IS_ERR(*rdev)) {
 287                 err = PTR_ERR(*rdev);
 288                 goto out_rtnl;
 289         }
 290
 291         return 0;
 292  out_rtnl:
 293         rtnl_unlock();
 294         return err;
 295 }
 296
 297 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 298 {
 299         cfg80211_unlock_rdev(rdev);
 300         rtnl_unlock();
 301 }
 302
 303 /* IE validation */
 304 static bool is_valid_ie_attr(const struct nlattr *attr)
 305 {
 306         const u8 *pos;
 307         int len;
 308
 309         if (!attr)
 310                 return true;
 311
 312         pos = nla_data(attr);
 313         len = nla_len(attr);
 314
 315         while (len) {
 316                 u8 elemlen;
 317
 318                 if (len < 2)
 319                         return false;
 320                 len -= 2;
 321
 322                 elemlen = pos[1];
 323                 if (elemlen > len)
 324                         return false;
 325
 326                 len -= elemlen;
 327                 pos += 2 + elemlen;
 328         }
 329
 330         return true;
 331 }
 332
 333 /* message building helper */
 334 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 335                                    int flags, u8 cmd)
 336 {
 337         /* since there is no private header just add the generic one */
 338         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 339 }
 340
 341 static int nl80211_msg_put_channel(struct sk_buff *msg,
 342                                    struct ieee80211_channel *chan)
 343 {
 344         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 345                     chan->center_freq);
 346
 347         if (chan->flags & IEEE80211_CHAN_DISABLED)
 348                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 349         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 350                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 351         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 352                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 353         if (chan->flags & IEEE80211_CHAN_RADAR)
 354                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 355
 356         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 357                     DBM_TO_MBM(chan->max_power));
 358
 359         return 0;
 360
 361  nla_put_failure:
 362         return -ENOBUFS;
 363 }
 364
 365 /* netlink command implementations */
 366
 367 struct key_parse {
 368         struct key_params p;
 369         int idx;
 370         int type;
 371         bool def, defmgmt;
 372         bool def_uni, def_multi;
 373 };
 374
 375 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 376 {
 377         struct nlattr *tb[NL80211_KEY_MAX + 1];
 378         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 379                                    nl80211_key_policy);
 380         if (err)
 381                 return err;
 382
 383         k->def = !!tb[NL80211_KEY_DEFAULT];
 384         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 385
 386         if (k->def) {
 387                 k->def_uni = true;
 388                 k->def_multi = true;
 389         }
 390         if (k->defmgmt)
 391                 k->def_multi = true;
 392
 393         if (tb[NL80211_KEY_IDX])
 394                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 395
 396         if (tb[NL80211_KEY_DATA]) {
 397                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 398                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 399         }
 400
 401         if (tb[NL80211_KEY_SEQ]) {
 402                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 403                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 404         }
 405
 406         if (tb[NL80211_KEY_CIPHER])
 407                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 408
 409         if (tb[NL80211_KEY_TYPE]) {
 410                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 411                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 412                         return -EINVAL;
 413         }
 414
 415         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 416                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 417                 int err = nla_parse_nested(kdt,
 418                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 419                                            tb[NL80211_KEY_DEFAULT_TYPES],
 420                                            nl80211_key_default_policy);
 421                 if (err)
 422                         return err;
 423
 424                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 425                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 426         }
 427
 428         return 0;
 429 }
 430
 431 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 432 {
 433         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 434                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 435                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 436         }
 437
 438         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 439                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 440                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 441         }
 442
 443         if (info->attrs[NL80211_ATTR_KEY_IDX])
 444                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 445
 446         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 447                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 448
 449         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 450         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 451
 452         if (k->def) {
 453                 k->def_uni = true;
 454                 k->def_multi = true;
 455         }
 456         if (k->defmgmt)
 457                 k->def_multi = true;
 458
 459         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 460                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 461                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 462                         return -EINVAL;
 463         }
 464
 465         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 466                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 467                 int err = nla_parse_nested(
 468                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 469                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 470                                 nl80211_key_default_policy);
 471                 if (err)
 472                         return err;
 473
 474                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 475                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 476         }
 477
 478         return 0;
 479 }
 480
 481 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 482 {
 483         int err;
 484
 485         memset(k, 0, sizeof(*k));
 486         k->idx = -1;
 487         k->type = -1;
 488
 489         if (info->attrs[NL80211_ATTR_KEY])
 490                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 491         else
 492                 err = nl80211_parse_key_old(info, k);
 493
 494         if (err)
 495                 return err;
 496
 497         if (k->def && k->defmgmt)
 498                 return -EINVAL;
 499
 500         if (k->defmgmt) {
 501                 if (k->def_uni || !k->def_multi)
 502                         return -EINVAL;
 503         }
 504
 505         if (k->idx != -1) {
 506                 if (k->defmgmt) {
 507                         if (k->idx < 4 || k->idx > 5)
 508                                 return -EINVAL;
 509                 } else if (k->def) {
 510                         if (k->idx < 0 || k->idx > 3)
 511                                 return -EINVAL;
 512                 } else {
 513                         if (k->idx < 0 || k->idx > 5)
 514                                 return -EINVAL;
 515                 }
 516         }
 517
 518         return 0;
 519 }
 520
 521 static struct cfg80211_cached_keys *
 522 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 523                        struct nlattr *keys)
 524 {
 525         struct key_parse parse;
 526         struct nlattr *key;
 527         struct cfg80211_cached_keys *result;
 528         int rem, err, def = 0;
 529
 530         result = kzalloc(sizeof(*result), GFP_KERNEL);
 531         if (!result)
 532                 return ERR_PTR(-ENOMEM);
 533
 534         result->def = -1;
 535         result->defmgmt = -1;
 536
 537         nla_for_each_nested(key, keys, rem) {
 538                 memset(&parse, 0, sizeof(parse));
 539                 parse.idx = -1;
 540
 541                 err = nl80211_parse_key_new(key, &parse);
 542                 if (err)
 543                         goto error;
 544                 err = -EINVAL;
 545                 if (!parse.p.key)
 546                         goto error;
 547                 if (parse.idx < 0 || parse.idx > 4)
 548                         goto error;
 549                 if (parse.def) {
 550                         if (def)
 551                                 goto error;
 552                         def = 1;
 553                         result->def = parse.idx;
 554                         if (!parse.def_uni || !parse.def_multi)
 555                                 goto error;
 556                 } else if (parse.defmgmt)
 557                         goto error;
 558                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 559                                                      parse.idx, false, NULL);
 560                 if (err)
 561                         goto error;
 562                 result->params[parse.idx].cipher = parse.p.cipher;
 563                 result->params[parse.idx].key_len = parse.p.key_len;
 564                 result->params[parse.idx].key = result->data[parse.idx];
 565                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 566         }
 567
 568         return result;
 569  error:
 570         kfree(result);
 571         return ERR_PTR(err);
 572 }
 573
 574 static int nl80211_key_allowed(struct wireless_dev *wdev)
 575 {
 576         ASSERT_WDEV_LOCK(wdev);
 577
 578         switch (wdev->iftype) {
 579         case NL80211_IFTYPE_AP:
 580         case NL80211_IFTYPE_AP_VLAN:
 581         case NL80211_IFTYPE_P2P_GO:
 582         case NL80211_IFTYPE_MESH_POINT:
 583                 break;
 584         case NL80211_IFTYPE_ADHOC:
 585                 if (!wdev->current_bss)
 586                         return -ENOLINK;
 587                 break;
 588         case NL80211_IFTYPE_STATION:
 589         case NL80211_IFTYPE_P2P_CLIENT:
 590                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 591                         return -ENOLINK;
 592                 break;
 593         default:
 594                 return -EINVAL;
 595         }
 596
 597         return 0;
 598 }
 599
 600 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 601 {
 602         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 603         int i;
 604
 605         if (!nl_modes)
 606                 goto nla_put_failure;
 607
 608         i = 0;
 609         while (ifmodes) {
 610                 if (ifmodes & 1)
 611                         NLA_PUT_FLAG(msg, i);
 612                 ifmodes >>= 1;
 613                 i++;
 614         }
 615
 616         nla_nest_end(msg, nl_modes);
 617         return 0;
 618
 619 nla_put_failure:
 620         return -ENOBUFS;
 621 }
 622
 623 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 624                                           struct sk_buff *msg)
 625 {
 626         struct nlattr *nl_combis;
 627         int i, j;
 628
 629         nl_combis = nla_nest_start(msg,
 630                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 631         if (!nl_combis)
 632                 goto nla_put_failure;
 633
 634         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 635                 const struct ieee80211_iface_combination *c;
 636                 struct nlattr *nl_combi, *nl_limits;
 637
 638                 c = &wiphy->iface_combinations[i];
 639
 640                 nl_combi = nla_nest_start(msg, i + 1);
 641                 if (!nl_combi)
 642                         goto nla_put_failure;
 643
 644                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 645                 if (!nl_limits)
 646                         goto nla_put_failure;
 647
 648                 for (j = 0; j < c->n_limits; j++) {
 649                         struct nlattr *nl_limit;
 650
 651                         nl_limit = nla_nest_start(msg, j + 1);
 652                         if (!nl_limit)
 653                                 goto nla_put_failure;
 654                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 655                                     c->limits[j].max);
 656                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 657                                                 c->limits[j].types))
 658                                 goto nla_put_failure;
 659                         nla_nest_end(msg, nl_limit);
 660                 }
 661
 662                 nla_nest_end(msg, nl_limits);
 663
 664                 if (c->beacon_int_infra_match)
 665                         NLA_PUT_FLAG(msg,
 666                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 667                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 668                             c->num_different_channels);
 669                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 670                             c->max_interfaces);
 671
 672                 nla_nest_end(msg, nl_combi);
 673         }
 674
 675         nla_nest_end(msg, nl_combis);
 676
 677         return 0;
 678 nla_put_failure:
 679         return -ENOBUFS;
 680 }
 681
 682 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 683                               struct cfg80211_registered_device *dev)
 684 {
 685         void *hdr;
 686         struct nlattr *nl_bands, *nl_band;
 687         struct nlattr *nl_freqs, *nl_freq;
 688         struct nlattr *nl_rates, *nl_rate;
 689         struct nlattr *nl_cmds;
 690         enum ieee80211_band band;
 691         struct ieee80211_channel *chan;
 692         struct ieee80211_rate *rate;
 693         int i;
 694         const struct ieee80211_txrx_stypes *mgmt_stypes =
 695                                 dev->wiphy.mgmt_stypes;
 696
 697         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 698         if (!hdr)
 699                 return -1;
 700
 701         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 702         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 703
 704         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 705                     cfg80211_rdev_list_generation);
 706
 707         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 708                    dev->wiphy.retry_short);
 709         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 710                    dev->wiphy.retry_long);
 711         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 712                     dev->wiphy.frag_threshold);
 713         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 714                     dev->wiphy.rts_threshold);
 715         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 716                     dev->wiphy.coverage_class);
 717         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 718                    dev->wiphy.max_scan_ssids);
 719         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 720                    dev->wiphy.max_sched_scan_ssids);
 721         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 722                     dev->wiphy.max_scan_ie_len);
 723         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 724                     dev->wiphy.max_sched_scan_ie_len);
 725         NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 726                    dev->wiphy.max_match_sets);
 727
 728         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 729                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 730         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 731                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 732         if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 733                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 734
 735         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 736                 NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 737
 738         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 739                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 740                 dev->wiphy.cipher_suites);
 741
 742         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 743                    dev->wiphy.max_num_pmkids);
 744
 745         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 746                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 747
 748         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 749                     dev->wiphy.available_antennas_tx);
 750         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 751                     dev->wiphy.available_antennas_rx);
 752
 753         if ((dev->wiphy.available_antennas_tx ||
 754              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 755                 u32 tx_ant = 0, rx_ant = 0;
 756                 int res;
 757                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 758                 if (!res) {
 759                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 760                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 761                 }
 762         }
 763
 764         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 765                                 dev->wiphy.interface_modes))
 766                 goto nla_put_failure;
 767
 768         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 769         if (!nl_bands)
 770                 goto nla_put_failure;
 771
 772         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 773                 if (!dev->wiphy.bands[band])
 774                         continue;
 775
 776                 nl_band = nla_nest_start(msg, band);
 777                 if (!nl_band)
 778                         goto nla_put_failure;
 779
 780                 /* add HT info */
 781                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 782                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 783                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 784                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 785                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 786                                 dev->wiphy.bands[band]->ht_cap.cap);
 787                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 788                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 789                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 790                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 791                 }
 792
 793                 /* add frequencies */
 794                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 795                 if (!nl_freqs)
 796                         goto nla_put_failure;
 797
 798                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 799                         nl_freq = nla_nest_start(msg, i);
 800                         if (!nl_freq)
 801                                 goto nla_put_failure;
 802
 803                         chan = &dev->wiphy.bands[band]->channels[i];
 804
 805                         if (nl80211_msg_put_channel(msg, chan))
 806                                 goto nla_put_failure;
 807
 808                         nla_nest_end(msg, nl_freq);
 809                 }
 810
 811                 nla_nest_end(msg, nl_freqs);
 812
 813                 /* add bitrates */
 814                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 815                 if (!nl_rates)
 816                         goto nla_put_failure;
 817
 818                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 819                         nl_rate = nla_nest_start(msg, i);
 820                         if (!nl_rate)
 821                                 goto nla_put_failure;
 822
 823                         rate = &dev->wiphy.bands[band]->bitrates[i];
 824                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 825                                     rate->bitrate);
 826                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 827                                 NLA_PUT_FLAG(msg,
 828                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 829
 830                         nla_nest_end(msg, nl_rate);
 831                 }
 832
 833                 nla_nest_end(msg, nl_rates);
 834
 835                 nla_nest_end(msg, nl_band);
 836         }
 837         nla_nest_end(msg, nl_bands);
 838
 839         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 840         if (!nl_cmds)
 841                 goto nla_put_failure;
 842
 843         i = 0;
 844 #define CMD(op, n)                                              \
 845          do {                                                   \
 846                 if (dev->ops->op) {                             \
 847                         i++;                                    \
 848                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 849                 }                                               \
 850         } while (0)
 851
 852         CMD(add_virtual_intf, NEW_INTERFACE);
 853         CMD(change_virtual_intf, SET_INTERFACE);
 854         CMD(add_key, NEW_KEY);
 855         CMD(add_beacon, NEW_BEACON);
 856         CMD(add_station, NEW_STATION);
 857         CMD(add_mpath, NEW_MPATH);
 858         CMD(update_mesh_config, SET_MESH_CONFIG);
 859         CMD(change_bss, SET_BSS);
 860         CMD(auth, AUTHENTICATE);
 861         CMD(assoc, ASSOCIATE);
 862         CMD(deauth, DEAUTHENTICATE);
 863         CMD(disassoc, DISASSOCIATE);
 864         CMD(join_ibss, JOIN_IBSS);
 865         CMD(join_mesh, JOIN_MESH);
 866         CMD(set_pmksa, SET_PMKSA);
 867         CMD(del_pmksa, DEL_PMKSA);
 868         CMD(flush_pmksa, FLUSH_PMKSA);
 869         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 870         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 871         CMD(mgmt_tx, FRAME);
 872         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 873         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 874                 i++;
 875                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 876         }
 877         CMD(set_channel, SET_CHANNEL);
 878         CMD(set_wds_peer, SET_WDS_PEER);
 879         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
 880                 CMD(sched_scan_start, START_SCHED_SCAN);
 881
 882 #undef CMD
 883
 884         if (dev->ops->connect || dev->ops->auth) {
 885                 i++;
 886                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 887         }
 888
 889         if (dev->ops->disconnect || dev->ops->deauth) {
 890                 i++;
 891                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 892         }
 893
 894         nla_nest_end(msg, nl_cmds);
 895
 896         if (dev->ops->remain_on_channel)
 897                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 898                             dev->wiphy.max_remain_on_channel_duration);
 899
 900         if (dev->ops->mgmt_tx_cancel_wait)
 901                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 902
 903         if (mgmt_stypes) {
 904                 u16 stypes;
 905                 struct nlattr *nl_ftypes, *nl_ifs;
 906                 enum nl80211_iftype ift;
 907
 908                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 909                 if (!nl_ifs)
 910                         goto nla_put_failure;
 911
 912                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 913                         nl_ftypes = nla_nest_start(msg, ift);
 914                         if (!nl_ftypes)
 915                                 goto nla_put_failure;
 916                         i = 0;
 917                         stypes = mgmt_stypes[ift].tx;
 918                         while (stypes) {
 919                                 if (stypes & 1)
 920                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 921                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 922                                 stypes >>= 1;
 923                                 i++;
 924                         }
 925                         nla_nest_end(msg, nl_ftypes);
 926                 }
 927
 928                 nla_nest_end(msg, nl_ifs);
 929
 930                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 931                 if (!nl_ifs)
 932                         goto nla_put_failure;
 933
 934                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 935                         nl_ftypes = nla_nest_start(msg, ift);
 936                         if (!nl_ftypes)
 937                                 goto nla_put_failure;
 938                         i = 0;
 939                         stypes = mgmt_stypes[ift].rx;
 940                         while (stypes) {
 941                                 if (stypes & 1)
 942                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 943                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 944                                 stypes >>= 1;
 945                                 i++;
 946                         }
 947                         nla_nest_end(msg, nl_ftypes);
 948                 }
 949                 nla_nest_end(msg, nl_ifs);
 950         }
 951
 952         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
 953                 struct nlattr *nl_wowlan;
 954
 955                 nl_wowlan = nla_nest_start(msg,
 956                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 957                 if (!nl_wowlan)
 958                         goto nla_put_failure;
 959
 960                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 961                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 962                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 963                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 964                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 965                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 966                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 967                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 968                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 969                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 970                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 971                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 972                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 973                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 974                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 975                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 976                 if (dev->wiphy.wowlan.n_patterns) {
 977                         struct nl80211_wowlan_pattern_support pat = {
 978                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
 979                                 .min_pattern_len =
 980                                         dev->wiphy.wowlan.pattern_min_len,
 981                                 .max_pattern_len =
 982                                         dev->wiphy.wowlan.pattern_max_len,
 983                         };
 984                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 985                                 sizeof(pat), &pat);
 986                 }
 987
 988                 nla_nest_end(msg, nl_wowlan);
 989         }
 990
 991         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 992                                 dev->wiphy.software_iftypes))
 993                 goto nla_put_failure;
 994
 995         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
 996                 goto nla_put_failure;
 997
 998         return genlmsg_end(msg, hdr);
 999
1000  nla_put_failure:
1001         genlmsg_cancel(msg, hdr);
1002         return -EMSGSIZE;
1003 }
1004
1005 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1006 {
1007         int idx = 0;
1008         int start = cb->args[0];
1009         struct cfg80211_registered_device *dev;
1010
1011         mutex_lock(&cfg80211_mutex);
1012         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1013                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1014                         continue;
1015                 if (++idx <= start)
1016                         continue;
1017                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1018                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1019                                        dev) < 0) {
1020                         idx--;
1021                         break;
1022                 }
1023         }
1024         mutex_unlock(&cfg80211_mutex);
1025
1026         cb->args[0] = idx;
1027
1028         return skb->len;
1029 }
1030
1031 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1032 {
1033         struct sk_buff *msg;
1034         struct cfg80211_registered_device *dev = info->user_ptr[0];
1035
1036         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1037         if (!msg)
1038                 return -ENOMEM;
1039
1040         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1041                 nlmsg_free(msg);
1042                 return -ENOBUFS;
1043         }
1044
1045         return genlmsg_reply(msg, info);
1046 }
1047
1048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1049         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1050         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1051         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1052         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1053         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1054 };
1055
1056 static int parse_txq_params(struct nlattr *tb[],
1057                             struct ieee80211_txq_params *txq_params)
1058 {
1059         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1060             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1061             !tb[NL80211_TXQ_ATTR_AIFS])
1062                 return -EINVAL;
1063
1064         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1065         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1066         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1067         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1068         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1069
1070         return 0;
1071 }
1072
1073 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1074 {
1075         /*
1076          * You can only set the channel explicitly for AP, mesh
1077          * and WDS type interfaces; all others have their channel
1078          * managed via their respective "establish a connection"
1079          * command (connect, join, ...)
1080          *
1081          * Monitors are special as they are normally slaved to
1082          * whatever else is going on, so they behave as though
1083          * you tried setting the wiphy channel itself.
1084          */
1085         return !wdev ||
1086                 wdev->iftype == NL80211_IFTYPE_AP ||
1087                 wdev->iftype == NL80211_IFTYPE_WDS ||
1088                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1089                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1090                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1091 }
1092
1093 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1094                                  struct wireless_dev *wdev,
1095                                  struct genl_info *info)
1096 {
1097         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1098         u32 freq;
1099         int result;
1100
1101         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1102                 return -EINVAL;
1103
1104         if (!nl80211_can_set_dev_channel(wdev))
1105                 return -EOPNOTSUPP;
1106
1107         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1108                 channel_type = nla_get_u32(info->attrs[
1109                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1110                 if (channel_type != NL80211_CHAN_NO_HT &&
1111                     channel_type != NL80211_CHAN_HT20 &&
1112                     channel_type != NL80211_CHAN_HT40PLUS &&
1113                     channel_type != NL80211_CHAN_HT40MINUS)
1114                         return -EINVAL;
1115         }
1116
1117         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1118
1119         mutex_lock(&rdev->devlist_mtx);
1120         if (wdev) {
1121                 wdev_lock(wdev);
1122                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1123                 wdev_unlock(wdev);
1124         } else {
1125                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1126         }
1127         mutex_unlock(&rdev->devlist_mtx);
1128
1129         return result;
1130 }
1131
1132 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1133 {
1134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1135         struct net_device *netdev = info->user_ptr[1];
1136
1137         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1138 }
1139
1140 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1141 {
1142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1143         struct net_device *dev = info->user_ptr[1];
1144         struct wireless_dev *wdev = dev->ieee80211_ptr;
1145         const u8 *bssid;
1146
1147         if (!info->attrs[NL80211_ATTR_MAC])
1148                 return -EINVAL;
1149
1150         if (netif_running(dev))
1151                 return -EBUSY;
1152
1153         if (!rdev->ops->set_wds_peer)
1154                 return -EOPNOTSUPP;
1155
1156         if (wdev->iftype != NL80211_IFTYPE_WDS)
1157                 return -EOPNOTSUPP;
1158
1159         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1160         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1161 }
1162
1163
1164 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1165 {
1166         struct cfg80211_registered_device *rdev;
1167         struct net_device *netdev = NULL;
1168         struct wireless_dev *wdev;
1169         int result = 0, rem_txq_params = 0;
1170         struct nlattr *nl_txq_params;
1171         u32 changed;
1172         u8 retry_short = 0, retry_long = 0;
1173         u32 frag_threshold = 0, rts_threshold = 0;
1174         u8 coverage_class = 0;
1175
1176         /*
1177          * Try to find the wiphy and netdev. Normally this
1178          * function shouldn't need the netdev, but this is
1179          * done for backward compatibility -- previously
1180          * setting the channel was done per wiphy, but now
1181          * it is per netdev. Previous userland like hostapd
1182          * also passed a netdev to set_wiphy, so that it is
1183          * possible to let that go to the right netdev!
