net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  27                             struct genl_info *info);
  28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  29                               struct genl_info *info);
  30
  31 /* the netlink family */
  32 static struct genl_family nl80211_fam = {
  33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  34         .name = "nl80211",      /* have users key off the name instead */
  35         .hdrsize = 0,           /* no private header */
  36         .version = 1,           /* no particular meaning now */
  37         .maxattr = NL80211_ATTR_MAX,
  38         .netnsok = true,
  39         .pre_doit = nl80211_pre_doit,
  40         .post_doit = nl80211_post_doit,
  41 };
  42
  43 /* internal helper: get rdev and dev */
  44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  45                                        struct cfg80211_registered_device **rdev,
  46                                        struct net_device **dev)
  47 {
  48         struct nlattr **attrs = info->attrs;
  49         int ifindex;
  50
  51         if (!attrs[NL80211_ATTR_IFINDEX])
  52                 return -EINVAL;
  53
  54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  56         if (!*dev)
  57                 return -ENODEV;
  58
  59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  60         if (IS_ERR(*rdev)) {
  61                 dev_put(*dev);
  62                 return PTR_ERR(*rdev);
  63         }
  64
  65         return 0;
  66 }
  67
  68 /* policy for the attributes */
  69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  72                                       .len = 20-1 },
  73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  81
  82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  85
  86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  88
  89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  91                                     .len = WLAN_MAX_KEY_LEN },
  92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  96         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
  97
  98         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  99         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 100         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 101                                        .len = IEEE80211_MAX_DATA_LEN },
 102         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 103                                        .len = IEEE80211_MAX_DATA_LEN },
 104         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 105         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 106         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 107         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 108                                                .len = NL80211_MAX_SUPP_RATES },
 109         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 110         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 111         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 112         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 113                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 114         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 115
 116         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 117         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 120         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 122         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 123                                            .len = NL80211_MAX_SUPP_RATES },
 124
 125         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 126
 127         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 128                                          .len = NL80211_HT_CAPABILITY_LEN },
 129
 130         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 131         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 132                               .len = IEEE80211_MAX_DATA_LEN },
 133         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 134         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 135
 136         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 137                                 .len = IEEE80211_MAX_SSID_LEN },
 138         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 139         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 140         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 141         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 142         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 143         [NL80211_ATTR_STA_FLAGS2] = {
 144                 .len = sizeof(struct nl80211_sta_flag_update),
 145         },
 146         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 147         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 148         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 151         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 152         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 153         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 154         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 155                                  .len = WLAN_PMKID_LEN },
 156         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 157         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 158         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 159         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 160                                  .len = IEEE80211_MAX_DATA_LEN },
 161         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 162         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 163         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 164         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 165         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 166         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 167         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 168         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 169         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 170         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 171         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 172         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 173 };
 174
 175 /* policy for the key attributes */
 176 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 177         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 178         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 179         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 180         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 181         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 182         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 183         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 184 };
 185
 186 /* ifidx get helper */
 187 static int nl80211_get_ifidx(struct netlink_callback *cb)
 188 {
 189         int res;
 190
 191         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 192                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 193                           nl80211_policy);
 194         if (res)
 195                 return res;
 196
 197         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 198                 return -EINVAL;
 199
 200         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 201         if (!res)
 202                 return -EINVAL;
 203         return res;
 204 }
 205
 206 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 207                                        struct netlink_callback *cb,
 208                                        struct cfg80211_registered_device **rdev,
 209                                        struct net_device **dev)
 210 {
 211         int ifidx = cb->args[0];
 212         int err;
 213
 214         if (!ifidx)
 215                 ifidx = nl80211_get_ifidx(cb);
 216         if (ifidx < 0)
 217                 return ifidx;
 218
 219         cb->args[0] = ifidx;
 220
 221         rtnl_lock();
 222
 223         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 224         if (!*dev) {
 225                 err = -ENODEV;
 226                 goto out_rtnl;
 227         }
 228
 229         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 230         if (IS_ERR(*rdev)) {
 231                 err = PTR_ERR(*rdev);
 232                 goto out_rtnl;
 233         }
 234
 235         return 0;
 236  out_rtnl:
 237         rtnl_unlock();
 238         return err;
 239 }
 240
 241 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 242 {
 243         cfg80211_unlock_rdev(rdev);
 244         rtnl_unlock();
 245 }
 246
 247 /* IE validation */
 248 static bool is_valid_ie_attr(const struct nlattr *attr)
 249 {
 250         const u8 *pos;
 251         int len;
 252
 253         if (!attr)
 254                 return true;
 255
 256         pos = nla_data(attr);
 257         len = nla_len(attr);
 258
 259         while (len) {
 260                 u8 elemlen;
 261
 262                 if (len < 2)
 263                         return false;
 264                 len -= 2;
 265
 266                 elemlen = pos[1];
 267                 if (elemlen > len)
 268                         return false;
 269
 270                 len -= elemlen;
 271                 pos += 2 + elemlen;
 272         }
 273
 274         return true;
 275 }
 276
 277 /* message building helper */
 278 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 279                                    int flags, u8 cmd)
 280 {
 281         /* since there is no private header just add the generic one */
 282         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 283 }
 284
 285 static int nl80211_msg_put_channel(struct sk_buff *msg,
 286                                    struct ieee80211_channel *chan)
 287 {
 288         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 289                     chan->center_freq);
 290
 291         if (chan->flags & IEEE80211_CHAN_DISABLED)
 292                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 293         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 294                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 295         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 296                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 297         if (chan->flags & IEEE80211_CHAN_RADAR)
 298                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 299
 300         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 301                     DBM_TO_MBM(chan->max_power));
 302
 303         return 0;
 304
 305  nla_put_failure:
 306         return -ENOBUFS;
 307 }
 308
 309 /* netlink command implementations */
 310
 311 struct key_parse {
 312         struct key_params p;
 313         int idx;
 314         int type;
 315         bool def, defmgmt;
 316 };
 317
 318 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 319 {
 320         struct nlattr *tb[NL80211_KEY_MAX + 1];
 321         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 322                                    nl80211_key_policy);
 323         if (err)
 324                 return err;
 325
 326         k->def = !!tb[NL80211_KEY_DEFAULT];
 327         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 328
 329         if (tb[NL80211_KEY_IDX])
 330                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 331
 332         if (tb[NL80211_KEY_DATA]) {
 333                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 334                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 335         }
 336
 337         if (tb[NL80211_KEY_SEQ]) {
 338                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 339                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 340         }
 341
 342         if (tb[NL80211_KEY_CIPHER])
 343                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 344
 345         if (tb[NL80211_KEY_TYPE]) {
 346                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 347                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 348                         return -EINVAL;
 349         }
 350
 351         return 0;
 352 }
 353
 354 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 355 {
 356         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 357                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 358                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 359         }
 360
 361         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 362                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 363                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 364         }
 365
 366         if (info->attrs[NL80211_ATTR_KEY_IDX])
 367                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 368
 369         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 370                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 371
 372         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 373         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 374
 375         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 376                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 377                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 378                         return -EINVAL;
 379         }
 380
 381         return 0;
 382 }
 383
 384 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 385 {
 386         int err;
 387
 388         memset(k, 0, sizeof(*k));
 389         k->idx = -1;
 390         k->type = -1;
 391
 392         if (info->attrs[NL80211_ATTR_KEY])
 393                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 394         else
 395                 err = nl80211_parse_key_old(info, k);
 396
 397         if (err)
 398                 return err;
 399
 400         if (k->def && k->defmgmt)
 401                 return -EINVAL;
 402
 403         if (k->idx != -1) {
 404                 if (k->defmgmt) {
 405                         if (k->idx < 4 || k->idx > 5)
 406                                 return -EINVAL;
 407                 } else if (k->def) {
 408                         if (k->idx < 0 || k->idx > 3)
 409                                 return -EINVAL;
 410                 } else {
 411                         if (k->idx < 0 || k->idx > 5)
 412                                 return -EINVAL;
 413                 }
 414         }
 415
 416         return 0;
 417 }
 418
 419 static struct cfg80211_cached_keys *
 420 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 421                        struct nlattr *keys)
 422 {
 423         struct key_parse parse;
 424         struct nlattr *key;
 425         struct cfg80211_cached_keys *result;
 426         int rem, err, def = 0;
 427
 428         result = kzalloc(sizeof(*result), GFP_KERNEL);
 429         if (!result)
 430                 return ERR_PTR(-ENOMEM);
 431
 432         result->def = -1;
 433         result->defmgmt = -1;
 434
 435         nla_for_each_nested(key, keys, rem) {
 436                 memset(&parse, 0, sizeof(parse));
 437                 parse.idx = -1;
 438
 439                 err = nl80211_parse_key_new(key, &parse);
 440                 if (err)
 441                         goto error;
 442                 err = -EINVAL;
 443                 if (!parse.p.key)
 444                         goto error;
 445                 if (parse.idx < 0 || parse.idx > 4)
 446                         goto error;
 447                 if (parse.def) {
 448                         if (def)
 449                                 goto error;
 450                         def = 1;
 451                         result->def = parse.idx;
 452                 } else if (parse.defmgmt)
 453                         goto error;
 454                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 455                                                      parse.idx, false, NULL);
 456                 if (err)
 457                         goto error;
 458                 result->params[parse.idx].cipher = parse.p.cipher;
 459                 result->params[parse.idx].key_len = parse.p.key_len;
 460                 result->params[parse.idx].key = result->data[parse.idx];
 461                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 462         }
 463
 464         return result;
 465  error:
 466         kfree(result);
 467         return ERR_PTR(err);
 468 }
 469
 470 static int nl80211_key_allowed(struct wireless_dev *wdev)
 471 {
 472         ASSERT_WDEV_LOCK(wdev);
 473
 474         switch (wdev->iftype) {
 475         case NL80211_IFTYPE_AP:
 476         case NL80211_IFTYPE_AP_VLAN:
 477         case NL80211_IFTYPE_P2P_GO:
 478                 break;
 479         case NL80211_IFTYPE_ADHOC:
 480                 if (!wdev->current_bss)
 481                         return -ENOLINK;
 482                 break;
 483         case NL80211_IFTYPE_STATION:
 484         case NL80211_IFTYPE_P2P_CLIENT:
 485                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 486                         return -ENOLINK;
 487                 break;
 488         default:
 489                 return -EINVAL;
 490         }
 491
 492         return 0;
 493 }
 494
 495 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 496                               struct cfg80211_registered_device *dev)
 497 {
 498         void *hdr;
 499         struct nlattr *nl_bands, *nl_band;
 500         struct nlattr *nl_freqs, *nl_freq;
 501         struct nlattr *nl_rates, *nl_rate;
 502         struct nlattr *nl_modes;
 503         struct nlattr *nl_cmds;
 504         enum ieee80211_band band;
 505         struct ieee80211_channel *chan;
 506         struct ieee80211_rate *rate;
 507         int i;
 508         u16 ifmodes = dev->wiphy.interface_modes;
 509         const struct ieee80211_txrx_stypes *mgmt_stypes =
 510                                 dev->wiphy.mgmt_stypes;
 511
 512         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 513         if (!hdr)
 514                 return -1;
 515
 516         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 517         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 518
 519         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 520                     cfg80211_rdev_list_generation);
 521
 522         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 523                    dev->wiphy.retry_short);
 524         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 525                    dev->wiphy.retry_long);
 526         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 527                     dev->wiphy.frag_threshold);
 528         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 529                     dev->wiphy.rts_threshold);
 530         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 531                     dev->wiphy.coverage_class);
 532         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 533                    dev->wiphy.max_scan_ssids);
 534         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 535                     dev->wiphy.max_scan_ie_len);
 536
 537         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 538                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 539
 540         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 541                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 542                 dev->wiphy.cipher_suites);
 543
 544         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 545                    dev->wiphy.max_num_pmkids);
 546
 547         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 548                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 549
 550         if (dev->ops->get_antenna) {
 551                 u32 tx_ant = 0, rx_ant = 0;
 552                 int res;
 553                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 554                 if (!res) {
 555                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 556                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 557                 }
 558         }
 559
 560         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 561         if (!nl_modes)
 562                 goto nla_put_failure;
 563
 564         i = 0;
 565         while (ifmodes) {
 566                 if (ifmodes & 1)
 567                         NLA_PUT_FLAG(msg, i);
 568                 ifmodes >>= 1;
 569                 i++;
 570         }
 571
 572         nla_nest_end(msg, nl_modes);
 573
 574         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 575         if (!nl_bands)
 576                 goto nla_put_failure;
 577
 578         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 579                 if (!dev->wiphy.bands[band])
 580                         continue;
 581
 582                 nl_band = nla_nest_start(msg, band);
 583                 if (!nl_band)
 584                         goto nla_put_failure;
 585
 586                 /* add HT info */
 587                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 588                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 589                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 590                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 591                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 592                                 dev->wiphy.bands[band]->ht_cap.cap);
 593                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 594                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 595                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 596                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 597                 }
 598
 599                 /* add frequencies */
 600                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 601                 if (!nl_freqs)
 602                         goto nla_put_failure;
 603
 604                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 605                         nl_freq = nla_nest_start(msg, i);
 606                         if (!nl_freq)
 607                                 goto nla_put_failure;
 608
 609                         chan = &dev->wiphy.bands[band]->channels[i];
 610
 611                         if (nl80211_msg_put_channel(msg, chan))
 612                                 goto nla_put_failure;
 613
 614                         nla_nest_end(msg, nl_freq);
 615                 }
 616
 617                 nla_nest_end(msg, nl_freqs);
 618
 619                 /* add bitrates */
 620                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 621                 if (!nl_rates)
 622                         goto nla_put_failure;
 623
 624                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 625                         nl_rate = nla_nest_start(msg, i);
 626                         if (!nl_rate)
 627                                 goto nla_put_failure;
 628
 629                         rate = &dev->wiphy.bands[band]->bitrates[i];
 630                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 631                                     rate->bitrate);
 632                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 633                                 NLA_PUT_FLAG(msg,
 634                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 635
 636                         nla_nest_end(msg, nl_rate);
 637                 }
 638
 639                 nla_nest_end(msg, nl_rates);
 640
 641                 nla_nest_end(msg, nl_band);
 642         }
 643         nla_nest_end(msg, nl_bands);
 644
 645         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 646         if (!nl_cmds)
 647                 goto nla_put_failure;
 648
 649         i = 0;
 650 #define CMD(op, n)                                              \
 651          do {                                                   \
 652                 if (dev->ops->op) {                             \
 653                         i++;                                    \
 654                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 655                 }                                               \
 656         } while (0)
 657
 658         CMD(add_virtual_intf, NEW_INTERFACE);
 659         CMD(change_virtual_intf, SET_INTERFACE);
 660         CMD(add_key, NEW_KEY);
 661         CMD(add_beacon, NEW_BEACON);
 662         CMD(add_station, NEW_STATION);
 663         CMD(add_mpath, NEW_MPATH);
 664         CMD(set_mesh_params, SET_MESH_PARAMS);
 665         CMD(change_bss, SET_BSS);
 666         CMD(auth, AUTHENTICATE);
 667         CMD(assoc, ASSOCIATE);
 668         CMD(deauth, DEAUTHENTICATE);
 669         CMD(disassoc, DISASSOCIATE);
 670         CMD(join_ibss, JOIN_IBSS);
 671         CMD(set_pmksa, SET_PMKSA);
 672         CMD(del_pmksa, DEL_PMKSA);
 673         CMD(flush_pmksa, FLUSH_PMKSA);
 674         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 675         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 676         CMD(mgmt_tx, FRAME);
 677         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 678         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 679                 i++;
 680                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 681         }
 682         CMD(set_channel, SET_CHANNEL);
 683         CMD(set_wds_peer, SET_WDS_PEER);
 684
 685 #undef CMD
 686
 687         if (dev->ops->connect || dev->ops->auth) {
 688                 i++;
 689                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 690         }
 691
 692         if (dev->ops->disconnect || dev->ops->deauth) {
 693                 i++;
 694                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 695         }
 696
 697         nla_nest_end(msg, nl_cmds);
 698
 699         /* for now at least assume all drivers have it */
 700         if (dev->ops->mgmt_tx)
 701                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 702
 703         if (mgmt_stypes) {
 704                 u16 stypes;
 705                 struct nlattr *nl_ftypes, *nl_ifs;
 706                 enum nl80211_iftype ift;
 707
 708                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 709                 if (!nl_ifs)
 710                         goto nla_put_failure;
 711
 712                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 713                         nl_ftypes = nla_nest_start(msg, ift);
 714                         if (!nl_ftypes)
 715                                 goto nla_put_failure;
 716                         i = 0;
 717                         stypes = mgmt_stypes[ift].tx;
 718                         while (stypes) {
 719                                 if (stypes & 1)
 720                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 721                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 722                                 stypes >>= 1;
 723                                 i++;
 724                         }
 725                         nla_nest_end(msg, nl_ftypes);
 726                 }
 727
 728                 nla_nest_end(msg, nl_ifs);
 729
 730                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 731                 if (!nl_ifs)
 732                         goto nla_put_failure;
 733
 734                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 735                         nl_ftypes = nla_nest_start(msg, ift);
 736                         if (!nl_ftypes)
 737                                 goto nla_put_failure;
 738                         i = 0;
 739                         stypes = mgmt_stypes[ift].rx;
 740                         while (stypes) {
 741                                 if (stypes & 1)
 742                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 743                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 744                                 stypes >>= 1;
 745                                 i++;
 746                         }
 747                         nla_nest_end(msg, nl_ftypes);
 748                 }
 749                 nla_nest_end(msg, nl_ifs);
 750         }
 751
 752         return genlmsg_end(msg, hdr);
 753
 754  nla_put_failure:
 755         genlmsg_cancel(msg, hdr);
 756         return -EMSGSIZE;
 757 }
 758
 759 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 760 {
 761         int idx = 0;
 762         int start = cb->args[0];
 763         struct cfg80211_registered_device *dev;
 764
 765         mutex_lock(&cfg80211_mutex);
 766         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 767                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 768                         continue;
 769                 if (++idx <= start)
 770                         continue;
 771                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 772                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 773                                        dev) < 0) {
 774                         idx--;
 775                         break;
 776                 }
 777         }
 778         mutex_unlock(&cfg80211_mutex);
 779
 780         cb->args[0] = idx;
 781
 782         return skb->len;
 783 }
 784
 785 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 786 {
 787         struct sk_buff *msg;
 788         struct cfg80211_registered_device *dev = info->user_ptr[0];
 789
 790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 791         if (!msg)
 792                 return -ENOMEM;
 793
 794         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
 795                 nlmsg_free(msg);
 796                 return -ENOBUFS;
 797         }
 798
 799         return genlmsg_reply(msg, info);
 800 }
 801
 802 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 803         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 804         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 805         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 806         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 807         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 808 };
 809
 810 static int parse_txq_params(struct nlattr *tb[],
 811                             struct ieee80211_txq_params *txq_params)
 812 {
 813         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 814             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 815             !tb[NL80211_TXQ_ATTR_AIFS])
 816                 return -EINVAL;
 817
 818         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 819         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 820         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 821         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 822         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 823
 824         return 0;
 825 }
 826
 827 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 828 {
 829         /*
 830          * You can only set the channel explicitly for AP, mesh
 831          * and WDS type interfaces; all others have their channel
 832          * managed via their respective "establish a connection"
 833          * command (connect, join, ...)
