mac80211: Send mesh non-HWMP path selection frames to userspace
[linux-2.6.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25
26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
27                             struct genl_info *info);
28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
29                               struct genl_info *info);
30
31 /* the netlink family */
32 static struct genl_family nl80211_fam = {
33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
34         .name = "nl80211",      /* have users key off the name instead */
35         .hdrsize = 0,           /* no private header */
36         .version = 1,           /* no particular meaning now */
37         .maxattr = NL80211_ATTR_MAX,
38         .netnsok = true,
39         .pre_doit = nl80211_pre_doit,
40         .post_doit = nl80211_post_doit,
41 };
42
43 /* internal helper: get rdev and dev */
44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
45                                        struct cfg80211_registered_device **rdev,
46                                        struct net_device **dev)
47 {
48         struct nlattr **attrs = info->attrs;
49         int ifindex;
50
51         if (!attrs[NL80211_ATTR_IFINDEX])
52                 return -EINVAL;
53
54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
56         if (!*dev)
57                 return -ENODEV;
58
59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
60         if (IS_ERR(*rdev)) {
61                 dev_put(*dev);
62                 return PTR_ERR(*rdev);
63         }
64
65         return 0;
66 }
67
68 /* policy for the attributes */
69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
72                                       .len = 20-1 },
73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
81
82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
85
86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
88
89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
91                                     .len = WLAN_MAX_KEY_LEN },
92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
96         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
97
98         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
99         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
100         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
101                                        .len = IEEE80211_MAX_DATA_LEN },
102         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
103                                        .len = IEEE80211_MAX_DATA_LEN },
104         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
105         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
106         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
107         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
108                                                .len = NL80211_MAX_SUPP_RATES },
109         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
110         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
111         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
112         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
113                                 .len = IEEE80211_MAX_MESH_ID_LEN },
114         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
115
116         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
117         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
118
119         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
120         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
121         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
122         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
123                                            .len = NL80211_MAX_SUPP_RATES },
124         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
125
126         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
127
128         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
129                                          .len = NL80211_HT_CAPABILITY_LEN },
130
131         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
132         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
133                               .len = IEEE80211_MAX_DATA_LEN },
134         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
135         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
136
137         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
138                                 .len = IEEE80211_MAX_SSID_LEN },
139         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
140         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
141         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
142         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
143         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
144         [NL80211_ATTR_STA_FLAGS2] = {
145                 .len = sizeof(struct nl80211_sta_flag_update),
146         },
147         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
148         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
149         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
150         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
151         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
152         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
153         [NL80211_ATTR_PID] = { .type = NLA_U32 },
154         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
155         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
156                                  .len = WLAN_PMKID_LEN },
157         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
158         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
159         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
160         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
161                                  .len = IEEE80211_MAX_DATA_LEN },
162         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
163         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
164         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
165         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
166         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
167         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
168         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
169         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
170         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
171         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
172         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
173         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
174         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
175 };
176
177 /* policy for the key attributes */