1184          */
1185         mutex_lock(&cfg80211_mutex);
1186
1187         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1188                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1189
1190                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1191                 if (netdev && netdev->ieee80211_ptr) {
1192                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1193                         mutex_lock(&rdev->mtx);
1194                 } else
1195                         netdev = NULL;
1196         }
1197
1198         if (!netdev) {
1199                 rdev = __cfg80211_rdev_from_info(info);
1200                 if (IS_ERR(rdev)) {
1201                         mutex_unlock(&cfg80211_mutex);
1202                         return PTR_ERR(rdev);
1203                 }
1204                 wdev = NULL;
1205                 netdev = NULL;
1206                 result = 0;
1207
1208                 mutex_lock(&rdev->mtx);
1209         } else if (netif_running(netdev) &&
1210                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1211                 wdev = netdev->ieee80211_ptr;
1212         else
1213                 wdev = NULL;
1214
1215         /*
1216          * end workaround code, by now the rdev is available
1217          * and locked, and wdev may or may not be NULL.
1218          */
1219
1220         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1221                 result = cfg80211_dev_rename(
1222                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1223
1224         mutex_unlock(&cfg80211_mutex);
1225
1226         if (result)
1227                 goto bad_res;
1228
1229         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1230                 struct ieee80211_txq_params txq_params;
1231                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1232
1233                 if (!rdev->ops->set_txq_params) {
1234                         result = -EOPNOTSUPP;
1235                         goto bad_res;
1236                 }
1237
1238                 nla_for_each_nested(nl_txq_params,
1239                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1240                                     rem_txq_params) {
1241                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1242                                   nla_data(nl_txq_params),
1243                                   nla_len(nl_txq_params),
1244                                   txq_params_policy);
1245                         result = parse_txq_params(tb, &txq_params);
1246                         if (result)
1247                                 goto bad_res;
1248
1249                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1250                                                            &txq_params);
1251                         if (result)
1252                                 goto bad_res;
1253                 }
1254         }
1255
1256         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1257                 result = __nl80211_set_channel(rdev, wdev, info);
1258                 if (result)
1259                         goto bad_res;
1260         }
1261
1262         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1263                 enum nl80211_tx_power_setting type;
1264                 int idx, mbm = 0;
1265
1266                 if (!rdev->ops->set_tx_power) {
1267                         result = -EOPNOTSUPP;
1268                         goto bad_res;
1269                 }
1270
1271                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1272                 type = nla_get_u32(info->attrs[idx]);
1273
1274                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1275                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1276                         result = -EINVAL;
1277                         goto bad_res;
1278                 }
1279
1280                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1281                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1282                         mbm = nla_get_u32(info->attrs[idx]);
1283                 }
1284
1285                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1286                 if (result)
1287                         goto bad_res;
1288         }
1289
1290         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1291             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1292                 u32 tx_ant, rx_ant;
1293                 if ((!rdev->wiphy.available_antennas_tx &&
1294                      !rdev->wiphy.available_antennas_rx) ||
1295                     !rdev->ops->set_antenna) {
1296                         result = -EOPNOTSUPP;
1297                         goto bad_res;
1298                 }
1299
1300                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1301                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1302
1303                 /* reject antenna configurations which don't match the
1304                  * available antenna masks, except for the "all" mask */
1305                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1306                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1307                         result = -EINVAL;
1308                         goto bad_res;
1309                 }
1310
1311                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1312                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1313
1314                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1315                 if (result)
1316                         goto bad_res;
1317         }
1318
1319         changed = 0;
1320
1321         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1322                 retry_short = nla_get_u8(
1323                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1324                 if (retry_short == 0) {
1325                         result = -EINVAL;
1326                         goto bad_res;
1327                 }
1328                 changed |= WIPHY_PARAM_RETRY_SHORT;
1329         }
1330
1331         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1332                 retry_long = nla_get_u8(
1333                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1334                 if (retry_long == 0) {
1335                         result = -EINVAL;
1336                         goto bad_res;
1337                 }
1338                 changed |= WIPHY_PARAM_RETRY_LONG;
1339         }
1340
1341         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1342                 frag_threshold = nla_get_u32(
1343                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1344                 if (frag_threshold < 256) {
1345                         result = -EINVAL;
1346                         goto bad_res;
1347                 }
1348                 if (frag_threshold != (u32) -1) {
1349                         /*
1350                          * Fragments (apart from the last one) are required to
1351                          * have even length. Make the fragmentation code
1352                          * simpler by stripping LSB should someone try to use
1353                          * odd threshold value.
1354                          */
1355                         frag_threshold &= ~0x1;
1356                 }
1357                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1358         }
1359
1360         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1361                 rts_threshold = nla_get_u32(
1362                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1363                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1364         }
1365
1366         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1367                 coverage_class = nla_get_u8(
1368                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1369                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1370         }
1371
1372         if (changed) {
1373                 u8 old_retry_short, old_retry_long;
1374                 u32 old_frag_threshold, old_rts_threshold;
1375                 u8 old_coverage_class;
1376
1377                 if (!rdev->ops->set_wiphy_params) {
1378                         result = -EOPNOTSUPP;
1379                         goto bad_res;
1380                 }
1381
1382                 old_retry_short = rdev->wiphy.retry_short;
1383                 old_retry_long = rdev->wiphy.retry_long;
1384                 old_frag_threshold = rdev->wiphy.frag_threshold;
1385                 old_rts_threshold = rdev->wiphy.rts_threshold;
1386                 old_coverage_class = rdev->wiphy.coverage_class;
1387
1388                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1389                         rdev->wiphy.retry_short = retry_short;
1390                 if (changed & WIPHY_PARAM_RETRY_LONG)
1391                         rdev->wiphy.retry_long = retry_long;
1392                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1393                         rdev->wiphy.frag_threshold = frag_threshold;
1394                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1395                         rdev->wiphy.rts_threshold = rts_threshold;
1396                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1397                         rdev->wiphy.coverage_class = coverage_class;
1398
1399                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1400                 if (result) {
1401                         rdev->wiphy.retry_short = old_retry_short;
1402                         rdev->wiphy.retry_long = old_retry_long;
1403                         rdev->wiphy.frag_threshold = old_frag_threshold;
1404                         rdev->wiphy.rts_threshold = old_rts_threshold;
1405                         rdev->wiphy.coverage_class = old_coverage_class;
1406                 }
1407         }
1408
1409  bad_res:
1410         mutex_unlock(&rdev->mtx);
1411         if (netdev)
1412                 dev_put(netdev);
1413         return result;
1414 }
1415
1416
1417 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1418                               struct cfg80211_registered_device *rdev,
1419                               struct net_device *dev)
1420 {
1421         void *hdr;
1422
1423         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1424         if (!hdr)
1425                 return -1;
1426
1427         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1428         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1429         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1430         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1431
1432         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1433                     rdev->devlist_generation ^
1434                         (cfg80211_rdev_list_generation << 2));
1435
1436         return genlmsg_end(msg, hdr);
1437
1438  nla_put_failure:
1439         genlmsg_cancel(msg, hdr);
1440         return -EMSGSIZE;
1441 }
1442
1443 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1444 {
1445         int wp_idx = 0;
1446         int if_idx = 0;
1447         int wp_start = cb->args[0];
1448         int if_start = cb->args[1];
1449         struct cfg80211_registered_device *rdev;
1450         struct wireless_dev *wdev;
1451
1452         mutex_lock(&cfg80211_mutex);
1453         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1454                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1455                         continue;
1456                 if (wp_idx < wp_start) {
1457                         wp_idx++;
1458                         continue;
1459                 }
1460                 if_idx = 0;
1461
1462                 mutex_lock(&rdev->devlist_mtx);
1463                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1464                         if (if_idx < if_start) {
1465                                 if_idx++;
1466                                 continue;
1467                         }
1468                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1469                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1470                                                rdev, wdev->netdev) < 0) {
1471                                 mutex_unlock(&rdev->devlist_mtx);
1472                                 goto out;
1473                         }
1474                         if_idx++;
1475                 }
1476                 mutex_unlock(&rdev->devlist_mtx);
1477
1478                 wp_idx++;
1479         }
1480  out:
1481         mutex_unlock(&cfg80211_mutex);
1482
1483         cb->args[0] = wp_idx;
1484         cb->args[1] = if_idx;
1485
1486         return skb->len;
1487 }
1488
1489 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1490 {
1491         struct sk_buff *msg;
1492         struct cfg80211_registered_device *dev = info->user_ptr[0];
1493         struct net_device *netdev = info->user_ptr[1];
1494
1495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1496         if (!msg)
1497                 return -ENOMEM;
1498
1499         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1500                                dev, netdev) < 0) {
1501                 nlmsg_free(msg);
1502                 return -ENOBUFS;
1503         }
1504
1505         return genlmsg_reply(msg, info);
1506 }
1507
1508 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1509         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1510         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1511         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1512         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1513         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1514 };
1515
1516 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1517 {
1518         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1519         int flag;
1520
1521         *mntrflags = 0;
1522
1523         if (!nla)
1524                 return -EINVAL;
1525
1526         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1527                              nla, mntr_flags_policy))
1528                 return -EINVAL;
1529
1530         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1531                 if (flags[flag])
1532                         *mntrflags |= (1<<flag);
1533
1534         return 0;
1535 }
1536
1537 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1538                                struct net_device *netdev, u8 use_4addr,
1539                                enum nl80211_iftype iftype)
1540 {
1541         if (!use_4addr) {
1542                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1543                         return -EBUSY;
1544                 return 0;
1545         }
1546
1547         switch (iftype) {
1548         case NL80211_IFTYPE_AP_VLAN:
1549                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1550                         return 0;
1551                 break;
1552         case NL80211_IFTYPE_STATION:
1553                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1554                         return 0;
1555                 break;
1556         default:
1557                 break;
1558         }
1559
1560         return -EOPNOTSUPP;
1561 }
1562
1563 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1564 {
1565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1566         struct vif_params params;
1567         int err;
1568         enum nl80211_iftype otype, ntype;
1569         struct net_device *dev = info->user_ptr[1];
1570         u32 _flags, *flags = NULL;
1571         bool change = false;
1572
1573         memset(&params, 0, sizeof(params));
1574
1575         otype = ntype = dev->ieee80211_ptr->iftype;
1576
1577         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1578                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1579                 if (otype != ntype)
1580                         change = true;
1581                 if (ntype > NL80211_IFTYPE_MAX)
1582                         return -EINVAL;
1583         }
1584
1585         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1586                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1587
1588                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1589                         return -EINVAL;
1590                 if (netif_running(dev))
1591                         return -EBUSY;
1592
1593                 wdev_lock(wdev);
1594                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1595                              IEEE80211_MAX_MESH_ID_LEN);
1596                 wdev->mesh_id_up_len =
1597                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1598                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1599                        wdev->mesh_id_up_len);
1600                 wdev_unlock(wdev);
1601         }
1602
1603         if (info->attrs[NL80211_ATTR_4ADDR]) {
1604                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1605                 change = true;
1606                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1607                 if (err)
1608                         return err;
1609         } else {
1610                 params.use_4addr = -1;
1611         }
1612
1613         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1614                 if (ntype != NL80211_IFTYPE_MONITOR)
1615                         return -EINVAL;
1616                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1617                                           &_flags);
1618                 if (err)
1619                         return err;
1620
1621                 flags = &_flags;
1622                 change = true;
1623         }
1624
1625         if (change)
1626                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1627         else
1628                 err = 0;
1629
1630         if (!err && params.use_4addr != -1)
1631                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1632
1633         return err;
1634 }
1635
1636 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1637 {
1638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1639         struct vif_params params;
1640         struct net_device *dev;
1641         int err;
1642         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1643         u32 flags;
1644
1645         memset(&params, 0, sizeof(params));
1646
1647         if (!info->attrs[NL80211_ATTR_IFNAME])
1648                 return -EINVAL;
1649
1650         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1651                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1652                 if (type > NL80211_IFTYPE_MAX)
1653                         return -EINVAL;
1654         }
1655
1656         if (!rdev->ops->add_virtual_intf ||
1657             !(rdev->wiphy.interface_modes & (1 << type)))
1658                 return -EOPNOTSUPP;
1659
1660         if (info->attrs[NL80211_ATTR_4ADDR]) {
1661                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1662                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1663                 if (err)
1664                         return err;
1665         }
1666
1667         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1668                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1669                                   &flags);
1670         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1671                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1672                 type, err ? NULL : &flags, &params);
1673         if (IS_ERR(dev))
1674                 return PTR_ERR(dev);
1675
1676         if (type == NL80211_IFTYPE_MESH_POINT &&
1677             info->attrs[NL80211_ATTR_MESH_ID]) {
1678                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1679
1680                 wdev_lock(wdev);
1681                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1682                              IEEE80211_MAX_MESH_ID_LEN);
1683                 wdev->mesh_id_up_len =
1684                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1685                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1686                        wdev->mesh_id_up_len);
1687                 wdev_unlock(wdev);
1688         }
1689
1690         return 0;
1691 }
1692
1693 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1694 {
1695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1696         struct net_device *dev = info->user_ptr[1];
1697
1698         if (!rdev->ops->del_virtual_intf)
1699                 return -EOPNOTSUPP;
1700
1701         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1702 }
1703
1704 struct get_key_cookie {
1705         struct sk_buff *msg;
1706         int error;
1707         int idx;
1708 };
1709
1710 static void get_key_callback(void *c, struct key_params *params)
1711 {
1712         struct nlattr *key;
1713         struct get_key_cookie *cookie = c;
1714
1715         if (params->key)
1716                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1717                         params->key_len, params->key);
1718
1719         if (params->seq)
1720                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1721                         params->seq_len, params->seq);
1722
1723         if (params->cipher)
1724                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1725                             params->cipher);
1726
1727         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1728         if (!key)
1729                 goto nla_put_failure;
1730
1731         if (params->key)
1732                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1733                         params->key_len, params->key);
1734
1735         if (params->seq)
1736                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1737                         params->seq_len, params->seq);
1738
1739         if (params->cipher)
1740                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1741                             params->cipher);
1742
1743         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1744
1745         nla_nest_end(cookie->msg, key);
1746
1747         return;
1748  nla_put_failure:
1749         cookie->error = 1;
1750 }
1751
1752 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1753 {
1754         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1755         int err;
1756         struct net_device *dev = info->user_ptr[1];
1757         u8 key_idx = 0;
1758         const u8 *mac_addr = NULL;
1759         bool pairwise;
1760         struct get_key_cookie cookie = {
1761                 .error = 0,
1762         };
1763         void *hdr;
1764         struct sk_buff *msg;
1765
1766         if (info->attrs[NL80211_ATTR_KEY_IDX])
1767                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1768
1769         if (key_idx > 5)
1770                 return -EINVAL;
1771
1772         if (info->attrs[NL80211_ATTR_MAC])
1773                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1774
1775         pairwise = !!mac_addr;
1776         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1777                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1778                 if (kt >= NUM_NL80211_KEYTYPES)
1779                         return -EINVAL;
1780                 if (kt != NL80211_KEYTYPE_GROUP &&
1781                     kt != NL80211_KEYTYPE_PAIRWISE)
1782                         return -EINVAL;
1783                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1784         }
1785
1786         if (!rdev->ops->get_key)
1787                 return -EOPNOTSUPP;
1788
1789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1790         if (!msg)
1791                 return -ENOMEM;
1792
1793         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1794                              NL80211_CMD_NEW_KEY);
1795         if (IS_ERR(hdr))
1796                 return PTR_ERR(hdr);
1797
1798         cookie.msg = msg;
1799         cookie.idx = key_idx;
1800
1801         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1802         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1803         if (mac_addr)
1804                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1805
1806         if (pairwise && mac_addr &&
1807             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1808                 return -ENOENT;
1809
1810         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1811                                  mac_addr, &cookie, get_key_callback);
1812
1813         if (err)
1814                 goto free_msg;
1815
1816         if (cookie.error)
1817                 goto nla_put_failure;
1818
1819         genlmsg_end(msg, hdr);
1820         return genlmsg_reply(msg, info);
1821
1822  nla_put_failure:
1823         err = -ENOBUFS;
1824  free_msg:
1825         nlmsg_free(msg);
1826         return err;
1827 }
1828
1829 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1830 {
1831         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1832         struct key_parse key;
1833         int err;
1834         struct net_device *dev = info->user_ptr[1];
1835
1836         err = nl80211_parse_key(info, &key);
1837         if (err)
1838                 return err;
1839
1840         if (key.idx < 0)
1841                 return -EINVAL;
1842
1843         /* only support setting default key */
1844         if (!key.def && !key.defmgmt)
1845                 return -EINVAL;
1846
1847         wdev_lock(dev->ieee80211_ptr);
1848
1849         if (key.def) {
1850                 if (!rdev->ops->set_default_key) {
1851                         err = -EOPNOTSUPP;
1852                         goto out;
1853                 }
1854
1855                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1856                 if (err)
1857                         goto out;
1858
1859                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1860                                                  key.def_uni, key.def_multi);
1861
1862                 if (err)
1863                         goto out;
1864
1865 #ifdef CONFIG_CFG80211_WEXT
1866                 dev->ieee80211_ptr->wext.default_key = key.idx;
1867 #endif
1868         } else {
1869                 if (key.def_uni || !key.def_multi) {
1870                         err = -EINVAL;
1871                         goto out;
1872                 }
1873
1874                 if (!rdev->ops->set_default_mgmt_key) {
1875                         err = -EOPNOTSUPP;
1876                         goto out;
1877                 }
1878
1879                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1880                 if (err)
1881                         goto out;
1882
1883                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1884                                                       dev, key.idx);
1885                 if (err)
1886                         goto out;
1887
1888 #ifdef CONFIG_CFG80211_WEXT
1889                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1890 #endif
1891         }
1892
1893  out:
1894         wdev_unlock(dev->ieee80211_ptr);
1895
1896         return err;
1897 }
1898
1899 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1900 {
1901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1902         int err;
1903         struct net_device *dev = info->user_ptr[1];
1904         struct key_parse key;
1905         const u8 *mac_addr = NULL;
1906
1907         err = nl80211_parse_key(info, &key);
1908         if (err)
1909                 return err;
1910
1911         if (!key.p.key)
1912                 return -EINVAL;
1913
1914         if (info->attrs[NL80211_ATTR_MAC])
1915                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1916
1917         if (key.type == -1) {
1918                 if (mac_addr)
1919                         key.type = NL80211_KEYTYPE_PAIRWISE;
1920                 else
1921                         key.type = NL80211_KEYTYPE_GROUP;
1922         }
1923
1924         /* for now */
1925         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1926             key.type != NL80211_KEYTYPE_GROUP)
1927                 return -EINVAL;
1928
1929         if (!rdev->ops->add_key)
1930                 return -EOPNOTSUPP;
1931
1932         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1933                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1934                                            mac_addr))
1935                 return -EINVAL;
1936
1937         wdev_lock(dev->ieee80211_ptr);
1938         err = nl80211_key_allowed(dev->ieee80211_ptr);
1939         if (!err)
1940                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1941                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1942                                          mac_addr, &key.p);
1943         wdev_unlock(dev->ieee80211_ptr);
1944
1945         return err;
1946 }
1947
1948 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1949 {
1950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1951         int err;
1952         struct net_device *dev = info->user_ptr[1];
1953         u8 *mac_addr = NULL;
1954         struct key_parse key;
1955
1956         err = nl80211_parse_key(info, &key);
1957         if (err)
1958                 return err;
1959
1960         if (info->attrs[NL80211_ATTR_MAC])
1961                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1962
1963         if (key.type == -1) {
1964                 if (mac_addr)
1965                         key.type = NL80211_KEYTYPE_PAIRWISE;
1966                 else
1967                         key.type = NL80211_KEYTYPE_GROUP;
1968         }
1969
1970         /* for now */
1971         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1972             key.type != NL80211_KEYTYPE_GROUP)
1973                 return -EINVAL;
1974
1975         if (!rdev->ops->del_key)
1976                 return -EOPNOTSUPP;
1977
1978         wdev_lock(dev->ieee80211_ptr);
1979         err = nl80211_key_allowed(dev->ieee80211_ptr);
1980
1981         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1982             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1983                 err = -ENOENT;
1984
1985         if (!err)
1986                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1987                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1988                                          mac_addr);
1989
1990 #ifdef CONFIG_CFG80211_WEXT
1991         if (!err) {
1992                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1993                         dev->ieee80211_ptr->wext.default_key = -1;
1994                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1995                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1996         }
1997 #endif
1998         wdev_unlock(dev->ieee80211_ptr);
1999
2000         return err;
2001 }
2002
2003 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
2004 {
2005         int (*call)(struct wiphy *wiphy, struct net_device *dev,
2006                     struct beacon_parameters *info);
2007         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2008         struct net_device *dev = info->user_ptr[1];
2009         struct wireless_dev *wdev = dev->ieee80211_ptr;
2010         struct beacon_parameters params;
2011         int haveinfo = 0, err;
2012
2013         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2014             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2015             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2016             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2017                 return -EINVAL;
2018
2019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2020             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2021                 return -EOPNOTSUPP;
2022
2023         memset(&params, 0, sizeof(params));
2024
2025         switch (info->genlhdr->cmd) {
2026         case NL80211_CMD_NEW_BEACON:
2027                 /* these are required for NEW_BEACON */
2028                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2029                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2030                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
2031                         return -EINVAL;
2032
2033                 params.interval =
2034                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2035                 params.dtim_period =
2036                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2037
2038                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2039                 if (err)
2040                         return err;
2041
2042                 /*
2043                  * In theory, some of these attributes could be required for
2044                  * NEW_BEACON, but since they were not used when the command was
2045                  * originally added, keep them optional for old user space
2046                  * programs to work with drivers that do not need the additional
2047                  * information.