 834          *
 835          * Monitors are special as they are normally slaved to
 836          * whatever else is going on, so they behave as though
 837          * you tried setting the wiphy channel itself.
 838          */
 839         return !wdev ||
 840                 wdev->iftype == NL80211_IFTYPE_AP ||
 841                 wdev->iftype == NL80211_IFTYPE_WDS ||
 842                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 843                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
 844                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
 845 }
 846
 847 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 848                                  struct wireless_dev *wdev,
 849                                  struct genl_info *info)
 850 {
 851         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 852         u32 freq;
 853         int result;
 854
 855         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
 856                 return -EINVAL;
 857
 858         if (!nl80211_can_set_dev_channel(wdev))
 859                 return -EOPNOTSUPP;
 860
 861         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 862                 channel_type = nla_get_u32(info->attrs[
 863                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 864                 if (channel_type != NL80211_CHAN_NO_HT &&
 865                     channel_type != NL80211_CHAN_HT20 &&
 866                     channel_type != NL80211_CHAN_HT40PLUS &&
 867                     channel_type != NL80211_CHAN_HT40MINUS)
 868                         return -EINVAL;
 869         }
 870
 871         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 872
 873         mutex_lock(&rdev->devlist_mtx);
 874         if (wdev) {
 875                 wdev_lock(wdev);
 876                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
 877                 wdev_unlock(wdev);
 878         } else {
 879                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
 880         }
 881         mutex_unlock(&rdev->devlist_mtx);
 882
 883         return result;
 884 }
 885
 886 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 887 {
 888         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 889         struct net_device *netdev = info->user_ptr[1];
 890
 891         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 892 }
 893
 894 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
 895 {
 896         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 897         struct net_device *dev = info->user_ptr[1];
 898         struct wireless_dev *wdev = dev->ieee80211_ptr;
 899         const u8 *bssid;
 900
 901         if (!info->attrs[NL80211_ATTR_MAC])
 902                 return -EINVAL;
 903
 904         if (netif_running(dev))
 905                 return -EBUSY;
 906
 907         if (!rdev->ops->set_wds_peer)
 908                 return -EOPNOTSUPP;
 909
 910         if (wdev->iftype != NL80211_IFTYPE_WDS)
 911                 return -EOPNOTSUPP;
 912
 913         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 914         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
 915 }
 916
 917
 918 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 919 {
 920         struct cfg80211_registered_device *rdev;
 921         struct net_device *netdev = NULL;
 922         struct wireless_dev *wdev;
 923         int result = 0, rem_txq_params = 0;
 924         struct nlattr *nl_txq_params;
 925         u32 changed;
 926         u8 retry_short = 0, retry_long = 0;
 927         u32 frag_threshold = 0, rts_threshold = 0;
 928         u8 coverage_class = 0;
 929
 930         /*
 931          * Try to find the wiphy and netdev. Normally this
 932          * function shouldn't need the netdev, but this is
 933          * done for backward compatibility -- previously
 934          * setting the channel was done per wiphy, but now
 935          * it is per netdev. Previous userland like hostapd
 936          * also passed a netdev to set_wiphy, so that it is
 937          * possible to let that go to the right netdev!
 938          */
 939         mutex_lock(&cfg80211_mutex);
 940
 941         if (info->attrs[NL80211_ATTR_IFINDEX]) {
 942                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 943
 944                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
 945                 if (netdev && netdev->ieee80211_ptr) {
 946                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
 947                         mutex_lock(&rdev->mtx);
 948                 } else
 949                         netdev = NULL;
 950         }
 951
 952         if (!netdev) {
 953                 rdev = __cfg80211_rdev_from_info(info);
 954                 if (IS_ERR(rdev)) {
 955                         mutex_unlock(&cfg80211_mutex);
 956                         return PTR_ERR(rdev);
 957                 }
 958                 wdev = NULL;
 959                 netdev = NULL;
 960                 result = 0;
 961
 962                 mutex_lock(&rdev->mtx);
 963         } else if (netif_running(netdev) &&
 964                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
 965                 wdev = netdev->ieee80211_ptr;
 966         else
 967                 wdev = NULL;
 968
 969         /*
 970          * end workaround code, by now the rdev is available
 971          * and locked, and wdev may or may not be NULL.
 972          */
 973
 974         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 975                 result = cfg80211_dev_rename(
 976                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 977
 978         mutex_unlock(&cfg80211_mutex);
 979
 980         if (result)
 981                 goto bad_res;
 982
 983         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 984                 struct ieee80211_txq_params txq_params;
 985                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 986
 987                 if (!rdev->ops->set_txq_params) {
 988                         result = -EOPNOTSUPP;
 989                         goto bad_res;
 990                 }
 991
 992                 nla_for_each_nested(nl_txq_params,
 993                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 994                                     rem_txq_params) {
 995                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 996                                   nla_data(nl_txq_params),
 997                                   nla_len(nl_txq_params),
 998                                   txq_params_policy);
 999                         result = parse_txq_params(tb, &txq_params);
1000                         if (result)
1001                                 goto bad_res;
1002
1003                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1004                                                            &txq_params);
1005                         if (result)
1006                                 goto bad_res;
1007                 }
1008         }
1009
1010         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1011                 result = __nl80211_set_channel(rdev, wdev, info);
1012                 if (result)
1013                         goto bad_res;
1014         }
1015
1016         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1017                 enum nl80211_tx_power_setting type;
1018                 int idx, mbm = 0;
1019
1020                 if (!rdev->ops->set_tx_power) {
1021                         result = -EOPNOTSUPP;
1022                         goto bad_res;
1023                 }
1024
1025                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1026                 type = nla_get_u32(info->attrs[idx]);
1027
1028                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1029                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1030                         result = -EINVAL;
1031                         goto bad_res;
1032                 }
1033
1034                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1035                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1036                         mbm = nla_get_u32(info->attrs[idx]);
1037                 }
1038
1039                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1040                 if (result)
1041                         goto bad_res;
1042         }
1043
1044         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1045             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1046                 u32 tx_ant, rx_ant;
1047                 if (!rdev->ops->set_antenna) {
1048                         result = -EOPNOTSUPP;
1049                         goto bad_res;
1050                 }
1051
1052                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1053                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1054
1055                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1056                 if (result)
1057                         goto bad_res;
1058         }
1059
1060         changed = 0;
1061
1062         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1063                 retry_short = nla_get_u8(
1064                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1065                 if (retry_short == 0) {
1066                         result = -EINVAL;
1067                         goto bad_res;
1068                 }
1069                 changed |= WIPHY_PARAM_RETRY_SHORT;
1070         }
1071
1072         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1073                 retry_long = nla_get_u8(
1074                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1075                 if (retry_long == 0) {
1076                         result = -EINVAL;
1077                         goto bad_res;
1078                 }
1079                 changed |= WIPHY_PARAM_RETRY_LONG;
1080         }
1081
1082         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1083                 frag_threshold = nla_get_u32(
1084                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1085                 if (frag_threshold < 256) {
1086                         result = -EINVAL;
1087                         goto bad_res;
1088                 }
1089                 if (frag_threshold != (u32) -1) {
1090                         /*
1091                          * Fragments (apart from the last one) are required to
1092                          * have even length. Make the fragmentation code
1093                          * simpler by stripping LSB should someone try to use
1094                          * odd threshold value.
1095                          */
1096                         frag_threshold &= ~0x1;
1097                 }
1098                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1099         }
1100
1101         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1102                 rts_threshold = nla_get_u32(
1103                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1104                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1105         }
1106
1107         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1108                 coverage_class = nla_get_u8(
1109                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1110                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1111         }
1112
1113         if (changed) {
1114                 u8 old_retry_short, old_retry_long;
1115                 u32 old_frag_threshold, old_rts_threshold;
1116                 u8 old_coverage_class;
1117
1118                 if (!rdev->ops->set_wiphy_params) {
1119                         result = -EOPNOTSUPP;
1120                         goto bad_res;
1121                 }
1122
1123                 old_retry_short = rdev->wiphy.retry_short;
1124                 old_retry_long = rdev->wiphy.retry_long;
1125                 old_frag_threshold = rdev->wiphy.frag_threshold;
1126                 old_rts_threshold = rdev->wiphy.rts_threshold;
1127                 old_coverage_class = rdev->wiphy.coverage_class;
1128
1129                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1130                         rdev->wiphy.retry_short = retry_short;
1131                 if (changed & WIPHY_PARAM_RETRY_LONG)
1132                         rdev->wiphy.retry_long = retry_long;
1133                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1134                         rdev->wiphy.frag_threshold = frag_threshold;
1135                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1136                         rdev->wiphy.rts_threshold = rts_threshold;
1137                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1138                         rdev->wiphy.coverage_class = coverage_class;
1139
1140                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1141                 if (result) {
1142                         rdev->wiphy.retry_short = old_retry_short;
1143                         rdev->wiphy.retry_long = old_retry_long;
1144                         rdev->wiphy.frag_threshold = old_frag_threshold;
1145                         rdev->wiphy.rts_threshold = old_rts_threshold;
1146                         rdev->wiphy.coverage_class = old_coverage_class;
1147                 }
1148         }
1149
1150  bad_res:
1151         mutex_unlock(&rdev->mtx);
1152         if (netdev)
1153                 dev_put(netdev);
1154         return result;
1155 }
1156
1157
1158 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1159                               struct cfg80211_registered_device *rdev,
1160                               struct net_device *dev)
1161 {
1162         void *hdr;
1163
1164         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1165         if (!hdr)
1166                 return -1;
1167
1168         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1169         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1170         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1171         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1172
1173         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1174                     rdev->devlist_generation ^
1175                         (cfg80211_rdev_list_generation << 2));
1176
1177         return genlmsg_end(msg, hdr);
1178
1179  nla_put_failure:
1180         genlmsg_cancel(msg, hdr);
1181         return -EMSGSIZE;
1182 }
1183
1184 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1185 {
1186         int wp_idx = 0;
1187         int if_idx = 0;
1188         int wp_start = cb->args[0];
1189         int if_start = cb->args[1];
1190         struct cfg80211_registered_device *rdev;
1191         struct wireless_dev *wdev;
1192
1193         mutex_lock(&cfg80211_mutex);
1194         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1195                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1196                         continue;
1197                 if (wp_idx < wp_start) {
1198                         wp_idx++;
1199                         continue;
1200                 }
1201                 if_idx = 0;
1202
1203                 mutex_lock(&rdev->devlist_mtx);
1204                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1205                         if (if_idx < if_start) {
1206                                 if_idx++;
1207                                 continue;
1208                         }
1209                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1210                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1211                                                rdev, wdev->netdev) < 0) {
1212                                 mutex_unlock(&rdev->devlist_mtx);
1213                                 goto out;
1214                         }
1215                         if_idx++;
1216                 }
1217                 mutex_unlock(&rdev->devlist_mtx);
1218
1219                 wp_idx++;
1220         }
1221  out:
1222         mutex_unlock(&cfg80211_mutex);
1223
1224         cb->args[0] = wp_idx;
1225         cb->args[1] = if_idx;
1226
1227         return skb->len;
1228 }
1229
1230 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1231 {
1232         struct sk_buff *msg;
1233         struct cfg80211_registered_device *dev = info->user_ptr[0];
1234         struct net_device *netdev = info->user_ptr[1];
1235
1236         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1237         if (!msg)
1238                 return -ENOMEM;
1239
1240         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1241                                dev, netdev) < 0) {
1242                 nlmsg_free(msg);
1243                 return -ENOBUFS;
1244         }
1245
1246         return genlmsg_reply(msg, info);
1247 }
1248
1249 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1250         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1251         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1252         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1253         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1254         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1255 };
1256
1257 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1258 {
1259         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1260         int flag;
1261
1262         *mntrflags = 0;
1263
1264         if (!nla)
1265                 return -EINVAL;
1266
1267         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1268                              nla, mntr_flags_policy))
1269                 return -EINVAL;
1270
1271         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1272                 if (flags[flag])
1273                         *mntrflags |= (1<<flag);
1274
1275         return 0;
1276 }
1277
1278 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1279                                struct net_device *netdev, u8 use_4addr,
1280                                enum nl80211_iftype iftype)
1281 {
1282         if (!use_4addr) {
1283                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1284                         return -EBUSY;
1285                 return 0;
1286         }
1287
1288         switch (iftype) {
1289         case NL80211_IFTYPE_AP_VLAN:
1290                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1291                         return 0;
1292                 break;
1293         case NL80211_IFTYPE_STATION:
1294                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1295                         return 0;
1296                 break;
1297         default:
1298                 break;
1299         }
1300
1301         return -EOPNOTSUPP;
1302 }
1303
1304 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1305 {
1306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1307         struct vif_params params;
1308         int err;
1309         enum nl80211_iftype otype, ntype;
1310         struct net_device *dev = info->user_ptr[1];
1311         u32 _flags, *flags = NULL;
1312         bool change = false;
1313
1314         memset(&params, 0, sizeof(params));
1315
1316         otype = ntype = dev->ieee80211_ptr->iftype;
1317
1318         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1319                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1320                 if (otype != ntype)
1321                         change = true;
1322                 if (ntype > NL80211_IFTYPE_MAX)
1323                         return -EINVAL;
1324         }
1325
1326         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1327                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1328                         return -EINVAL;
1329                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1330                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1331                 change = true;
1332         }
1333
1334         if (info->attrs[NL80211_ATTR_4ADDR]) {
1335                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1336                 change = true;
1337                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1338                 if (err)
1339                         return err;
1340         } else {
1341                 params.use_4addr = -1;
1342         }
1343
1344         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1345                 if (ntype != NL80211_IFTYPE_MONITOR)
1346                         return -EINVAL;
1347                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1348                                           &_flags);
1349                 if (err)
1350                         return err;
1351
1352                 flags = &_flags;
1353                 change = true;
1354         }
1355
1356         if (change)
1357                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1358         else
1359                 err = 0;
1360
1361         if (!err && params.use_4addr != -1)
1362                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1363
1364         return err;
1365 }
1366
1367 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1368 {
1369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1370         struct vif_params params;
1371         struct net_device *dev;
1372         int err;
1373         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1374         u32 flags;
1375
1376         memset(&params, 0, sizeof(params));
1377
1378         if (!info->attrs[NL80211_ATTR_IFNAME])
1379                 return -EINVAL;
1380
1381         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1382                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1383                 if (type > NL80211_IFTYPE_MAX)
1384                         return -EINVAL;
1385         }
1386
1387         if (!rdev->ops->add_virtual_intf ||
1388             !(rdev->wiphy.interface_modes & (1 << type)))
1389                 return -EOPNOTSUPP;
1390
1391         if (type == NL80211_IFTYPE_MESH_POINT &&
1392             info->attrs[NL80211_ATTR_MESH_ID]) {
1393                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1394                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1395         }
1396
1397         if (info->attrs[NL80211_ATTR_4ADDR]) {
1398                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1399                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1400                 if (err)
1401                         return err;
1402         }
1403
1404         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1405                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1406                                   &flags);
1407         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1408                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1409                 type, err ? NULL : &flags, &params);
1410         if (IS_ERR(dev))
1411                 return PTR_ERR(dev);
1412
1413         return 0;
1414 }
1415
1416 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1417 {
1418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1419         struct net_device *dev = info->user_ptr[1];
1420
1421         if (!rdev->ops->del_virtual_intf)
1422                 return -EOPNOTSUPP;
1423
1424         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1425 }
1426
1427 struct get_key_cookie {
1428         struct sk_buff *msg;
1429         int error;
1430         int idx;
1431 };
1432
1433 static void get_key_callback(void *c, struct key_params *params)
1434 {
1435         struct nlattr *key;
1436         struct get_key_cookie *cookie = c;
1437
1438         if (params->key)
1439                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1440                         params->key_len, params->key);
1441
1442         if (params->seq)
1443                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1444                         params->seq_len, params->seq);
1445
1446         if (params->cipher)
1447                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1448                             params->cipher);
1449
1450         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1451         if (!key)
1452                 goto nla_put_failure;
1453
1454         if (params->key)
1455                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1456                         params->key_len, params->key);
1457
1458         if (params->seq)
1459                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1460                         params->seq_len, params->seq);
1461
1462         if (params->cipher)
1463                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1464                             params->cipher);
1465
1466         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1467
1468         nla_nest_end(cookie->msg, key);
1469
1470         return;
1471  nla_put_failure:
1472         cookie->error = 1;
1473 }
1474
1475 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1476 {
1477         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1478         int err;
1479         struct net_device *dev = info->user_ptr[1];
1480         u8 key_idx = 0;
1481         const u8 *mac_addr = NULL;
1482         bool pairwise;
1483         struct get_key_cookie cookie = {
1484                 .error = 0,
1485         };
1486         void *hdr;
1487         struct sk_buff *msg;
1488
1489         if (info->attrs[NL80211_ATTR_KEY_IDX])
1490                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1491
1492         if (key_idx > 5)
1493                 return -EINVAL;
1494
1495         if (info->attrs[NL80211_ATTR_MAC])
1496                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1497
1498         pairwise = !!mac_addr;
1499         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1500                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1501                 if (kt >= NUM_NL80211_KEYTYPES)
1502                         return -EINVAL;
1503                 if (kt != NL80211_KEYTYPE_GROUP &&
1504                     kt != NL80211_KEYTYPE_PAIRWISE)
1505                         return -EINVAL;
1506                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1507         }
1508
1509         if (!rdev->ops->get_key)
1510                 return -EOPNOTSUPP;
1511
1512         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1513         if (!msg)
1514                 return -ENOMEM;
1515
1516         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1517                              NL80211_CMD_NEW_KEY);
1518         if (IS_ERR(hdr))
1519                 return PTR_ERR(hdr);
1520
1521         cookie.msg = msg;
1522         cookie.idx = key_idx;
1523
1524         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1525         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1526         if (mac_addr)
1527                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1528
1529         if (pairwise && mac_addr &&
1530             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1531                 return -ENOENT;
1532
1533         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1534                                  mac_addr, &cookie, get_key_callback);
1535
1536         if (err)
1537                 goto free_msg;
1538
1539         if (cookie.error)
1540                 goto nla_put_failure;
1541
1542         genlmsg_end(msg, hdr);
1543         return genlmsg_reply(msg, info);
1544
1545  nla_put_failure:
1546         err = -ENOBUFS;
1547  free_msg:
1548         nlmsg_free(msg);
1549         return err;
1550 }
1551
1552 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1553 {
1554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1555         struct key_parse key;
1556         int err;
1557         struct net_device *dev = info->user_ptr[1];
1558         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1559                     u8 key_index);
1560
1561         err = nl80211_parse_key(info, &key);
1562         if (err)
1563                 return err;
1564
1565         if (key.idx < 0)
1566                 return -EINVAL;
1567
1568         /* only support setting default key */
1569         if (!key.def && !key.defmgmt)
1570                 return -EINVAL;
1571
1572         if (key.def)
1573                 func = rdev->ops->set_default_key;
1574         else
1575                 func = rdev->ops->set_default_mgmt_key;
1576
1577         if (!func)
1578                 return -EOPNOTSUPP;
1579
1580         wdev_lock(dev->ieee80211_ptr);
1581         err = nl80211_key_allowed(dev->ieee80211_ptr);
1582         if (!err)
1583                 err = func(&rdev->wiphy, dev, key.idx);
1584
1585 #ifdef CONFIG_CFG80211_WEXT
1586         if (!err) {
1587                 if (func == rdev->ops->set_default_key)
1588                         dev->ieee80211_ptr->wext.default_key = key.idx;
1589                 else
1590                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1591         }
1592 #endif
1593         wdev_unlock(dev->ieee80211_ptr);
1594
1595         return err;
1596 }
1597
1598 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1599 {
1600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1601         int err;
1602         struct net_device *dev = info->user_ptr[1];
1603         struct key_parse key;
1604         const u8 *mac_addr = NULL;
1605
1606         err = nl80211_parse_key(info, &key);
1607         if (err)
1608                 return err;
1609
1610         if (!key.p.key)
1611                 return -EINVAL;
1612
1613         if (info->attrs[NL80211_ATTR_MAC])
1614                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1615
1616         if (key.type == -1) {
1617                 if (mac_addr)
1618                         key.type = NL80211_KEYTYPE_PAIRWISE;
1619                 else
1620                         key.type = NL80211_KEYTYPE_GROUP;
1621         }
1622
1623         /* for now */
1624         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1625             key.type != NL80211_KEYTYPE_GROUP)
1626                 return -EINVAL;
1627
1628         if (!rdev->ops->add_key)
1629                 return -EOPNOTSUPP;
1630
1631         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1632                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1633                                            mac_addr))
1634                 return -EINVAL;
1635
1636         wdev_lock(dev->ieee80211_ptr);
1637         err = nl80211_key_allowed(dev->ieee80211_ptr);
1638         if (!err)
1639                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1640                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1641                                          mac_addr, &key.p);
1642         wdev_unlock(dev->ieee80211_ptr);
1643
1644         return err;
1645 }
1646
1647 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1648 {
1649         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1650         int err;
1651         struct net_device *dev = info->user_ptr[1];
1652         u8 *mac_addr = NULL;
1653         struct key_parse key;
1654
1655         err = nl80211_parse_key(info, &key);
1656         if (err)
1657                 return err;
1658
1659         if (info->attrs[NL80211_ATTR_MAC])
1660                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1661
1662         if (key.type == -1) {
1663                 if (mac_addr)
1664                         key.type = NL80211_KEYTYPE_PAIRWISE;
1665                 else
1666                         key.type = NL80211_KEYTYPE_GROUP;
1667         }
1668
1669         /* for now */
1670         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1671             key.type != NL80211_KEYTYPE_GROUP)
1672                 return -EINVAL;
1673
1674         if (!rdev->ops->del_key)
1675                 return -EOPNOTSUPP;
1676
1677         wdev_lock(dev->ieee80211_ptr);
1678         err = nl80211_key_allowed(dev->ieee80211_ptr);
1679
1680         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1681             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1682                 err = -ENOENT;
1683
1684         if (!err)