178 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
179         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
180         [NL80211_KEY_IDX] = { .type = NLA_U8 },
181         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
182         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
183         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
184         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
185         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
186         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
187 };
188
189 /* policy for the key default flags */
190 static const struct nla_policy
191 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
192         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
193         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
194 };
195
196 /* ifidx get helper */
197 static int nl80211_get_ifidx(struct netlink_callback *cb)
198 {
199         int res;
200
201         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
202                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
203                           nl80211_policy);
204         if (res)
205                 return res;
206
207         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
208                 return -EINVAL;
209
210         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
211         if (!res)
212                 return -EINVAL;
213         return res;
214 }
215
216 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
217                                        struct netlink_callback *cb,
218                                        struct cfg80211_registered_device **rdev,
219                                        struct net_device **dev)
220 {
221         int ifidx = cb->args[0];
222         int err;
223
224         if (!ifidx)
225                 ifidx = nl80211_get_ifidx(cb);
226         if (ifidx < 0)
227                 return ifidx;
228
229         cb->args[0] = ifidx;
230
231         rtnl_lock();
232
233         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
234         if (!*dev) {
235                 err = -ENODEV;
236                 goto out_rtnl;
237         }
238
239         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
240         if (IS_ERR(*rdev)) {
241                 err = PTR_ERR(*rdev);
242                 goto out_rtnl;
243         }
244
245         return 0;
246  out_rtnl:
247         rtnl_unlock();
248         return err;
249 }
250
251 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
252 {
253         cfg80211_unlock_rdev(rdev);
254         rtnl_unlock();
255 }
256
257 /* IE validation */
258 static bool is_valid_ie_attr(const struct nlattr *attr)
259 {
260         const u8 *pos;
261         int len;
262
263         if (!attr)
264                 return true;
265
266         pos = nla_data(attr);
267         len = nla_len(attr);
268
269         while (len) {
270                 u8 elemlen;
271
272                 if (len < 2)
273                         return false;
274                 len -= 2;
275
276                 elemlen = pos[1];
277                 if (elemlen > len)
278                         return false;
279
280                 len -= elemlen;
281                 pos += 2 + elemlen;
282         }
283
284         return true;
285 }
286
287 /* message building helper */
288 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
289                                    int flags, u8 cmd)
290 {
291         /* since there is no private header just add the generic one */
292         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
293 }
294
295 static int nl80211_msg_put_channel(struct sk_buff *msg,
296                                    struct ieee80211_channel *chan)
297 {
298         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
299                     chan->center_freq);
300
301         if (chan->flags & IEEE80211_CHAN_DISABLED)
302                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
303         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
304                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
305         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
306                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
307         if (chan->flags & IEEE80211_CHAN_RADAR)
308                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
309
310         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
311                     DBM_TO_MBM(chan->max_power));
312
313         return 0;
314
315  nla_put_failure:
316         return -ENOBUFS;
317 }
318
319 /* netlink command implementations */
320
321 struct key_parse {
322         struct key_params p;
323         int idx;
324         int type;
325         bool def, defmgmt;
326         bool def_uni, def_multi;
327 };
328
329 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
330 {
331         struct nlattr *tb[NL80211_KEY_MAX + 1];
332         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
333                                    nl80211_key_policy);
334         if (err)
335                 return err;
336
337         k->def = !!tb[NL80211_KEY_DEFAULT];
338         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
339
340         if (k->def) {
341                 k->def_uni = true;
342                 k->def_multi = true;
343         }
344         if (k->defmgmt)
345                 k->def_multi = true;
346
347         if (tb[NL80211_KEY_IDX])
348                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
349
350         if (tb[NL80211_KEY_DATA]) {
351                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
352                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
353         }
354
355         if (tb[NL80211_KEY_SEQ]) {
356                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
357                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
358         }
359
360         if (tb[NL80211_KEY_CIPHER])
361                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
362
363         if (tb[NL80211_KEY_TYPE]) {
364                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
365                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
366                         return -EINVAL;
367         }
368
369         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
370                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
371                 int err = nla_parse_nested(kdt,
372                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
373                                            tb[NL80211_KEY_DEFAULT_TYPES],
374                                            nl80211_key_default_policy);
375                 if (err)
376                         return err;
377