2048                  */
2049                 if (info->attrs[NL80211_ATTR_SSID]) {
2050                         params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2051                         params.ssid_len =
2052                                 nla_len(info->attrs[NL80211_ATTR_SSID]);
2053                         if (params.ssid_len == 0 ||
2054                             params.ssid_len > IEEE80211_MAX_SSID_LEN)
2055                                 return -EINVAL;
2056                 }
2057
2058                 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2059                         params.hidden_ssid = nla_get_u32(
2060                                 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2061                         if (params.hidden_ssid !=
2062                             NL80211_HIDDEN_SSID_NOT_IN_USE &&
2063                             params.hidden_ssid !=
2064                             NL80211_HIDDEN_SSID_ZERO_LEN &&
2065                             params.hidden_ssid !=
2066                             NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2067                                 return -EINVAL;
2068                 }
2069
2070                 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2071
2072                 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2073                         params.auth_type = nla_get_u32(
2074                                 info->attrs[NL80211_ATTR_AUTH_TYPE]);
2075                         if (!nl80211_valid_auth_type(params.auth_type))
2076                                 return -EINVAL;
2077                 } else
2078                         params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2079
2080                 err = nl80211_crypto_settings(rdev, info, &params.crypto,
2081                                               NL80211_MAX_NR_CIPHER_SUITES);
2082                 if (err)
2083                         return err;
2084
2085                 call = rdev->ops->add_beacon;
2086                 break;
2087         case NL80211_CMD_SET_BEACON:
2088                 call = rdev->ops->set_beacon;
2089                 break;
2090         default:
2091                 WARN_ON(1);
2092                 return -EOPNOTSUPP;
2093         }
2094
2095         if (!call)
2096                 return -EOPNOTSUPP;
2097
2098         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2099                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2100                 params.head_len =
2101                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2102                 haveinfo = 1;
2103         }
2104
2105         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2106                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2107                 params.tail_len =
2108                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2109                 haveinfo = 1;
2110         }
2111
2112         if (!haveinfo)
2113                 return -EINVAL;
2114
2115         if (info->attrs[NL80211_ATTR_IE]) {
2116                 params.beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2117                 params.beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2118         }
2119
2120         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2121                 params.proberesp_ies =
2122                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2123                 params.proberesp_ies_len =
2124                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2125         }
2126
2127         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2128                 params.assocresp_ies =
2129                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2130                 params.assocresp_ies_len =
2131                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2132         }
2133
2134         err = call(&rdev->wiphy, dev, &params);
2135         if (!err && params.interval)
2136                 wdev->beacon_interval = params.interval;
2137         return err;
2138 }
2139
2140 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2141 {
2142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2143         struct net_device *dev = info->user_ptr[1];
2144         struct wireless_dev *wdev = dev->ieee80211_ptr;
2145         int err;
2146
2147         if (!rdev->ops->del_beacon)
2148                 return -EOPNOTSUPP;
2149
2150         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2151             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2152                 return -EOPNOTSUPP;
2153
2154         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2155         if (!err)
2156                 wdev->beacon_interval = 0;
2157         return err;
2158 }
2159
2160 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2161         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2162         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2163         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2164         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2165         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2166 };
2167
2168 static int parse_station_flags(struct genl_info *info,
2169                                struct station_parameters *params)
2170 {
2171         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2172         struct nlattr *nla;
2173         int flag;
2174
2175         /*
2176          * Try parsing the new attribute first so userspace
2177          * can specify both for older kernels.
2178          */
2179         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2180         if (nla) {
2181                 struct nl80211_sta_flag_update *sta_flags;
2182
2183                 sta_flags = nla_data(nla);
2184                 params->sta_flags_mask = sta_flags->mask;
2185                 params->sta_flags_set = sta_flags->set;
2186                 if ((params->sta_flags_mask |
2187                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2188                         return -EINVAL;
2189                 return 0;
2190         }
2191
2192         /* if present, parse the old attribute */
2193
2194         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2195         if (!nla)
2196                 return 0;
2197
2198         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2199                              nla, sta_flags_policy))
2200                 return -EINVAL;
2201
2202         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2203         params->sta_flags_mask &= ~1;
2204
2205         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2206                 if (flags[flag])
2207                         params->sta_flags_set |= (1<<flag);
2208
2209         return 0;
2210 }
2211
2212 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2213                                  int attr)
2214 {
2215         struct nlattr *rate;
2216         u16 bitrate;
2217
2218         rate = nla_nest_start(msg, attr);
2219         if (!rate)
2220                 goto nla_put_failure;
2221
2222         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2223         bitrate = cfg80211_calculate_bitrate(info);
2224         if (bitrate > 0)
2225                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2226
2227         if (info->flags & RATE_INFO_FLAGS_MCS)
2228                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2229         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2230                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2231         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2232                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2233
2234         nla_nest_end(msg, rate);
2235         return true;
2236
2237 nla_put_failure:
2238         return false;
2239 }
2240
2241 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2242                                 int flags, struct net_device *dev,
2243                                 const u8 *mac_addr, struct station_info *sinfo)
2244 {
2245         void *hdr;
2246         struct nlattr *sinfoattr, *bss_param;
2247
2248         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2249         if (!hdr)
2250                 return -1;
2251
2252         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2253         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2254
2255         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2256
2257         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2258         if (!sinfoattr)
2259                 goto nla_put_failure;
2260         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2261                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2262                             sinfo->connected_time);
2263         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2264                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2265                             sinfo->inactive_time);
2266         if (sinfo->filled & STATION_INFO_RX_BYTES)
2267                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2268                             sinfo->rx_bytes);
2269         if (sinfo->filled & STATION_INFO_TX_BYTES)
2270                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2271                             sinfo->tx_bytes);
2272         if (sinfo->filled & STATION_INFO_LLID)
2273                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2274                             sinfo->llid);
2275         if (sinfo->filled & STATION_INFO_PLID)
2276                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2277                             sinfo->plid);
2278         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2279                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2280                             sinfo->plink_state);
2281         if (sinfo->filled & STATION_INFO_SIGNAL)
2282                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2283                            sinfo->signal);
2284         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2285                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2286                            sinfo->signal_avg);
2287         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2288                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2289                                           NL80211_STA_INFO_TX_BITRATE))
2290                         goto nla_put_failure;
2291         }
2292         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2293                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2294                                           NL80211_STA_INFO_RX_BITRATE))
2295                         goto nla_put_failure;
2296         }
2297         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2298                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2299                             sinfo->rx_packets);
2300         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2301                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2302                             sinfo->tx_packets);
2303         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2304                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2305                             sinfo->tx_retries);
2306         if (sinfo->filled & STATION_INFO_TX_FAILED)
2307                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2308                             sinfo->tx_failed);
2309         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2310                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2311                 if (!bss_param)
2312                         goto nla_put_failure;
2313
2314                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2315                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2316                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2317                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2318                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2319                         NLA_PUT_FLAG(msg,
2320                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2321                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2322                            sinfo->bss_param.dtim_period);
2323                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2324                             sinfo->bss_param.beacon_interval);
2325
2326                 nla_nest_end(msg, bss_param);
2327         }
2328         nla_nest_end(msg, sinfoattr);
2329
2330         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
2331                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2332                         sinfo->assoc_req_ies);
2333
2334         return genlmsg_end(msg, hdr);
2335
2336  nla_put_failure:
2337         genlmsg_cancel(msg, hdr);
2338         return -EMSGSIZE;
2339 }
2340
2341 static int nl80211_dump_station(struct sk_buff *skb,
2342                                 struct netlink_callback *cb)
2343 {
2344         struct station_info sinfo;
2345         struct cfg80211_registered_device *dev;
2346         struct net_device *netdev;
2347         u8 mac_addr[ETH_ALEN];
2348         int sta_idx = cb->args[1];
2349         int err;
2350
2351         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2352         if (err)
2353                 return err;
2354
2355         if (!dev->ops->dump_station) {
2356                 err = -EOPNOTSUPP;
2357                 goto out_err;
2358         }
2359
2360         while (1) {
2361                 memset(&sinfo, 0, sizeof(sinfo));
2362                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2363                                              mac_addr, &sinfo);
2364                 if (err == -ENOENT)
2365                         break;
2366                 if (err)
2367                         goto out_err;
2368
2369                 if (nl80211_send_station(skb,
2370                                 NETLINK_CB(cb->skb).pid,
2371                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2372                                 netdev, mac_addr,
2373                                 &sinfo) < 0)
2374                         goto out;
2375
2376                 sta_idx++;
2377         }
2378
2379
2380  out:
2381         cb->args[1] = sta_idx;
2382         err = skb->len;
2383  out_err:
2384         nl80211_finish_netdev_dump(dev);
2385
2386         return err;
2387 }
2388
2389 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2390 {
2391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2392         struct net_device *dev = info->user_ptr[1];
2393         struct station_info sinfo;
2394         struct sk_buff *msg;
2395         u8 *mac_addr = NULL;
2396         int err;
2397
2398         memset(&sinfo, 0, sizeof(sinfo));
2399
2400         if (!info->attrs[NL80211_ATTR_MAC])
2401                 return -EINVAL;
2402
2403         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2404
2405         if (!rdev->ops->get_station)
2406                 return -EOPNOTSUPP;
2407
2408         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2409         if (err)
2410                 return err;
2411
2412         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2413         if (!msg)
2414                 return -ENOMEM;
2415
2416         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2417                                  dev, mac_addr, &sinfo) < 0) {
2418                 nlmsg_free(msg);
2419                 return -ENOBUFS;
2420         }
2421
2422         return genlmsg_reply(msg, info);
2423 }
2424
2425 /*
2426  * Get vlan interface making sure it is running and on the right wiphy.
2427  */
2428 static int get_vlan(struct genl_info *info,
2429                     struct cfg80211_registered_device *rdev,
2430                     struct net_device **vlan)
2431 {
2432         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2433         *vlan = NULL;
2434
2435         if (vlanattr) {
2436                 *vlan = dev_get_by_index(genl_info_net(info),
2437                                          nla_get_u32(vlanattr));
2438                 if (!*vlan)
2439                         return -ENODEV;
2440                 if (!(*vlan)->ieee80211_ptr)
2441                         return -EINVAL;
2442                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2443                         return -EINVAL;
2444                 if (!netif_running(*vlan))
2445                         return -ENETDOWN;
2446         }
2447         return 0;
2448 }
2449
2450 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2451 {
2452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2453         int err;
2454         struct net_device *dev = info->user_ptr[1];
2455         struct station_parameters params;
2456         u8 *mac_addr = NULL;
2457
2458         memset(&params, 0, sizeof(params));
2459
2460         params.listen_interval = -1;
2461         params.plink_state = -1;
2462
2463         if (info->attrs[NL80211_ATTR_STA_AID])
2464                 return -EINVAL;
2465
2466         if (!info->attrs[NL80211_ATTR_MAC])
2467                 return -EINVAL;
2468
2469         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2470
2471         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2472                 params.supported_rates =
2473                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2474                 params.supported_rates_len =
2475                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2476         }
2477
2478         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2479                 params.listen_interval =
2480                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2481
2482         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2483                 params.ht_capa =
2484                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2485
2486         if (parse_station_flags(info, &params))
2487                 return -EINVAL;
2488
2489         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2490                 params.plink_action =
2491                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2492
2493         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2494                 params.plink_state =
2495                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2496
2497         err = get_vlan(info, rdev, &params.vlan);
2498         if (err)
2499                 goto out;
2500
2501         /* validate settings */
2502         err = 0;
2503
2504         switch (dev->ieee80211_ptr->iftype) {
2505         case NL80211_IFTYPE_AP:
2506         case NL80211_IFTYPE_AP_VLAN:
2507         case NL80211_IFTYPE_P2P_GO:
2508                 /* disallow mesh-specific things */
2509                 if (params.plink_action)
2510                         err = -EINVAL;
2511                 break;
2512         case NL80211_IFTYPE_P2P_CLIENT:
2513         case NL80211_IFTYPE_STATION:
2514                 /* disallow everything but AUTHORIZED flag */
2515                 if (params.plink_action)
2516                         err = -EINVAL;
2517                 if (params.vlan)
2518                         err = -EINVAL;
2519                 if (params.supported_rates)
2520                         err = -EINVAL;
2521                 if (params.ht_capa)
2522                         err = -EINVAL;
2523                 if (params.listen_interval >= 0)
2524                         err = -EINVAL;
2525                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2526                         err = -EINVAL;
2527                 break;
2528         case NL80211_IFTYPE_MESH_POINT:
2529                 /* disallow things mesh doesn't support */
2530                 if (params.vlan)
2531                         err = -EINVAL;
2532                 if (params.ht_capa)
2533                         err = -EINVAL;
2534                 if (params.listen_interval >= 0)
2535                         err = -EINVAL;
2536                 if (params.sta_flags_mask &
2537                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2538                                   BIT(NL80211_STA_FLAG_MFP) |
2539                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2540                         err = -EINVAL;
2541                 break;
2542         default:
2543                 err = -EINVAL;
2544         }
2545
2546         if (err)
2547                 goto out;
2548
2549         if (!rdev->ops->change_station) {
2550                 err = -EOPNOTSUPP;
2551                 goto out;
2552         }
2553
2554         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2555
2556  out:
2557         if (params.vlan)
2558                 dev_put(params.vlan);
2559
2560         return err;
2561 }
2562
2563 static struct nla_policy
2564 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
2565         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
2566         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
2567 };
2568
2569 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2570 {
2571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2572         int err;
2573         struct net_device *dev = info->user_ptr[1];
2574         struct station_parameters params;
2575         u8 *mac_addr = NULL;
2576
2577         memset(&params, 0, sizeof(params));
2578
2579         if (!info->attrs[NL80211_ATTR_MAC])
2580                 return -EINVAL;
2581
2582         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2583                 return -EINVAL;
2584
2585         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2586                 return -EINVAL;
2587
2588         if (!info->attrs[NL80211_ATTR_STA_AID])
2589                 return -EINVAL;
2590
2591         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2592         params.supported_rates =
2593                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2594         params.supported_rates_len =
2595                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2596         params.listen_interval =
2597                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2598
2599         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2600         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2601                 return -EINVAL;
2602
2603         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2604                 params.ht_capa =
2605                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2606
2607         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2608                 params.plink_action =
2609                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2610
2611         if (parse_station_flags(info, &params))
2612                 return -EINVAL;
2613
2614         /* parse WME attributes if sta is WME capable */
2615         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2616             (params.sta_flags_set & NL80211_STA_FLAG_WME) &&
2617             info->attrs[NL80211_ATTR_STA_WME]) {
2618                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
2619                 struct nlattr *nla;
2620
2621                 nla = info->attrs[NL80211_ATTR_STA_WME];
2622                 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
2623                                        nl80211_sta_wme_policy);
2624                 if (err)
2625                         return err;
2626
2627                 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
2628                         params.uapsd_queues =
2629                              nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
2630                 if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
2631                         return -EINVAL;
2632
2633                 if (tb[NL80211_STA_WME_MAX_SP])
2634                         params.max_sp =
2635                              nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
2636
2637                 if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
2638                         return -EINVAL;
2639         }
2640
2641         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2642             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2643             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2644             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2645                 return -EINVAL;
2646
2647         err = get_vlan(info, rdev, &params.vlan);
2648         if (err)
2649                 goto out;
2650
2651         /* validate settings */
2652         err = 0;
2653
2654         if (!rdev->ops->add_station) {
2655                 err = -EOPNOTSUPP;
2656                 goto out;
2657         }
2658
2659         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2660
2661  out:
2662         if (params.vlan)
2663                 dev_put(params.vlan);
2664         return err;
2665 }
2666
2667 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2668 {
2669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2670         struct net_device *dev = info->user_ptr[1];
2671         u8 *mac_addr = NULL;
2672
2673         if (info->attrs[NL80211_ATTR_MAC])
2674                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2675
2676         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2677             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2678             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2679             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2680                 return -EINVAL;
2681
2682         if (!rdev->ops->del_station)
2683                 return -EOPNOTSUPP;
2684
2685         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2686 }
2687
2688 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2689                                 int flags, struct net_device *dev,
2690                                 u8 *dst, u8 *next_hop,
2691                                 struct mpath_info *pinfo)
2692 {
2693         void *hdr;
2694         struct nlattr *pinfoattr;
2695
2696         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2697         if (!hdr)
2698                 return -1;
2699
2700         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2701         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2702         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2703
2704         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2705
2706         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2707         if (!pinfoattr)
2708                 goto nla_put_failure;
2709         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2710                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2711                             pinfo->frame_qlen);
2712         if (pinfo->filled & MPATH_INFO_SN)
2713                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2714                             pinfo->sn);
2715         if (pinfo->filled & MPATH_INFO_METRIC)
2716                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2717                             pinfo->metric);
2718         if (pinfo->filled & MPATH_INFO_EXPTIME)
2719                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2720                             pinfo->exptime);
2721         if (pinfo->filled & MPATH_INFO_FLAGS)
2722                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2723                             pinfo->flags);
2724         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2725                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2726                             pinfo->discovery_timeout);
2727         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2728                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2729                             pinfo->discovery_retries);
2730
2731         nla_nest_end(msg, pinfoattr);
2732
2733         return genlmsg_end(msg, hdr);
2734
2735  nla_put_failure:
2736         genlmsg_cancel(msg, hdr);
2737         return -EMSGSIZE;
2738 }
2739
2740 static int nl80211_dump_mpath(struct sk_buff *skb,
2741                               struct netlink_callback *cb)
2742 {
2743         struct mpath_info pinfo;
2744         struct cfg80211_registered_device *dev;
2745         struct net_device *netdev;
2746         u8 dst[ETH_ALEN];
2747         u8 next_hop[ETH_ALEN];
2748         int path_idx = cb->args[1];
2749         int err;
2750
2751         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2752         if (err)
2753                 return err;
2754
2755         if (!dev->ops->dump_mpath) {
2756                 err = -EOPNOTSUPP;
2757                 goto out_err;
2758         }
2759
2760         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2761                 err = -EOPNOTSUPP;
2762                 goto out_err;
2763         }
2764
2765         while (1) {
2766                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2767                                            dst, next_hop, &pinfo);
2768                 if (err == -ENOENT)
2769                         break;
2770                 if (err)
2771                         goto out_err;
2772
2773                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2774                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2775                                        netdev, dst, next_hop,
2776                                        &pinfo) < 0)
2777                         goto out;
2778
2779                 path_idx++;
2780         }
2781
2782
2783  out:
2784         cb->args[1] = path_idx;
2785         err = skb->len;
2786  out_err:
2787         nl80211_finish_netdev_dump(dev);
2788         return err;
2789 }
2790
2791 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2792 {
2793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2794         int err;
2795         struct net_device *dev = info->user_ptr[1];
2796         struct mpath_info pinfo;
2797         struct sk_buff *msg;
2798         u8 *dst = NULL;
2799         u8 next_hop[ETH_ALEN];
2800
2801         memset(&pinfo, 0, sizeof(pinfo));
2802
2803         if (!info->attrs[NL80211_ATTR_MAC])
2804                 return -EINVAL;
2805
2806         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2807
2808         if (!rdev->ops->get_mpath)
2809                 return -EOPNOTSUPP;
2810
2811         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2812                 return -EOPNOTSUPP;
2813
2814         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2815         if (err)
2816                 return err;
2817
2818         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2819         if (!msg)
2820                 return -ENOMEM;
2821
2822         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2823                                  dev, dst, next_hop, &pinfo) < 0) {
2824                 nlmsg_free(msg);
2825                 return -ENOBUFS;
2826         }
2827
2828         return genlmsg_reply(msg, info);
2829 }
2830
2831 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2832 {
2833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2834         struct net_device *dev = info->user_ptr[1];
2835         u8 *dst = NULL;
2836         u8 *next_hop = NULL;
2837
2838         if (!info->attrs[NL80211_ATTR_MAC])
2839                 return -EINVAL;
2840
2841         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2842                 return -EINVAL;
2843
2844         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2845         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2846
2847         if (!rdev->ops->change_mpath)
2848                 return -EOPNOTSUPP;
2849
2850         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2851                 return -EOPNOTSUPP;
2852
2853         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2854 }
2855
2856 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2857 {
2858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2859         struct net_device *dev = info->user_ptr[1];
2860         u8 *dst = NULL;
2861         u8 *next_hop = NULL;
2862
2863         if (!info->attrs[NL80211_ATTR_MAC])
2864                 return -EINVAL;
2865
2866         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2867                 return -EINVAL;
2868
2869         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2870         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2871
2872         if (!rdev->ops->add_mpath)
2873                 return -EOPNOTSUPP;
2874
2875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2876                 return -EOPNOTSUPP;
2877
2878         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2879 }
2880
2881 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2882 {
2883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2884         struct net_device *dev = info->user_ptr[1];
2885         u8 *dst = NULL;
2886
2887         if (info->attrs[NL80211_ATTR_MAC])
2888                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2889
2890         if (!rdev->ops->del_mpath)
2891                 return -EOPNOTSUPP;
2892
2893         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2894 }
2895
2896 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2897 {
2898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2899         struct net_device *dev = info->user_ptr[1];
2900         struct bss_parameters params;
2901
2902         memset(&params, 0, sizeof(params));
2903         /* default to not changing parameters */
2904         params.use_cts_prot = -1;
2905         params.use_short_preamble = -1;
2906         params.use_short_slot_time = -1;
2907         params.ap_isolate = -1;
2908         params.ht_opmode = -1;
2909
2910         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2911                 params.use_cts_prot =
2912                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2913         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2914                 params.use_short_preamble =
2915                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2916         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2917                 params.use_short_slot_time =
2918                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2919         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2920                 params.basic_rates =
2921                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2922                 params.basic_rates_len =
2923                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2924         }
2925         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2926                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2927         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2928                 params.ht_opmode =
2929                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2930
2931         if (!rdev->ops->change_bss)
2932                 return -EOPNOTSUPP;
2933
2934         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2935             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2936                 return -EOPNOTSUPP;
2937
2938         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2939 }
2940
2941 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2942         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2943         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2944         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2945         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2946         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2947         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2948 };
2949
2950 static int parse_reg_rule(struct nlattr *tb[],
2951         struct ieee80211_reg_rule *reg_rule)
2952 {
2953         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2954         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2955
2956         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2957                 return -EINVAL;
2958         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2959                 return -EINVAL;
2960         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2961                 return -EINVAL;
2962         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2963                 return -EINVAL;
2964         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2965                 return -EINVAL;
2966
2967         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2968
2969         freq_range->start_freq_khz =
2970                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2971         freq_range->end_freq_khz =
2972                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2973         freq_range->max_bandwidth_khz =
2974                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2975
2976         power_rule->max_eirp =
2977                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2978
2979         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2980                 power_rule->max_antenna_gain =
2981                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2982
2983         return 0;
2984 }
2985
2986 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2987 {
2988         int r;
2989         char *data = NULL;
2990
2991         /*
2992          * You should only get this when cfg80211 hasn't yet initialized
2993          * completely when built-in to the kernel right between the time
2994          * window between nl80211_init() and regulatory_init(), if that is
2995          * even possible.