1685                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1686                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1687                                          mac_addr);
1688
1689 #ifdef CONFIG_CFG80211_WEXT
1690         if (!err) {
1691                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1692                         dev->ieee80211_ptr->wext.default_key = -1;
1693                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1694                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1695         }
1696 #endif
1697         wdev_unlock(dev->ieee80211_ptr);
1698
1699         return err;
1700 }
1701
1702 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1703 {
1704         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1705                     struct beacon_parameters *info);
1706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1707         struct net_device *dev = info->user_ptr[1];
1708         struct beacon_parameters params;
1709         int haveinfo = 0;
1710
1711         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1712                 return -EINVAL;
1713
1714         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1715             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1716                 return -EOPNOTSUPP;
1717
1718         switch (info->genlhdr->cmd) {
1719         case NL80211_CMD_NEW_BEACON:
1720                 /* these are required for NEW_BEACON */
1721                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1722                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1723                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1724                         return -EINVAL;
1725
1726                 call = rdev->ops->add_beacon;
1727                 break;
1728         case NL80211_CMD_SET_BEACON:
1729                 call = rdev->ops->set_beacon;
1730                 break;
1731         default:
1732                 WARN_ON(1);
1733                 return -EOPNOTSUPP;
1734         }
1735
1736         if (!call)
1737                 return -EOPNOTSUPP;
1738
1739         memset(&params, 0, sizeof(params));
1740
1741         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1742                 params.interval =
1743                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1744                 haveinfo = 1;
1745         }
1746
1747         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1748                 params.dtim_period =
1749                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1750                 haveinfo = 1;
1751         }
1752
1753         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1754                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1755                 params.head_len =
1756                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1757                 haveinfo = 1;
1758         }
1759
1760         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1761                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1762                 params.tail_len =
1763                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1764                 haveinfo = 1;
1765         }
1766
1767         if (!haveinfo)
1768                 return -EINVAL;
1769
1770         return call(&rdev->wiphy, dev, &params);
1771 }
1772
1773 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1774 {
1775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1776         struct net_device *dev = info->user_ptr[1];
1777
1778         if (!rdev->ops->del_beacon)
1779                 return -EOPNOTSUPP;
1780
1781         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1782             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1783                 return -EOPNOTSUPP;
1784
1785         return rdev->ops->del_beacon(&rdev->wiphy, dev);
1786 }
1787
1788 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1789         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1790         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1791         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1792         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1793 };
1794
1795 static int parse_station_flags(struct genl_info *info,
1796                                struct station_parameters *params)
1797 {
1798         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1799         struct nlattr *nla;
1800         int flag;
1801
1802         /*
1803          * Try parsing the new attribute first so userspace
1804          * can specify both for older kernels.
1805          */
1806         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1807         if (nla) {
1808                 struct nl80211_sta_flag_update *sta_flags;
1809
1810                 sta_flags = nla_data(nla);
1811                 params->sta_flags_mask = sta_flags->mask;
1812                 params->sta_flags_set = sta_flags->set;
1813                 if ((params->sta_flags_mask |
1814                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1815                         return -EINVAL;
1816                 return 0;
1817         }
1818
1819         /* if present, parse the old attribute */
1820
1821         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1822         if (!nla)
1823                 return 0;
1824
1825         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1826                              nla, sta_flags_policy))
1827                 return -EINVAL;
1828
1829         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1830         params->sta_flags_mask &= ~1;
1831
1832         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1833                 if (flags[flag])
1834                         params->sta_flags_set |= (1<<flag);
1835
1836         return 0;
1837 }
1838
1839 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1840                                 int flags, struct net_device *dev,
1841                                 const u8 *mac_addr, struct station_info *sinfo)
1842 {
1843         void *hdr;
1844         struct nlattr *sinfoattr, *txrate;
1845         u16 bitrate;
1846
1847         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1848         if (!hdr)
1849                 return -1;
1850
1851         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1852         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1853
1854         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1855
1856         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1857         if (!sinfoattr)
1858                 goto nla_put_failure;
1859         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1860                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1861                             sinfo->inactive_time);
1862         if (sinfo->filled & STATION_INFO_RX_BYTES)
1863                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1864                             sinfo->rx_bytes);
1865         if (sinfo->filled & STATION_INFO_TX_BYTES)
1866                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1867                             sinfo->tx_bytes);
1868         if (sinfo->filled & STATION_INFO_LLID)
1869                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1870                             sinfo->llid);
1871         if (sinfo->filled & STATION_INFO_PLID)
1872                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1873                             sinfo->plid);
1874         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1875                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1876                             sinfo->plink_state);
1877         if (sinfo->filled & STATION_INFO_SIGNAL)
1878                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1879                            sinfo->signal);
1880         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1881                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1882                 if (!txrate)
1883                         goto nla_put_failure;
1884
1885                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1886                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1887                 if (bitrate > 0)
1888                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1889
1890                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1891                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1892                                     sinfo->txrate.mcs);
1893                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1894                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1895                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1896                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1897
1898                 nla_nest_end(msg, txrate);
1899         }
1900         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1901                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1902                             sinfo->rx_packets);
1903         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1904                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1905                             sinfo->tx_packets);
1906         if (sinfo->filled & STATION_INFO_TX_RETRIES)
1907                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
1908                             sinfo->tx_retries);
1909         if (sinfo->filled & STATION_INFO_TX_FAILED)
1910                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
1911                             sinfo->tx_failed);
1912         nla_nest_end(msg, sinfoattr);
1913
1914         return genlmsg_end(msg, hdr);
1915
1916  nla_put_failure:
1917         genlmsg_cancel(msg, hdr);
1918         return -EMSGSIZE;
1919 }
1920
1921 static int nl80211_dump_station(struct sk_buff *skb,
1922                                 struct netlink_callback *cb)
1923 {
1924         struct station_info sinfo;
1925         struct cfg80211_registered_device *dev;
1926         struct net_device *netdev;
1927         u8 mac_addr[ETH_ALEN];
1928         int sta_idx = cb->args[1];
1929         int err;
1930
1931         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
1932         if (err)
1933                 return err;
1934
1935         if (!dev->ops->dump_station) {
1936                 err = -EOPNOTSUPP;
1937                 goto out_err;
1938         }
1939
1940         while (1) {
1941                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1942                                              mac_addr, &sinfo);
1943                 if (err == -ENOENT)
1944                         break;
1945                 if (err)
1946                         goto out_err;
1947
1948                 if (nl80211_send_station(skb,
1949                                 NETLINK_CB(cb->skb).pid,
1950                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1951                                 netdev, mac_addr,
1952                                 &sinfo) < 0)
1953                         goto out;
1954
1955                 sta_idx++;
1956         }
1957
1958
1959  out:
1960         cb->args[1] = sta_idx;
1961         err = skb->len;
1962  out_err:
1963         nl80211_finish_netdev_dump(dev);
1964
1965         return err;
1966 }
1967
1968 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1969 {
1970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1971         struct net_device *dev = info->user_ptr[1];
1972         struct station_info sinfo;
1973         struct sk_buff *msg;
1974         u8 *mac_addr = NULL;
1975         int err;
1976
1977         memset(&sinfo, 0, sizeof(sinfo));
1978
1979         if (!info->attrs[NL80211_ATTR_MAC])
1980                 return -EINVAL;
1981
1982         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1983
1984         if (!rdev->ops->get_station)
1985                 return -EOPNOTSUPP;
1986
1987         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1988         if (err)
1989                 return err;
1990
1991         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1992         if (!msg)
1993                 return -ENOMEM;
1994
1995         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1996                                  dev, mac_addr, &sinfo) < 0) {
1997                 nlmsg_free(msg);
1998                 return -ENOBUFS;
1999         }
2000
2001         return genlmsg_reply(msg, info);
2002 }
2003
2004 /*
2005  * Get vlan interface making sure it is running and on the right wiphy.
2006  */
2007 static int get_vlan(struct genl_info *info,
2008                     struct cfg80211_registered_device *rdev,
2009                     struct net_device **vlan)
2010 {
2011         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2012         *vlan = NULL;
2013
2014         if (vlanattr) {
2015                 *vlan = dev_get_by_index(genl_info_net(info),
2016                                          nla_get_u32(vlanattr));
2017                 if (!*vlan)
2018                         return -ENODEV;
2019                 if (!(*vlan)->ieee80211_ptr)
2020                         return -EINVAL;
2021                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2022                         return -EINVAL;
2023                 if (!netif_running(*vlan))
2024                         return -ENETDOWN;
2025         }
2026         return 0;
2027 }
2028
2029 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2030 {
2031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2032         int err;
2033         struct net_device *dev = info->user_ptr[1];
2034         struct station_parameters params;
2035         u8 *mac_addr = NULL;
2036
2037         memset(&params, 0, sizeof(params));
2038
2039         params.listen_interval = -1;
2040
2041         if (info->attrs[NL80211_ATTR_STA_AID])
2042                 return -EINVAL;
2043
2044         if (!info->attrs[NL80211_ATTR_MAC])
2045                 return -EINVAL;
2046
2047         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2048
2049         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2050                 params.supported_rates =
2051                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2052                 params.supported_rates_len =
2053                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2054         }
2055
2056         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2057                 params.listen_interval =
2058                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2059
2060         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2061                 params.ht_capa =
2062                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2063
2064         if (parse_station_flags(info, &params))
2065                 return -EINVAL;
2066
2067         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2068                 params.plink_action =
2069                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2070
2071         err = get_vlan(info, rdev, &params.vlan);
2072         if (err)
2073                 goto out;
2074
2075         /* validate settings */
2076         err = 0;
2077
2078         switch (dev->ieee80211_ptr->iftype) {
2079         case NL80211_IFTYPE_AP:
2080         case NL80211_IFTYPE_AP_VLAN:
2081         case NL80211_IFTYPE_P2P_GO:
2082                 /* disallow mesh-specific things */
2083                 if (params.plink_action)
2084                         err = -EINVAL;
2085                 break;
2086         case NL80211_IFTYPE_P2P_CLIENT:
2087         case NL80211_IFTYPE_STATION:
2088                 /* disallow everything but AUTHORIZED flag */
2089                 if (params.plink_action)
2090                         err = -EINVAL;
2091                 if (params.vlan)
2092                         err = -EINVAL;
2093                 if (params.supported_rates)
2094                         err = -EINVAL;
2095                 if (params.ht_capa)
2096                         err = -EINVAL;
2097                 if (params.listen_interval >= 0)
2098                         err = -EINVAL;
2099                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2100                         err = -EINVAL;
2101                 break;
2102         case NL80211_IFTYPE_MESH_POINT:
2103                 /* disallow things mesh doesn't support */
2104                 if (params.vlan)
2105                         err = -EINVAL;
2106                 if (params.ht_capa)
2107                         err = -EINVAL;
2108                 if (params.listen_interval >= 0)
2109                         err = -EINVAL;
2110                 if (params.supported_rates)
2111                         err = -EINVAL;
2112                 if (params.sta_flags_mask)
2113                         err = -EINVAL;
2114                 break;
2115         default:
2116                 err = -EINVAL;
2117         }
2118
2119         if (err)
2120                 goto out;
2121
2122         if (!rdev->ops->change_station) {
2123                 err = -EOPNOTSUPP;
2124                 goto out;
2125         }
2126
2127         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2128
2129  out:
2130         if (params.vlan)
2131                 dev_put(params.vlan);
2132
2133         return err;
2134 }
2135
2136 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2137 {
2138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2139         int err;
2140         struct net_device *dev = info->user_ptr[1];
2141         struct station_parameters params;
2142         u8 *mac_addr = NULL;
2143
2144         memset(&params, 0, sizeof(params));
2145
2146         if (!info->attrs[NL80211_ATTR_MAC])
2147                 return -EINVAL;
2148
2149         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2150                 return -EINVAL;
2151
2152         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2153                 return -EINVAL;
2154
2155         if (!info->attrs[NL80211_ATTR_STA_AID])
2156                 return -EINVAL;
2157
2158         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2159         params.supported_rates =
2160                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2161         params.supported_rates_len =
2162                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2163         params.listen_interval =
2164                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2165
2166         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2167         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2168                 return -EINVAL;
2169
2170         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2171                 params.ht_capa =
2172                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2173
2174         if (parse_station_flags(info, &params))
2175                 return -EINVAL;
2176
2177         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2178             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2179             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2180                 return -EINVAL;
2181
2182         err = get_vlan(info, rdev, &params.vlan);
2183         if (err)
2184                 goto out;
2185
2186         /* validate settings */
2187         err = 0;
2188
2189         if (!rdev->ops->add_station) {
2190                 err = -EOPNOTSUPP;
2191                 goto out;
2192         }
2193
2194         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2195
2196  out:
2197         if (params.vlan)
2198                 dev_put(params.vlan);
2199         return err;
2200 }
2201
2202 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2203 {
2204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2205         struct net_device *dev = info->user_ptr[1];
2206         u8 *mac_addr = NULL;
2207
2208         if (info->attrs[NL80211_ATTR_MAC])
2209                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2210
2211         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2212             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2213             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2214             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2215                 return -EINVAL;
2216
2217         if (!rdev->ops->del_station)
2218                 return -EOPNOTSUPP;
2219
2220         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2221 }
2222
2223 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2224                                 int flags, struct net_device *dev,
2225                                 u8 *dst, u8 *next_hop,
2226                                 struct mpath_info *pinfo)
2227 {
2228         void *hdr;
2229         struct nlattr *pinfoattr;
2230
2231         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2232         if (!hdr)
2233                 return -1;
2234
2235         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2236         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2237         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2238
2239         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2240
2241         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2242         if (!pinfoattr)
2243                 goto nla_put_failure;
2244         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2245                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2246                             pinfo->frame_qlen);
2247         if (pinfo->filled & MPATH_INFO_SN)
2248                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2249                             pinfo->sn);
2250         if (pinfo->filled & MPATH_INFO_METRIC)
2251                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2252                             pinfo->metric);
2253         if (pinfo->filled & MPATH_INFO_EXPTIME)
2254                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2255                             pinfo->exptime);
2256         if (pinfo->filled & MPATH_INFO_FLAGS)
2257                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2258                             pinfo->flags);
2259         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2260                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2261                             pinfo->discovery_timeout);
2262         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2263                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2264                             pinfo->discovery_retries);
2265
2266         nla_nest_end(msg, pinfoattr);
2267
2268         return genlmsg_end(msg, hdr);
2269
2270  nla_put_failure:
2271         genlmsg_cancel(msg, hdr);
2272         return -EMSGSIZE;
2273 }
2274
2275 static int nl80211_dump_mpath(struct sk_buff *skb,
2276                               struct netlink_callback *cb)
2277 {
2278         struct mpath_info pinfo;
2279         struct cfg80211_registered_device *dev;
2280         struct net_device *netdev;
2281         u8 dst[ETH_ALEN];
2282         u8 next_hop[ETH_ALEN];
2283         int path_idx = cb->args[1];
2284         int err;
2285
2286         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2287         if (err)
2288                 return err;
2289
2290         if (!dev->ops->dump_mpath) {
2291                 err = -EOPNOTSUPP;
2292                 goto out_err;
2293         }
2294
2295         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2296                 err = -EOPNOTSUPP;
2297                 goto out_err;
2298         }
2299
2300         while (1) {
2301                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2302                                            dst, next_hop, &pinfo);
2303                 if (err == -ENOENT)
2304                         break;
2305                 if (err)
2306                         goto out_err;
2307
2308                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2309                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2310                                        netdev, dst, next_hop,
2311                                        &pinfo) < 0)
2312                         goto out;
2313
2314                 path_idx++;
2315         }
2316
2317
2318  out:
2319         cb->args[1] = path_idx;
2320         err = skb->len;
2321  out_err:
2322         nl80211_finish_netdev_dump(dev);
2323         return err;
2324 }
2325
2326 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2327 {
2328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2329         int err;
2330         struct net_device *dev = info->user_ptr[1];
2331         struct mpath_info pinfo;
2332         struct sk_buff *msg;
2333         u8 *dst = NULL;
2334         u8 next_hop[ETH_ALEN];
2335
2336         memset(&pinfo, 0, sizeof(pinfo));
2337
2338         if (!info->attrs[NL80211_ATTR_MAC])
2339                 return -EINVAL;
2340
2341         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2342
2343         if (!rdev->ops->get_mpath)
2344                 return -EOPNOTSUPP;
2345
2346         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2347                 return -EOPNOTSUPP;
2348
2349         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2350         if (err)
2351                 return err;
2352
2353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2354         if (!msg)
2355                 return -ENOMEM;
2356
2357         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2358                                  dev, dst, next_hop, &pinfo) < 0) {
2359                 nlmsg_free(msg);
2360                 return -ENOBUFS;
2361         }
2362
2363         return genlmsg_reply(msg, info);
2364 }
2365
2366 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2367 {
2368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2369         struct net_device *dev = info->user_ptr[1];
2370         u8 *dst = NULL;
2371         u8 *next_hop = NULL;
2372
2373         if (!info->attrs[NL80211_ATTR_MAC])
2374                 return -EINVAL;
2375
2376         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2377                 return -EINVAL;
2378
2379         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2380         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2381
2382         if (!rdev->ops->change_mpath)
2383                 return -EOPNOTSUPP;
2384
2385         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2386                 return -EOPNOTSUPP;
2387
2388         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2389 }
2390
2391 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2392 {
2393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2394         struct net_device *dev = info->user_ptr[1];
2395         u8 *dst = NULL;
2396         u8 *next_hop = NULL;
2397
2398         if (!info->attrs[NL80211_ATTR_MAC])
2399                 return -EINVAL;
2400
2401         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2402                 return -EINVAL;
2403
2404         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2405         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2406
2407         if (!rdev->ops->add_mpath)
2408                 return -EOPNOTSUPP;
2409
2410         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2411                 return -EOPNOTSUPP;
2412
2413         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2414 }
2415
2416 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2417 {
2418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2419         struct net_device *dev = info->user_ptr[1];
2420         u8 *dst = NULL;
2421
2422         if (info->attrs[NL80211_ATTR_MAC])
2423                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2424
2425         if (!rdev->ops->del_mpath)
2426                 return -EOPNOTSUPP;
2427
2428         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2429 }
2430
2431 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2432 {
2433         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2434         struct net_device *dev = info->user_ptr[1];
2435         struct bss_parameters params;
2436
2437         memset(&params, 0, sizeof(params));
2438         /* default to not changing parameters */
2439         params.use_cts_prot = -1;
2440         params.use_short_preamble = -1;
2441         params.use_short_slot_time = -1;
2442         params.ap_isolate = -1;
2443
2444         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2445                 params.use_cts_prot =
2446                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2447         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2448                 params.use_short_preamble =
2449                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2450         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2451                 params.use_short_slot_time =
2452                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2453         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2454                 params.basic_rates =
2455                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2456                 params.basic_rates_len =
2457                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2458         }
2459         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2460                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2461
2462         if (!rdev->ops->change_bss)
2463                 return -EOPNOTSUPP;
2464
2465         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2466             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2467                 return -EOPNOTSUPP;
2468
2469         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2470 }
2471
2472 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2473         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2474         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2475         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2476         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2477         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2478         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2479 };
2480
2481 static int parse_reg_rule(struct nlattr *tb[],
2482         struct ieee80211_reg_rule *reg_rule)
2483 {
2484         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2485         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2486
2487         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2488                 return -EINVAL;
2489         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2490                 return -EINVAL;
2491         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2492                 return -EINVAL;
2493         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2494                 return -EINVAL;
2495         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2496                 return -EINVAL;
2497
2498         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2499
2500         freq_range->start_freq_khz =
2501                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2502         freq_range->end_freq_khz =
2503                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2504         freq_range->max_bandwidth_khz =
2505                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2506
2507         power_rule->max_eirp =
2508                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2509
2510         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2511                 power_rule->max_antenna_gain =
2512                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2513
2514         return 0;
2515 }
2516
2517 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2518 {
2519         int r;
2520         char *data = NULL;
2521
2522         /*
2523          * You should only get this when cfg80211 hasn't yet initialized
2524          * completely when built-in to the kernel right between the time
2525          * window between nl80211_init() and regulatory_init(), if that is
2526          * even possible.