378                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
379                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
380         }
381
382         return 0;
383 }
384
385 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
386 {
387         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
388                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
389                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
390         }
391
392         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
393                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
394                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
395         }
396
397         if (info->attrs[NL80211_ATTR_KEY_IDX])
398                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
399
400         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
401                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
402
403         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
404         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
405
406         if (k->def) {
407                 k->def_uni = true;
408                 k->def_multi = true;
409         }
410         if (k->defmgmt)
411                 k->def_multi = true;
412
413         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
414                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
415                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
416                         return -EINVAL;
417         }
418
419         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
420                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
421                 int err = nla_parse_nested(
422                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
423                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
424                                 nl80211_key_default_policy);
425                 if (err)
426                         return err;
427
428                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
429                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
430         }
431
432         return 0;
433 }
434
435 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
436 {
437         int err;
438
439         memset(k, 0, sizeof(*k));
440         k->idx = -1;
441         k->type = -1;
442
443         if (info->attrs[NL80211_ATTR_KEY])
444                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
445         else
446                 err = nl80211_parse_key_old(info, k);
447
448         if (err)
449                 return err;
450
451         if (k->def && k->defmgmt)
452                 return -EINVAL;
453
454         if (k->defmgmt) {
455                 if (k->def_uni || !k->def_multi)
456                         return -EINVAL;
457         }
458
459         if (k->idx != -1) {
460                 if (k->defmgmt) {
461                         if (k->idx < 4 || k->idx > 5)
462                                 return -EINVAL;
463                 } else if (k->def) {
464                         if (k->idx < 0 || k->idx > 3)
465                                 return -EINVAL;
466                 } else {
467                         if (k->idx < 0 || k->idx > 5)
468                                 return -EINVAL;
469                 }
470         }
471
472         return 0;
473 }
474
475 static struct cfg80211_cached_keys *
476 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
477                        struct nlattr *keys)
478 {
479         struct key_parse parse;
480         struct nlattr *key;
481         struct cfg80211_cached_keys *result;
482         int rem, err, def = 0;
483
484         result = kzalloc(sizeof(*result), GFP_KERNEL);
485         if (!result)
486                 return ERR_PTR(-ENOMEM);
487
488         result->def = -1;
489         result->defmgmt = -1;
490
491         nla_for_each_nested(key, keys, rem) {
492                 memset(&parse, 0, sizeof(parse));
493                 parse.idx = -1;
494
495                 err = nl80211_parse_key_new(key, &parse);
496                 if (err)
497                         goto error;
498                 err = -EINVAL;
499                 if (!parse.p.key)
500                         goto error;
501                 if (parse.idx < 0 || parse.idx > 4)
502                         goto error;
503                 if (parse.def) {
504                         if (def)
505                                 goto error;
506                         def = 1;
507                         result->def = parse.idx;
508                         if (!parse.def_uni || !parse.def_multi)
509                                 goto error;
510                 } else if (parse.defmgmt)
511                         goto error;
512                 err = cfg80211_validate_key_settings(rdev, &parse.p,
513                                                      parse.idx, false, NULL);
514                 if (err)
515                         goto error;
516                 result->params[parse.idx].cipher = parse.p.cipher;
517                 result->params[parse.idx].key_len = parse.p.key_len;
518                 result->params[parse.idx].key = result->data[parse.idx];
519                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
520         }
521
522         return result;
523  error:
524         kfree(result);
525         return ERR_PTR(err);
526 }
527
528 static int nl80211_key_allowed(struct wireless_dev *wdev)
529 {
530         ASSERT_WDEV_LOCK(wdev);
531
532         switch (wdev->iftype) {
533         case NL80211_IFTYPE_AP:
534         case NL80211_IFTYPE_AP_VLAN:
535         case NL80211_IFTYPE_P2P_GO:
536                 break;
537         case NL80211_IFTYPE_ADHOC:
538                 if (!wdev->current_bss)
539                         return -ENOLINK;
540                 break;
541         case NL80211_IFTYPE_STATION:
542         case NL80211_IFTYPE_P2P_CLIENT:
543                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
544                         return -ENOLINK;
545                 break;
546         default:
547                 return -EINVAL;
548         }
549
550         return 0;
551 }
552
553 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
554                               struct cfg80211_registered_device *dev)
555 {
556         void *hdr;
557         struct nlattr *nl_bands, *nl_band;
558         struct nlattr *nl_freqs, *nl_freq;
559         struct nlattr *nl_rates, *nl_rate;
560         struct nlattr *nl_modes;
561         struct nlattr *nl_cmds;
562         enum ieee80211_band band;
563         struct ieee80211_channel *chan;
564         struct ieee80211_rate *rate;
565         int i;
566         u16 ifmodes = dev->wiphy.interface_modes;
567         const struct ieee80211_txrx_stypes *mgmt_stypes =