2996          */
2997         mutex_lock(&cfg80211_mutex);
2998         if (unlikely(!cfg80211_regdomain)) {
2999                 mutex_unlock(&cfg80211_mutex);
3000                 return -EINPROGRESS;
3001         }
3002         mutex_unlock(&cfg80211_mutex);
3003
3004         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3005                 return -EINVAL;
3006
3007         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3008
3009         r = regulatory_hint_user(data);
3010
3011         return r;
3012 }
3013
3014 static int nl80211_get_mesh_config(struct sk_buff *skb,
3015                                    struct genl_info *info)
3016 {
3017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3018         struct net_device *dev = info->user_ptr[1];
3019         struct wireless_dev *wdev = dev->ieee80211_ptr;
3020         struct mesh_config cur_params;
3021         int err = 0;
3022         void *hdr;
3023         struct nlattr *pinfoattr;
3024         struct sk_buff *msg;
3025
3026         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3027                 return -EOPNOTSUPP;
3028
3029         if (!rdev->ops->get_mesh_config)
3030                 return -EOPNOTSUPP;
3031
3032         wdev_lock(wdev);
3033         /* If not connected, get default parameters */
3034         if (!wdev->mesh_id_len)
3035                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3036         else
3037                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3038                                                  &cur_params);
3039         wdev_unlock(wdev);
3040
3041         if (err)
3042                 return err;
3043
3044         /* Draw up a netlink message to send back */
3045         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3046         if (!msg)
3047                 return -ENOMEM;
3048         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3049                              NL80211_CMD_GET_MESH_CONFIG);
3050         if (!hdr)
3051                 goto out;
3052         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3053         if (!pinfoattr)
3054                 goto nla_put_failure;
3055         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3056         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3057                         cur_params.dot11MeshRetryTimeout);
3058         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3059                         cur_params.dot11MeshConfirmTimeout);
3060         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3061                         cur_params.dot11MeshHoldingTimeout);
3062         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3063                         cur_params.dot11MeshMaxPeerLinks);
3064         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
3065                         cur_params.dot11MeshMaxRetries);
3066         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
3067                         cur_params.dot11MeshTTL);
3068         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3069                         cur_params.element_ttl);
3070         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3071                         cur_params.auto_open_plinks);
3072         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3073                         cur_params.dot11MeshHWMPmaxPREQretries);
3074         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3075                         cur_params.path_refresh_time);
3076         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3077                         cur_params.min_discovery_timeout);
3078         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3079                         cur_params.dot11MeshHWMPactivePathTimeout);
3080         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3081                         cur_params.dot11MeshHWMPpreqMinInterval);
3082         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3083                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
3084         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3085                         cur_params.dot11MeshHWMPRootMode);
3086         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3087                         cur_params.dot11MeshHWMPRannInterval);
3088         NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3089                         cur_params.dot11MeshGateAnnouncementProtocol);
3090         nla_nest_end(msg, pinfoattr);
3091         genlmsg_end(msg, hdr);
3092         return genlmsg_reply(msg, info);
3093
3094  nla_put_failure:
3095         genlmsg_cancel(msg, hdr);
3096  out:
3097         nlmsg_free(msg);
3098         return -ENOBUFS;
3099 }
3100
3101 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3102         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3103         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3104         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3105         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3106         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3107         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3108         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3109         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3110
3111         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3112         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3113         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3114         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3115         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3116         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3117         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3118         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3119         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3120 };
3121
3122 static const struct nla_policy
3123         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3124         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3125         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3126         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3127         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3128                 .len = IEEE80211_MAX_DATA_LEN },
3129         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3130 };
3131
3132 static int nl80211_parse_mesh_config(struct genl_info *info,
3133                                      struct mesh_config *cfg,
3134                                      u32 *mask_out)
3135 {
3136         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3137         u32 mask = 0;
3138
3139 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3140 do {\
3141         if (table[attr_num]) {\
3142                 cfg->param = nla_fn(table[attr_num]); \
3143                 mask |= (1 << (attr_num - 1)); \
3144         } \
3145 } while (0);\
3146
3147
3148         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3149                 return -EINVAL;
3150         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3151                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3152                              nl80211_meshconf_params_policy))
3153                 return -EINVAL;
3154
3155         /* This makes sure that there aren't more than 32 mesh config
3156          * parameters (otherwise our bitfield scheme would not work.) */
3157         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3158
3159         /* Fill in the params struct */
3160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3161                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3162         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3163                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3164         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3165                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3166         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3167                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3168         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3169                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3171                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3172         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3173                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3174         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3175                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3177                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3178                         nla_get_u8);
3179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3180                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3181         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3182                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3183                         nla_get_u16);
3184         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3185                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3186                         nla_get_u32);
3187         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3188                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3189                         nla_get_u16);
3190         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3191                         dot11MeshHWMPnetDiameterTraversalTime,
3192                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3193                         nla_get_u16);
3194         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3195                         dot11MeshHWMPRootMode, mask,
3196                         NL80211_MESHCONF_HWMP_ROOTMODE,
3197                         nla_get_u8);
3198         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3199                         dot11MeshHWMPRannInterval, mask,
3200                         NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3201                         nla_get_u16);
3202         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3203                         dot11MeshGateAnnouncementProtocol, mask,
3204                         NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3205                         nla_get_u8);
3206         if (mask_out)
3207                 *mask_out = mask;
3208
3209         return 0;
3210
3211 #undef FILL_IN_MESH_PARAM_IF_SET
3212 }
3213
3214 static int nl80211_parse_mesh_setup(struct genl_info *info,
3215                                      struct mesh_setup *setup)
3216 {
3217         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3218
3219         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3220                 return -EINVAL;
3221         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3222                              info->attrs[NL80211_ATTR_MESH_SETUP],
3223                              nl80211_mesh_setup_params_policy))
3224                 return -EINVAL;
3225
3226         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3227                 setup->path_sel_proto =
3228                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3229                  IEEE80211_PATH_PROTOCOL_VENDOR :
3230                  IEEE80211_PATH_PROTOCOL_HWMP;
3231
3232         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3233                 setup->path_metric =
3234                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3235                  IEEE80211_PATH_METRIC_VENDOR :
3236                  IEEE80211_PATH_METRIC_AIRTIME;
3237
3238
3239         if (tb[NL80211_MESH_SETUP_IE]) {
3240                 struct nlattr *ieattr =
3241                         tb[NL80211_MESH_SETUP_IE];
3242                 if (!is_valid_ie_attr(ieattr))
3243                         return -EINVAL;
3244                 setup->ie = nla_data(ieattr);
3245                 setup->ie_len = nla_len(ieattr);
3246         }
3247         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3248         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3249
3250         return 0;
3251 }
3252
3253 static int nl80211_update_mesh_config(struct sk_buff *skb,
3254                                       struct genl_info *info)
3255 {
3256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3257         struct net_device *dev = info->user_ptr[1];
3258         struct wireless_dev *wdev = dev->ieee80211_ptr;
3259         struct mesh_config cfg;
3260         u32 mask;
3261         int err;
3262
3263         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3264                 return -EOPNOTSUPP;
3265
3266         if (!rdev->ops->update_mesh_config)
3267                 return -EOPNOTSUPP;
3268
3269         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3270         if (err)
3271                 return err;
3272
3273         wdev_lock(wdev);
3274         if (!wdev->mesh_id_len)
3275                 err = -ENOLINK;
3276
3277         if (!err)
3278                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3279                                                     mask, &cfg);
3280
3281         wdev_unlock(wdev);
3282
3283         return err;
3284 }
3285
3286 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3287 {
3288         struct sk_buff *msg;
3289         void *hdr = NULL;
3290         struct nlattr *nl_reg_rules;
3291         unsigned int i;
3292         int err = -EINVAL;
3293
3294         mutex_lock(&cfg80211_mutex);
3295
3296         if (!cfg80211_regdomain)
3297                 goto out;
3298
3299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3300         if (!msg) {
3301                 err = -ENOBUFS;
3302                 goto out;
3303         }
3304
3305         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3306                              NL80211_CMD_GET_REG);
3307         if (!hdr)
3308                 goto put_failure;
3309
3310         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3311                 cfg80211_regdomain->alpha2);
3312
3313         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3314         if (!nl_reg_rules)
3315                 goto nla_put_failure;
3316
3317         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3318                 struct nlattr *nl_reg_rule;
3319                 const struct ieee80211_reg_rule *reg_rule;
3320                 const struct ieee80211_freq_range *freq_range;
3321                 const struct ieee80211_power_rule *power_rule;
3322
3323                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3324                 freq_range = &reg_rule->freq_range;
3325                 power_rule = &reg_rule->power_rule;
3326
3327                 nl_reg_rule = nla_nest_start(msg, i);
3328                 if (!nl_reg_rule)
3329                         goto nla_put_failure;
3330
3331                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3332                         reg_rule->flags);
3333                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3334                         freq_range->start_freq_khz);
3335                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3336                         freq_range->end_freq_khz);
3337                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3338                         freq_range->max_bandwidth_khz);
3339                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3340                         power_rule->max_antenna_gain);
3341                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3342                         power_rule->max_eirp);
3343
3344                 nla_nest_end(msg, nl_reg_rule);
3345         }
3346
3347         nla_nest_end(msg, nl_reg_rules);
3348
3349         genlmsg_end(msg, hdr);
3350         err = genlmsg_reply(msg, info);
3351         goto out;
3352
3353 nla_put_failure:
3354         genlmsg_cancel(msg, hdr);
3355 put_failure:
3356         nlmsg_free(msg);
3357         err = -EMSGSIZE;
3358 out:
3359         mutex_unlock(&cfg80211_mutex);
3360         return err;
3361 }
3362
3363 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3364 {
3365         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3366         struct nlattr *nl_reg_rule;
3367         char *alpha2 = NULL;
3368         int rem_reg_rules = 0, r = 0;
3369         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3370         struct ieee80211_regdomain *rd = NULL;
3371
3372         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3373                 return -EINVAL;
3374
3375         if (!info->attrs[NL80211_ATTR_REG_RULES])
3376                 return -EINVAL;
3377
3378         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3379
3380         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3381                         rem_reg_rules) {
3382                 num_rules++;
3383                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3384                         return -EINVAL;
3385         }
3386
3387         mutex_lock(&cfg80211_mutex);
3388
3389         if (!reg_is_valid_request(alpha2)) {
3390                 r = -EINVAL;
3391                 goto bad_reg;
3392         }
3393
3394         size_of_regd = sizeof(struct ieee80211_regdomain) +
3395                 (num_rules * sizeof(struct ieee80211_reg_rule));
3396
3397         rd = kzalloc(size_of_regd, GFP_KERNEL);
3398         if (!rd) {
3399                 r = -ENOMEM;
3400                 goto bad_reg;
3401         }
3402
3403         rd->n_reg_rules = num_rules;
3404         rd->alpha2[0] = alpha2[0];
3405         rd->alpha2[1] = alpha2[1];
3406
3407         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3408                         rem_reg_rules) {
3409                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3410                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3411                         reg_rule_policy);
3412                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3413                 if (r)
3414                         goto bad_reg;
3415
3416                 rule_idx++;
3417
3418                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3419                         r = -EINVAL;
3420                         goto bad_reg;
3421                 }
3422         }
3423
3424         BUG_ON(rule_idx != num_rules);
3425
3426         r = set_regdom(rd);
3427
3428         mutex_unlock(&cfg80211_mutex);
3429
3430         return r;
3431
3432  bad_reg:
3433         mutex_unlock(&cfg80211_mutex);
3434         kfree(rd);
3435         return r;
3436 }
3437
3438 static int validate_scan_freqs(struct nlattr *freqs)
3439 {
3440         struct nlattr *attr1, *attr2;
3441         int n_channels = 0, tmp1, tmp2;
3442
3443         nla_for_each_nested(attr1, freqs, tmp1) {
3444                 n_channels++;
3445                 /*
3446                  * Some hardware has a limited channel list for
3447                  * scanning, and it is pretty much nonsensical
3448                  * to scan for a channel twice, so disallow that
3449                  * and don't require drivers to check that the
3450                  * channel list they get isn't longer than what
3451                  * they can scan, as long as they can scan all
3452                  * the channels they registered at once.
3453                  */
3454                 nla_for_each_nested(attr2, freqs, tmp2)
3455                         if (attr1 != attr2 &&
3456                             nla_get_u32(attr1) == nla_get_u32(attr2))
3457                                 return 0;
3458         }
3459
3460         return n_channels;
3461 }
3462
3463 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3464 {
3465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3466         struct net_device *dev = info->user_ptr[1];
3467         struct cfg80211_scan_request *request;
3468         struct nlattr *attr;
3469         struct wiphy *wiphy;
3470         int err, tmp, n_ssids = 0, n_channels, i;
3471         size_t ie_len;
3472
3473         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3474                 return -EINVAL;
3475
3476         wiphy = &rdev->wiphy;
3477
3478         if (!rdev->ops->scan)
3479                 return -EOPNOTSUPP;
3480
3481         if (rdev->scan_req)
3482                 return -EBUSY;
3483
3484         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3485                 n_channels = validate_scan_freqs(
3486                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3487                 if (!n_channels)
3488                         return -EINVAL;
3489         } else {
3490                 enum ieee80211_band band;
3491                 n_channels = 0;
3492
3493                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3494                         if (wiphy->bands[band])
3495                                 n_channels += wiphy->bands[band]->n_channels;
3496         }
3497
3498         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3499                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3500                         n_ssids++;
3501
3502         if (n_ssids > wiphy->max_scan_ssids)
3503                 return -EINVAL;
3504
3505         if (info->attrs[NL80211_ATTR_IE])
3506                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3507         else
3508                 ie_len = 0;
3509
3510         if (ie_len > wiphy->max_scan_ie_len)
3511                 return -EINVAL;
3512
3513         request = kzalloc(sizeof(*request)
3514                         + sizeof(*request->ssids) * n_ssids
3515                         + sizeof(*request->channels) * n_channels
3516                         + ie_len, GFP_KERNEL);
3517         if (!request)
3518                 return -ENOMEM;
3519
3520         if (n_ssids)
3521                 request->ssids = (void *)&request->channels[n_channels];
3522         request->n_ssids = n_ssids;
3523         if (ie_len) {
3524                 if (request->ssids)
3525                         request->ie = (void *)(request->ssids + n_ssids);
3526                 else
3527                         request->ie = (void *)(request->channels + n_channels);
3528         }
3529
3530         i = 0;
3531         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3532                 /* user specified, bail out if channel not found */
3533                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3534                         struct ieee80211_channel *chan;
3535
3536                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3537
3538                         if (!chan) {
3539                                 err = -EINVAL;
3540                                 goto out_free;
3541                         }
3542
3543                         /* ignore disabled channels */
3544                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3545                                 continue;
3546
3547                         request->channels[i] = chan;
3548                         i++;
3549                 }
3550         } else {
3551                 enum ieee80211_band band;
3552
3553                 /* all channels */
3554                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3555                         int j;
3556                         if (!wiphy->bands[band])
3557                                 continue;
3558                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3559                                 struct ieee80211_channel *chan;
3560
3561                                 chan = &wiphy->bands[band]->channels[j];
3562
3563                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3564                                         continue;
3565
3566                                 request->channels[i] = chan;
3567                                 i++;
3568                         }
3569                 }
3570         }
3571
3572         if (!i) {
3573                 err = -EINVAL;
3574                 goto out_free;
3575         }
3576
3577         request->n_channels = i;
3578
3579         i = 0;
3580         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3581                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3582                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3583                                 err = -EINVAL;
3584                                 goto out_free;
3585                         }
3586                         request->ssids[i].ssid_len = nla_len(attr);
3587                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3588                         i++;
3589                 }
3590         }
3591
3592         if (info->attrs[NL80211_ATTR_IE]) {
3593                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3594                 memcpy((void *)request->ie,
3595                        nla_data(info->attrs[NL80211_ATTR_IE]),
3596                        request->ie_len);
3597         }
3598
3599         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
3600                 if (wiphy->bands[i])
3601                         request->rates[i] =
3602                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
3603
3604         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
3605                 nla_for_each_nested(attr,
3606                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
3607                                     tmp) {
3608                         enum ieee80211_band band = nla_type(attr);
3609
3610                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
3611                                 err = -EINVAL;
3612                                 goto out_free;
3613                         }
3614                         err = ieee80211_get_ratemask(wiphy->bands[band],
3615                                                      nla_data(attr),
3616                                                      nla_len(attr),
3617                                                      &request->rates[band]);
3618                         if (err)
3619                                 goto out_free;
3620                 }
3621         }
3622
3623         request->dev = dev;
3624         request->wiphy = &rdev->wiphy;
3625
3626         rdev->scan_req = request;
3627         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3628
3629         if (!err) {
3630                 nl80211_send_scan_start(rdev, dev);
3631                 dev_hold(dev);
3632         } else {
3633  out_free:
3634                 rdev->scan_req = NULL;
3635                 kfree(request);
3636         }
3637
3638         return err;
3639 }
3640
3641 static int nl80211_start_sched_scan(struct sk_buff *skb,
3642                                     struct genl_info *info)
3643 {
3644         struct cfg80211_sched_scan_request *request;
3645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3646         struct net_device *dev = info->user_ptr[1];
3647         struct nlattr *attr;
3648         struct wiphy *wiphy;
3649         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
3650         u32 interval;
3651         enum ieee80211_band band;
3652         size_t ie_len;
3653         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
3654
3655         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3656             !rdev->ops->sched_scan_start)
3657                 return -EOPNOTSUPP;
3658
3659         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3660                 return -EINVAL;
3661
3662         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3663                 return -EINVAL;
3664
3665         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3666         if (interval == 0)
3667                 return -EINVAL;
3668
3669         wiphy = &rdev->wiphy;
3670
3671         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3672                 n_channels = validate_scan_freqs(
3673                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3674                 if (!n_channels)
3675                         return -EINVAL;
3676         } else {
3677                 n_channels = 0;
3678
3679                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3680                         if (wiphy->bands[band])
3681                                 n_channels += wiphy->bands[band]->n_channels;
3682         }
3683
3684         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3685                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3686                                     tmp)
3687                         n_ssids++;
3688
3689         if (n_ssids > wiphy->max_sched_scan_ssids)
3690                 return -EINVAL;
3691
3692         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
3693                 nla_for_each_nested(attr,
3694                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3695                                     tmp)
3696                         n_match_sets++;
3697
3698         if (n_match_sets > wiphy->max_match_sets)
3699                 return -EINVAL;
3700
3701         if (info->attrs[NL80211_ATTR_IE])
3702                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3703         else
3704                 ie_len = 0;
3705
3706         if (ie_len > wiphy->max_sched_scan_ie_len)
3707                 return -EINVAL;
3708
3709         mutex_lock(&rdev->sched_scan_mtx);
3710
3711         if (rdev->sched_scan_req) {
3712                 err = -EINPROGRESS;
3713                 goto out;
3714         }
3715
3716         request = kzalloc(sizeof(*request)
3717                         + sizeof(*request->ssids) * n_ssids
3718                         + sizeof(*request->match_sets) * n_match_sets
3719                         + sizeof(*request->channels) * n_channels
3720                         + ie_len, GFP_KERNEL);
3721         if (!request) {
3722                 err = -ENOMEM;
3723                 goto out;
3724         }
3725
3726         if (n_ssids)
3727                 request->ssids = (void *)&request->channels[n_channels];
3728         request->n_ssids = n_ssids;
3729         if (ie_len) {
3730                 if (request->ssids)
3731                         request->ie = (void *)(request->ssids + n_ssids);
3732                 else
3733                         request->ie = (void *)(request->channels + n_channels);
3734         }
3735
3736         if (n_match_sets) {
3737                 if (request->ie)
3738                         request->match_sets = (void *)(request->ie + ie_len);
3739                 else if (request->ssids)
3740                         request->match_sets =
3741                                 (void *)(request->ssids + n_ssids);
3742                 else
3743                         request->match_sets =
3744                                 (void *)(request->channels + n_channels);
3745         }
3746         request->n_match_sets = n_match_sets;
3747
3748         i = 0;
3749         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3750                 /* user specified, bail out if channel not found */
3751                 nla_for_each_nested(attr,
3752                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3753                                     tmp) {
3754                         struct ieee80211_channel *chan;
3755
3756                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3757
3758                         if (!chan) {
3759                                 err = -EINVAL;
3760                                 goto out_free;
3761                         }
3762
3763                         /* ignore disabled channels */
3764                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3765                                 continue;
3766
3767                         request->channels[i] = chan;
3768                         i++;
3769                 }
3770         } else {
3771                 /* all channels */
3772                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3773                         int j;
3774                         if (!wiphy->bands[band])
3775                                 continue;
3776                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3777                                 struct ieee80211_channel *chan;
3778
3779                                 chan = &wiphy->bands[band]->channels[j];
3780
3781                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3782                                         continue;
3783
3784                                 request->channels[i] = chan;
3785                                 i++;
3786                         }
3787                 }
3788         }
3789
3790         if (!i) {
3791                 err = -EINVAL;
3792                 goto out_free;
3793         }
3794
3795         request->n_channels = i;
3796
3797         i = 0;
3798         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3799                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3800                                     tmp) {
3801                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3802                                 err = -EINVAL;
3803                                 goto out_free;
3804                         }
3805                         request->ssids[i].ssid_len = nla_len(attr);
3806                         memcpy(request->ssids[i].ssid, nla_data(attr),
3807                                nla_len(attr));
3808                         i++;
3809                 }
3810         }
3811
3812         i = 0;
3813         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
3814                 nla_for_each_nested(attr,
3815                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
3816                                     tmp) {
3817                         struct nlattr *ssid;
3818
3819                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
3820                                   nla_data(attr), nla_len(attr),
3821                                   nl80211_match_policy);
3822                         ssid = tb[NL80211_ATTR_SCHED_SCAN_MATCH_SSID];
3823                         if (ssid) {
3824                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
3825                                         err = -EINVAL;
3826                                         goto out_free;
3827                                 }
3828                                 memcpy(request->match_sets[i].ssid.ssid,
3829                                        nla_data(ssid), nla_len(ssid));
3830                                 request->match_sets[i].ssid.ssid_len =
3831                                         nla_len(ssid);
3832                         }
3833                         i++;
3834                 }
3835         }
3836
3837         if (info->attrs[NL80211_ATTR_IE]) {
3838                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3839                 memcpy((void *)request->ie,
3840                        nla_data(info->attrs[NL80211_ATTR_IE]),
3841                        request->ie_len);
3842         }
3843
3844         request->dev = dev;
3845         request->wiphy = &rdev->wiphy;
3846         request->interval = interval;
3847
3848         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3849         if (!err) {
3850                 rdev->sched_scan_req = request;
3851                 nl80211_send_sched_scan(rdev, dev,
3852                                         NL80211_CMD_START_SCHED_SCAN);
3853                 goto out;
3854         }
3855
3856 out_free:
3857         kfree(request);
3858 out:
3859         mutex_unlock(&rdev->sched_scan_mtx);
3860         return err;
3861 }
3862
3863 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3864                                    struct genl_info *info)
3865 {
3866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3867         int err;
3868
3869         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3870             !rdev->ops->sched_scan_stop)
3871                 return -EOPNOTSUPP;
3872
3873         mutex_lock(&rdev->sched_scan_mtx);
3874         err = __cfg80211_stop_sched_scan(rdev, false);
3875         mutex_unlock(&rdev->sched_scan_mtx);
3876
3877         return err;
3878 }
3879
3880 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3881                             u32 seq, int flags,
3882                             struct cfg80211_registered_device *rdev,
3883                             struct wireless_dev *wdev,
3884                             struct cfg80211_internal_bss *intbss)
3885 {
3886         struct cfg80211_bss *res = &intbss->pub;
3887         void *hdr;
3888         struct nlattr *bss;
3889         int i;
3890
3891         ASSERT_WDEV_LOCK(wdev);
3892
3893         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3894                              NL80211_CMD_NEW_SCAN_RESULTS);
3895         if (!hdr)
3896                 return -1;
3897
3898         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3899
3900         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3901         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3902
3903         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3904         if (!bss)
3905                 goto nla_put_failure;
3906         if (!is_zero_ether_addr(res->bssid))
3907                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3908         if (res->information_elements && res->len_information_elements)
3909                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3910                         res->len_information_elements,
3911                         res->information_elements);
3912         if (res->beacon_ies && res->len_beacon_ies &&
3913             res->beacon_ies != res->information_elements)
3914                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3915                         res->len_beacon_ies, res->beacon_ies);
3916         if (res->tsf)
3917                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3918         if (res->beacon_interval)
3919                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3920         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3921         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3922         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3923                 jiffies_to_msecs(jiffies - intbss->ts));
3924
3925         switch (rdev->wiphy.signal_type) {
3926         case CFG80211_SIGNAL_TYPE_MBM:
3927                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3928                 break;
3929         case CFG80211_SIGNAL_TYPE_UNSPEC:
3930                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3931                 break;
3932         default:
3933                 break;
3934         }
3935
3936         switch (wdev->iftype) {
3937         case NL80211_IFTYPE_P2P_CLIENT:
3938         case NL80211_IFTYPE_STATION:
3939                 if (intbss == wdev->current_bss)
3940                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3941                                     NL80211_BSS_STATUS_ASSOCIATED);
3942                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3943                         if (intbss != wdev->auth_bsses[i])
3944                                 continue;
3945                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3946                                     NL80211_BSS_STATUS_AUTHENTICATED);
3947                         break;