2527          */
2528         mutex_lock(&cfg80211_mutex);
2529         if (unlikely(!cfg80211_regdomain)) {
2530                 mutex_unlock(&cfg80211_mutex);
2531                 return -EINPROGRESS;
2532         }
2533         mutex_unlock(&cfg80211_mutex);
2534
2535         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2536                 return -EINVAL;
2537
2538         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2539
2540         r = regulatory_hint_user(data);
2541
2542         return r;
2543 }
2544
2545 static int nl80211_get_mesh_params(struct sk_buff *skb,
2546         struct genl_info *info)
2547 {
2548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2549         struct mesh_config cur_params;
2550         int err;
2551         struct net_device *dev = info->user_ptr[1];
2552         void *hdr;
2553         struct nlattr *pinfoattr;
2554         struct sk_buff *msg;
2555
2556         if (!rdev->ops->get_mesh_params)
2557                 return -EOPNOTSUPP;
2558
2559         /* Get the mesh params */
2560         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2561         if (err)
2562                 return err;
2563
2564         /* Draw up a netlink message to send back */
2565         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2566         if (!msg)
2567                 return -ENOMEM;
2568         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2569                              NL80211_CMD_GET_MESH_PARAMS);
2570         if (!hdr)
2571                 goto nla_put_failure;
2572         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2573         if (!pinfoattr)
2574                 goto nla_put_failure;
2575         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2576         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2577                         cur_params.dot11MeshRetryTimeout);
2578         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2579                         cur_params.dot11MeshConfirmTimeout);
2580         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2581                         cur_params.dot11MeshHoldingTimeout);
2582         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2583                         cur_params.dot11MeshMaxPeerLinks);
2584         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2585                         cur_params.dot11MeshMaxRetries);
2586         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2587                         cur_params.dot11MeshTTL);
2588         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
2589                         cur_params.element_ttl);
2590         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2591                         cur_params.auto_open_plinks);
2592         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2593                         cur_params.dot11MeshHWMPmaxPREQretries);
2594         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2595                         cur_params.path_refresh_time);
2596         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2597                         cur_params.min_discovery_timeout);
2598         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2599                         cur_params.dot11MeshHWMPactivePathTimeout);
2600         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2601                         cur_params.dot11MeshHWMPpreqMinInterval);
2602         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2603                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2604         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2605                         cur_params.dot11MeshHWMPRootMode);
2606         nla_nest_end(msg, pinfoattr);
2607         genlmsg_end(msg, hdr);
2608         return genlmsg_reply(msg, info);
2609
2610  nla_put_failure:
2611         genlmsg_cancel(msg, hdr);
2612         nlmsg_free(msg);
2613         return -ENOBUFS;
2614 }
2615
2616 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2617         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2618         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2619         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2620         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2621         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2622         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2623         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
2624         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2625
2626         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2627         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2628         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2629         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2630         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2631         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2632 };
2633
2634 static int nl80211_parse_mesh_params(struct genl_info *info,
2635                                      struct mesh_config *cfg,
2636                                      u32 *mask_out)
2637 {
2638         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2639         u32 mask = 0;
2640
2641 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2642 do {\
2643         if (table[attr_num]) {\
2644                 cfg->param = nla_fn(table[attr_num]); \
2645                 mask |= (1 << (attr_num - 1)); \
2646         } \
2647 } while (0);\
2648
2649
2650         if (!info->attrs[NL80211_ATTR_MESH_PARAMS])
2651                 return -EINVAL;
2652         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2653                              info->attrs[NL80211_ATTR_MESH_PARAMS],
2654                              nl80211_meshconf_params_policy))
2655                 return -EINVAL;
2656
2657         /* This makes sure that there aren't more than 32 mesh config
2658          * parameters (otherwise our bitfield scheme would not work.) */
2659         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2660
2661         /* Fill in the params struct */
2662         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2663                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2664         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2665                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2666         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2667                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2668         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2669                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2670         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2671                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2672         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2673                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2674         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
2675                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
2676         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2677                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2678         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2679                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2680                         nla_get_u8);
2681         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2682                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2683         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2684                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2685                         nla_get_u16);
2686         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2687                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2688                         nla_get_u32);
2689         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2690                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2691                         nla_get_u16);
2692         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2693                         dot11MeshHWMPnetDiameterTraversalTime,
2694                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2695                         nla_get_u16);
2696         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2697                         dot11MeshHWMPRootMode, mask,
2698                         NL80211_MESHCONF_HWMP_ROOTMODE,
2699                         nla_get_u8);
2700
2701         if (mask_out)
2702                 *mask_out = mask;
2703         return 0;
2704
2705 #undef FILL_IN_MESH_PARAM_IF_SET
2706 }
2707
2708 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2709 {
2710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2711         struct net_device *dev = info->user_ptr[1];
2712         struct mesh_config cfg;
2713         u32 mask;
2714         int err;
2715
2716         if (!rdev->ops->set_mesh_params)
2717                 return -EOPNOTSUPP;
2718
2719         err = nl80211_parse_mesh_params(info, &cfg, &mask);
2720         if (err)
2721                 return err;
2722
2723         /* Apply changes */
2724         return rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2725 }
2726
2727 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2728 {
2729         struct sk_buff *msg;
2730         void *hdr = NULL;
2731         struct nlattr *nl_reg_rules;
2732         unsigned int i;
2733         int err = -EINVAL;
2734
2735         mutex_lock(&cfg80211_mutex);
2736
2737         if (!cfg80211_regdomain)
2738                 goto out;
2739
2740         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2741         if (!msg) {
2742                 err = -ENOBUFS;
2743                 goto out;
2744         }
2745
2746         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2747                              NL80211_CMD_GET_REG);
2748         if (!hdr)
2749                 goto nla_put_failure;
2750
2751         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2752                 cfg80211_regdomain->alpha2);
2753
2754         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2755         if (!nl_reg_rules)
2756                 goto nla_put_failure;
2757
2758         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2759                 struct nlattr *nl_reg_rule;
2760                 const struct ieee80211_reg_rule *reg_rule;
2761                 const struct ieee80211_freq_range *freq_range;
2762                 const struct ieee80211_power_rule *power_rule;
2763
2764                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2765                 freq_range = &reg_rule->freq_range;
2766                 power_rule = &reg_rule->power_rule;
2767
2768                 nl_reg_rule = nla_nest_start(msg, i);
2769                 if (!nl_reg_rule)
2770                         goto nla_put_failure;
2771
2772                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2773                         reg_rule->flags);
2774                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2775                         freq_range->start_freq_khz);
2776                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2777                         freq_range->end_freq_khz);
2778                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2779                         freq_range->max_bandwidth_khz);
2780                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2781                         power_rule->max_antenna_gain);
2782                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2783                         power_rule->max_eirp);
2784
2785                 nla_nest_end(msg, nl_reg_rule);
2786         }
2787
2788         nla_nest_end(msg, nl_reg_rules);
2789
2790         genlmsg_end(msg, hdr);
2791         err = genlmsg_reply(msg, info);
2792         goto out;
2793
2794 nla_put_failure:
2795         genlmsg_cancel(msg, hdr);
2796         nlmsg_free(msg);
2797         err = -EMSGSIZE;
2798 out:
2799         mutex_unlock(&cfg80211_mutex);
2800         return err;
2801 }
2802
2803 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2804 {
2805         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2806         struct nlattr *nl_reg_rule;
2807         char *alpha2 = NULL;
2808         int rem_reg_rules = 0, r = 0;
2809         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2810         struct ieee80211_regdomain *rd = NULL;
2811
2812         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2813                 return -EINVAL;
2814
2815         if (!info->attrs[NL80211_ATTR_REG_RULES])
2816                 return -EINVAL;
2817
2818         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2819
2820         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2821                         rem_reg_rules) {
2822                 num_rules++;
2823                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2824                         return -EINVAL;
2825         }
2826
2827         mutex_lock(&cfg80211_mutex);
2828
2829         if (!reg_is_valid_request(alpha2)) {
2830                 r = -EINVAL;
2831                 goto bad_reg;
2832         }
2833
2834         size_of_regd = sizeof(struct ieee80211_regdomain) +
2835                 (num_rules * sizeof(struct ieee80211_reg_rule));
2836
2837         rd = kzalloc(size_of_regd, GFP_KERNEL);
2838         if (!rd) {
2839                 r = -ENOMEM;
2840                 goto bad_reg;
2841         }
2842
2843         rd->n_reg_rules = num_rules;
2844         rd->alpha2[0] = alpha2[0];
2845         rd->alpha2[1] = alpha2[1];
2846
2847         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2848                         rem_reg_rules) {
2849                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2850                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2851                         reg_rule_policy);
2852                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2853                 if (r)
2854                         goto bad_reg;
2855
2856                 rule_idx++;
2857
2858                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2859                         r = -EINVAL;
2860                         goto bad_reg;
2861                 }
2862         }
2863
2864         BUG_ON(rule_idx != num_rules);
2865
2866         r = set_regdom(rd);
2867
2868         mutex_unlock(&cfg80211_mutex);
2869
2870         return r;
2871
2872  bad_reg:
2873         mutex_unlock(&cfg80211_mutex);
2874         kfree(rd);
2875         return r;
2876 }
2877
2878 static int validate_scan_freqs(struct nlattr *freqs)
2879 {
2880         struct nlattr *attr1, *attr2;
2881         int n_channels = 0, tmp1, tmp2;
2882
2883         nla_for_each_nested(attr1, freqs, tmp1) {
2884                 n_channels++;
2885                 /*
2886                  * Some hardware has a limited channel list for
2887                  * scanning, and it is pretty much nonsensical
2888                  * to scan for a channel twice, so disallow that
2889                  * and don't require drivers to check that the
2890                  * channel list they get isn't longer than what
2891                  * they can scan, as long as they can scan all
2892                  * the channels they registered at once.