568                                 dev->wiphy.mgmt_stypes;
569
570         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
571         if (!hdr)
572                 return -1;
573
574         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
575         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
576
577         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
578                     cfg80211_rdev_list_generation);
579
580         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
581                    dev->wiphy.retry_short);
582         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
583                    dev->wiphy.retry_long);
584         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
585                     dev->wiphy.frag_threshold);
586         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
587                     dev->wiphy.rts_threshold);
588         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
589                     dev->wiphy.coverage_class);
590         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
591                    dev->wiphy.max_scan_ssids);
592         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
593                     dev->wiphy.max_scan_ie_len);
594
595         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
596                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
597
598         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
599                 sizeof(u32) * dev->wiphy.n_cipher_suites,
600                 dev->wiphy.cipher_suites);
601
602         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
603                    dev->wiphy.max_num_pmkids);
604
605         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
606                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
607
608         if (dev->wiphy.available_antennas && dev->ops->get_antenna) {
609                 u32 tx_ant = 0, rx_ant = 0;
610                 int res;
611                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
612                 if (!res) {
613                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
614                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
615                 }
616         }
617
618         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
619         if (!nl_modes)
620                 goto nla_put_failure;
621
622         i = 0;
623         while (ifmodes) {
624                 if (ifmodes & 1)
625                         NLA_PUT_FLAG(msg, i);
626                 ifmodes >>= 1;
627                 i++;
628         }
629
630         nla_nest_end(msg, nl_modes);
631
632         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
633         if (!nl_bands)
634                 goto nla_put_failure;
635
636         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
637                 if (!dev->wiphy.bands[band])
638                         continue;
639
640                 nl_band = nla_nest_start(msg, band);
641                 if (!nl_band)
642                         goto nla_put_failure;
643
644                 /* add HT info */
645                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
646                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
647                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
648                                 &dev->wiphy.bands[band]->ht_cap.mcs);
649                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
650                                 dev->wiphy.bands[band]->ht_cap.cap);
651                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
652                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
653                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
654                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
655                 }
656
657                 /* add frequencies */
658                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
659                 if (!nl_freqs)
660                         goto nla_put_failure;
661
662                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
663                         nl_freq = nla_nest_start(msg, i);
664                         if (!nl_freq)
665                                 goto nla_put_failure;
666
667                         chan = &dev->wiphy.bands[band]->channels[i];
668
669                         if (nl80211_msg_put_channel(msg, chan))
670                                 goto nla_put_failure;
671
672                         nla_nest_end(msg, nl_freq);
673                 }
674
675                 nla_nest_end(msg, nl_freqs);
676
677                 /* add bitrates */
678                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
679                 if (!nl_rates)
680                         goto nla_put_failure;
681
682                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
683                         nl_rate = nla_nest_start(msg, i);
684                         if (!nl_rate)
685                                 goto nla_put_failure;
686
687                         rate = &dev->wiphy.bands[band]->bitrates[i];
688                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
689                                     rate->bitrate);
690                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
691                                 NLA_PUT_FLAG(msg,
692                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
693
694                         nla_nest_end(msg, nl_rate);
695                 }
696
697                 nla_nest_end(msg, nl_rates);
698
699                 nla_nest_end(msg, nl_band);
700         }
701         nla_nest_end(msg, nl_bands);
702
703         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
704         if (!nl_cmds)
705                 goto nla_put_failure;
706
707         i = 0;
708 #define CMD(op, n)                                              \
709          do {                                                   \
710                 if (dev->ops->op) {                             \
711                         i++;                                    \
712                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
713                 }                                               \
714         } while (0)
715
716         CMD(add_virtual_intf, NEW_INTERFACE);
717         CMD(change_virtual_intf, SET_INTERFACE);
718         CMD(add_key, NEW_KEY);
719         CMD(add_beacon, NEW_BEACON);
720         CMD(add_station, NEW_STATION);
721         CMD(add_mpath, NEW_MPATH);
722         CMD(update_mesh_config, SET_MESH_CONFIG);
723         CMD(change_bss, SET_BSS);
724         CMD(auth, AUTHENTICATE);
725         CMD(assoc, ASSOCIATE);
726         CMD(deauth, DEAUTHENTICATE);