3948                 }
3949                 break;
3950         case NL80211_IFTYPE_ADHOC:
3951                 if (intbss == wdev->current_bss)
3952                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3953                                     NL80211_BSS_STATUS_IBSS_JOINED);
3954                 break;
3955         default:
3956                 break;
3957         }
3958
3959         nla_nest_end(msg, bss);
3960
3961         return genlmsg_end(msg, hdr);
3962
3963  nla_put_failure:
3964         genlmsg_cancel(msg, hdr);
3965         return -EMSGSIZE;
3966 }
3967
3968 static int nl80211_dump_scan(struct sk_buff *skb,
3969                              struct netlink_callback *cb)
3970 {
3971         struct cfg80211_registered_device *rdev;
3972         struct net_device *dev;
3973         struct cfg80211_internal_bss *scan;
3974         struct wireless_dev *wdev;
3975         int start = cb->args[1], idx = 0;
3976         int err;
3977
3978         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3979         if (err)
3980                 return err;
3981
3982         wdev = dev->ieee80211_ptr;
3983
3984         wdev_lock(wdev);
3985         spin_lock_bh(&rdev->bss_lock);
3986         cfg80211_bss_expire(rdev);
3987
3988         cb->seq = rdev->bss_generation;
3989
3990         list_for_each_entry(scan, &rdev->bss_list, list) {
3991                 if (++idx <= start)
3992                         continue;
3993                 if (nl80211_send_bss(skb, cb,
3994                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3995                                 rdev, wdev, scan) < 0) {
3996                         idx--;
3997                         break;
3998                 }
3999         }
4000
4001         spin_unlock_bh(&rdev->bss_lock);
4002         wdev_unlock(wdev);
4003
4004         cb->args[1] = idx;
4005         nl80211_finish_netdev_dump(rdev);
4006
4007         return skb->len;
4008 }
4009
4010 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4011                                 int flags, struct net_device *dev,
4012                                 struct survey_info *survey)
4013 {
4014         void *hdr;
4015         struct nlattr *infoattr;
4016
4017         hdr = nl80211hdr_put(msg, pid, seq, flags,
4018                              NL80211_CMD_NEW_SURVEY_RESULTS);
4019         if (!hdr)
4020                 return -ENOMEM;
4021
4022         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
4023
4024         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4025         if (!infoattr)
4026                 goto nla_put_failure;
4027
4028         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4029                     survey->channel->center_freq);
4030         if (survey->filled & SURVEY_INFO_NOISE_DBM)
4031                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
4032                             survey->noise);
4033         if (survey->filled & SURVEY_INFO_IN_USE)
4034                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
4035         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
4036                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4037                             survey->channel_time);
4038         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
4039                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4040                             survey->channel_time_busy);
4041         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
4042                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4043                             survey->channel_time_ext_busy);
4044         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
4045                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4046                             survey->channel_time_rx);
4047         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
4048                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4049                             survey->channel_time_tx);
4050
4051         nla_nest_end(msg, infoattr);
4052
4053         return genlmsg_end(msg, hdr);
4054
4055  nla_put_failure:
4056         genlmsg_cancel(msg, hdr);
4057         return -EMSGSIZE;
4058 }
4059
4060 static int nl80211_dump_survey(struct sk_buff *skb,
4061                         struct netlink_callback *cb)
4062 {
4063         struct survey_info survey;
4064         struct cfg80211_registered_device *dev;
4065         struct net_device *netdev;
4066         int survey_idx = cb->args[1];
4067         int res;
4068
4069         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4070         if (res)
4071                 return res;
4072
4073         if (!dev->ops->dump_survey) {
4074                 res = -EOPNOTSUPP;
4075                 goto out_err;
4076         }
4077
4078         while (1) {
4079                 struct ieee80211_channel *chan;
4080
4081                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4082                                             &survey);
4083                 if (res == -ENOENT)
4084                         break;
4085                 if (res)
4086                         goto out_err;
4087
4088                 /* Survey without a channel doesn't make sense */
4089                 if (!survey.channel) {
4090                         res = -EINVAL;
4091                         goto out;
4092                 }
4093
4094                 chan = ieee80211_get_channel(&dev->wiphy,
4095                                              survey.channel->center_freq);
4096                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4097                         survey_idx++;
4098                         continue;
4099                 }
4100
4101                 if (nl80211_send_survey(skb,
4102                                 NETLINK_CB(cb->skb).pid,
4103                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4104                                 netdev,
4105                                 &survey) < 0)
4106                         goto out;
4107                 survey_idx++;
4108         }
4109
4110  out:
4111         cb->args[1] = survey_idx;
4112         res = skb->len;
4113  out_err:
4114         nl80211_finish_netdev_dump(dev);
4115         return res;
4116 }
4117
4118 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4119 {
4120         return auth_type <= NL80211_AUTHTYPE_MAX;
4121 }
4122
4123 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4124 {
4125         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4126                                   NL80211_WPA_VERSION_2));
4127 }
4128
4129 static bool nl80211_valid_akm_suite(u32 akm)
4130 {
4131         return akm == WLAN_AKM_SUITE_8021X ||
4132                 akm == WLAN_AKM_SUITE_PSK;
4133 }
4134
4135 static bool nl80211_valid_cipher_suite(u32 cipher)
4136 {
4137         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
4138                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
4139                 cipher == WLAN_CIPHER_SUITE_TKIP ||
4140                 cipher == WLAN_CIPHER_SUITE_CCMP ||
4141                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
4142 }
4143
4144
4145 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4146 {
4147         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4148         struct net_device *dev = info->user_ptr[1];
4149         struct ieee80211_channel *chan;
4150         const u8 *bssid, *ssid, *ie = NULL;
4151         int err, ssid_len, ie_len = 0;
4152         enum nl80211_auth_type auth_type;
4153         struct key_parse key;
4154         bool local_state_change;
4155
4156         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4157                 return -EINVAL;
4158
4159         if (!info->attrs[NL80211_ATTR_MAC])
4160                 return -EINVAL;
4161
4162         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4163                 return -EINVAL;
4164
4165         if (!info->attrs[NL80211_ATTR_SSID])
4166                 return -EINVAL;
4167
4168         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4169                 return -EINVAL;
4170
4171         err = nl80211_parse_key(info, &key);
4172         if (err)
4173                 return err;
4174
4175         if (key.idx >= 0) {
4176                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4177                         return -EINVAL;
4178                 if (!key.p.key || !key.p.key_len)
4179                         return -EINVAL;
4180                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4181                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4182                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4183                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4184                         return -EINVAL;
4185                 if (key.idx > 4)
4186                         return -EINVAL;
4187         } else {
4188                 key.p.key_len = 0;
4189                 key.p.key = NULL;
4190         }
4191
4192         if (key.idx >= 0) {
4193                 int i;
4194                 bool ok = false;
4195                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4196                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4197                                 ok = true;
4198                                 break;
4199                         }
4200                 }
4201                 if (!ok)
4202                         return -EINVAL;
4203         }
4204
4205         if (!rdev->ops->auth)
4206                 return -EOPNOTSUPP;
4207
4208         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4209             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4210                 return -EOPNOTSUPP;
4211
4212         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4213         chan = ieee80211_get_channel(&rdev->wiphy,
4214                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4215         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4216                 return -EINVAL;
4217
4218         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4219         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4220
4221         if (info->attrs[NL80211_ATTR_IE]) {
4222                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4223                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4224         }
4225
4226         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4227         if (!nl80211_valid_auth_type(auth_type))
4228                 return -EINVAL;
4229
4230         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4231
4232         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4233                                   ssid, ssid_len, ie, ie_len,
4234                                   key.p.key, key.p.key_len, key.idx,
4235                                   local_state_change);
4236 }
4237
4238 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4239                                    struct genl_info *info,
4240                                    struct cfg80211_crypto_settings *settings,
4241                                    int cipher_limit)
4242 {
4243         memset(settings, 0, sizeof(*settings));
4244
4245         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4246
4247         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4248                 u16 proto;
4249                 proto = nla_get_u16(
4250                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4251                 settings->control_port_ethertype = cpu_to_be16(proto);
4252                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4253                     proto != ETH_P_PAE)
4254                         return -EINVAL;
4255                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4256                         settings->control_port_no_encrypt = true;
4257         } else
4258                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4259
4260         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4261                 void *data;
4262                 int len, i;
4263
4264                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4265                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4266                 settings->n_ciphers_pairwise = len / sizeof(u32);
4267
4268                 if (len % sizeof(u32))
4269                         return -EINVAL;
4270
4271                 if (settings->n_ciphers_pairwise > cipher_limit)
4272                         return -EINVAL;
4273
4274                 memcpy(settings->ciphers_pairwise, data, len);
4275
4276                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4277                         if (!nl80211_valid_cipher_suite(
4278                                         settings->ciphers_pairwise[i]))
4279                                 return -EINVAL;
4280         }
4281
4282         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4283                 settings->cipher_group =
4284                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4285                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4286                         return -EINVAL;
4287         }
4288
4289         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4290                 settings->wpa_versions =
4291                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4292                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4293                         return -EINVAL;
4294         }
4295
4296         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4297                 void *data;
4298                 int len, i;
4299
4300                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4301                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4302                 settings->n_akm_suites = len / sizeof(u32);
4303
4304                 if (len % sizeof(u32))
4305                         return -EINVAL;
4306
4307                 memcpy(settings->akm_suites, data, len);
4308
4309                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4310                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4311                                 return -EINVAL;
4312         }
4313
4314         return 0;
4315 }
4316
4317 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4318 {
4319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4320         struct net_device *dev = info->user_ptr[1];
4321         struct cfg80211_crypto_settings crypto;
4322         struct ieee80211_channel *chan;
4323         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4324         int err, ssid_len, ie_len = 0;
4325         bool use_mfp = false;
4326
4327         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4328                 return -EINVAL;
4329
4330         if (!info->attrs[NL80211_ATTR_MAC] ||
4331             !info->attrs[NL80211_ATTR_SSID] ||
4332             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4333                 return -EINVAL;
4334
4335         if (!rdev->ops->assoc)
4336                 return -EOPNOTSUPP;
4337
4338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4340                 return -EOPNOTSUPP;
4341
4342         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4343
4344         chan = ieee80211_get_channel(&rdev->wiphy,
4345                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4346         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4347                 return -EINVAL;
4348
4349         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4350         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4351
4352         if (info->attrs[NL80211_ATTR_IE]) {
4353                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4354                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4355         }
4356
4357         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4358                 enum nl80211_mfp mfp =
4359                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4360                 if (mfp == NL80211_MFP_REQUIRED)
4361                         use_mfp = true;
4362                 else if (mfp != NL80211_MFP_NO)
4363                         return -EINVAL;
4364         }
4365
4366         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4367                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4368
4369         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4370         if (!err)
4371                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4372                                           ssid, ssid_len, ie, ie_len, use_mfp,
4373                                           &crypto);
4374
4375         return err;
4376 }
4377
4378 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4379 {
4380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4381         struct net_device *dev = info->user_ptr[1];
4382         const u8 *ie = NULL, *bssid;
4383         int ie_len = 0;
4384         u16 reason_code;
4385         bool local_state_change;
4386
4387         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4388                 return -EINVAL;
4389
4390         if (!info->attrs[NL80211_ATTR_MAC])
4391                 return -EINVAL;
4392
4393         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4394                 return -EINVAL;
4395
4396         if (!rdev->ops->deauth)
4397                 return -EOPNOTSUPP;
4398
4399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4400             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4401                 return -EOPNOTSUPP;
4402
4403         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4404
4405         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4406         if (reason_code == 0) {
4407                 /* Reason Code 0 is reserved */
4408                 return -EINVAL;
4409         }
4410
4411         if (info->attrs[NL80211_ATTR_IE]) {
4412                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4413                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4414         }
4415
4416         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4417
4418         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4419                                     local_state_change);
4420 }
4421
4422 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4423 {
4424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4425         struct net_device *dev = info->user_ptr[1];
4426         const u8 *ie = NULL, *bssid;
4427         int ie_len = 0;
4428         u16 reason_code;
4429         bool local_state_change;
4430
4431         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4432                 return -EINVAL;
4433
4434         if (!info->attrs[NL80211_ATTR_MAC])
4435                 return -EINVAL;
4436
4437         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4438                 return -EINVAL;
4439
4440         if (!rdev->ops->disassoc)
4441                 return -EOPNOTSUPP;
4442
4443         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4444             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4445                 return -EOPNOTSUPP;
4446
4447         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4448
4449         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4450         if (reason_code == 0) {
4451                 /* Reason Code 0 is reserved */
4452                 return -EINVAL;
4453         }
4454
4455         if (info->attrs[NL80211_ATTR_IE]) {
4456                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4457                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4458         }
4459
4460         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4461
4462         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4463                                       local_state_change);
4464 }
4465
4466 static bool
4467 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4468                          int mcast_rate[IEEE80211_NUM_BANDS],
4469                          int rateval)
4470 {
4471         struct wiphy *wiphy = &rdev->wiphy;
4472         bool found = false;
4473         int band, i;
4474
4475         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4476                 struct ieee80211_supported_band *sband;
4477
4478                 sband = wiphy->bands[band];
4479                 if (!sband)
4480                         continue;
4481
4482                 for (i = 0; i < sband->n_bitrates; i++) {
4483                         if (sband->bitrates[i].bitrate == rateval) {
4484                                 mcast_rate[band] = i + 1;
4485                                 found = true;
4486                                 break;
4487                         }
4488                 }
4489         }
4490
4491         return found;
4492 }
4493
4494 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4495 {
4496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4497         struct net_device *dev = info->user_ptr[1];
4498         struct cfg80211_ibss_params ibss;
4499         struct wiphy *wiphy;
4500         struct cfg80211_cached_keys *connkeys = NULL;
4501         int err;
4502
4503         memset(&ibss, 0, sizeof(ibss));
4504
4505         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4506                 return -EINVAL;
4507
4508         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4509             !info->attrs[NL80211_ATTR_SSID] ||
4510             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4511                 return -EINVAL;
4512
4513         ibss.beacon_interval = 100;
4514
4515         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4516                 ibss.beacon_interval =
4517                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4518                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4519                         return -EINVAL;
4520         }
4521
4522         if (!rdev->ops->join_ibss)
4523                 return -EOPNOTSUPP;
4524
4525         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4526                 return -EOPNOTSUPP;
4527
4528         wiphy = &rdev->wiphy;
4529
4530         if (info->attrs[NL80211_ATTR_MAC]) {
4531                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4532
4533                 if (!is_valid_ether_addr(ibss.bssid))
4534                         return -EINVAL;
4535         }
4536         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4537         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4538
4539         if (info->attrs[NL80211_ATTR_IE]) {
4540                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4541                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4542         }
4543
4544         ibss.channel = ieee80211_get_channel(wiphy,
4545                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4546         if (!ibss.channel ||
4547             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4548             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4549                 return -EINVAL;
4550
4551         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4552         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4553
4554         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4555                 u8 *rates =
4556                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4557                 int n_rates =
4558                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4559                 struct ieee80211_supported_band *sband =
4560                         wiphy->bands[ibss.channel->band];
4561                 int err;
4562
4563                 err = ieee80211_get_ratemask(sband, rates, n_rates,
4564                                              &ibss.basic_rates);
4565                 if (err)
4566                         return err;
4567         }
4568
4569         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4570             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4571                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4572                 return -EINVAL;
4573
4574         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4575                 connkeys = nl80211_parse_connkeys(rdev,
4576                                         info->attrs[NL80211_ATTR_KEYS]);
4577                 if (IS_ERR(connkeys))
4578                         return PTR_ERR(connkeys);
4579         }
4580
4581         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4582         if (err)
4583                 kfree(connkeys);
4584         return err;
4585 }
4586
4587 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4588 {
4589         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4590         struct net_device *dev = info->user_ptr[1];
4591
4592         if (!rdev->ops->leave_ibss)
4593                 return -EOPNOTSUPP;
4594
4595         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4596                 return -EOPNOTSUPP;
4597
4598         return cfg80211_leave_ibss(rdev, dev, false);
4599 }
4600
4601 #ifdef CONFIG_NL80211_TESTMODE
4602 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4603         .name = "testmode",
4604 };
4605
4606 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4607 {
4608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4609         int err;
4610
4611         if (!info->attrs[NL80211_ATTR_TESTDATA])
4612                 return -EINVAL;
4613
4614         err = -EOPNOTSUPP;
4615         if (rdev->ops->testmode_cmd) {
4616                 rdev->testmode_info = info;
4617                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4618                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4619                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4620                 rdev->testmode_info = NULL;
4621         }
4622
4623         return err;
4624 }
4625
4626 static int nl80211_testmode_dump(struct sk_buff *skb,
4627                                  struct netlink_callback *cb)
4628 {
4629         struct cfg80211_registered_device *dev;
4630         int err;
4631         long phy_idx;
4632         void *data = NULL;
4633         int data_len = 0;
4634
4635         if (cb->args[0]) {
4636                 /*
4637                  * 0 is a valid index, but not valid for args[0],
4638                  * so we need to offset by 1.
4639                  */
4640                 phy_idx = cb->args[0] - 1;
4641         } else {
4642                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4643                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4644                                   nl80211_policy);
4645                 if (err)
4646                         return err;
4647                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4648                         return -EINVAL;
4649                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4650                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4651                         cb->args[1] =
4652                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4653         }
4654
4655         if (cb->args[1]) {
4656                 data = nla_data((void *)cb->args[1]);
4657                 data_len = nla_len((void *)cb->args[1]);
4658         }
4659
4660         mutex_lock(&cfg80211_mutex);
4661         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4662         if (!dev) {
4663                 mutex_unlock(&cfg80211_mutex);
4664                 return -ENOENT;
4665         }
4666         cfg80211_lock_rdev(dev);
4667         mutex_unlock(&cfg80211_mutex);
4668
4669         if (!dev->ops->testmode_dump) {
4670                 err = -EOPNOTSUPP;
4671                 goto out_err;
4672         }
4673
4674         while (1) {
4675                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4676                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4677                                            NL80211_CMD_TESTMODE);
4678                 struct nlattr *tmdata;
4679
4680                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4681                         genlmsg_cancel(skb, hdr);
4682                         break;
4683                 }
4684
4685                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4686                 if (!tmdata) {
4687                         genlmsg_cancel(skb, hdr);
4688                         break;
4689                 }
4690                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4691                                               data, data_len);
4692                 nla_nest_end(skb, tmdata);
4693
4694                 if (err == -ENOBUFS || err == -ENOENT) {
4695                         genlmsg_cancel(skb, hdr);
4696                         break;
4697                 } else if (err) {
4698                         genlmsg_cancel(skb, hdr);
4699                         goto out_err;
4700                 }
4701
4702                 genlmsg_end(skb, hdr);
4703         }
4704
4705         err = skb->len;
4706         /* see above */
4707         cb->args[0] = phy_idx + 1;
4708  out_err:
4709         cfg80211_unlock_rdev(dev);
4710         return err;
4711 }
4712
4713 static struct sk_buff *
4714 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4715                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4716 {
4717         struct sk_buff *skb;
4718         void *hdr;
4719         struct nlattr *data;
4720
4721         skb = nlmsg_new(approxlen + 100, gfp);
4722         if (!skb)
4723                 return NULL;
4724
4725         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4726         if (!hdr) {
4727                 kfree_skb(skb);
4728                 return NULL;
4729         }
4730
4731         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4732         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4733
4734         ((void **)skb->cb)[0] = rdev;
4735         ((void **)skb->cb)[1] = hdr;
4736         ((void **)skb->cb)[2] = data;
4737
4738         return skb;
4739
4740  nla_put_failure:
4741         kfree_skb(skb);
4742         return NULL;
4743 }
4744
4745 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4746                                                   int approxlen)
4747 {
4748         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4749
4750         if (WARN_ON(!rdev->testmode_info))
4751                 return NULL;
4752
4753         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4754                                 rdev->testmode_info->snd_pid,
4755                                 rdev->testmode_info->snd_seq,
4756                                 GFP_KERNEL);
4757 }
4758 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4759
4760 int cfg80211_testmode_reply(struct sk_buff *skb)
4761 {
4762         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4763         void *hdr = ((void **)skb->cb)[1];
4764         struct nlattr *data = ((void **)skb->cb)[2];
4765
4766         if (WARN_ON(!rdev->testmode_info)) {
4767                 kfree_skb(skb);
4768                 return -EINVAL;
4769         }
4770
4771         nla_nest_end(skb, data);
4772         genlmsg_end(skb, hdr);
4773         return genlmsg_reply(skb, rdev->testmode_info);
4774 }
4775 EXPORT_SYMBOL(cfg80211_testmode_reply);
4776
4777 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4778                                                   int approxlen, gfp_t gfp)
4779 {
4780         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4781
4782         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4783 }
4784 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4785
4786 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4787 {
4788         void *hdr = ((void **)skb->cb)[1];
4789         struct nlattr *data = ((void **)skb->cb)[2];
4790
4791         nla_nest_end(skb, data);
4792         genlmsg_end(skb, hdr);
4793         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4794 }
4795 EXPORT_SYMBOL(cfg80211_testmode_event);
4796 #endif
4797
4798 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4799 {
4800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4801         struct net_device *dev = info->user_ptr[1];
4802         struct cfg80211_connect_params connect;
4803         struct wiphy *wiphy;
4804         struct cfg80211_cached_keys *connkeys = NULL;
4805         int err;
4806
4807         memset(&connect, 0, sizeof(connect));
4808
4809         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4810                 return -EINVAL;
4811
4812         if (!info->attrs[NL80211_ATTR_SSID] ||
4813             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4814                 return -EINVAL;
4815
4816         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4817                 connect.auth_type =
4818                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4819                 if (!nl80211_valid_auth_type(connect.auth_type))
4820                         return -EINVAL;
4821         } else
4822                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4823
4824         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4825
4826         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4827                                       NL80211_MAX_NR_CIPHER_SUITES);
4828         if (err)
4829                 return err;
4830
4831         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4832             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4833                 return -EOPNOTSUPP;
4834
4835         wiphy = &rdev->wiphy;
4836
4837         if (info->attrs[NL80211_ATTR_MAC])
4838                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4839         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4840         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4841
4842         if (info->attrs[NL80211_ATTR_IE]) {
4843                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4844                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4845         }
4846
4847         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4848                 connect.channel =
4849                         ieee80211_get_channel(wiphy,
4850                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4851                 if (!connect.channel ||
4852                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4853                         return -EINVAL;
4854         }
4855
4856         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4857                 connkeys = nl80211_parse_connkeys(rdev,
4858                                         info->attrs[NL80211_ATTR_KEYS]);
4859                 if (IS_ERR(connkeys))
4860                         return PTR_ERR(connkeys);
4861         }
4862
4863         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4864         if (err)
4865                 kfree(connkeys);
4866         return err;
4867 }
4868
4869 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4870 {
4871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4872         struct net_device *dev = info->user_ptr[1];
4873         u16 reason;
4874
4875         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4876                 reason = WLAN_REASON_DEAUTH_LEAVING;
4877         else
4878                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4879
4880         if (reason == 0)
4881                 return -EINVAL;
4882
4883         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4884             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4885                 return -EOPNOTSUPP;
4886
4887         return cfg80211_disconnect(rdev, dev, reason, true);
4888 }
4889
4890 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4891 {
4892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4893         struct net *net;
4894         int err;
4895         u32 pid;
4896
4897         if (!info->attrs[NL80211_ATTR_PID])
4898                 return -EINVAL;
4899
4900         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4901
4902         net = get_net_ns_by_pid(pid);
4903         if (IS_ERR(net))
4904                 return PTR_ERR(net);
4905
4906         err = 0;
4907
4908         /* check if anything to do */
4909         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4910                 err = cfg80211_switch_netns(rdev, net);
4911
4912         put_net(net);
4913         return err;
4914 }
4915
4916 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4917 {
4918         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4919         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4920                         struct cfg80211_pmksa *pmksa) = NULL;
4921         struct net_device *dev = info->user_ptr[1];
4922         struct cfg80211_pmksa pmksa;
4923
4924         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4925
4926         if (!info->attrs[NL80211_ATTR_MAC])
4927                 return -EINVAL;
4928
4929         if (!info->attrs[NL80211_ATTR_PMKID])
4930                 return -EINVAL;
4931
4932         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4933         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4934
4935         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4936             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4937                 return -EOPNOTSUPP;
4938
4939         switch (info->genlhdr->cmd) {
4940         case NL80211_CMD_SET_PMKSA:
4941                 rdev_ops = rdev->ops->set_pmksa;
4942                 break;
4943         case NL80211_CMD_DEL_PMKSA:
4944                 rdev_ops = rdev->ops->del_pmksa;
4945                 break;
4946         default:
4947                 WARN_ON(1);
4948                 break;
4949         }
4950
4951         if (!rdev_ops)
4952                 return -EOPNOTSUPP;
4953
4954         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4955 }
4956
4957 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4958 {
4959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4960         struct net_device *dev = info->user_ptr[1];
4961
4962         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4963             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4964                 return -EOPNOTSUPP;
4965
4966         if (!rdev->ops->flush_pmksa)
4967                 return -EOPNOTSUPP;
4968
4969         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4970 }
4971
4972 static int nl80211_remain_on_channel(struct sk_buff *skb,
4973                                      struct genl_info *info)
4974 {
4975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4976         struct net_device *dev = info->user_ptr[1];
4977         struct ieee80211_channel *chan;
4978         struct sk_buff *msg;
4979         void *hdr;
4980         u64 cookie;
4981         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4982         u32 freq, duration;
4983         int err;
4984
4985         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4986             !info->attrs[NL80211_ATTR_DURATION])
4987                 return -EINVAL;
4988
4989         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4990
4991         /*
4992          * We should be on that channel for at least one jiffie,
4993          * and more than 5 seconds seems excessive.