2893                  */
2894                 nla_for_each_nested(attr2, freqs, tmp2)
2895                         if (attr1 != attr2 &&
2896                             nla_get_u32(attr1) == nla_get_u32(attr2))
2897                                 return 0;
2898         }
2899
2900         return n_channels;
2901 }
2902
2903 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2904 {
2905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2906         struct net_device *dev = info->user_ptr[1];
2907         struct cfg80211_scan_request *request;
2908         struct cfg80211_ssid *ssid;
2909         struct ieee80211_channel *channel;
2910         struct nlattr *attr;
2911         struct wiphy *wiphy;
2912         int err, tmp, n_ssids = 0, n_channels, i;
2913         enum ieee80211_band band;
2914         size_t ie_len;
2915
2916         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2917                 return -EINVAL;
2918
2919         wiphy = &rdev->wiphy;
2920
2921         if (!rdev->ops->scan)
2922                 return -EOPNOTSUPP;
2923
2924         if (rdev->scan_req)
2925                 return -EBUSY;
2926
2927         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2928                 n_channels = validate_scan_freqs(
2929                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2930                 if (!n_channels)
2931                         return -EINVAL;
2932         } else {
2933                 n_channels = 0;
2934
2935                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2936                         if (wiphy->bands[band])
2937                                 n_channels += wiphy->bands[band]->n_channels;
2938         }
2939
2940         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2941                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2942                         n_ssids++;
2943
2944         if (n_ssids > wiphy->max_scan_ssids)
2945                 return -EINVAL;
2946
2947         if (info->attrs[NL80211_ATTR_IE])
2948                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2949         else
2950                 ie_len = 0;
2951
2952         if (ie_len > wiphy->max_scan_ie_len)
2953                 return -EINVAL;
2954
2955         request = kzalloc(sizeof(*request)
2956                         + sizeof(*ssid) * n_ssids
2957                         + sizeof(channel) * n_channels
2958                         + ie_len, GFP_KERNEL);
2959         if (!request)
2960                 return -ENOMEM;
2961
2962         if (n_ssids)
2963                 request->ssids = (void *)&request->channels[n_channels];
2964         request->n_ssids = n_ssids;
2965         if (ie_len) {
2966                 if (request->ssids)
2967                         request->ie = (void *)(request->ssids + n_ssids);
2968                 else
2969                         request->ie = (void *)(request->channels + n_channels);
2970         }
2971
2972         i = 0;
2973         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2974                 /* user specified, bail out if channel not found */
2975                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2976                         struct ieee80211_channel *chan;
2977
2978                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2979
2980                         if (!chan) {
2981                                 err = -EINVAL;
2982                                 goto out_free;
2983                         }
2984
2985                         /* ignore disabled channels */
2986                         if (chan->flags & IEEE80211_CHAN_DISABLED)
2987                                 continue;
2988
2989                         request->channels[i] = chan;
2990                         i++;
2991                 }
2992         } else {
2993                 /* all channels */
2994                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2995                         int j;
2996                         if (!wiphy->bands[band])
2997                                 continue;
2998                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2999                                 struct ieee80211_channel *chan;
3000
3001                                 chan = &wiphy->bands[band]->channels[j];
3002
3003                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3004                                         continue;
3005
3006                                 request->channels[i] = chan;
3007                                 i++;
3008                         }
3009                 }
3010         }
3011
3012         if (!i) {
3013                 err = -EINVAL;
3014                 goto out_free;
3015         }
3016
3017         request->n_channels = i;
3018
3019         i = 0;
3020         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3021                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3022                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3023                                 err = -EINVAL;
3024                                 goto out_free;
3025                         }
3026                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3027                         request->ssids[i].ssid_len = nla_len(attr);
3028                         i++;
3029                 }
3030         }
3031
3032         if (info->attrs[NL80211_ATTR_IE]) {
3033                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3034                 memcpy((void *)request->ie,
3035                        nla_data(info->attrs[NL80211_ATTR_IE]),
3036                        request->ie_len);
3037         }
3038
3039         request->dev = dev;
3040         request->wiphy = &rdev->wiphy;
3041
3042         rdev->scan_req = request;
3043         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3044
3045         if (!err) {
3046                 nl80211_send_scan_start(rdev, dev);
3047                 dev_hold(dev);
3048         } else {
3049  out_free:
3050                 rdev->scan_req = NULL;
3051                 kfree(request);
3052         }
3053
3054         return err;
3055 }
3056
3057 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3058                             struct cfg80211_registered_device *rdev,
3059                             struct wireless_dev *wdev,
3060                             struct cfg80211_internal_bss *intbss)
3061 {
3062         struct cfg80211_bss *res = &intbss->pub;
3063         void *hdr;
3064         struct nlattr *bss;
3065         int i;
3066
3067         ASSERT_WDEV_LOCK(wdev);
3068
3069         hdr = nl80211hdr_put(msg, pid, seq, flags,
3070                              NL80211_CMD_NEW_SCAN_RESULTS);
3071         if (!hdr)
3072                 return -1;
3073
3074         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3075         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3076
3077         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3078         if (!bss)
3079                 goto nla_put_failure;
3080         if (!is_zero_ether_addr(res->bssid))
3081                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3082         if (res->information_elements && res->len_information_elements)
3083                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3084                         res->len_information_elements,
3085                         res->information_elements);
3086         if (res->beacon_ies && res->len_beacon_ies &&
3087             res->beacon_ies != res->information_elements)
3088                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3089                         res->len_beacon_ies, res->beacon_ies);
3090         if (res->tsf)
3091                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3092         if (res->beacon_interval)
3093                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3094         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3095         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3096         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3097                 jiffies_to_msecs(jiffies - intbss->ts));
3098
3099         switch (rdev->wiphy.signal_type) {
3100         case CFG80211_SIGNAL_TYPE_MBM:
3101                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3102                 break;
3103         case CFG80211_SIGNAL_TYPE_UNSPEC:
3104                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3105                 break;
3106         default:
3107                 break;
3108         }
3109
3110         switch (wdev->iftype) {
3111         case NL80211_IFTYPE_P2P_CLIENT:
3112         case NL80211_IFTYPE_STATION:
3113                 if (intbss == wdev->current_bss)
3114                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3115                                     NL80211_BSS_STATUS_ASSOCIATED);
3116                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3117                         if (intbss != wdev->auth_bsses[i])
3118                                 continue;
3119                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3120                                     NL80211_BSS_STATUS_AUTHENTICATED);
3121                         break;
3122                 }
3123                 break;
3124         case NL80211_IFTYPE_ADHOC:
3125                 if (intbss == wdev->current_bss)
3126                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3127                                     NL80211_BSS_STATUS_IBSS_JOINED);
3128                 break;
3129         default:
3130                 break;
3131         }
3132
3133         nla_nest_end(msg, bss);
3134
3135         return genlmsg_end(msg, hdr);
3136
3137  nla_put_failure:
3138         genlmsg_cancel(msg, hdr);
3139         return -EMSGSIZE;
3140 }
3141
3142 static int nl80211_dump_scan(struct sk_buff *skb,
3143                              struct netlink_callback *cb)
3144 {
3145         struct cfg80211_registered_device *rdev;
3146         struct net_device *dev;
3147         struct cfg80211_internal_bss *scan;
3148         struct wireless_dev *wdev;
3149         int start = cb->args[1], idx = 0;
3150         int err;
3151
3152         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3153         if (err)
3154                 return err;
3155
3156         wdev = dev->ieee80211_ptr;
3157
3158         wdev_lock(wdev);
3159         spin_lock_bh(&rdev->bss_lock);
3160         cfg80211_bss_expire(rdev);
3161
3162         list_for_each_entry(scan, &rdev->bss_list, list) {
3163                 if (++idx <= start)
3164                         continue;
3165                 if (nl80211_send_bss(skb,
3166                                 NETLINK_CB(cb->skb).pid,
3167                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3168                                 rdev, wdev, scan) < 0) {
3169                         idx--;
3170                         break;
3171                 }
3172         }
3173
3174         spin_unlock_bh(&rdev->bss_lock);
3175         wdev_unlock(wdev);
3176
3177         cb->args[1] = idx;
3178         nl80211_finish_netdev_dump(rdev);
3179
3180         return skb->len;
3181 }
3182
3183 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3184                                 int flags, struct net_device *dev,
3185                                 struct survey_info *survey)
3186 {
3187         void *hdr;
3188         struct nlattr *infoattr;
3189
3190         /* Survey without a channel doesn't make sense */
3191         if (!survey->channel)
3192                 return -EINVAL;
3193
3194         hdr = nl80211hdr_put(msg, pid, seq, flags,
3195                              NL80211_CMD_NEW_SURVEY_RESULTS);
3196         if (!hdr)
3197                 return -ENOMEM;
3198
3199         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3200
3201         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3202         if (!infoattr)
3203                 goto nla_put_failure;
3204
3205         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3206                     survey->channel->center_freq);
3207         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3208                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3209                             survey->noise);
3210         if (survey->filled & SURVEY_INFO_IN_USE)
3211                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3212         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3213                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3214                             survey->channel_time);
3215         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3216                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3217                             survey->channel_time_busy);
3218         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3219                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3220                             survey->channel_time_ext_busy);
3221         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3222                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3223                             survey->channel_time_rx);
3224         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3225                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3226                             survey->channel_time_tx);
3227
3228         nla_nest_end(msg, infoattr);
3229
3230         return genlmsg_end(msg, hdr);
3231
3232  nla_put_failure:
3233         genlmsg_cancel(msg, hdr);
3234         return -EMSGSIZE;
3235 }
3236
3237 static int nl80211_dump_survey(struct sk_buff *skb,
3238                         struct netlink_callback *cb)
3239 {
3240         struct survey_info survey;
3241         struct cfg80211_registered_device *dev;
3242         struct net_device *netdev;
3243         int survey_idx = cb->args[1];
3244         int res;
3245
3246         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3247         if (res)
3248                 return res;
3249
3250         if (!dev->ops->dump_survey) {
3251                 res = -EOPNOTSUPP;
3252                 goto out_err;
3253         }
3254
3255         while (1) {
3256                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3257                                             &survey);
3258                 if (res == -ENOENT)
3259                         break;
3260                 if (res)
3261                         goto out_err;
3262
3263                 if (nl80211_send_survey(skb,
3264                                 NETLINK_CB(cb->skb).pid,
3265                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3266                                 netdev,
3267                                 &survey) < 0)
3268                         goto out;
3269                 survey_idx++;
3270         }
3271
3272  out:
3273         cb->args[1] = survey_idx;
3274         res = skb->len;
3275  out_err:
3276         nl80211_finish_netdev_dump(dev);
3277         return res;
3278 }
3279
3280 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3281 {
3282         return auth_type <= NL80211_AUTHTYPE_MAX;
3283 }
3284
3285 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3286 {
3287         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3288                                   NL80211_WPA_VERSION_2));
3289 }
3290
3291 static bool nl80211_valid_akm_suite(u32 akm)
3292 {
3293         return akm == WLAN_AKM_SUITE_8021X ||
3294                 akm == WLAN_AKM_SUITE_PSK;
3295 }
3296
3297 static bool nl80211_valid_cipher_suite(u32 cipher)
3298 {
3299         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3300                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3301                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3302                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3303                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3304 }
3305
3306
3307 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3308 {
3309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3310         struct net_device *dev = info->user_ptr[1];
3311         struct ieee80211_channel *chan;
3312         const u8 *bssid, *ssid, *ie = NULL;
3313         int err, ssid_len, ie_len = 0;
3314         enum nl80211_auth_type auth_type;
3315         struct key_parse key;
3316         bool local_state_change;
3317
3318         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3319                 return -EINVAL;
3320
3321         if (!info->attrs[NL80211_ATTR_MAC])
3322                 return -EINVAL;
3323
3324         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3325                 return -EINVAL;
3326
3327         if (!info->attrs[NL80211_ATTR_SSID])
3328                 return -EINVAL;
3329
3330         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3331                 return -EINVAL;
3332
3333         err = nl80211_parse_key(info, &key);
3334         if (err)
3335                 return err;
3336
3337         if (key.idx >= 0) {
3338                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
3339                         return -EINVAL;
3340                 if (!key.p.key || !key.p.key_len)
3341                         return -EINVAL;
3342                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3343                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3344                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3345                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3346                         return -EINVAL;
3347                 if (key.idx > 4)
3348                         return -EINVAL;
3349         } else {
3350                 key.p.key_len = 0;
3351                 key.p.key = NULL;
3352         }
3353
3354         if (key.idx >= 0) {
3355                 int i;
3356                 bool ok = false;
3357                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3358                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3359                                 ok = true;
3360                                 break;
3361                         }
3362                 }
3363                 if (!ok)
3364                         return -EINVAL;
3365         }
3366
3367         if (!rdev->ops->auth)
3368                 return -EOPNOTSUPP;
3369
3370         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3371             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3372                 return -EOPNOTSUPP;
3373
3374         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3375         chan = ieee80211_get_channel(&rdev->wiphy,
3376                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3377         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3378                 return -EINVAL;
3379
3380         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3381         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3382
3383         if (info->attrs[NL80211_ATTR_IE]) {
3384                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3385                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3386         }
3387
3388         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3389         if (!nl80211_valid_auth_type(auth_type))
3390                 return -EINVAL;
3391
3392         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3393
3394         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3395                                   ssid, ssid_len, ie, ie_len,
3396                                   key.p.key, key.p.key_len, key.idx,
3397                                   local_state_change);
3398 }
3399
3400 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
3401                                    struct genl_info *info,
3402                                    struct cfg80211_crypto_settings *settings,
3403                                    int cipher_limit)
3404 {
3405         memset(settings, 0, sizeof(*settings));
3406
3407         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3408
3409         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
3410                 u16 proto;
3411                 proto = nla_get_u16(
3412                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3413                 settings->control_port_ethertype = cpu_to_be16(proto);
3414                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
3415                     proto != ETH_P_PAE)
3416                         return -EINVAL;
3417                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
3418                         settings->control_port_no_encrypt = true;
3419         } else
3420                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
3421
3422         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3423                 void *data;
3424                 int len, i;
3425
3426                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3427                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3428                 settings->n_ciphers_pairwise = len / sizeof(u32);
3429
3430                 if (len % sizeof(u32))
3431                         return -EINVAL;
3432
3433                 if (settings->n_ciphers_pairwise > cipher_limit)
3434                         return -EINVAL;
3435
3436                 memcpy(settings->ciphers_pairwise, data, len);
3437
3438                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3439                         if (!nl80211_valid_cipher_suite(
3440                                         settings->ciphers_pairwise[i]))
3441                                 return -EINVAL;
3442         }
3443
3444         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3445                 settings->cipher_group =
3446                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3447                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3448                         return -EINVAL;
3449         }
3450
3451         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3452                 settings->wpa_versions =
3453                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3454                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3455                         return -EINVAL;
3456         }
3457
3458         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3459                 void *data;
3460                 int len, i;
3461
3462                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3463                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3464                 settings->n_akm_suites = len / sizeof(u32);
3465
3466                 if (len % sizeof(u32))
3467                         return -EINVAL;
3468
3469                 memcpy(settings->akm_suites, data, len);
3470
3471                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3472                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3473                                 return -EINVAL;
3474         }
3475
3476         return 0;
3477 }
3478
3479 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3480 {
3481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3482         struct net_device *dev = info->user_ptr[1];
3483         struct cfg80211_crypto_settings crypto;
3484         struct ieee80211_channel *chan;
3485         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3486         int err, ssid_len, ie_len = 0;
3487         bool use_mfp = false;
3488
3489         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3490                 return -EINVAL;
3491
3492         if (!info->attrs[NL80211_ATTR_MAC] ||
3493             !info->attrs[NL80211_ATTR_SSID] ||
3494             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3495                 return -EINVAL;
3496
3497         if (!rdev->ops->assoc)
3498                 return -EOPNOTSUPP;
3499
3500         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3501             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3502                 return -EOPNOTSUPP;
3503
3504         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3505
3506         chan = ieee80211_get_channel(&rdev->wiphy,
3507                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3508         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3509                 return -EINVAL;
3510
3511         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3512         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3513
3514         if (info->attrs[NL80211_ATTR_IE]) {
3515                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3516                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3517         }
3518
3519         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3520                 enum nl80211_mfp mfp =
3521                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3522                 if (mfp == NL80211_MFP_REQUIRED)
3523                         use_mfp = true;
3524                 else if (mfp != NL80211_MFP_NO)
3525                         return -EINVAL;
3526         }
3527
3528         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3529                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3530
3531         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
3532         if (!err)
3533                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3534                                           ssid, ssid_len, ie, ie_len, use_mfp,
3535                                           &crypto);
3536
3537         return err;
3538 }
3539
3540 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3541 {
3542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3543         struct net_device *dev = info->user_ptr[1];
3544         const u8 *ie = NULL, *bssid;
3545         int ie_len = 0;
3546         u16 reason_code;
3547         bool local_state_change;
3548
3549         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3550                 return -EINVAL;
3551
3552         if (!info->attrs[NL80211_ATTR_MAC])
3553                 return -EINVAL;
3554
3555         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3556                 return -EINVAL;
3557
3558         if (!rdev->ops->deauth)
3559                 return -EOPNOTSUPP;
3560
3561         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3562             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3563                 return -EOPNOTSUPP;
3564
3565         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3566
3567         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3568         if (reason_code == 0) {
3569                 /* Reason Code 0 is reserved */
3570                 return -EINVAL;
3571         }
3572
3573         if (info->attrs[NL80211_ATTR_IE]) {
3574                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3575                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3576         }
3577
3578         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3579
3580         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3581                                     local_state_change);
3582 }
3583
3584 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3585 {
3586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3587         struct net_device *dev = info->user_ptr[1];
3588         const u8 *ie = NULL, *bssid;
3589         int ie_len = 0;
3590         u16 reason_code;
3591         bool local_state_change;
3592
3593         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3594                 return -EINVAL;
3595
3596         if (!info->attrs[NL80211_ATTR_MAC])
3597                 return -EINVAL;
3598
3599         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3600                 return -EINVAL;
3601
3602         if (!rdev->ops->disassoc)
3603                 return -EOPNOTSUPP;
3604
3605         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3606             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3607                 return -EOPNOTSUPP;
3608
3609         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3610
3611         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3612         if (reason_code == 0) {
3613                 /* Reason Code 0 is reserved */
3614                 return -EINVAL;
3615         }
3616
3617         if (info->attrs[NL80211_ATTR_IE]) {
3618                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3619                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3620         }
3621
3622         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3623
3624         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3625                                       local_state_change);
3626 }
3627
3628 static bool
3629 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
3630                          int mcast_rate[IEEE80211_NUM_BANDS],
3631                          int rateval)
3632 {
3633         struct wiphy *wiphy = &rdev->wiphy;
3634         bool found = false;
3635         int band, i;
3636
3637         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3638                 struct ieee80211_supported_band *sband;
3639
3640                 sband = wiphy->bands[band];
3641                 if (!sband)