727         CMD(disassoc, DISASSOCIATE);
728         CMD(join_ibss, JOIN_IBSS);
729         CMD(join_mesh, JOIN_MESH);
730         CMD(set_pmksa, SET_PMKSA);
731         CMD(del_pmksa, DEL_PMKSA);
732         CMD(flush_pmksa, FLUSH_PMKSA);
733         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
734         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
735         CMD(mgmt_tx, FRAME);
736         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
737         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
738                 i++;
739                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
740         }
741         CMD(set_channel, SET_CHANNEL);
742         CMD(set_wds_peer, SET_WDS_PEER);
743
744 #undef CMD
745
746         if (dev->ops->connect || dev->ops->auth) {
747                 i++;
748                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
749         }
750
751         if (dev->ops->disconnect || dev->ops->deauth) {
752                 i++;
753                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
754         }
755
756         nla_nest_end(msg, nl_cmds);
757
758         if (dev->ops->remain_on_channel)
759                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
760                             dev->wiphy.max_remain_on_channel_duration);
761
762         /* for now at least assume all drivers have it */
763         if (dev->ops->mgmt_tx)
764                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
765
766         if (mgmt_stypes) {
767                 u16 stypes;
768                 struct nlattr *nl_ftypes, *nl_ifs;
769                 enum nl80211_iftype ift;
770
771                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
772                 if (!nl_ifs)
773                         goto nla_put_failure;
774
775                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
776                         nl_ftypes = nla_nest_start(msg, ift);
777                         if (!nl_ftypes)
778                                 goto nla_put_failure;
779                         i = 0;
780                         stypes = mgmt_stypes[ift].tx;
781                         while (stypes) {
782                                 if (stypes & 1)
783                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
784                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
785                                 stypes >>= 1;
786                                 i++;
787                         }
788                         nla_nest_end(msg, nl_ftypes);
789                 }
790
791                 nla_nest_end(msg, nl_ifs);
792
793                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
794                 if (!nl_ifs)
795                         goto nla_put_failure;
796
797                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
798                         nl_ftypes = nla_nest_start(msg, ift);
799                         if (!nl_ftypes)
800                                 goto nla_put_failure;
801                         i = 0;
802                         stypes = mgmt_stypes[ift].rx;
803                         while (stypes) {
804                                 if (stypes & 1)
805                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
806                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
807                                 stypes >>= 1;
808                                 i++;
809                         }
810                         nla_nest_end(msg, nl_ftypes);
811                 }
812                 nla_nest_end(msg, nl_ifs);
813         }
814
815         return genlmsg_end(msg, hdr);
816
817  nla_put_failure:
818         genlmsg_cancel(msg, hdr);
819         return -EMSGSIZE;
820 }
821
822 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
823 {
824         int idx = 0;
825         int start = cb->args[0];
826         struct cfg80211_registered_device *dev;
827
828         mutex_lock(&cfg80211_mutex);
829         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
830                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
831                         continue;
832                 if (++idx <= start)
833                         continue;
834                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
835                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
836                                        dev) < 0) {
837                         idx--;
838                         break;
839                 }
840         }
841         mutex_unlock(&cfg80211_mutex);
842
843         cb->args[0] = idx;
844
845         return skb->len;
846 }
847
848 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
849 {
850         struct sk_buff *msg;
851         struct cfg80211_registered_device *dev = info->user_ptr[0];
852
853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
854         if (!msg)
855                 return -ENOMEM;
856
857         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
858                 nlmsg_free(msg);
859                 return -ENOBUFS;
860         }
861
862         return genlmsg_reply(msg, info);
863 }
864
865 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
866         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
867         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
868         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
869         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
870         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
871 };
872
873 static int parse_txq_params(struct nlattr *tb[],
874                             struct ieee80211_txq_params *txq_params)
875 {
876         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
877             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
878             !tb[NL80211_TXQ_ATTR_AIFS])
879                 return -EINVAL;
880
881         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
882         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
883         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
884         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
885         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
886
887         return 0;
888 }
889
890 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
891 {
892         /*
893          * You can only set the channel explicitly for AP, mesh
894          * and WDS type interfaces; all others have their channel
895          * managed via their respective "establish a connection"
896          * command (connect, join, ...)
897          *
898          * Monitors are special as they are normally slaved to
899          * whatever else is going on, so they behave as though
900          * you tried setting the wiphy channel itself.