4994          */
4995         if (!duration || !msecs_to_jiffies(duration) ||
4996             duration > rdev->wiphy.max_remain_on_channel_duration)
4997                 return -EINVAL;
4998
4999         if (!rdev->ops->remain_on_channel)
5000                 return -EOPNOTSUPP;
5001
5002         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5003                 channel_type = nla_get_u32(
5004                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5005                 if (channel_type != NL80211_CHAN_NO_HT &&
5006                     channel_type != NL80211_CHAN_HT20 &&
5007                     channel_type != NL80211_CHAN_HT40PLUS &&
5008                     channel_type != NL80211_CHAN_HT40MINUS)
5009                         return -EINVAL;
5010         }
5011
5012         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5013         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5014         if (chan == NULL)
5015                 return -EINVAL;
5016
5017         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5018         if (!msg)
5019                 return -ENOMEM;
5020
5021         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5022                              NL80211_CMD_REMAIN_ON_CHANNEL);
5023
5024         if (IS_ERR(hdr)) {
5025                 err = PTR_ERR(hdr);
5026                 goto free_msg;
5027         }
5028
5029         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5030                                            channel_type, duration, &cookie);
5031
5032         if (err)
5033                 goto free_msg;
5034
5035         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5036
5037         genlmsg_end(msg, hdr);
5038
5039         return genlmsg_reply(msg, info);
5040
5041  nla_put_failure:
5042         err = -ENOBUFS;
5043  free_msg:
5044         nlmsg_free(msg);
5045         return err;
5046 }
5047
5048 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5049                                             struct genl_info *info)
5050 {
5051         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5052         struct net_device *dev = info->user_ptr[1];
5053         u64 cookie;
5054
5055         if (!info->attrs[NL80211_ATTR_COOKIE])
5056                 return -EINVAL;
5057
5058         if (!rdev->ops->cancel_remain_on_channel)
5059                 return -EOPNOTSUPP;
5060
5061         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5062
5063         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5064 }
5065
5066 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5067                            u8 *rates, u8 rates_len)
5068 {
5069         u8 i;
5070         u32 mask = 0;
5071
5072         for (i = 0; i < rates_len; i++) {
5073                 int rate = (rates[i] & 0x7f) * 5;
5074                 int ridx;
5075                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5076                         struct ieee80211_rate *srate =
5077                                 &sband->bitrates[ridx];
5078                         if (rate == srate->bitrate) {
5079                                 mask |= 1 << ridx;
5080                                 break;
5081                         }
5082                 }
5083                 if (ridx == sband->n_bitrates)
5084                         return 0; /* rate not found */
5085         }
5086
5087         return mask;
5088 }
5089
5090 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5091         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5092                                     .len = NL80211_MAX_SUPP_RATES },
5093 };
5094
5095 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5096                                        struct genl_info *info)
5097 {
5098         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5100         struct cfg80211_bitrate_mask mask;
5101         int rem, i;
5102         struct net_device *dev = info->user_ptr[1];
5103         struct nlattr *tx_rates;
5104         struct ieee80211_supported_band *sband;
5105
5106         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5107                 return -EINVAL;
5108
5109         if (!rdev->ops->set_bitrate_mask)
5110                 return -EOPNOTSUPP;
5111
5112         memset(&mask, 0, sizeof(mask));
5113         /* Default to all rates enabled */
5114         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5115                 sband = rdev->wiphy.bands[i];
5116                 mask.control[i].legacy =
5117                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5118         }
5119
5120         /*
5121          * The nested attribute uses enum nl80211_band as the index. This maps
5122          * directly to the enum ieee80211_band values used in cfg80211.
5123          */
5124         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
5125         {
5126                 enum ieee80211_band band = nla_type(tx_rates);
5127                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
5128                         return -EINVAL;
5129                 sband = rdev->wiphy.bands[band];
5130                 if (sband == NULL)
5131                         return -EINVAL;
5132                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
5133                           nla_len(tx_rates), nl80211_txattr_policy);
5134                 if (tb[NL80211_TXRATE_LEGACY]) {
5135                         mask.control[band].legacy = rateset_to_mask(
5136                                 sband,
5137                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5138                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5139                         if (mask.control[band].legacy == 0)
5140                                 return -EINVAL;
5141                 }
5142         }
5143
5144         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
5145 }
5146
5147 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
5148 {
5149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5150         struct net_device *dev = info->user_ptr[1];
5151         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
5152
5153         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
5154                 return -EINVAL;
5155
5156         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
5157                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
5158
5159         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5160             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5161             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5162             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5163             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5164             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5165             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5166                 return -EOPNOTSUPP;
5167
5168         /* not much point in registering if we can't reply */
5169         if (!rdev->ops->mgmt_tx)
5170                 return -EOPNOTSUPP;
5171
5172         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
5173                         frame_type,
5174                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
5175                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
5176 }
5177
5178 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
5179 {
5180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5181         struct net_device *dev = info->user_ptr[1];
5182         struct ieee80211_channel *chan;
5183         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5184         bool channel_type_valid = false;
5185         u32 freq;
5186         int err;
5187         void *hdr;
5188         u64 cookie;
5189         struct sk_buff *msg;
5190         unsigned int wait = 0;
5191         bool offchan;
5192
5193         if (!info->attrs[NL80211_ATTR_FRAME] ||
5194             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5195                 return -EINVAL;
5196
5197         if (!rdev->ops->mgmt_tx)
5198                 return -EOPNOTSUPP;
5199
5200         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5201             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5202             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5203             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5204             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5205             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5206             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5207                 return -EOPNOTSUPP;
5208
5209         if (info->attrs[NL80211_ATTR_DURATION]) {
5210                 if (!rdev->ops->mgmt_tx_cancel_wait)
5211                         return -EINVAL;
5212                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5213         }
5214
5215         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5216                 channel_type = nla_get_u32(
5217                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5218                 if (channel_type != NL80211_CHAN_NO_HT &&
5219                     channel_type != NL80211_CHAN_HT20 &&
5220                     channel_type != NL80211_CHAN_HT40PLUS &&
5221                     channel_type != NL80211_CHAN_HT40MINUS)
5222                         return -EINVAL;
5223                 channel_type_valid = true;
5224         }
5225
5226         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5227
5228         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5229         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5230         if (chan == NULL)
5231                 return -EINVAL;
5232
5233         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5234         if (!msg)
5235                 return -ENOMEM;
5236
5237         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5238                              NL80211_CMD_FRAME);
5239
5240         if (IS_ERR(hdr)) {
5241                 err = PTR_ERR(hdr);
5242                 goto free_msg;
5243         }
5244         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5245                                     channel_type_valid, wait,
5246                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5247                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5248                                     &cookie);
5249         if (err)
5250                 goto free_msg;
5251
5252         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5253
5254         genlmsg_end(msg, hdr);
5255         return genlmsg_reply(msg, info);
5256
5257  nla_put_failure:
5258         err = -ENOBUFS;
5259  free_msg:
5260         nlmsg_free(msg);
5261         return err;
5262 }
5263
5264 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5265 {
5266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5267         struct net_device *dev = info->user_ptr[1];
5268         u64 cookie;
5269
5270         if (!info->attrs[NL80211_ATTR_COOKIE])
5271                 return -EINVAL;
5272
5273         if (!rdev->ops->mgmt_tx_cancel_wait)
5274                 return -EOPNOTSUPP;
5275
5276         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5277             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5278             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5279             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5280             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5281             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5282                 return -EOPNOTSUPP;
5283
5284         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5285
5286         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5287 }
5288
5289 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5290 {
5291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5292         struct wireless_dev *wdev;
5293         struct net_device *dev = info->user_ptr[1];
5294         u8 ps_state;
5295         bool state;
5296         int err;
5297
5298         if (!info->attrs[NL80211_ATTR_PS_STATE])
5299                 return -EINVAL;
5300
5301         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5302
5303         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5304                 return -EINVAL;
5305
5306         wdev = dev->ieee80211_ptr;
5307
5308         if (!rdev->ops->set_power_mgmt)
5309                 return -EOPNOTSUPP;
5310
5311         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5312
5313         if (state == wdev->ps)
5314                 return 0;
5315
5316         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5317                                         wdev->ps_timeout);
5318         if (!err)
5319                 wdev->ps = state;
5320         return err;
5321 }
5322
5323 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5324 {
5325         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5326         enum nl80211_ps_state ps_state;
5327         struct wireless_dev *wdev;
5328         struct net_device *dev = info->user_ptr[1];
5329         struct sk_buff *msg;
5330         void *hdr;
5331         int err;
5332
5333         wdev = dev->ieee80211_ptr;
5334
5335         if (!rdev->ops->set_power_mgmt)
5336                 return -EOPNOTSUPP;
5337
5338         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5339         if (!msg)
5340                 return -ENOMEM;
5341
5342         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5343                              NL80211_CMD_GET_POWER_SAVE);
5344         if (!hdr) {
5345                 err = -ENOBUFS;
5346                 goto free_msg;
5347         }
5348
5349         if (wdev->ps)
5350                 ps_state = NL80211_PS_ENABLED;
5351         else
5352                 ps_state = NL80211_PS_DISABLED;
5353
5354         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5355
5356         genlmsg_end(msg, hdr);
5357         return genlmsg_reply(msg, info);
5358
5359  nla_put_failure:
5360         err = -ENOBUFS;
5361  free_msg:
5362         nlmsg_free(msg);
5363         return err;
5364 }
5365
5366 static struct nla_policy
5367 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5368         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5369         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5370         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5371 };
5372
5373 static int nl80211_set_cqm_rssi(struct genl_info *info,
5374                                 s32 threshold, u32 hysteresis)
5375 {
5376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5377         struct wireless_dev *wdev;
5378         struct net_device *dev = info->user_ptr[1];
5379
5380         if (threshold > 0)
5381                 return -EINVAL;
5382
5383         wdev = dev->ieee80211_ptr;
5384
5385         if (!rdev->ops->set_cqm_rssi_config)
5386                 return -EOPNOTSUPP;
5387
5388         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5389             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5390                 return -EOPNOTSUPP;
5391
5392         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5393                                               threshold, hysteresis);
5394 }
5395
5396 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5397 {
5398         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5399         struct nlattr *cqm;
5400         int err;
5401
5402         cqm = info->attrs[NL80211_ATTR_CQM];
5403         if (!cqm) {
5404                 err = -EINVAL;
5405                 goto out;
5406         }
5407
5408         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5409                                nl80211_attr_cqm_policy);
5410         if (err)
5411                 goto out;
5412
5413         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5414             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5415                 s32 threshold;
5416                 u32 hysteresis;
5417                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5418                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5419                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5420         } else
5421                 err = -EINVAL;
5422
5423 out:
5424         return err;
5425 }
5426
5427 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5428 {
5429         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5430         struct net_device *dev = info->user_ptr[1];
5431         struct mesh_config cfg;
5432         struct mesh_setup setup;
5433         int err;
5434
5435         /* start with default */
5436         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5437         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5438
5439         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5440                 /* and parse parameters if given */
5441                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5442                 if (err)
5443                         return err;
5444         }
5445
5446         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5447             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5448                 return -EINVAL;
5449
5450         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5451         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5452
5453         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5454                 /* parse additional setup parameters if given */
5455                 err = nl80211_parse_mesh_setup(info, &setup);
5456                 if (err)
5457                         return err;
5458         }
5459
5460         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5461 }
5462
5463 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5464 {
5465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5466         struct net_device *dev = info->user_ptr[1];
5467
5468         return cfg80211_leave_mesh(rdev, dev);
5469 }
5470
5471 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5472 {
5473         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5474         struct sk_buff *msg;
5475         void *hdr;
5476
5477         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5478                 return -EOPNOTSUPP;
5479
5480         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5481         if (!msg)
5482                 return -ENOMEM;
5483
5484         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5485                              NL80211_CMD_GET_WOWLAN);
5486         if (!hdr)
5487                 goto nla_put_failure;
5488
5489         if (rdev->wowlan) {
5490                 struct nlattr *nl_wowlan;
5491
5492                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5493                 if (!nl_wowlan)
5494                         goto nla_put_failure;
5495
5496                 if (rdev->wowlan->any)
5497                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5498                 if (rdev->wowlan->disconnect)
5499                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5500                 if (rdev->wowlan->magic_pkt)
5501                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5502                 if (rdev->wowlan->gtk_rekey_failure)
5503                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5504                 if (rdev->wowlan->eap_identity_req)
5505                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5506                 if (rdev->wowlan->four_way_handshake)
5507                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5508                 if (rdev->wowlan->rfkill_release)
5509                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5510                 if (rdev->wowlan->n_patterns) {
5511                         struct nlattr *nl_pats, *nl_pat;
5512                         int i, pat_len;
5513
5514                         nl_pats = nla_nest_start(msg,
5515                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5516                         if (!nl_pats)
5517                                 goto nla_put_failure;
5518
5519                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5520                                 nl_pat = nla_nest_start(msg, i + 1);
5521                                 if (!nl_pat)
5522                                         goto nla_put_failure;
5523                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5524                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5525                                         DIV_ROUND_UP(pat_len, 8),
5526                                         rdev->wowlan->patterns[i].mask);
5527                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5528                                         pat_len,
5529                                         rdev->wowlan->patterns[i].pattern);
5530                                 nla_nest_end(msg, nl_pat);
5531                         }
5532                         nla_nest_end(msg, nl_pats);
5533                 }
5534
5535                 nla_nest_end(msg, nl_wowlan);
5536         }
5537
5538         genlmsg_end(msg, hdr);
5539         return genlmsg_reply(msg, info);
5540
5541 nla_put_failure:
5542         nlmsg_free(msg);
5543         return -ENOBUFS;
5544 }
5545
5546 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5547 {
5548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5549         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5550         struct cfg80211_wowlan no_triggers = {};
5551         struct cfg80211_wowlan new_triggers = {};
5552         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5553         int err, i;
5554
5555         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5556                 return -EOPNOTSUPP;
5557
5558         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5559                 goto no_triggers;
5560
5561         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5562                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5563                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5564                         nl80211_wowlan_policy);
5565         if (err)
5566                 return err;
5567
5568         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5569                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5570                         return -EINVAL;
5571                 new_triggers.any = true;
5572         }
5573
5574         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5575                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5576                         return -EINVAL;
5577                 new_triggers.disconnect = true;
5578         }
5579
5580         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5581                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5582                         return -EINVAL;
5583                 new_triggers.magic_pkt = true;
5584         }
5585
5586         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5587                 return -EINVAL;
5588
5589         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5590                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5591                         return -EINVAL;
5592                 new_triggers.gtk_rekey_failure = true;
5593         }
5594
5595         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5596                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5597                         return -EINVAL;
5598                 new_triggers.eap_identity_req = true;
5599         }
5600
5601         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5602                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5603                         return -EINVAL;
5604                 new_triggers.four_way_handshake = true;
5605         }
5606
5607         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5608                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5609                         return -EINVAL;
5610                 new_triggers.rfkill_release = true;
5611         }
5612
5613         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5614                 struct nlattr *pat;
5615                 int n_patterns = 0;
5616                 int rem, pat_len, mask_len;
5617                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5618
5619                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5620                                     rem)
5621                         n_patterns++;
5622                 if (n_patterns > wowlan->n_patterns)
5623                         return -EINVAL;
5624
5625                 new_triggers.patterns = kcalloc(n_patterns,
5626                                                 sizeof(new_triggers.patterns[0]),
5627                                                 GFP_KERNEL);
5628                 if (!new_triggers.patterns)
5629                         return -ENOMEM;
5630
5631                 new_triggers.n_patterns = n_patterns;
5632                 i = 0;
5633
5634                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5635                                     rem) {
5636                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5637                                   nla_data(pat), nla_len(pat), NULL);
5638                         err = -EINVAL;
5639                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5640                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5641                                 goto error;
5642                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5643                         mask_len = DIV_ROUND_UP(pat_len, 8);
5644                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5645                             mask_len)
5646                                 goto error;
5647                         if (pat_len > wowlan->pattern_max_len ||
5648                             pat_len < wowlan->pattern_min_len)
5649                                 goto error;
5650
5651                         new_triggers.patterns[i].mask =
5652                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5653                         if (!new_triggers.patterns[i].mask) {
5654                                 err = -ENOMEM;
5655                                 goto error;
5656                         }
5657                         new_triggers.patterns[i].pattern =
5658                                 new_triggers.patterns[i].mask + mask_len;
5659                         memcpy(new_triggers.patterns[i].mask,
5660                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5661                                mask_len);
5662                         new_triggers.patterns[i].pattern_len = pat_len;
5663                         memcpy(new_triggers.patterns[i].pattern,
5664                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5665                                pat_len);
5666                         i++;
5667                 }
5668         }
5669
5670         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5671                 struct cfg80211_wowlan *ntrig;
5672                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5673                                 GFP_KERNEL);
5674                 if (!ntrig) {
5675                         err = -ENOMEM;
5676                         goto error;
5677                 }
5678                 cfg80211_rdev_free_wowlan(rdev);
5679                 rdev->wowlan = ntrig;
5680         } else {
5681  no_triggers:
5682                 cfg80211_rdev_free_wowlan(rdev);
5683                 rdev->wowlan = NULL;
5684         }
5685
5686         return 0;
5687  error:
5688         for (i = 0; i < new_triggers.n_patterns; i++)
5689                 kfree(new_triggers.patterns[i].mask);
5690         kfree(new_triggers.patterns);
5691         return err;
5692 }
5693
5694 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5695 {
5696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5697         struct net_device *dev = info->user_ptr[1];
5698         struct wireless_dev *wdev = dev->ieee80211_ptr;
5699         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5700         struct cfg80211_gtk_rekey_data rekey_data;
5701         int err;
5702
5703         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5704                 return -EINVAL;
5705
5706         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5707                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5708                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5709                         nl80211_rekey_policy);
5710         if (err)
5711                 return err;
5712
5713         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5714                 return -ERANGE;
5715         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5716                 return -ERANGE;
5717         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5718                 return -ERANGE;
5719
5720         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5721                NL80211_KEK_LEN);
5722         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5723                NL80211_KCK_LEN);
5724         memcpy(rekey_data.replay_ctr,
5725                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5726                NL80211_REPLAY_CTR_LEN);
5727
5728         wdev_lock(wdev);
5729         if (!wdev->current_bss) {
5730                 err = -ENOTCONN;
5731                 goto out;
5732         }
5733
5734         if (!rdev->ops->set_rekey_data) {
5735                 err = -EOPNOTSUPP;
5736                 goto out;
5737         }
5738
5739         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5740  out:
5741         wdev_unlock(wdev);
5742         return err;
5743 }
5744
5745 #define NL80211_FLAG_NEED_WIPHY         0x01
5746 #define NL80211_FLAG_NEED_NETDEV        0x02
5747 #define NL80211_FLAG_NEED_RTNL          0x04
5748 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5749 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5750                                          NL80211_FLAG_CHECK_NETDEV_UP)
5751
5752 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5753                             struct genl_info *info)
5754 {
5755         struct cfg80211_registered_device *rdev;
5756         struct net_device *dev;