3642                         continue;
3643
3644                 for (i = 0; i < sband->n_bitrates; i++) {
3645                         if (sband->bitrates[i].bitrate == rateval) {
3646                                 mcast_rate[band] = i + 1;
3647                                 found = true;
3648                                 break;
3649                         }
3650                 }
3651         }
3652
3653         return found;
3654 }
3655
3656 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3657 {
3658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3659         struct net_device *dev = info->user_ptr[1];
3660         struct cfg80211_ibss_params ibss;
3661         struct wiphy *wiphy;
3662         struct cfg80211_cached_keys *connkeys = NULL;
3663         int err;
3664
3665         memset(&ibss, 0, sizeof(ibss));
3666
3667         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3668                 return -EINVAL;
3669
3670         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3671             !info->attrs[NL80211_ATTR_SSID] ||
3672             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3673                 return -EINVAL;
3674
3675         ibss.beacon_interval = 100;
3676
3677         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3678                 ibss.beacon_interval =
3679                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3680                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3681                         return -EINVAL;
3682         }
3683
3684         if (!rdev->ops->join_ibss)
3685                 return -EOPNOTSUPP;
3686
3687         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3688                 return -EOPNOTSUPP;
3689
3690         wiphy = &rdev->wiphy;
3691
3692         if (info->attrs[NL80211_ATTR_MAC])
3693                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3694         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3695         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3696
3697         if (info->attrs[NL80211_ATTR_IE]) {
3698                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3699                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3700         }
3701
3702         ibss.channel = ieee80211_get_channel(wiphy,
3703                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3704         if (!ibss.channel ||
3705             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3706             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
3707                 return -EINVAL;
3708
3709         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3710         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3711
3712         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3713                 u8 *rates =
3714                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3715                 int n_rates =
3716                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3717                 struct ieee80211_supported_band *sband =
3718                         wiphy->bands[ibss.channel->band];
3719                 int i, j;
3720
3721                 if (n_rates == 0)
3722                         return -EINVAL;
3723
3724                 for (i = 0; i < n_rates; i++) {
3725                         int rate = (rates[i] & 0x7f) * 5;
3726                         bool found = false;
3727
3728                         for (j = 0; j < sband->n_bitrates; j++) {
3729                                 if (sband->bitrates[j].bitrate == rate) {
3730                                         found = true;
3731                                         ibss.basic_rates |= BIT(j);
3732                                         break;
3733                                 }
3734                         }
3735                         if (!found)
3736                                 return -EINVAL;
3737                 }
3738         }
3739
3740         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
3741             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
3742                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
3743                 return -EINVAL;
3744
3745         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3746                 connkeys = nl80211_parse_connkeys(rdev,
3747                                         info->attrs[NL80211_ATTR_KEYS]);
3748                 if (IS_ERR(connkeys))
3749                         return PTR_ERR(connkeys);
3750         }
3751
3752         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3753         if (err)
3754                 kfree(connkeys);
3755         return err;
3756 }
3757
3758 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3759 {
3760         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3761         struct net_device *dev = info->user_ptr[1];
3762
3763         if (!rdev->ops->leave_ibss)
3764                 return -EOPNOTSUPP;
3765
3766         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3767                 return -EOPNOTSUPP;
3768
3769         return cfg80211_leave_ibss(rdev, dev, false);
3770 }
3771
3772 #ifdef CONFIG_NL80211_TESTMODE
3773 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3774         .name = "testmode",
3775 };
3776
3777 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3778 {
3779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3780         int err;
3781
3782         if (!info->attrs[NL80211_ATTR_TESTDATA])
3783                 return -EINVAL;
3784
3785         err = -EOPNOTSUPP;
3786         if (rdev->ops->testmode_cmd) {
3787                 rdev->testmode_info = info;
3788                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3789                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3790                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3791                 rdev->testmode_info = NULL;
3792         }
3793
3794         return err;
3795 }
3796
3797 static struct sk_buff *
3798 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3799                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3800 {
3801         struct sk_buff *skb;
3802         void *hdr;
3803         struct nlattr *data;
3804
3805         skb = nlmsg_new(approxlen + 100, gfp);
3806         if (!skb)
3807                 return NULL;
3808
3809         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3810         if (!hdr) {
3811                 kfree_skb(skb);
3812                 return NULL;
3813         }
3814
3815         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3816         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3817
3818         ((void **)skb->cb)[0] = rdev;
3819         ((void **)skb->cb)[1] = hdr;
3820         ((void **)skb->cb)[2] = data;
3821
3822         return skb;
3823
3824  nla_put_failure:
3825         kfree_skb(skb);
3826         return NULL;
3827 }
3828
3829 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3830                                                   int approxlen)
3831 {
3832         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3833
3834         if (WARN_ON(!rdev->testmode_info))
3835                 return NULL;
3836
3837         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3838                                 rdev->testmode_info->snd_pid,
3839                                 rdev->testmode_info->snd_seq,
3840                                 GFP_KERNEL);
3841 }
3842 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3843
3844 int cfg80211_testmode_reply(struct sk_buff *skb)
3845 {
3846         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3847         void *hdr = ((void **)skb->cb)[1];
3848         struct nlattr *data = ((void **)skb->cb)[2];
3849
3850         if (WARN_ON(!rdev->testmode_info)) {
3851                 kfree_skb(skb);
3852                 return -EINVAL;
3853         }
3854
3855         nla_nest_end(skb, data);
3856         genlmsg_end(skb, hdr);
3857         return genlmsg_reply(skb, rdev->testmode_info);
3858 }
3859 EXPORT_SYMBOL(cfg80211_testmode_reply);
3860
3861 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3862                                                   int approxlen, gfp_t gfp)
3863 {
3864         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3865
3866         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3867 }
3868 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3869
3870 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3871 {
3872         void *hdr = ((void **)skb->cb)[1];
3873         struct nlattr *data = ((void **)skb->cb)[2];
3874
3875         nla_nest_end(skb, data);
3876         genlmsg_end(skb, hdr);
3877         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3878 }
3879 EXPORT_SYMBOL(cfg80211_testmode_event);
3880 #endif
3881
3882 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3883 {
3884         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3885         struct net_device *dev = info->user_ptr[1];
3886         struct cfg80211_connect_params connect;
3887         struct wiphy *wiphy;
3888         struct cfg80211_cached_keys *connkeys = NULL;
3889         int err;
3890
3891         memset(&connect, 0, sizeof(connect));
3892
3893         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3894                 return -EINVAL;
3895
3896         if (!info->attrs[NL80211_ATTR_SSID] ||
3897             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3898                 return -EINVAL;
3899
3900         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3901                 connect.auth_type =
3902                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3903                 if (!nl80211_valid_auth_type(connect.auth_type))
3904                         return -EINVAL;
3905         } else
3906                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3907
3908         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3909
3910         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
3911                                       NL80211_MAX_NR_CIPHER_SUITES);
3912         if (err)
3913                 return err;
3914
3915         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3916             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3917                 return -EOPNOTSUPP;
3918
3919         wiphy = &rdev->wiphy;
3920
3921         if (info->attrs[NL80211_ATTR_MAC])
3922                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3923         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3924         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3925
3926         if (info->attrs[NL80211_ATTR_IE]) {
3927                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3928                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3929         }
3930
3931         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3932                 connect.channel =
3933                         ieee80211_get_channel(wiphy,
3934                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3935                 if (!connect.channel ||
3936                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
3937                         return -EINVAL;
3938         }
3939
3940         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3941                 connkeys = nl80211_parse_connkeys(rdev,
3942                                         info->attrs[NL80211_ATTR_KEYS]);
3943                 if (IS_ERR(connkeys))
3944                         return PTR_ERR(connkeys);
3945         }
3946
3947         err = cfg80211_connect(rdev, dev, &connect, connkeys);
3948         if (err)
3949                 kfree(connkeys);
3950         return err;
3951 }
3952
3953 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3954 {
3955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3956         struct net_device *dev = info->user_ptr[1];
3957         u16 reason;
3958
3959         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3960                 reason = WLAN_REASON_DEAUTH_LEAVING;
3961         else
3962                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3963
3964         if (reason == 0)
3965                 return -EINVAL;
3966
3967         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3968             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3969                 return -EOPNOTSUPP;
3970
3971         return cfg80211_disconnect(rdev, dev, reason, true);
3972 }
3973
3974 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
3975 {
3976         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3977         struct net *net;
3978         int err;
3979         u32 pid;
3980
3981         if (!info->attrs[NL80211_ATTR_PID])
3982                 return -EINVAL;
3983
3984         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
3985
3986         net = get_net_ns_by_pid(pid);
3987         if (IS_ERR(net))
3988                 return PTR_ERR(net);
3989
3990         err = 0;
3991
3992         /* check if anything to do */
3993         if (!net_eq(wiphy_net(&rdev->wiphy), net))
3994                 err = cfg80211_switch_netns(rdev, net);
3995
3996         put_net(net);
3997         return err;
3998 }
3999
4000 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4001 {
4002         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4003         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4004                         struct cfg80211_pmksa *pmksa) = NULL;
4005         struct net_device *dev = info->user_ptr[1];
4006         struct cfg80211_pmksa pmksa;
4007
4008         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4009
4010         if (!info->attrs[NL80211_ATTR_MAC])
4011                 return -EINVAL;
4012
4013         if (!info->attrs[NL80211_ATTR_PMKID])
4014                 return -EINVAL;
4015
4016         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4017         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4018
4019         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4020             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4021                 return -EOPNOTSUPP;
4022
4023         switch (info->genlhdr->cmd) {
4024         case NL80211_CMD_SET_PMKSA:
4025                 rdev_ops = rdev->ops->set_pmksa;
4026                 break;
4027         case NL80211_CMD_DEL_PMKSA:
4028                 rdev_ops = rdev->ops->del_pmksa;
4029                 break;
4030         default:
4031                 WARN_ON(1);
4032                 break;
4033         }
4034
4035         if (!rdev_ops)
4036                 return -EOPNOTSUPP;
4037
4038         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4039 }
4040
4041 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4042 {
4043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4044         struct net_device *dev = info->user_ptr[1];
4045
4046         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4047             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4048                 return -EOPNOTSUPP;
4049
4050         if (!rdev->ops->flush_pmksa)
4051                 return -EOPNOTSUPP;
4052
4053         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4054 }
4055
4056 static int nl80211_remain_on_channel(struct sk_buff *skb,
4057                                      struct genl_info *info)
4058 {
4059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4060         struct net_device *dev = info->user_ptr[1];
4061         struct ieee80211_channel *chan;
4062         struct sk_buff *msg;
4063         void *hdr;
4064         u64 cookie;
4065         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4066         u32 freq, duration;
4067         int err;
4068
4069         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4070             !info->attrs[NL80211_ATTR_DURATION])
4071                 return -EINVAL;
4072
4073         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4074
4075         /*
4076          * We should be on that channel for at least one jiffie,
4077          * and more than 5 seconds seems excessive.
4078          */
4079         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4080                 return -EINVAL;
4081
4082         if (!rdev->ops->remain_on_channel)
4083                 return -EOPNOTSUPP;
4084
4085         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4086                 channel_type = nla_get_u32(
4087                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4088                 if (channel_type != NL80211_CHAN_NO_HT &&
4089                     channel_type != NL80211_CHAN_HT20 &&
4090                     channel_type != NL80211_CHAN_HT40PLUS &&
4091                     channel_type != NL80211_CHAN_HT40MINUS)
4092                         return -EINVAL;
4093         }
4094
4095         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4096         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4097         if (chan == NULL)
4098                 return -EINVAL;
4099
4100         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4101         if (!msg)
4102                 return -ENOMEM;
4103
4104         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4105                              NL80211_CMD_REMAIN_ON_CHANNEL);
4106
4107         if (IS_ERR(hdr)) {
4108                 err = PTR_ERR(hdr);
4109                 goto free_msg;
4110         }
4111
4112         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4113                                            channel_type, duration, &cookie);
4114
4115         if (err)
4116                 goto free_msg;
4117
4118         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4119
4120         genlmsg_end(msg, hdr);
4121
4122         return genlmsg_reply(msg, info);
4123
4124  nla_put_failure:
4125         err = -ENOBUFS;
4126  free_msg:
4127         nlmsg_free(msg);
4128         return err;
4129 }
4130
4131 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4132                                             struct genl_info *info)
4133 {
4134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4135         struct net_device *dev = info->user_ptr[1];
4136         u64 cookie;
4137
4138         if (!info->attrs[NL80211_ATTR_COOKIE])
4139                 return -EINVAL;
4140
4141         if (!rdev->ops->cancel_remain_on_channel)
4142                 return -EOPNOTSUPP;
4143
4144         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4145
4146         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4147 }
4148
4149 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4150                            u8 *rates, u8 rates_len)
4151 {
4152         u8 i;
4153         u32 mask = 0;
4154
4155         for (i = 0; i < rates_len; i++) {
4156                 int rate = (rates[i] & 0x7f) * 5;
4157                 int ridx;
4158                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4159                         struct ieee80211_rate *srate =
4160                                 &sband->bitrates[ridx];
4161                         if (rate == srate->bitrate) {
4162                                 mask |= 1 << ridx;
4163                                 break;
4164                         }
4165                 }
4166                 if (ridx == sband->n_bitrates)
4167                         return 0; /* rate not found */
4168         }
4169
4170         return mask;
4171 }
4172
4173 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4174         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4175                                     .len = NL80211_MAX_SUPP_RATES },
4176 };
4177
4178 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4179                                        struct genl_info *info)
4180 {
4181         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4182         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4183         struct cfg80211_bitrate_mask mask;
4184         int rem, i;
4185         struct net_device *dev = info->user_ptr[1];
4186         struct nlattr *tx_rates;
4187         struct ieee80211_supported_band *sband;
4188
4189         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4190                 return -EINVAL;
4191
4192         if (!rdev->ops->set_bitrate_mask)
4193                 return -EOPNOTSUPP;
4194
4195         memset(&mask, 0, sizeof(mask));
4196         /* Default to all rates enabled */
4197         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4198                 sband = rdev->wiphy.bands[i];
4199                 mask.control[i].legacy =
4200                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4201         }
4202
4203         /*
4204          * The nested attribute uses enum nl80211_band as the index. This maps
4205          * directly to the enum ieee80211_band values used in cfg80211.
4206          */
4207         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4208         {
4209                 enum ieee80211_band band = nla_type(tx_rates);
4210                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4211                         return -EINVAL;
4212                 sband = rdev->wiphy.bands[band];
4213                 if (sband == NULL)
4214                         return -EINVAL;
4215                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4216                           nla_len(tx_rates), nl80211_txattr_policy);
4217                 if (tb[NL80211_TXRATE_LEGACY]) {
4218                         mask.control[band].legacy = rateset_to_mask(
4219                                 sband,
4220                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4221                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4222                         if (mask.control[band].legacy == 0)
4223                                 return -EINVAL;
4224                 }
4225         }
4226
4227         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4228 }
4229
4230 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4231 {
4232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4233         struct net_device *dev = info->user_ptr[1];
4234         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4235
4236         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4237                 return -EINVAL;
4238
4239         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4240                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4241
4242         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4243             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4244             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4245             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4246             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4247             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4248                 return -EOPNOTSUPP;
4249
4250         /* not much point in registering if we can't reply */
4251         if (!rdev->ops->mgmt_tx)
4252                 return -EOPNOTSUPP;
4253
4254         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4255                         frame_type,
4256                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4257                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4258 }
4259
4260 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4261 {
4262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4263         struct net_device *dev = info->user_ptr[1];
4264         struct ieee80211_channel *chan;
4265         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4266         bool channel_type_valid = false;
4267         u32 freq;
4268         int err;
4269         void *hdr;
4270         u64 cookie;
4271         struct sk_buff *msg;
4272         unsigned int wait = 0;
4273         bool offchan;
4274
4275         if (!info->attrs[NL80211_ATTR_FRAME] ||
4276             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4277                 return -EINVAL;
4278
4279         if (!rdev->ops->mgmt_tx)
4280                 return -EOPNOTSUPP;
4281
4282         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4283             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4284             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4285             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4286             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4287             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4288                 return -EOPNOTSUPP;
4289
4290         if (info->attrs[NL80211_ATTR_DURATION]) {
4291                 if (!rdev->ops->mgmt_tx_cancel_wait)
4292                         return -EINVAL;
4293                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4294         }
4295
4296         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4297                 channel_type = nla_get_u32(
4298                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4299                 if (channel_type != NL80211_CHAN_NO_HT &&
4300                     channel_type != NL80211_CHAN_HT20 &&
4301                     channel_type != NL80211_CHAN_HT40PLUS &&
4302                     channel_type != NL80211_CHAN_HT40MINUS)
4303                         return -EINVAL;
4304                 channel_type_valid = true;
4305         }
4306
4307         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
4308
4309         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4310         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4311         if (chan == NULL)
4312                 return -EINVAL;
4313
4314         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4315         if (!msg)
4316                 return -ENOMEM;
4317
4318         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4319                              NL80211_CMD_FRAME);
4320
4321         if (IS_ERR(hdr)) {
4322                 err = PTR_ERR(hdr);
4323                 goto free_msg;
4324         }
4325         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
4326                                     channel_type_valid, wait,
4327                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
4328                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
4329                                     &cookie);
4330         if (err)
4331                 goto free_msg;
4332
4333         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4334
4335         genlmsg_end(msg, hdr);
4336         return genlmsg_reply(msg, info);
4337
4338  nla_put_failure:
4339         err = -ENOBUFS;
4340  free_msg:
4341         nlmsg_free(msg);
4342         return err;
4343 }
4344
4345 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
4346 {
4347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4348         struct net_device *dev = info->user_ptr[1];
4349         u64 cookie;
4350
4351         if (!info->attrs[NL80211_ATTR_COOKIE])
4352                 return -EINVAL;
4353
4354         if (!rdev->ops->mgmt_tx_cancel_wait)
4355                 return -EOPNOTSUPP;
4356
4357         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4358             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4359             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4360             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4361             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4362             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4363                 return -EOPNOTSUPP;
4364
4365         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4366
4367         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
4368 }
4369
4370 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4371 {
4372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4373         struct wireless_dev *wdev;
4374         struct net_device *dev = info->user_ptr[1];
4375         u8 ps_state;
4376         bool state;
4377         int err;
4378
4379         if (!info->attrs[NL80211_ATTR_PS_STATE])
4380                 return -EINVAL;
4381
4382         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4383
4384         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
4385                 return -EINVAL;
4386
4387         wdev = dev->ieee80211_ptr;
4388
4389         if (!rdev->ops->set_power_mgmt)
4390                 return -EOPNOTSUPP;
4391
4392         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4393
4394         if (state == wdev->ps)
4395                 return 0;
4396
4397         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
4398                                         wdev->ps_timeout);
4399         if (!err)
4400                 wdev->ps = state;
4401         return err;
4402 }
4403
4404 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4405 {
4406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4407         enum nl80211_ps_state ps_state;
4408         struct wireless_dev *wdev;
4409         struct net_device *dev = info->user_ptr[1];
4410         struct sk_buff *msg;
4411         void *hdr;
4412         int err;
4413
4414         wdev = dev->ieee80211_ptr;
4415
4416         if (!rdev->ops->set_power_mgmt)
4417                 return -EOPNOTSUPP;
4418
4419         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4420         if (!msg)