5757         int err;
5758         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5759
5760         if (rtnl)
5761                 rtnl_lock();
5762
5763         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5764                 rdev = cfg80211_get_dev_from_info(info);
5765                 if (IS_ERR(rdev)) {
5766                         if (rtnl)
5767                                 rtnl_unlock();
5768                         return PTR_ERR(rdev);
5769                 }
5770                 info->user_ptr[0] = rdev;
5771         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5772                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5773                 if (err) {
5774                         if (rtnl)
5775                                 rtnl_unlock();
5776                         return err;
5777                 }
5778                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5779                     !netif_running(dev)) {
5780                         cfg80211_unlock_rdev(rdev);
5781                         dev_put(dev);
5782                         if (rtnl)
5783                                 rtnl_unlock();
5784                         return -ENETDOWN;
5785                 }
5786                 info->user_ptr[0] = rdev;
5787                 info->user_ptr[1] = dev;
5788         }
5789
5790         return 0;
5791 }
5792
5793 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5794                               struct genl_info *info)
5795 {
5796         if (info->user_ptr[0])
5797                 cfg80211_unlock_rdev(info->user_ptr[0]);
5798         if (info->user_ptr[1])
5799                 dev_put(info->user_ptr[1]);
5800         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5801                 rtnl_unlock();
5802 }
5803
5804 static struct genl_ops nl80211_ops[] = {
5805         {
5806                 .cmd = NL80211_CMD_GET_WIPHY,
5807                 .doit = nl80211_get_wiphy,
5808                 .dumpit = nl80211_dump_wiphy,
5809                 .policy = nl80211_policy,
5810                 /* can be retrieved by unprivileged users */
5811                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5812         },
5813         {
5814                 .cmd = NL80211_CMD_SET_WIPHY,
5815                 .doit = nl80211_set_wiphy,
5816                 .policy = nl80211_policy,
5817                 .flags = GENL_ADMIN_PERM,
5818                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5819         },
5820         {
5821                 .cmd = NL80211_CMD_GET_INTERFACE,
5822                 .doit = nl80211_get_interface,
5823                 .dumpit = nl80211_dump_interface,
5824                 .policy = nl80211_policy,
5825                 /* can be retrieved by unprivileged users */
5826                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5827         },
5828         {
5829                 .cmd = NL80211_CMD_SET_INTERFACE,
5830                 .doit = nl80211_set_interface,
5831                 .policy = nl80211_policy,
5832                 .flags = GENL_ADMIN_PERM,
5833                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5834                                   NL80211_FLAG_NEED_RTNL,
5835         },
5836         {
5837                 .cmd = NL80211_CMD_NEW_INTERFACE,
5838                 .doit = nl80211_new_interface,
5839                 .policy = nl80211_policy,
5840                 .flags = GENL_ADMIN_PERM,
5841                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5842                                   NL80211_FLAG_NEED_RTNL,
5843         },
5844         {
5845                 .cmd = NL80211_CMD_DEL_INTERFACE,
5846                 .doit = nl80211_del_interface,
5847                 .policy = nl80211_policy,
5848                 .flags = GENL_ADMIN_PERM,
5849                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5850                                   NL80211_FLAG_NEED_RTNL,
5851         },
5852         {
5853                 .cmd = NL80211_CMD_GET_KEY,
5854                 .doit = nl80211_get_key,
5855                 .policy = nl80211_policy,
5856                 .flags = GENL_ADMIN_PERM,
5857                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5858                                   NL80211_FLAG_NEED_RTNL,
5859         },
5860         {
5861                 .cmd = NL80211_CMD_SET_KEY,
5862                 .doit = nl80211_set_key,
5863                 .policy = nl80211_policy,
5864                 .flags = GENL_ADMIN_PERM,
5865                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5866                                   NL80211_FLAG_NEED_RTNL,
5867         },
5868         {
5869                 .cmd = NL80211_CMD_NEW_KEY,
5870                 .doit = nl80211_new_key,
5871                 .policy = nl80211_policy,
5872                 .flags = GENL_ADMIN_PERM,
5873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5874                                   NL80211_FLAG_NEED_RTNL,
5875         },
5876         {
5877                 .cmd = NL80211_CMD_DEL_KEY,
5878                 .doit = nl80211_del_key,
5879                 .policy = nl80211_policy,
5880                 .flags = GENL_ADMIN_PERM,
5881                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5882                                   NL80211_FLAG_NEED_RTNL,
5883         },
5884         {
5885                 .cmd = NL80211_CMD_SET_BEACON,
5886                 .policy = nl80211_policy,
5887                 .flags = GENL_ADMIN_PERM,
5888                 .doit = nl80211_addset_beacon,
5889                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5890                                   NL80211_FLAG_NEED_RTNL,
5891         },
5892         {
5893                 .cmd = NL80211_CMD_NEW_BEACON,
5894                 .policy = nl80211_policy,
5895                 .flags = GENL_ADMIN_PERM,
5896                 .doit = nl80211_addset_beacon,
5897                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5898                                   NL80211_FLAG_NEED_RTNL,
5899         },
5900         {
5901                 .cmd = NL80211_CMD_DEL_BEACON,
5902                 .policy = nl80211_policy,
5903                 .flags = GENL_ADMIN_PERM,
5904                 .doit = nl80211_del_beacon,
5905                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5906                                   NL80211_FLAG_NEED_RTNL,
5907         },
5908         {
5909                 .cmd = NL80211_CMD_GET_STATION,
5910                 .doit = nl80211_get_station,
5911                 .dumpit = nl80211_dump_station,
5912                 .policy = nl80211_policy,
5913                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5914                                   NL80211_FLAG_NEED_RTNL,
5915         },
5916         {
5917                 .cmd = NL80211_CMD_SET_STATION,
5918                 .doit = nl80211_set_station,
5919                 .policy = nl80211_policy,
5920                 .flags = GENL_ADMIN_PERM,
5921                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5922                                   NL80211_FLAG_NEED_RTNL,
5923         },
5924         {
5925                 .cmd = NL80211_CMD_NEW_STATION,
5926                 .doit = nl80211_new_station,
5927                 .policy = nl80211_policy,
5928                 .flags = GENL_ADMIN_PERM,
5929                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5930                                   NL80211_FLAG_NEED_RTNL,
5931         },
5932         {
5933                 .cmd = NL80211_CMD_DEL_STATION,
5934                 .doit = nl80211_del_station,
5935                 .policy = nl80211_policy,
5936                 .flags = GENL_ADMIN_PERM,
5937                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5938                                   NL80211_FLAG_NEED_RTNL,
5939         },
5940         {
5941                 .cmd = NL80211_CMD_GET_MPATH,
5942                 .doit = nl80211_get_mpath,
5943                 .dumpit = nl80211_dump_mpath,
5944                 .policy = nl80211_policy,
5945                 .flags = GENL_ADMIN_PERM,
5946                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5947                                   NL80211_FLAG_NEED_RTNL,
5948         },
5949         {
5950                 .cmd = NL80211_CMD_SET_MPATH,
5951                 .doit = nl80211_set_mpath,
5952                 .policy = nl80211_policy,
5953                 .flags = GENL_ADMIN_PERM,
5954                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5955                                   NL80211_FLAG_NEED_RTNL,
5956         },
5957         {
5958                 .cmd = NL80211_CMD_NEW_MPATH,
5959                 .doit = nl80211_new_mpath,
5960                 .policy = nl80211_policy,
5961                 .flags = GENL_ADMIN_PERM,
5962                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5963                                   NL80211_FLAG_NEED_RTNL,
5964         },
5965         {
5966                 .cmd = NL80211_CMD_DEL_MPATH,
5967                 .doit = nl80211_del_mpath,
5968                 .policy = nl80211_policy,
5969                 .flags = GENL_ADMIN_PERM,
5970                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5971                                   NL80211_FLAG_NEED_RTNL,
5972         },
5973         {
5974                 .cmd = NL80211_CMD_SET_BSS,
5975                 .doit = nl80211_set_bss,
5976                 .policy = nl80211_policy,
5977                 .flags = GENL_ADMIN_PERM,
5978                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5979                                   NL80211_FLAG_NEED_RTNL,
5980         },
5981         {
5982                 .cmd = NL80211_CMD_GET_REG,
5983                 .doit = nl80211_get_reg,
5984                 .policy = nl80211_policy,
5985                 /* can be retrieved by unprivileged users */
5986         },
5987         {
5988                 .cmd = NL80211_CMD_SET_REG,
5989                 .doit = nl80211_set_reg,
5990                 .policy = nl80211_policy,
5991                 .flags = GENL_ADMIN_PERM,
5992         },
5993         {
5994                 .cmd = NL80211_CMD_REQ_SET_REG,
5995                 .doit = nl80211_req_set_reg,
5996                 .policy = nl80211_policy,
5997                 .flags = GENL_ADMIN_PERM,
5998         },
5999         {
6000                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
6001                 .doit = nl80211_get_mesh_config,
6002                 .policy = nl80211_policy,
6003                 /* can be retrieved by unprivileged users */
6004                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6005                                   NL80211_FLAG_NEED_RTNL,
6006         },
6007         {
6008                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
6009                 .doit = nl80211_update_mesh_config,
6010                 .policy = nl80211_policy,
6011                 .flags = GENL_ADMIN_PERM,
6012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6013                                   NL80211_FLAG_NEED_RTNL,
6014         },
6015         {
6016                 .cmd = NL80211_CMD_TRIGGER_SCAN,
6017                 .doit = nl80211_trigger_scan,
6018                 .policy = nl80211_policy,
6019                 .flags = GENL_ADMIN_PERM,
6020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6021                                   NL80211_FLAG_NEED_RTNL,
6022         },
6023         {
6024                 .cmd = NL80211_CMD_GET_SCAN,
6025                 .policy = nl80211_policy,
6026                 .dumpit = nl80211_dump_scan,
6027         },
6028         {
6029                 .cmd = NL80211_CMD_START_SCHED_SCAN,
6030                 .doit = nl80211_start_sched_scan,
6031                 .policy = nl80211_policy,
6032                 .flags = GENL_ADMIN_PERM,
6033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6034                                   NL80211_FLAG_NEED_RTNL,
6035         },
6036         {
6037                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
6038                 .doit = nl80211_stop_sched_scan,
6039                 .policy = nl80211_policy,
6040                 .flags = GENL_ADMIN_PERM,
6041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6042                                   NL80211_FLAG_NEED_RTNL,
6043         },
6044         {
6045                 .cmd = NL80211_CMD_AUTHENTICATE,
6046                 .doit = nl80211_authenticate,
6047                 .policy = nl80211_policy,
6048                 .flags = GENL_ADMIN_PERM,
6049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6050                                   NL80211_FLAG_NEED_RTNL,
6051         },
6052         {
6053                 .cmd = NL80211_CMD_ASSOCIATE,
6054                 .doit = nl80211_associate,
6055                 .policy = nl80211_policy,
6056                 .flags = GENL_ADMIN_PERM,
6057                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6058                                   NL80211_FLAG_NEED_RTNL,
6059         },
6060         {
6061                 .cmd = NL80211_CMD_DEAUTHENTICATE,
6062                 .doit = nl80211_deauthenticate,
6063                 .policy = nl80211_policy,
6064                 .flags = GENL_ADMIN_PERM,
6065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6066                                   NL80211_FLAG_NEED_RTNL,
6067         },
6068         {
6069                 .cmd = NL80211_CMD_DISASSOCIATE,
6070                 .doit = nl80211_disassociate,
6071                 .policy = nl80211_policy,
6072                 .flags = GENL_ADMIN_PERM,
6073                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6074                                   NL80211_FLAG_NEED_RTNL,
6075         },
6076         {
6077                 .cmd = NL80211_CMD_JOIN_IBSS,
6078                 .doit = nl80211_join_ibss,
6079                 .policy = nl80211_policy,
6080                 .flags = GENL_ADMIN_PERM,
6081                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6082                                   NL80211_FLAG_NEED_RTNL,
6083         },
6084         {
6085                 .cmd = NL80211_CMD_LEAVE_IBSS,
6086                 .doit = nl80211_leave_ibss,
6087                 .policy = nl80211_policy,
6088                 .flags = GENL_ADMIN_PERM,
6089                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6090                                   NL80211_FLAG_NEED_RTNL,
6091         },
6092 #ifdef CONFIG_NL80211_TESTMODE
6093         {
6094                 .cmd = NL80211_CMD_TESTMODE,
6095                 .doit = nl80211_testmode_do,
6096                 .dumpit = nl80211_testmode_dump,
6097                 .policy = nl80211_policy,
6098                 .flags = GENL_ADMIN_PERM,
6099                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6100                                   NL80211_FLAG_NEED_RTNL,
6101         },
6102 #endif
6103         {
6104                 .cmd = NL80211_CMD_CONNECT,
6105                 .doit = nl80211_connect,
6106                 .policy = nl80211_policy,
6107                 .flags = GENL_ADMIN_PERM,
6108                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6109                                   NL80211_FLAG_NEED_RTNL,
6110         },
6111         {
6112                 .cmd = NL80211_CMD_DISCONNECT,
6113                 .doit = nl80211_disconnect,
6114                 .policy = nl80211_policy,
6115                 .flags = GENL_ADMIN_PERM,
6116                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6117                                   NL80211_FLAG_NEED_RTNL,
6118         },
6119         {
6120                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
6121                 .doit = nl80211_wiphy_netns,
6122                 .policy = nl80211_policy,
6123                 .flags = GENL_ADMIN_PERM,
6124                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6125                                   NL80211_FLAG_NEED_RTNL,
6126         },
6127         {
6128                 .cmd = NL80211_CMD_GET_SURVEY,
6129                 .policy = nl80211_policy,
6130                 .dumpit = nl80211_dump_survey,
6131         },
6132         {
6133                 .cmd = NL80211_CMD_SET_PMKSA,
6134                 .doit = nl80211_setdel_pmksa,
6135                 .policy = nl80211_policy,
6136                 .flags = GENL_ADMIN_PERM,
6137                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6138                                   NL80211_FLAG_NEED_RTNL,
6139         },
6140         {
6141                 .cmd = NL80211_CMD_DEL_PMKSA,
6142                 .doit = nl80211_setdel_pmksa,
6143                 .policy = nl80211_policy,
6144                 .flags = GENL_ADMIN_PERM,
6145                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6146                                   NL80211_FLAG_NEED_RTNL,
6147         },
6148         {
6149                 .cmd = NL80211_CMD_FLUSH_PMKSA,
6150                 .doit = nl80211_flush_pmksa,
6151                 .policy = nl80211_policy,
6152                 .flags = GENL_ADMIN_PERM,
6153                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6154                                   NL80211_FLAG_NEED_RTNL,
6155         },
6156         {
6157                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
6158                 .doit = nl80211_remain_on_channel,
6159                 .policy = nl80211_policy,
6160                 .flags = GENL_ADMIN_PERM,
6161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6162                                   NL80211_FLAG_NEED_RTNL,
6163         },
6164         {
6165                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6166                 .doit = nl80211_cancel_remain_on_channel,
6167                 .policy = nl80211_policy,
6168                 .flags = GENL_ADMIN_PERM,
6169                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6170                                   NL80211_FLAG_NEED_RTNL,
6171         },
6172         {
6173                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
6174                 .doit = nl80211_set_tx_bitrate_mask,
6175                 .policy = nl80211_policy,
6176                 .flags = GENL_ADMIN_PERM,
6177                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6178                                   NL80211_FLAG_NEED_RTNL,
6179         },
6180         {
6181                 .cmd = NL80211_CMD_REGISTER_FRAME,
6182                 .doit = nl80211_register_mgmt,
6183                 .policy = nl80211_policy,
6184                 .flags = GENL_ADMIN_PERM,
6185                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6186                                   NL80211_FLAG_NEED_RTNL,
6187         },
6188         {
6189                 .cmd = NL80211_CMD_FRAME,
6190                 .doit = nl80211_tx_mgmt,
6191                 .policy = nl80211_policy,
6192                 .flags = GENL_ADMIN_PERM,
6193                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6194                                   NL80211_FLAG_NEED_RTNL,
6195         },
6196         {
6197                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
6198                 .doit = nl80211_tx_mgmt_cancel_wait,
6199                 .policy = nl80211_policy,
6200                 .flags = GENL_ADMIN_PERM,
6201                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6202                                   NL80211_FLAG_NEED_RTNL,
6203         },
6204         {
6205                 .cmd = NL80211_CMD_SET_POWER_SAVE,
6206                 .doit = nl80211_set_power_save,
6207                 .policy = nl80211_policy,
6208                 .flags = GENL_ADMIN_PERM,
6209                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6210                                   NL80211_FLAG_NEED_RTNL,
6211         },
6212         {
6213                 .cmd = NL80211_CMD_GET_POWER_SAVE,
6214                 .doit = nl80211_get_power_save,
6215                 .policy = nl80211_policy,
6216                 /* can be retrieved by unprivileged users */
6217                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6218                                   NL80211_FLAG_NEED_RTNL,
6219         },
6220         {
6221                 .cmd = NL80211_CMD_SET_CQM,
6222                 .doit = nl80211_set_cqm,
6223                 .policy = nl80211_policy,
6224                 .flags = GENL_ADMIN_PERM,
6225                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6226                                   NL80211_FLAG_NEED_RTNL,
6227         },
6228         {
6229                 .cmd = NL80211_CMD_SET_CHANNEL,
6230                 .doit = nl80211_set_channel,
6231                 .policy = nl80211_policy,
6232                 .flags = GENL_ADMIN_PERM,
6233                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6234                                   NL80211_FLAG_NEED_RTNL,
6235         },
6236         {
6237                 .cmd = NL80211_CMD_SET_WDS_PEER,
6238                 .doit = nl80211_set_wds_peer,
6239                 .policy = nl80211_policy,
6240                 .flags = GENL_ADMIN_PERM,
6241                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
6242                                   NL80211_FLAG_NEED_RTNL,
6243         },
6244         {
6245                 .cmd = NL80211_CMD_JOIN_MESH,
6246                 .doit = nl80211_join_mesh,
6247                 .policy = nl80211_policy,
6248                 .flags = GENL_ADMIN_PERM,
6249                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6250                                   NL80211_FLAG_NEED_RTNL,
6251         },
6252         {
6253                 .cmd = NL80211_CMD_LEAVE_MESH,
6254                 .doit = nl80211_leave_mesh,
6255                 .policy = nl80211_policy,
6256                 .flags = GENL_ADMIN_PERM,
6257                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6258                                   NL80211_FLAG_NEED_RTNL,
6259         },
6260         {
6261                 .cmd = NL80211_CMD_GET_WOWLAN,
6262                 .doit = nl80211_get_wowlan,
6263                 .policy = nl80211_policy,
6264                 /* can be retrieved by unprivileged users */
6265                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6266                                   NL80211_FLAG_NEED_RTNL,
6267         },
6268         {
6269                 .cmd = NL80211_CMD_SET_WOWLAN,
6270                 .doit = nl80211_set_wowlan,
6271                 .policy = nl80211_policy,
6272                 .flags = GENL_ADMIN_PERM,
6273                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
6274                                   NL80211_FLAG_NEED_RTNL,
6275         },
6276         {
6277                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
6278                 .doit = nl80211_set_rekey_data,
6279                 .policy = nl80211_policy,
6280                 .flags = GENL_ADMIN_PERM,
6281                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6282                                   NL80211_FLAG_NEED_RTNL,
6283         },
6284 };
6285
6286 static struct genl_multicast_group nl80211_mlme_mcgrp = {
6287         .name = "mlme",
6288 };
6289
6290 /* multicast groups */
6291 static struct genl_multicast_group nl80211_config_mcgrp = {
6292         .name = "config",
6293 };
6294 static struct genl_multicast_group nl80211_scan_mcgrp = {
6295         .name = "scan",
6296 };
6297 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
6298         .name = "regulatory",
6299 };
6300
6301 /* notification functions */
6302
6303 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
6304 {
6305         struct sk_buff *msg;
6306
6307         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6308         if (!msg)
6309                 return;
6310
6311         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
6312                 nlmsg_free(msg);
6313                 return;
6314         }
6315
6316         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6317                                 nl80211_config_mcgrp.id, GFP_KERNEL);
6318 }
6319
6320 static int nl80211_add_scan_req(struct sk_buff *msg,
6321                                 struct cfg80211_registered_device *rdev)
6322 {
6323         struct cfg80211_scan_request *req = rdev->scan_req;
6324         struct nlattr *nest;
6325         int i;
6326
6327         ASSERT_RDEV_LOCK(rdev);
6328
6329         if (WARN_ON(!req))
6330                 return 0;
6331
6332         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
6333         if (!nest)
6334                 goto nla_put_failure;
6335         for (i = 0; i < req->n_ssids; i++)
6336                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
6337         nla_nest_end(msg, nest);
6338
6339         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
6340         if (!nest)
6341                 goto nla_put_failure;
6342         for (i = 0; i < req->n_channels; i++)
6343                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
6344         nla_nest_end(msg, nest);
6345
6346         if (req->ie)
6347                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
6348
6349         return 0;
6350  nla_put_failure:
6351         return -ENOBUFS;
6352 }
6353
6354 static int nl80211_send_scan_msg(struct sk_buff *msg,
6355                                  struct cfg80211_registered_device *rdev,
6356                                  struct net_device *netdev,
6357                                  u32 pid, u32 seq, int flags,
6358                                  u32 cmd)
6359 {
6360         void *hdr;
6361
6362         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6363         if (!hdr)
6364                 return -1;
6365
6366         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6367         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6368
6369         /* ignore errors and send incomplete event anyway */
6370         nl80211_add_scan_req(msg, rdev);
6371
6372         return genlmsg_end(msg, hdr);
6373
6374  nla_put_failure:
6375         genlmsg_cancel(msg, hdr);
6376         return -EMSGSIZE;
6377 }
6378
6379 static int
6380 nl80211_send_sched_scan_msg(struct sk_buff *msg,
6381                             struct cfg80211_registered_device *rdev,
6382                             struct net_device *netdev,
6383                             u32 pid, u32 seq, int flags, u32 cmd)
6384 {
6385         void *hdr;
6386
6387         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
6388         if (!hdr)
6389                 return -1;
6390
6391         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6392         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6393
6394         return genlmsg_end(msg, hdr);
6395
6396  nla_put_failure:
6397         genlmsg_cancel(msg, hdr);
6398         return -EMSGSIZE;
6399 }
6400
6401 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
6402                              struct net_device *netdev)
6403 {
6404         struct sk_buff *msg;
6405
6406         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6407         if (!msg)
6408                 return;
6409
6410         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6411                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
6412                 nlmsg_free(msg);
6413                 return;
6414         }
6415
6416         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6417                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6418 }
6419
6420 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
6421                             struct net_device *netdev)
6422 {
6423         struct sk_buff *msg;
6424
6425         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6426         if (!msg)
6427                 return;
6428
6429         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6430                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
6431                 nlmsg_free(msg);
6432                 return;
6433         }
6434
6435         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6436                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6437 }
6438
6439 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
6440                                struct net_device *netdev)
6441 {
6442         struct sk_buff *msg;
6443
6444         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6445         if (!msg)
6446                 return;
6447
6448         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
6449                                   NL80211_CMD_SCAN_ABORTED) < 0) {
6450                 nlmsg_free(msg);
6451                 return;
6452         }
6453
6454         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6455                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6456 }
6457
6458 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
6459                                      struct net_device *netdev)
6460 {
6461         struct sk_buff *msg;
6462
6463         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6464         if (!msg)
6465                 return;
6466
6467         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
6468                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
6469                 nlmsg_free(msg);
6470                 return;
6471         }
6472
6473         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6474                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6475 }
6476
6477 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
6478                              struct net_device *netdev, u32 cmd)
6479 {
6480         struct sk_buff *msg;
6481
6482         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6483         if (!msg)
6484                 return;
6485
6486         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
6487                 nlmsg_free(msg);
6488                 return;
6489         }
6490
6491         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6492                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
6493 }
6494
6495 /*
6496  * This can happen on global regulatory changes or device specific settings
6497  * based on custom world regulatory domains.