4421                 return -ENOMEM;
4422
4423         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4424                              NL80211_CMD_GET_POWER_SAVE);
4425         if (!hdr) {
4426                 err = -ENOBUFS;
4427                 goto free_msg;
4428         }
4429
4430         if (wdev->ps)
4431                 ps_state = NL80211_PS_ENABLED;
4432         else
4433                 ps_state = NL80211_PS_DISABLED;
4434
4435         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4436
4437         genlmsg_end(msg, hdr);
4438         return genlmsg_reply(msg, info);
4439
4440  nla_put_failure:
4441         err = -ENOBUFS;
4442  free_msg:
4443         nlmsg_free(msg);
4444         return err;
4445 }
4446
4447 static struct nla_policy
4448 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4449         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4450         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4451         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4452 };
4453
4454 static int nl80211_set_cqm_rssi(struct genl_info *info,
4455                                 s32 threshold, u32 hysteresis)
4456 {
4457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4458         struct wireless_dev *wdev;
4459         struct net_device *dev = info->user_ptr[1];
4460
4461         if (threshold > 0)
4462                 return -EINVAL;
4463
4464         wdev = dev->ieee80211_ptr;
4465
4466         if (!rdev->ops->set_cqm_rssi_config)
4467                 return -EOPNOTSUPP;
4468
4469         if (wdev->iftype != NL80211_IFTYPE_STATION &&
4470             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
4471                 return -EOPNOTSUPP;
4472
4473         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4474                                               threshold, hysteresis);
4475 }
4476
4477 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4478 {
4479         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4480         struct nlattr *cqm;
4481         int err;
4482
4483         cqm = info->attrs[NL80211_ATTR_CQM];
4484         if (!cqm) {
4485                 err = -EINVAL;
4486                 goto out;
4487         }
4488
4489         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4490                                nl80211_attr_cqm_policy);
4491         if (err)
4492                 goto out;
4493
4494         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4495             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4496                 s32 threshold;
4497                 u32 hysteresis;
4498                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4499                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4500                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4501         } else
4502                 err = -EINVAL;
4503
4504 out:
4505         return err;
4506 }
4507
4508 #define NL80211_FLAG_NEED_WIPHY         0x01
4509 #define NL80211_FLAG_NEED_NETDEV        0x02
4510 #define NL80211_FLAG_NEED_RTNL          0x04
4511 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
4512 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
4513                                          NL80211_FLAG_CHECK_NETDEV_UP)
4514
4515 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
4516                             struct genl_info *info)
4517 {
4518         struct cfg80211_registered_device *rdev;
4519         struct net_device *dev;
4520         int err;
4521         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
4522
4523         if (rtnl)
4524                 rtnl_lock();
4525
4526         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
4527                 rdev = cfg80211_get_dev_from_info(info);
4528                 if (IS_ERR(rdev)) {
4529                         if (rtnl)
4530                                 rtnl_unlock();
4531                         return PTR_ERR(rdev);
4532                 }
4533                 info->user_ptr[0] = rdev;
4534         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
4535                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4536                 if (err) {
4537                         if (rtnl)
4538                                 rtnl_unlock();
4539                         return err;
4540                 }
4541                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
4542                     !netif_running(dev)) {
4543                         cfg80211_unlock_rdev(rdev);
4544                         dev_put(dev);
4545                         if (rtnl)
4546                                 rtnl_unlock();
4547                         return -ENETDOWN;
4548                 }
4549                 info->user_ptr[0] = rdev;
4550                 info->user_ptr[1] = dev;
4551         }
4552
4553         return 0;
4554 }
4555
4556 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
4557                               struct genl_info *info)
4558 {
4559         if (info->user_ptr[0])
4560                 cfg80211_unlock_rdev(info->user_ptr[0]);
4561         if (info->user_ptr[1])
4562                 dev_put(info->user_ptr[1]);
4563         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
4564                 rtnl_unlock();
4565 }
4566
4567 static struct genl_ops nl80211_ops[] = {
4568         {
4569                 .cmd = NL80211_CMD_GET_WIPHY,
4570                 .doit = nl80211_get_wiphy,
4571                 .dumpit = nl80211_dump_wiphy,
4572                 .policy = nl80211_policy,
4573                 /* can be retrieved by unprivileged users */
4574                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
4575         },
4576         {
4577                 .cmd = NL80211_CMD_SET_WIPHY,
4578                 .doit = nl80211_set_wiphy,
4579                 .policy = nl80211_policy,
4580                 .flags = GENL_ADMIN_PERM,
4581                 .internal_flags = NL80211_FLAG_NEED_RTNL,
4582         },
4583         {
4584                 .cmd = NL80211_CMD_GET_INTERFACE,
4585                 .doit = nl80211_get_interface,
4586                 .dumpit = nl80211_dump_interface,
4587                 .policy = nl80211_policy,
4588                 /* can be retrieved by unprivileged users */
4589                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
4590         },
4591         {
4592                 .cmd = NL80211_CMD_SET_INTERFACE,
4593                 .doit = nl80211_set_interface,
4594                 .policy = nl80211_policy,
4595                 .flags = GENL_ADMIN_PERM,
4596                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4597                                   NL80211_FLAG_NEED_RTNL,
4598         },
4599         {
4600                 .cmd = NL80211_CMD_NEW_INTERFACE,
4601                 .doit = nl80211_new_interface,
4602                 .policy = nl80211_policy,
4603                 .flags = GENL_ADMIN_PERM,
4604                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4605                                   NL80211_FLAG_NEED_RTNL,
4606         },
4607         {
4608                 .cmd = NL80211_CMD_DEL_INTERFACE,
4609                 .doit = nl80211_del_interface,
4610                 .policy = nl80211_policy,
4611                 .flags = GENL_ADMIN_PERM,
4612                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4613                                   NL80211_FLAG_NEED_RTNL,
4614         },
4615         {
4616                 .cmd = NL80211_CMD_GET_KEY,
4617                 .doit = nl80211_get_key,
4618                 .policy = nl80211_policy,
4619                 .flags = GENL_ADMIN_PERM,
4620                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4621                                   NL80211_FLAG_NEED_RTNL,
4622         },
4623         {
4624                 .cmd = NL80211_CMD_SET_KEY,
4625                 .doit = nl80211_set_key,
4626                 .policy = nl80211_policy,
4627                 .flags = GENL_ADMIN_PERM,
4628                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4629                                   NL80211_FLAG_NEED_RTNL,
4630         },
4631         {
4632                 .cmd = NL80211_CMD_NEW_KEY,
4633                 .doit = nl80211_new_key,
4634                 .policy = nl80211_policy,
4635                 .flags = GENL_ADMIN_PERM,
4636                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4637                                   NL80211_FLAG_NEED_RTNL,
4638         },
4639         {
4640                 .cmd = NL80211_CMD_DEL_KEY,
4641                 .doit = nl80211_del_key,
4642                 .policy = nl80211_policy,
4643                 .flags = GENL_ADMIN_PERM,
4644                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4645                                   NL80211_FLAG_NEED_RTNL,
4646         },
4647         {
4648                 .cmd = NL80211_CMD_SET_BEACON,
4649                 .policy = nl80211_policy,
4650                 .flags = GENL_ADMIN_PERM,
4651                 .doit = nl80211_addset_beacon,
4652                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4653                                   NL80211_FLAG_NEED_RTNL,
4654         },
4655         {
4656                 .cmd = NL80211_CMD_NEW_BEACON,
4657                 .policy = nl80211_policy,
4658                 .flags = GENL_ADMIN_PERM,
4659                 .doit = nl80211_addset_beacon,
4660                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4661                                   NL80211_FLAG_NEED_RTNL,
4662         },
4663         {
4664                 .cmd = NL80211_CMD_DEL_BEACON,
4665                 .policy = nl80211_policy,
4666                 .flags = GENL_ADMIN_PERM,
4667                 .doit = nl80211_del_beacon,
4668                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4669                                   NL80211_FLAG_NEED_RTNL,
4670         },
4671         {
4672                 .cmd = NL80211_CMD_GET_STATION,
4673                 .doit = nl80211_get_station,
4674                 .dumpit = nl80211_dump_station,
4675                 .policy = nl80211_policy,
4676                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4677                                   NL80211_FLAG_NEED_RTNL,
4678         },
4679         {
4680                 .cmd = NL80211_CMD_SET_STATION,
4681                 .doit = nl80211_set_station,
4682                 .policy = nl80211_policy,
4683                 .flags = GENL_ADMIN_PERM,
4684                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4685                                   NL80211_FLAG_NEED_RTNL,
4686         },
4687         {
4688                 .cmd = NL80211_CMD_NEW_STATION,
4689                 .doit = nl80211_new_station,
4690                 .policy = nl80211_policy,
4691                 .flags = GENL_ADMIN_PERM,
4692                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4693                                   NL80211_FLAG_NEED_RTNL,
4694         },
4695         {
4696                 .cmd = NL80211_CMD_DEL_STATION,
4697                 .doit = nl80211_del_station,
4698                 .policy = nl80211_policy,
4699                 .flags = GENL_ADMIN_PERM,
4700                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4701                                   NL80211_FLAG_NEED_RTNL,
4702         },
4703         {
4704                 .cmd = NL80211_CMD_GET_MPATH,
4705                 .doit = nl80211_get_mpath,
4706                 .dumpit = nl80211_dump_mpath,
4707                 .policy = nl80211_policy,
4708                 .flags = GENL_ADMIN_PERM,
4709                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4710                                   NL80211_FLAG_NEED_RTNL,
4711         },
4712         {
4713                 .cmd = NL80211_CMD_SET_MPATH,
4714                 .doit = nl80211_set_mpath,
4715                 .policy = nl80211_policy,
4716                 .flags = GENL_ADMIN_PERM,
4717                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4718                                   NL80211_FLAG_NEED_RTNL,
4719         },
4720         {
4721                 .cmd = NL80211_CMD_NEW_MPATH,
4722                 .doit = nl80211_new_mpath,
4723                 .policy = nl80211_policy,
4724                 .flags = GENL_ADMIN_PERM,
4725                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4726                                   NL80211_FLAG_NEED_RTNL,
4727         },
4728         {
4729                 .cmd = NL80211_CMD_DEL_MPATH,
4730                 .doit = nl80211_del_mpath,
4731                 .policy = nl80211_policy,
4732                 .flags = GENL_ADMIN_PERM,
4733                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4734                                   NL80211_FLAG_NEED_RTNL,
4735         },
4736         {
4737                 .cmd = NL80211_CMD_SET_BSS,
4738                 .doit = nl80211_set_bss,
4739                 .policy = nl80211_policy,
4740                 .flags = GENL_ADMIN_PERM,
4741                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4742                                   NL80211_FLAG_NEED_RTNL,
4743         },
4744         {
4745                 .cmd = NL80211_CMD_GET_REG,
4746                 .doit = nl80211_get_reg,
4747                 .policy = nl80211_policy,
4748                 /* can be retrieved by unprivileged users */
4749         },
4750         {
4751                 .cmd = NL80211_CMD_SET_REG,
4752                 .doit = nl80211_set_reg,
4753                 .policy = nl80211_policy,
4754                 .flags = GENL_ADMIN_PERM,
4755         },
4756         {
4757                 .cmd = NL80211_CMD_REQ_SET_REG,
4758                 .doit = nl80211_req_set_reg,
4759                 .policy = nl80211_policy,
4760                 .flags = GENL_ADMIN_PERM,
4761         },
4762         {
4763                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4764                 .doit = nl80211_get_mesh_params,
4765                 .policy = nl80211_policy,
4766                 /* can be retrieved by unprivileged users */
4767                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4768                                   NL80211_FLAG_NEED_RTNL,
4769         },
4770         {
4771                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4772                 .doit = nl80211_set_mesh_params,
4773                 .policy = nl80211_policy,
4774                 .flags = GENL_ADMIN_PERM,
4775                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4776                                   NL80211_FLAG_NEED_RTNL,
4777         },
4778         {
4779                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4780                 .doit = nl80211_trigger_scan,
4781                 .policy = nl80211_policy,
4782                 .flags = GENL_ADMIN_PERM,
4783                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4784                                   NL80211_FLAG_NEED_RTNL,
4785         },
4786         {
4787                 .cmd = NL80211_CMD_GET_SCAN,
4788                 .policy = nl80211_policy,
4789                 .dumpit = nl80211_dump_scan,
4790         },
4791         {
4792                 .cmd = NL80211_CMD_AUTHENTICATE,
4793                 .doit = nl80211_authenticate,
4794                 .policy = nl80211_policy,
4795                 .flags = GENL_ADMIN_PERM,
4796                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4797                                   NL80211_FLAG_NEED_RTNL,
4798         },
4799         {
4800                 .cmd = NL80211_CMD_ASSOCIATE,
4801                 .doit = nl80211_associate,
4802                 .policy = nl80211_policy,
4803                 .flags = GENL_ADMIN_PERM,
4804                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4805                                   NL80211_FLAG_NEED_RTNL,
4806         },
4807         {
4808                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4809                 .doit = nl80211_deauthenticate,
4810                 .policy = nl80211_policy,
4811                 .flags = GENL_ADMIN_PERM,
4812                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4813                                   NL80211_FLAG_NEED_RTNL,
4814         },
4815         {
4816                 .cmd = NL80211_CMD_DISASSOCIATE,
4817                 .doit = nl80211_disassociate,
4818                 .policy = nl80211_policy,
4819                 .flags = GENL_ADMIN_PERM,
4820                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4821                                   NL80211_FLAG_NEED_RTNL,
4822         },
4823         {
4824                 .cmd = NL80211_CMD_JOIN_IBSS,
4825                 .doit = nl80211_join_ibss,
4826                 .policy = nl80211_policy,
4827                 .flags = GENL_ADMIN_PERM,
4828                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4829                                   NL80211_FLAG_NEED_RTNL,
4830         },
4831         {
4832                 .cmd = NL80211_CMD_LEAVE_IBSS,
4833                 .doit = nl80211_leave_ibss,
4834                 .policy = nl80211_policy,
4835                 .flags = GENL_ADMIN_PERM,
4836                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4837                                   NL80211_FLAG_NEED_RTNL,
4838         },
4839 #ifdef CONFIG_NL80211_TESTMODE
4840         {
4841                 .cmd = NL80211_CMD_TESTMODE,
4842                 .doit = nl80211_testmode_do,
4843                 .policy = nl80211_policy,
4844                 .flags = GENL_ADMIN_PERM,
4845                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4846                                   NL80211_FLAG_NEED_RTNL,
4847         },
4848 #endif
4849         {
4850                 .cmd = NL80211_CMD_CONNECT,
4851                 .doit = nl80211_connect,
4852                 .policy = nl80211_policy,
4853                 .flags = GENL_ADMIN_PERM,
4854                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4855                                   NL80211_FLAG_NEED_RTNL,
4856         },
4857         {
4858                 .cmd = NL80211_CMD_DISCONNECT,
4859                 .doit = nl80211_disconnect,
4860                 .policy = nl80211_policy,
4861                 .flags = GENL_ADMIN_PERM,
4862                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4863                                   NL80211_FLAG_NEED_RTNL,
4864         },
4865         {
4866                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4867                 .doit = nl80211_wiphy_netns,
4868                 .policy = nl80211_policy,
4869                 .flags = GENL_ADMIN_PERM,
4870                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4871                                   NL80211_FLAG_NEED_RTNL,
4872         },
4873         {
4874                 .cmd = NL80211_CMD_GET_SURVEY,
4875                 .policy = nl80211_policy,
4876                 .dumpit = nl80211_dump_survey,
4877         },
4878         {
4879                 .cmd = NL80211_CMD_SET_PMKSA,
4880                 .doit = nl80211_setdel_pmksa,
4881                 .policy = nl80211_policy,
4882                 .flags = GENL_ADMIN_PERM,
4883                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4884                                   NL80211_FLAG_NEED_RTNL,
4885         },
4886         {
4887                 .cmd = NL80211_CMD_DEL_PMKSA,
4888                 .doit = nl80211_setdel_pmksa,
4889                 .policy = nl80211_policy,
4890                 .flags = GENL_ADMIN_PERM,
4891                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4892                                   NL80211_FLAG_NEED_RTNL,
4893         },
4894         {
4895                 .cmd = NL80211_CMD_FLUSH_PMKSA,
4896                 .doit = nl80211_flush_pmksa,
4897                 .policy = nl80211_policy,
4898                 .flags = GENL_ADMIN_PERM,
4899                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4900                                   NL80211_FLAG_NEED_RTNL,
4901         },
4902         {
4903                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
4904                 .doit = nl80211_remain_on_channel,
4905                 .policy = nl80211_policy,
4906                 .flags = GENL_ADMIN_PERM,
4907                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4908                                   NL80211_FLAG_NEED_RTNL,
4909         },
4910         {
4911                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
4912                 .doit = nl80211_cancel_remain_on_channel,
4913                 .policy = nl80211_policy,
4914                 .flags = GENL_ADMIN_PERM,
4915                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4916                                   NL80211_FLAG_NEED_RTNL,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
4920                 .doit = nl80211_set_tx_bitrate_mask,
4921                 .policy = nl80211_policy,
4922                 .flags = GENL_ADMIN_PERM,
4923                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4924                                   NL80211_FLAG_NEED_RTNL,
4925         },
4926         {
4927                 .cmd = NL80211_CMD_REGISTER_FRAME,
4928                 .doit = nl80211_register_mgmt,
4929                 .policy = nl80211_policy,
4930                 .flags = GENL_ADMIN_PERM,
4931                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4932                                   NL80211_FLAG_NEED_RTNL,
4933         },
4934         {
4935                 .cmd = NL80211_CMD_FRAME,
4936                 .doit = nl80211_tx_mgmt,
4937                 .policy = nl80211_policy,
4938                 .flags = GENL_ADMIN_PERM,
4939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4940                                   NL80211_FLAG_NEED_RTNL,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
4944                 .doit = nl80211_tx_mgmt_cancel_wait,
4945                 .policy = nl80211_policy,
4946                 .flags = GENL_ADMIN_PERM,
4947                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4948                                   NL80211_FLAG_NEED_RTNL,
4949         },
4950         {
4951                 .cmd = NL80211_CMD_SET_POWER_SAVE,
4952                 .doit = nl80211_set_power_save,
4953                 .policy = nl80211_policy,
4954                 .flags = GENL_ADMIN_PERM,
4955                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4956                                   NL80211_FLAG_NEED_RTNL,
4957         },
4958         {
4959                 .cmd = NL80211_CMD_GET_POWER_SAVE,
4960                 .doit = nl80211_get_power_save,
4961                 .policy = nl80211_policy,
4962                 /* can be retrieved by unprivileged users */
4963                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4964                                   NL80211_FLAG_NEED_RTNL,
4965         },
4966         {
4967                 .cmd = NL80211_CMD_SET_CQM,
4968                 .doit = nl80211_set_cqm,
4969                 .policy = nl80211_policy,
4970                 .flags = GENL_ADMIN_PERM,
4971                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4972                                   NL80211_FLAG_NEED_RTNL,
4973         },
4974         {
4975                 .cmd = NL80211_CMD_SET_CHANNEL,
4976                 .doit = nl80211_set_channel,
4977                 .policy = nl80211_policy,
4978                 .flags = GENL_ADMIN_PERM,
4979                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4980                                   NL80211_FLAG_NEED_RTNL,
4981         },
4982         {
4983                 .cmd = NL80211_CMD_SET_WDS_PEER,
4984                 .doit = nl80211_set_wds_peer,
4985                 .policy = nl80211_policy,
4986                 .flags = GENL_ADMIN_PERM,
4987                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4988                                   NL80211_FLAG_NEED_RTNL,
4989         },
4990 };
4991
4992 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4993         .name = "mlme",
4994 };
4995
4996 /* multicast groups */
4997 static struct genl_multicast_group nl80211_config_mcgrp = {
4998         .name = "config",
4999 };
5000 static struct genl_multicast_group nl80211_scan_mcgrp = {
5001         .name = "scan",
5002 };
5003 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5004         .name = "regulatory",
5005 };
5006
5007 /* notification functions */
5008
5009 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5010 {
5011         struct sk_buff *msg;
5012
5013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5014         if (!msg)
5015                 return;
5016
5017         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5018                 nlmsg_free(msg);
5019                 return;
5020         }
5021
5022         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5023                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5024 }
5025
5026 static int nl80211_add_scan_req(struct sk_buff *msg,
5027                                 struct cfg80211_registered_device *rdev)
5028 {
5029         struct cfg80211_scan_request *req = rdev->scan_req;
5030         struct nlattr *nest;
5031         int i;
5032
5033         ASSERT_RDEV_LOCK(rdev);
5034
5035         if (WARN_ON(!req))
5036                 return 0;
5037
5038         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5039         if (!nest)
5040                 goto nla_put_failure;
5041         for (i = 0; i < req->n_ssids; i++)
5042                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5043         nla_nest_end(msg, nest);
5044
5045         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5046         if (!nest)
5047                 goto nla_put_failure;
5048         for (i = 0; i < req->n_channels; i++)
5049                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5050         nla_nest_end(msg, nest);
5051
5052         if (req->ie)
5053                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5054
5055         return 0;
5056  nla_put_failure:
5057         return -ENOBUFS;
5058 }
5059
5060 static int nl80211_send_scan_msg(struct sk_buff *msg,
5061                                  struct cfg80211_registered_device *rdev,
5062                                  struct net_device *netdev,
5063                                  u32 pid, u32 seq, int flags,
5064                                  u32 cmd)
5065 {
5066         void *hdr;
5067
5068         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5069         if (!hdr)
5070                 return -1;
5071
5072         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5073         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5074
5075         /* ignore errors and send incomplete event anyway */
5076         nl80211_add_scan_req(msg, rdev);
5077
5078         return genlmsg_end(msg, hdr);
5079
5080  nla_put_failure:
5081         genlmsg_cancel(msg, hdr);
5082         return -EMSGSIZE;
5083 }
5084
5085 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5086                              struct net_device *netdev)
5087 {
5088         struct sk_buff *msg;
5089
5090         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5091         if (!msg)
5092                 return;
5093
5094         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5095                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5096                 nlmsg_free(msg);
5097                 return;
5098         }
5099
5100         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5101                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5102 }
5103
5104 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5105                             struct net_device *netdev)
5106 {
5107         struct sk_buff *msg;
5108
5109         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5110         if (!msg)
5111                 return;
5112
5113         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5114                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5115                 nlmsg_free(msg);
5116                 return;
5117         }
5118
5119         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5120                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5121 }
5122
5123 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5124                                struct net_device *netdev)
5125 {
5126         struct sk_buff *msg;
5127
5128         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5129         if (!msg)
5130                 return;
5131
5132         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5133                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5134                 nlmsg_free(msg);
5135                 return;
5136         }
5137
5138         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5139                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5140 }
5141
5142 /*
5143  * This can happen on global regulatory changes or device specific settings
5144  * based on custom world regulatory domains.
5145  */
5146 void nl80211_send_reg_change_event(struct regulatory_request *request)
5147 {
5148         struct sk_buff *msg;
5149         void *hdr;
5150
5151         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5152         if (!msg)
5153                 return;
5154
5155         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5156         if (!hdr) {
5157                 nlmsg_free(msg);
5158                 return;
5159         }
5160
5161         /* Userspace can always count this one always being set */
5162         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5163
5164         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5165                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5166                            NL80211_REGDOM_TYPE_WORLD);
5167         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5168                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5169                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5170         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5171                  request->intersect)
5172                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5173                            NL80211_REGDOM_TYPE_INTERSECTION);
5174         else {
5175                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5176                            NL80211_REGDOM_TYPE_COUNTRY);
5177                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5178         }
5179
5180         if (wiphy_idx_valid(request->wiphy_idx))
5181                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5182
5183         if (genlmsg_end(msg, hdr) < 0) {
5184                 nlmsg_free(msg);
5185                 return;
5186         }
5187
5188         rcu_read_lock();
5189         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5190                                 GFP_ATOMIC);
5191         rcu_read_unlock();
5192
5193         return;
5194
5195 nla_put_failure:
5196         genlmsg_cancel(msg, hdr);
5197         nlmsg_free(msg);
5198 }
5199
5200 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5201                                     struct net_device *netdev,
5202                                     const u8 *buf, size_t len,
5203                                     enum nl80211_commands cmd, gfp_t gfp)
5204 {
5205         struct sk_buff *msg;
5206         void *hdr;
5207
5208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5209         if (!msg)
5210                 return;
5211
5212         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5213         if (!hdr) {
5214                 nlmsg_free(msg);
5215                 return;
5216         }
5217
5218         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5219         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5220         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5221
5222         if (genlmsg_end(msg, hdr) < 0) {
5223                 nlmsg_free(msg);
5224                 return;
5225         }
5226
5227         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5228                                 nl80211_mlme_mcgrp.id, gfp);
5229         return;
5230
5231  nla_put_failure:
5232         genlmsg_cancel(msg, hdr);
5233         nlmsg_free(msg);
5234 }
5235
5236 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5237                           struct net_device *netdev, const u8 *buf,
5238                           size_t len, gfp_t gfp)
5239 {
5240         nl80211_send_mlme_event(rdev, netdev, buf, len,
5241                                 NL80211_CMD_AUTHENTICATE, gfp);
5242 }
5243
5244 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5245                            struct net_device *netdev, const u8 *buf,
5246                            size_t len, gfp_t gfp)
5247 {
5248         nl80211_send_mlme_event(rdev, netdev, buf, len,
5249                                 NL80211_CMD_ASSOCIATE, gfp);
5250 }
5251
5252 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5253                          struct net_device *netdev, const u8 *buf,
5254                          size_t len, gfp_t gfp)
5255 {
5256         nl80211_send_mlme_event(rdev, netdev, buf, len,
5257                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5258 }
5259
5260 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5261                            struct net_device *netdev, const u8 *buf,
5262                            size_t len, gfp_t gfp)
5263 {
5264         nl80211_send_mlme_event(rdev, netdev, buf, len,
5265                                 NL80211_CMD_DISASSOCIATE, gfp);
5266 }
5267
5268 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5269                                       struct net_device *netdev, int cmd,
5270                                       const u8 *addr, gfp_t gfp)
5271 {
5272         struct sk_buff *msg;
5273         void *hdr;
5274
5275         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5276         if (!msg)
5277                 return;
5278
5279         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5280         if (!hdr) {
5281                 nlmsg_free(msg);
5282                 return;
5283         }
5284
5285         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5286         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5287         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5288         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5289
5290         if (genlmsg_end(msg, hdr) < 0) {
5291                 nlmsg_free(msg);
5292                 return;
5293         }
5294
5295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5296                                 nl80211_mlme_mcgrp.id, gfp);
5297         return;
5298
5299  nla_put_failure:
5300         genlmsg_cancel(msg, hdr);
5301         nlmsg_free(msg);
5302 }
5303
5304 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5305                                struct net_device *netdev, const u8 *addr,
5306                                gfp_t gfp)
5307 {
5308         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5309                                   addr, gfp);
5310 }
5311
5312 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5313                                 struct net_device *netdev, const u8 *addr,
5314                                 gfp_t gfp)
5315 {
5316         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5317                                   addr, gfp);
5318 }
5319
5320 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5321                                  struct net_device *netdev, const u8 *bssid,
5322                                  const u8 *req_ie, size_t req_ie_len,
5323                                  const u8 *resp_ie, size_t resp_ie_len,
5324                                  u16 status, gfp_t gfp)
5325 {
5326         struct sk_buff *msg;
5327         void *hdr;
5328
5329         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5330         if (!msg)
5331                 return;
5332
5333         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5334         if (!hdr) {
5335                 nlmsg_free(msg);
5336                 return;
5337         }
5338
5339         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5340         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5341         if (bssid)
5342                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5343         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5344         if (req_ie)
5345                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5346         if (resp_ie)
5347                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5348
5349         if (genlmsg_end(msg, hdr) < 0) {
5350                 nlmsg_free(msg);
5351                 return;
5352         }
5353
5354         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5355                                 nl80211_mlme_mcgrp.id, gfp);
5356         return;
5357
5358  nla_put_failure:
5359         genlmsg_cancel(msg, hdr);
5360         nlmsg_free(msg);
5361
5362 }
5363
5364 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5365                          struct net_device *netdev, const u8 *bssid,
5366                          const u8 *req_ie, size_t req_ie_len,
5367                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5368 {
5369         struct sk_buff *msg;
5370         void *hdr;
5371
5372         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5373         if (!msg)
5374                 return;
5375
5376         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5377         if (!hdr) {
5378                 nlmsg_free(msg);
5379                 return;
5380         }
5381
5382         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5383         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5384         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5385         if (req_ie)
5386                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5387         if (resp_ie)
5388                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5389
5390         if (genlmsg_end(msg, hdr) < 0) {
5391                 nlmsg_free(msg);
5392                 return;
5393         }
5394
5395         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5396                                 nl80211_mlme_mcgrp.id, gfp);
5397         return;
5398
5399  nla_put_failure:
5400         genlmsg_cancel(msg, hdr);
5401         nlmsg_free(msg);
5402
5403 }
5404
5405 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5406                                struct net_device *netdev, u16 reason,
5407                                const u8 *ie, size_t ie_len, bool from_ap)
5408 {
5409         struct sk_buff *msg;
5410         void *hdr;
5411
5412         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5413         if (!msg)
5414                 return;
5415
5416         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5417         if (!hdr) {
5418                 nlmsg_free(msg);
5419                 return;
5420         }
5421
5422         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5423         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5424         if (from_ap && reason)
5425                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5426         if (from_ap)
5427                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5428         if (ie)
5429                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5430
5431         if (genlmsg_end(msg, hdr) < 0) {
5432                 nlmsg_free(msg);
5433                 return;
5434         }
5435
5436         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5437                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5438         return;
5439
5440  nla_put_failure:
5441         genlmsg_cancel(msg, hdr);
5442         nlmsg_free(msg);
5443
5444 }
5445
5446 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5447                              struct net_device *netdev, const u8 *bssid,
5448                              gfp_t gfp)
5449 {
5450         struct sk_buff *msg;
5451         void *hdr;
5452
5453         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5454         if (!msg)
5455                 return;
5456
5457         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5458         if (!hdr) {
5459                 nlmsg_free(msg);
5460                 return;
5461         }
5462
5463         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5464         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5465         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5466
5467         if (genlmsg_end(msg, hdr) < 0) {
5468                 nlmsg_free(msg);
5469                 return;
5470         }
5471
5472         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5473                                 nl80211_mlme_mcgrp.id, gfp);
5474         return;
5475
5476  nla_put_failure:
5477         genlmsg_cancel(msg, hdr);
5478         nlmsg_free(msg);
5479 }
5480
5481 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5482                                  struct net_device *netdev, const u8 *addr,
5483                                  enum nl80211_key_type key_type, int key_id,
5484                                  const u8 *tsc, gfp_t gfp)
5485 {
5486         struct sk_buff *msg;
5487         void *hdr;
5488
5489         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5490         if (!msg)
5491                 return;
5492
5493         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5494         if (!hdr) {
5495                 nlmsg_free(msg);
5496                 return;
5497         }
5498
5499         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5500         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5501         if (addr)
5502                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5503         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5504         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5505         if (tsc)
5506                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5507
5508         if (genlmsg_end(msg, hdr) < 0) {
5509                 nlmsg_free(msg);
5510                 return;
5511         }
5512
5513         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5514                                 nl80211_mlme_mcgrp.id, gfp);
5515         return;
5516
5517  nla_put_failure:
5518         genlmsg_cancel(msg, hdr);
5519         nlmsg_free(msg);
5520 }
5521
5522 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5523                                     struct ieee80211_channel *channel_before,
5524                                     struct ieee80211_channel *channel_after)
5525 {
5526         struct sk_buff *msg;
5527         void *hdr;
5528         struct nlattr *nl_freq;
5529
5530         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5531         if (!msg)
5532                 return;
5533
5534         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5535         if (!hdr) {
5536                 nlmsg_free(msg);
5537                 return;
5538         }
5539
5540         /*
5541          * Since we are applying the beacon hint to a wiphy we know its
5542          * wiphy_idx is valid
5543          */
5544         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5545
5546         /* Before */
5547         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5548         if (!nl_freq)
5549                 goto nla_put_failure;
5550         if (nl80211_msg_put_channel(msg, channel_before))
5551                 goto nla_put_failure;
5552         nla_nest_end(msg, nl_freq);
5553
5554         /* After */
5555         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5556         if (!nl_freq)
5557                 goto nla_put_failure;
5558         if (nl80211_msg_put_channel(msg, channel_after))
5559                 goto nla_put_failure;
5560         nla_nest_end(msg, nl_freq);
5561
5562         if (genlmsg_end(msg, hdr) < 0) {
5563                 nlmsg_free(msg);
5564                 return;
5565         }
5566
5567         rcu_read_lock();
5568         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5569                                 GFP_ATOMIC);
5570         rcu_read_unlock();
5571
5572         return;
5573
5574 nla_put_failure:
5575         genlmsg_cancel(msg, hdr);
5576         nlmsg_free(msg);
5577 }
5578
5579 static void nl80211_send_remain_on_chan_event(
5580         int cmd, struct cfg80211_registered_device *rdev,
5581         struct net_device *netdev, u64 cookie,
5582         struct ieee80211_channel *chan,
5583         enum nl80211_channel_type channel_type,
5584         unsigned int duration, gfp_t gfp)
5585 {
5586         struct sk_buff *msg;
5587         void *hdr;
5588
5589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5590         if (!msg)
5591                 return;
5592
5593         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5594         if (!hdr) {
5595                 nlmsg_free(msg);
5596                 return;
5597         }
5598
5599         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5600         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5601         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5602         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5603         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5604
5605         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5606                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5607
5608         if (genlmsg_end(msg, hdr) < 0) {
5609                 nlmsg_free(msg);
5610                 return;
5611         }
5612
5613         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5614                                 nl80211_mlme_mcgrp.id, gfp);
5615         return;
5616
5617  nla_put_failure:
5618         genlmsg_cancel(msg, hdr);
5619         nlmsg_free(msg);
5620 }
5621
5622 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5623                                     struct net_device *netdev, u64 cookie,
5624                                     struct ieee80211_channel *chan,
5625                                     enum nl80211_channel_type channel_type,
5626                                     unsigned int duration, gfp_t gfp)
5627 {
5628         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5629                                           rdev, netdev, cookie, chan,
5630                                           channel_type, duration, gfp);
5631 }
5632
5633 void nl80211_send_remain_on_channel_cancel(
5634         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5635         u64 cookie, struct ieee80211_channel *chan,
5636         enum nl80211_channel_type channel_type, gfp_t gfp)
5637 {
5638         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5639                                           rdev, netdev, cookie, chan,
5640                                           channel_type, 0, gfp);
5641 }
5642
5643 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5644                             struct net_device *dev, const u8 *mac_addr,
5645                             struct station_info *sinfo, gfp_t gfp)
5646 {
5647         struct sk_buff *msg;
5648
5649         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5650         if (!msg)
5651                 return;
5652
5653         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5654                 nlmsg_free(msg);
5655                 return;
5656         }
5657
5658         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5659                                 nl80211_mlme_mcgrp.id, gfp);
5660 }
5661
5662 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
5663                       struct net_device *netdev, u32 nlpid,
5664                       int freq, const u8 *buf, size_t len, gfp_t gfp)
5665 {
5666         struct sk_buff *msg;
5667         void *hdr;
5668         int err;
5669
5670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5671         if (!msg)
5672                 return -ENOMEM;
5673
5674         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
5675         if (!hdr) {
5676                 nlmsg_free(msg);
5677                 return -ENOMEM;
5678         }
5679
5680         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5681         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5682         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5683         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5684
5685         err = genlmsg_end(msg, hdr);
5686         if (err < 0) {
5687                 nlmsg_free(msg);
5688                 return err;
5689         }
5690
5691         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5692         if (err < 0)
5693                 return err;
5694         return 0;
5695
5696  nla_put_failure:
5697         genlmsg_cancel(msg, hdr);
5698         nlmsg_free(msg);
5699         return -ENOBUFS;
5700 }
5701
5702 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
5703                                  struct net_device *netdev, u64 cookie,
5704                                  const u8 *buf, size_t len, bool ack,
5705                                  gfp_t gfp)
5706 {
5707         struct sk_buff *msg;
5708         void *hdr;
5709
5710         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5711         if (!msg)
5712                 return;
5713
5714         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
5715         if (!hdr) {
5716                 nlmsg_free(msg);
5717                 return;
5718         }
5719
5720         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5721         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5722         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5723         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5724         if (ack)
5725                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5726
5727         if (genlmsg_end(msg, hdr) < 0) {
5728                 nlmsg_free(msg);
5729                 return;
5730         }
5731
5732         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5733         return;
5734
5735  nla_put_failure:
5736         genlmsg_cancel(msg, hdr);
5737         nlmsg_free(msg);
5738 }
5739
5740 void
5741 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
5742                              struct net_device *netdev,
5743                              enum nl80211_cqm_rssi_threshold_event rssi_event,
5744                              gfp_t gfp)
5745 {
5746         struct sk_buff *msg;
5747         struct nlattr *pinfoattr;
5748         void *hdr;
5749
5750         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5751         if (!msg)
5752                 return;
5753
5754         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5755         if (!hdr) {
5756                 nlmsg_free(msg);
5757                 return;
5758         }
5759
5760         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5761         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5762
5763         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5764         if (!pinfoattr)
5765                 goto nla_put_failure;
5766
5767         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
5768                     rssi_event);
5769
5770         nla_nest_end(msg, pinfoattr);
5771
5772         if (genlmsg_end(msg, hdr) < 0) {
5773                 nlmsg_free(msg);
5774                 return;
5775         }
5776
5777         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5778                                 nl80211_mlme_mcgrp.id, gfp);
5779         return;
5780
5781  nla_put_failure:
5782         genlmsg_cancel(msg, hdr);
5783         nlmsg_free(msg);
5784 }
5785
5786 void
5787 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
5788                                 struct net_device *netdev, const u8 *peer,
5789                                 u32 num_packets, gfp_t gfp)
5790 {
5791         struct sk_buff *msg;
5792         struct nlattr *pinfoattr;
5793         void *hdr;
5794
5795         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5796         if (!msg)
5797                 return;
5798
5799         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5800         if (!hdr) {
5801                 nlmsg_free(msg);
5802                 return;
5803         }
5804
5805         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5806         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5807         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
5808
5809         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5810         if (!pinfoattr)
5811                 goto nla_put_failure;
5812
5813         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
5814
5815         nla_nest_end(msg, pinfoattr);
5816
5817         if (genlmsg_end(msg, hdr) < 0) {
5818                 nlmsg_free(msg);
5819                 return;
5820         }
5821
5822         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5823                                 nl80211_mlme_mcgrp.id, gfp);
5824         return;
5825
5826  nla_put_failure:
5827         genlmsg_cancel(msg, hdr);
5828         nlmsg_free(msg);
5829 }
5830
5831 static int nl80211_netlink_notify(struct notifier_block * nb,
5832                                   unsigned long state,
5833                                   void *_notify)
5834 {
5835         struct netlink_notify *notify = _notify;
5836         struct cfg80211_registered_device *rdev;
5837         struct wireless_dev *wdev;
5838
5839         if (state != NETLINK_URELEASE)
5840                 return NOTIFY_DONE;
5841
5842         rcu_read_lock();
5843
5844         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5845                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5846                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
5847
5848         rcu_read_unlock();
5849
5850         return NOTIFY_DONE;
5851 }
5852
5853 static struct notifier_block nl80211_netlink_notifier = {
5854         .notifier_call = nl80211_netlink_notify,
5855 };
5856
5857 /* initialisation/exit functions */
5858
5859 int nl80211_init(void)
5860 {
5861         int err;
5862
5863         err = genl_register_family_with_ops(&nl80211_fam,
5864                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5865         if (err)
5866                 return err;
5867
5868         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5869         if (err)
5870                 goto err_out;
5871
5872         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5873         if (err)
5874                 goto err_out;
5875
5876         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5877         if (err)
5878                 goto err_out;
5879
5880         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5881         if (err)
5882                 goto err_out;
5883
5884 #ifdef CONFIG_NL80211_TESTMODE
5885         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5886         if (err)
5887                 goto err_out;
5888 #endif
5889
5890         err = netlink_register_notifier(&nl80211_netlink_notifier);
5891         if (err)
5892                 goto err_out;
5893
5894         return 0;
5895  err_out:
5896         genl_unregister_family(&nl80211_fam);
5897         return err;
5898 }
5899
5900 void nl80211_exit(void)
5901 {
5902         netlink_unregister_notifier(&nl80211_netlink_notifier);
5903         genl_unregister_family(&nl80211_fam);
5904 }