6498  */
6499 void nl80211_send_reg_change_event(struct regulatory_request *request)
6500 {
6501         struct sk_buff *msg;
6502         void *hdr;
6503
6504         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6505         if (!msg)
6506                 return;
6507
6508         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
6509         if (!hdr) {
6510                 nlmsg_free(msg);
6511                 return;
6512         }
6513
6514         /* Userspace can always count this one always being set */
6515         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
6516
6517         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
6518                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6519                            NL80211_REGDOM_TYPE_WORLD);
6520         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
6521                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6522                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
6523         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
6524                  request->intersect)
6525                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6526                            NL80211_REGDOM_TYPE_INTERSECTION);
6527         else {
6528                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
6529                            NL80211_REGDOM_TYPE_COUNTRY);
6530                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
6531         }
6532
6533         if (wiphy_idx_valid(request->wiphy_idx))
6534                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
6535
6536         if (genlmsg_end(msg, hdr) < 0) {
6537                 nlmsg_free(msg);
6538                 return;
6539         }
6540
6541         rcu_read_lock();
6542         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6543                                 GFP_ATOMIC);
6544         rcu_read_unlock();
6545
6546         return;
6547
6548 nla_put_failure:
6549         genlmsg_cancel(msg, hdr);
6550         nlmsg_free(msg);
6551 }
6552
6553 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
6554                                     struct net_device *netdev,
6555                                     const u8 *buf, size_t len,
6556                                     enum nl80211_commands cmd, gfp_t gfp)
6557 {
6558         struct sk_buff *msg;
6559         void *hdr;
6560
6561         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6562         if (!msg)
6563                 return;
6564
6565         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6566         if (!hdr) {
6567                 nlmsg_free(msg);
6568                 return;
6569         }
6570
6571         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6572         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6573         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6574
6575         if (genlmsg_end(msg, hdr) < 0) {
6576                 nlmsg_free(msg);
6577                 return;
6578         }
6579
6580         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6581                                 nl80211_mlme_mcgrp.id, gfp);
6582         return;
6583
6584  nla_put_failure:
6585         genlmsg_cancel(msg, hdr);
6586         nlmsg_free(msg);
6587 }
6588
6589 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
6590                           struct net_device *netdev, const u8 *buf,
6591                           size_t len, gfp_t gfp)
6592 {
6593         nl80211_send_mlme_event(rdev, netdev, buf, len,
6594                                 NL80211_CMD_AUTHENTICATE, gfp);
6595 }
6596
6597 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
6598                            struct net_device *netdev, const u8 *buf,
6599                            size_t len, gfp_t gfp)
6600 {
6601         nl80211_send_mlme_event(rdev, netdev, buf, len,
6602                                 NL80211_CMD_ASSOCIATE, gfp);
6603 }
6604
6605 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
6606                          struct net_device *netdev, const u8 *buf,
6607                          size_t len, gfp_t gfp)
6608 {
6609         nl80211_send_mlme_event(rdev, netdev, buf, len,
6610                                 NL80211_CMD_DEAUTHENTICATE, gfp);
6611 }
6612
6613 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
6614                            struct net_device *netdev, const u8 *buf,
6615                            size_t len, gfp_t gfp)
6616 {
6617         nl80211_send_mlme_event(rdev, netdev, buf, len,
6618                                 NL80211_CMD_DISASSOCIATE, gfp);
6619 }
6620
6621 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
6622                                 struct net_device *netdev, const u8 *buf,
6623                                 size_t len, gfp_t gfp)
6624 {
6625         nl80211_send_mlme_event(rdev, netdev, buf, len,
6626                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
6627 }
6628
6629 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
6630                                   struct net_device *netdev, const u8 *buf,
6631                                   size_t len, gfp_t gfp)
6632 {
6633         nl80211_send_mlme_event(rdev, netdev, buf, len,
6634                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
6635 }
6636
6637 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
6638                                       struct net_device *netdev, int cmd,
6639                                       const u8 *addr, gfp_t gfp)
6640 {
6641         struct sk_buff *msg;
6642         void *hdr;
6643
6644         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6645         if (!msg)
6646                 return;
6647
6648         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
6649         if (!hdr) {
6650                 nlmsg_free(msg);
6651                 return;
6652         }
6653
6654         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6655         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6656         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
6657         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6658
6659         if (genlmsg_end(msg, hdr) < 0) {
6660                 nlmsg_free(msg);
6661                 return;
6662         }
6663
6664         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6665                                 nl80211_mlme_mcgrp.id, gfp);
6666         return;
6667
6668  nla_put_failure:
6669         genlmsg_cancel(msg, hdr);
6670         nlmsg_free(msg);
6671 }
6672
6673 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
6674                                struct net_device *netdev, const u8 *addr,
6675                                gfp_t gfp)
6676 {
6677         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
6678                                   addr, gfp);
6679 }
6680
6681 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
6682                                 struct net_device *netdev, const u8 *addr,
6683                                 gfp_t gfp)
6684 {
6685         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
6686                                   addr, gfp);
6687 }
6688
6689 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
6690                                  struct net_device *netdev, const u8 *bssid,
6691                                  const u8 *req_ie, size_t req_ie_len,
6692                                  const u8 *resp_ie, size_t resp_ie_len,
6693                                  u16 status, gfp_t gfp)
6694 {
6695         struct sk_buff *msg;
6696         void *hdr;
6697
6698         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6699         if (!msg)
6700                 return;
6701
6702         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
6703         if (!hdr) {
6704                 nlmsg_free(msg);
6705                 return;
6706         }
6707
6708         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6709         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6710         if (bssid)
6711                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6712         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
6713         if (req_ie)
6714                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6715         if (resp_ie)
6716                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6717
6718         if (genlmsg_end(msg, hdr) < 0) {
6719                 nlmsg_free(msg);
6720                 return;
6721         }
6722
6723         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6724                                 nl80211_mlme_mcgrp.id, gfp);
6725         return;
6726
6727  nla_put_failure:
6728         genlmsg_cancel(msg, hdr);
6729         nlmsg_free(msg);
6730
6731 }
6732
6733 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
6734                          struct net_device *netdev, const u8 *bssid,
6735                          const u8 *req_ie, size_t req_ie_len,
6736                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
6737 {
6738         struct sk_buff *msg;
6739         void *hdr;
6740
6741         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6742         if (!msg)
6743                 return;
6744
6745         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
6746         if (!hdr) {
6747                 nlmsg_free(msg);
6748                 return;
6749         }
6750
6751         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6752         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6753         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6754         if (req_ie)
6755                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
6756         if (resp_ie)
6757                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
6758
6759         if (genlmsg_end(msg, hdr) < 0) {
6760                 nlmsg_free(msg);
6761                 return;
6762         }
6763
6764         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6765                                 nl80211_mlme_mcgrp.id, gfp);
6766         return;
6767
6768  nla_put_failure:
6769         genlmsg_cancel(msg, hdr);
6770         nlmsg_free(msg);
6771
6772 }
6773
6774 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
6775                                struct net_device *netdev, u16 reason,
6776                                const u8 *ie, size_t ie_len, bool from_ap)
6777 {
6778         struct sk_buff *msg;
6779         void *hdr;
6780
6781         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6782         if (!msg)
6783                 return;
6784
6785         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
6786         if (!hdr) {
6787                 nlmsg_free(msg);
6788                 return;
6789         }
6790
6791         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6792         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6793         if (from_ap && reason)
6794                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
6795         if (from_ap)
6796                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
6797         if (ie)
6798                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
6799
6800         if (genlmsg_end(msg, hdr) < 0) {
6801                 nlmsg_free(msg);
6802                 return;
6803         }
6804
6805         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6806                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
6807         return;
6808
6809  nla_put_failure:
6810         genlmsg_cancel(msg, hdr);
6811         nlmsg_free(msg);
6812
6813 }
6814
6815 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
6816                              struct net_device *netdev, const u8 *bssid,
6817                              gfp_t gfp)
6818 {
6819         struct sk_buff *msg;
6820         void *hdr;
6821
6822         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6823         if (!msg)
6824                 return;
6825
6826         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
6827         if (!hdr) {
6828                 nlmsg_free(msg);
6829                 return;
6830         }
6831
6832         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6833         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6834         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
6835
6836         if (genlmsg_end(msg, hdr) < 0) {
6837                 nlmsg_free(msg);
6838                 return;
6839         }
6840
6841         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6842                                 nl80211_mlme_mcgrp.id, gfp);
6843         return;
6844
6845  nla_put_failure:
6846         genlmsg_cancel(msg, hdr);
6847         nlmsg_free(msg);
6848 }
6849
6850 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
6851                 struct net_device *netdev,
6852                 const u8 *macaddr, const u8* ie, u8 ie_len,
6853                 gfp_t gfp)
6854 {
6855         struct sk_buff *msg;
6856         void *hdr;
6857
6858         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6859         if (!msg)
6860                 return;
6861
6862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
6863         if (!hdr) {
6864                 nlmsg_free(msg);
6865                 return;
6866         }
6867
6868         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6869         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6870         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
6871         if (ie_len && ie)
6872                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
6873
6874         if (genlmsg_end(msg, hdr) < 0) {
6875                 nlmsg_free(msg);
6876                 return;
6877         }
6878
6879         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6880                                 nl80211_mlme_mcgrp.id, gfp);
6881         return;
6882
6883  nla_put_failure:
6884         genlmsg_cancel(msg, hdr);
6885         nlmsg_free(msg);
6886 }
6887
6888 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
6889                                  struct net_device *netdev, const u8 *addr,
6890                                  enum nl80211_key_type key_type, int key_id,
6891                                  const u8 *tsc, gfp_t gfp)
6892 {
6893         struct sk_buff *msg;
6894         void *hdr;
6895
6896         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6897         if (!msg)
6898                 return;
6899
6900         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
6901         if (!hdr) {
6902                 nlmsg_free(msg);
6903                 return;
6904         }
6905
6906         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6907         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6908         if (addr)
6909                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6910         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
6911         if (key_id != -1)
6912                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
6913         if (tsc)
6914                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
6915
6916         if (genlmsg_end(msg, hdr) < 0) {
6917                 nlmsg_free(msg);
6918                 return;
6919         }
6920
6921         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6922                                 nl80211_mlme_mcgrp.id, gfp);
6923         return;
6924
6925  nla_put_failure:
6926         genlmsg_cancel(msg, hdr);
6927         nlmsg_free(msg);
6928 }
6929
6930 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
6931                                     struct ieee80211_channel *channel_before,
6932                                     struct ieee80211_channel *channel_after)
6933 {
6934         struct sk_buff *msg;
6935         void *hdr;
6936         struct nlattr *nl_freq;
6937
6938         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
6939         if (!msg)
6940                 return;
6941
6942         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
6943         if (!hdr) {
6944                 nlmsg_free(msg);
6945                 return;
6946         }
6947
6948         /*
6949          * Since we are applying the beacon hint to a wiphy we know its
6950          * wiphy_idx is valid
6951          */
6952         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
6953
6954         /* Before */
6955         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
6956         if (!nl_freq)
6957                 goto nla_put_failure;
6958         if (nl80211_msg_put_channel(msg, channel_before))
6959                 goto nla_put_failure;
6960         nla_nest_end(msg, nl_freq);
6961
6962         /* After */
6963         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
6964         if (!nl_freq)
6965                 goto nla_put_failure;
6966         if (nl80211_msg_put_channel(msg, channel_after))
6967                 goto nla_put_failure;
6968         nla_nest_end(msg, nl_freq);
6969
6970         if (genlmsg_end(msg, hdr) < 0) {
6971                 nlmsg_free(msg);
6972                 return;
6973         }
6974
6975         rcu_read_lock();
6976         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
6977                                 GFP_ATOMIC);
6978         rcu_read_unlock();
6979
6980         return;
6981
6982 nla_put_failure:
6983         genlmsg_cancel(msg, hdr);
6984         nlmsg_free(msg);
6985 }
6986
6987 static void nl80211_send_remain_on_chan_event(
6988         int cmd, struct cfg80211_registered_device *rdev,
6989         struct net_device *netdev, u64 cookie,
6990         struct ieee80211_channel *chan,
6991         enum nl80211_channel_type channel_type,
6992         unsigned int duration, gfp_t gfp)
6993 {
6994         struct sk_buff *msg;
6995         void *hdr;
6996
6997         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6998         if (!msg)
6999                 return;
7000
7001         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7002         if (!hdr) {
7003                 nlmsg_free(msg);
7004                 return;
7005         }
7006
7007         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7008         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7009         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
7010         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
7011         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7012
7013         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
7014                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
7015
7016         if (genlmsg_end(msg, hdr) < 0) {
7017                 nlmsg_free(msg);
7018                 return;
7019         }
7020
7021         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7022                                 nl80211_mlme_mcgrp.id, gfp);
7023         return;
7024
7025  nla_put_failure:
7026         genlmsg_cancel(msg, hdr);
7027         nlmsg_free(msg);
7028 }
7029
7030 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
7031                                     struct net_device *netdev, u64 cookie,
7032                                     struct ieee80211_channel *chan,
7033                                     enum nl80211_channel_type channel_type,
7034                                     unsigned int duration, gfp_t gfp)
7035 {
7036         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
7037                                           rdev, netdev, cookie, chan,
7038                                           channel_type, duration, gfp);
7039 }
7040
7041 void nl80211_send_remain_on_channel_cancel(
7042         struct cfg80211_registered_device *rdev, struct net_device *netdev,
7043         u64 cookie, struct ieee80211_channel *chan,
7044         enum nl80211_channel_type channel_type, gfp_t gfp)
7045 {
7046         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7047                                           rdev, netdev, cookie, chan,
7048                                           channel_type, 0, gfp);
7049 }
7050
7051 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
7052                             struct net_device *dev, const u8 *mac_addr,
7053                             struct station_info *sinfo, gfp_t gfp)
7054 {
7055         struct sk_buff *msg;
7056
7057         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7058         if (!msg)
7059                 return;
7060
7061         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
7062                 nlmsg_free(msg);
7063                 return;
7064         }
7065
7066         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7067                                 nl80211_mlme_mcgrp.id, gfp);
7068 }
7069
7070 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
7071                                 struct net_device *dev, const u8 *mac_addr,
7072                                 gfp_t gfp)
7073 {
7074         struct sk_buff *msg;
7075         void *hdr;
7076
7077         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7078         if (!msg)
7079                 return;
7080
7081         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
7082         if (!hdr) {
7083                 nlmsg_free(msg);
7084                 return;
7085         }
7086
7087         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
7088         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
7089
7090         if (genlmsg_end(msg, hdr) < 0) {
7091                 nlmsg_free(msg);
7092                 return;
7093         }
7094
7095         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7096                                 nl80211_mlme_mcgrp.id, gfp);
7097         return;
7098
7099  nla_put_failure:
7100         genlmsg_cancel(msg, hdr);
7101         nlmsg_free(msg);
7102 }
7103
7104 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
7105                       struct net_device *netdev, u32 nlpid,
7106                       int freq, const u8 *buf, size_t len, gfp_t gfp)
7107 {
7108         struct sk_buff *msg;
7109         void *hdr;
7110         int err;
7111
7112         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7113         if (!msg)
7114                 return -ENOMEM;
7115
7116         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
7117         if (!hdr) {
7118                 nlmsg_free(msg);
7119                 return -ENOMEM;
7120         }
7121
7122         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7123         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7124         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
7125         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7126
7127         err = genlmsg_end(msg, hdr);
7128         if (err < 0) {
7129                 nlmsg_free(msg);
7130                 return err;
7131         }
7132
7133         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
7134         if (err < 0)
7135                 return err;
7136         return 0;
7137
7138  nla_put_failure:
7139         genlmsg_cancel(msg, hdr);
7140         nlmsg_free(msg);
7141         return -ENOBUFS;
7142 }
7143
7144 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
7145                                  struct net_device *netdev, u64 cookie,
7146                                  const u8 *buf, size_t len, bool ack,
7147                                  gfp_t gfp)
7148 {
7149         struct sk_buff *msg;
7150         void *hdr;
7151
7152         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7153         if (!msg)
7154                 return;
7155
7156         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
7157         if (!hdr) {
7158                 nlmsg_free(msg);
7159                 return;
7160         }
7161
7162         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7163         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7164         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
7165         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
7166         if (ack)
7167                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
7168
7169         if (genlmsg_end(msg, hdr) < 0) {
7170                 nlmsg_free(msg);
7171                 return;
7172         }
7173
7174         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
7175         return;
7176
7177  nla_put_failure:
7178         genlmsg_cancel(msg, hdr);
7179         nlmsg_free(msg);
7180 }
7181
7182 void
7183 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
7184                              struct net_device *netdev,
7185                              enum nl80211_cqm_rssi_threshold_event rssi_event,
7186                              gfp_t gfp)
7187 {
7188         struct sk_buff *msg;
7189         struct nlattr *pinfoattr;
7190         void *hdr;
7191
7192         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7193         if (!msg)
7194                 return;
7195
7196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7197         if (!hdr) {
7198                 nlmsg_free(msg);
7199                 return;
7200         }
7201
7202         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7203         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7204
7205         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7206         if (!pinfoattr)
7207                 goto nla_put_failure;
7208
7209         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
7210                     rssi_event);
7211
7212         nla_nest_end(msg, pinfoattr);
7213
7214         if (genlmsg_end(msg, hdr) < 0) {
7215                 nlmsg_free(msg);
7216                 return;
7217         }
7218
7219         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7220                                 nl80211_mlme_mcgrp.id, gfp);
7221         return;
7222
7223  nla_put_failure:
7224         genlmsg_cancel(msg, hdr);
7225         nlmsg_free(msg);
7226 }
7227
7228 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
7229                               struct net_device *netdev, const u8 *bssid,
7230                               const u8 *replay_ctr, gfp_t gfp)
7231 {
7232         struct sk_buff *msg;
7233         struct nlattr *rekey_attr;
7234         void *hdr;
7235
7236         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7237         if (!msg)
7238                 return;
7239
7240         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
7241         if (!hdr) {
7242                 nlmsg_free(msg);
7243                 return;
7244         }
7245
7246         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7247         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7248         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
7249
7250         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
7251         if (!rekey_attr)
7252                 goto nla_put_failure;
7253
7254         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
7255                 NL80211_REPLAY_CTR_LEN, replay_ctr);
7256
7257         nla_nest_end(msg, rekey_attr);
7258
7259         if (genlmsg_end(msg, hdr) < 0) {
7260                 nlmsg_free(msg);
7261                 return;
7262         }
7263
7264         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7265                                 nl80211_mlme_mcgrp.id, gfp);
7266         return;
7267
7268  nla_put_failure:
7269         genlmsg_cancel(msg, hdr);
7270         nlmsg_free(msg);
7271 }
7272
7273 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
7274                                     struct net_device *netdev, int index,
7275                                     const u8 *bssid, bool preauth, gfp_t gfp)
7276 {
7277         struct sk_buff *msg;
7278         struct nlattr *attr;
7279         void *hdr;
7280
7281         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7282         if (!msg)
7283                 return;
7284
7285         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
7286         if (!hdr) {
7287                 nlmsg_free(msg);
7288                 return;
7289         }
7290
7291         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7292         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7293
7294         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
7295         if (!attr)
7296                 goto nla_put_failure;
7297
7298         NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
7299         NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
7300         if (preauth)
7301                 NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
7302
7303         nla_nest_end(msg, attr);
7304
7305         if (genlmsg_end(msg, hdr) < 0) {
7306                 nlmsg_free(msg);
7307                 return;
7308         }
7309
7310         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7311                                 nl80211_mlme_mcgrp.id, gfp);
7312         return;
7313
7314  nla_put_failure:
7315         genlmsg_cancel(msg, hdr);
7316         nlmsg_free(msg);
7317 }
7318
7319 void
7320 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
7321                                 struct net_device *netdev, const u8 *peer,
7322                                 u32 num_packets, gfp_t gfp)
7323 {
7324         struct sk_buff *msg;
7325         struct nlattr *pinfoattr;
7326         void *hdr;
7327
7328         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
7329         if (!msg)
7330                 return;
7331
7332         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
7333         if (!hdr) {
7334                 nlmsg_free(msg);
7335                 return;
7336         }
7337
7338         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
7339         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
7340         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
7341
7342         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
7343         if (!pinfoattr)
7344                 goto nla_put_failure;
7345
7346         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
7347
7348         nla_nest_end(msg, pinfoattr);
7349
7350         if (genlmsg_end(msg, hdr) < 0) {
7351                 nlmsg_free(msg);
7352                 return;
7353         }
7354
7355         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7356                                 nl80211_mlme_mcgrp.id, gfp);
7357         return;
7358
7359  nla_put_failure:
7360         genlmsg_cancel(msg, hdr);
7361         nlmsg_free(msg);
7362 }
7363
7364 static int nl80211_netlink_notify(struct notifier_block * nb,
7365                                   unsigned long state,
7366                                   void *_notify)
7367 {
7368         struct netlink_notify *notify = _notify;
7369         struct cfg80211_registered_device *rdev;
7370         struct wireless_dev *wdev;
7371
7372         if (state != NETLINK_URELEASE)
7373                 return NOTIFY_DONE;
7374
7375         rcu_read_lock();
7376
7377         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
7378                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
7379                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
7380
7381         rcu_read_unlock();
7382
7383         return NOTIFY_DONE;
7384 }
7385
7386 static struct notifier_block nl80211_netlink_notifier = {
7387         .notifier_call = nl80211_netlink_notify,
7388 };
7389
7390 /* initialisation/exit functions */
7391
7392 int nl80211_init(void)
7393 {
7394         int err;
7395
7396         err = genl_register_family_with_ops(&nl80211_fam,
7397                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
7398         if (err)
7399                 return err;
7400
7401         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
7402         if (err)
7403                 goto err_out;
7404
7405         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
7406         if (err)
7407                 goto err_out;
7408
7409         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
7410         if (err)
7411                 goto err_out;
7412
7413         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
7414         if (err)
7415                 goto err_out;
7416
7417 #ifdef CONFIG_NL80211_TESTMODE
7418         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
7419         if (err)
7420                 goto err_out;
7421 #endif
7422
7423         err = netlink_register_notifier(&nl80211_netlink_notifier);
7424         if (err)
7425                 goto err_out;
7426
7427         return 0;
7428  err_out:
7429         genl_unregister_family(&nl80211_fam);
7430         return err;
7431 }
7432
7433 void nl80211_exit(void)
7434 {
7435         netlink_unregister_notifier(&nl80211_netlink_notifier);
7436         genl_unregister_family(&nl80211_fam);
7437 }