901          */
902         return !wdev ||
903                 wdev->iftype == NL80211_IFTYPE_AP ||
904                 wdev->iftype == NL80211_IFTYPE_WDS ||
905                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
906                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
907                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
908 }
909
910 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
911                                  struct wireless_dev *wdev,
912                                  struct genl_info *info)
913 {
914         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
915         u32 freq;
916         int result;
917
918         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
919                 return -EINVAL;
920
921         if (!nl80211_can_set_dev_channel(wdev))
922                 return -EOPNOTSUPP;
923
924         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
925                 channel_type = nla_get_u32(info->attrs[
926                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
927                 if (channel_type != NL80211_CHAN_NO_HT &&
928                     channel_type != NL80211_CHAN_HT20 &&
929                     channel_type != NL80211_CHAN_HT40PLUS &&
930                     channel_type != NL80211_CHAN_HT40MINUS)
931                         return -EINVAL;
932         }
933
934         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
935
936         mutex_lock(&rdev->devlist_mtx);
937         if (wdev) {
938                 wdev_lock(wdev);
939                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
940                 wdev_unlock(wdev);
941         } else {
942                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
943         }
944         mutex_unlock(&rdev->devlist_mtx);
945
946         return result;
947 }
948
949 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
950 {
951         struct cfg80211_registered_device *rdev = info->user_ptr[0];
952         struct net_device *netdev = info->user_ptr[1];
953
954         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
955 }
956
957 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
958 {
959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
960         struct net_device *dev = info->user_ptr[1];
961         struct wireless_dev *wdev = dev->ieee80211_ptr;
962         const u8 *bssid;
963
964         if (!info->attrs[NL80211_ATTR_MAC])
965                 return -EINVAL;
966
967         if (netif_running(dev))
968                 return -EBUSY;
969
970         if (!rdev->ops->set_wds_peer)
971                 return -EOPNOTSUPP;
972
973         if (wdev->iftype != NL80211_IFTYPE_WDS)
974                 return -EOPNOTSUPP;
975
976         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
977         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
978 }
979
980
981 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
982 {
983         struct cfg80211_registered_device *rdev;
984         struct net_device *netdev = NULL;
985         struct wireless_dev *wdev;
986         int result = 0, rem_txq_params = 0;
987         struct nlattr *nl_txq_params;
988         u32 changed;
989         u8 retry_short = 0, retry_long = 0;
990         u32 frag_threshold = 0, rts_threshold = 0;
991         u8 coverage_class = 0;
992
993         /*
994          * Try to find the wiphy and netdev. Normally this
995          * function shouldn't need the netdev, but this is
996          * done for backward compatibility -- previously
997          * setting the channel was done per wiphy, but now
998          * it is per netdev. Previous userland like hostapd
999          * also passed a netdev to set_wiphy, so that it is
1000          * possible to let that go to the right netdev!
1001          */
1002         mutex_lock(&cfg80211_mutex);
1003
1004         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1005                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1006
1007                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1008                 if (netdev && netdev->ieee80211_ptr) {
1009                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1010                         mutex_lock(&rdev->mtx);
1011                 } else
1012                         netdev = NULL;
1013         }
1014
1015         if (!netdev) {
1016                 rdev = __cfg80211_rdev_from_info(info);
1017                 if (IS_ERR(rdev)) {
1018                         mutex_unlock(&cfg80211_mutex);
1019                         return PTR_ERR(rdev);
1020                 }
1021                 wdev = NULL;
1022                 netdev = NULL;
1023                 result = 0;
1024
1025                 mutex_lock(&rdev->mtx);
1026         } else if (netif_running(netdev) &&
1027                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1028                 wdev = netdev->ieee80211_ptr;
1029         else
1030                 wdev = NULL;
1031
1032         /*
1033          * end workaround code, by now the rdev is available
1034          * and locked, and wdev may or may not be NULL.
1035          */
1036
1037         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1038                 result = cfg80211_dev_rename(
1039                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1040
1041         mutex_unlock(&cfg80211_mutex);
1042
1043         if (result)
1044                 goto bad_res;
1045
1046         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1047                 struct ieee80211_txq_params txq_params;
1048                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1049
1050                 if (!rdev->ops->set_txq_params) {
1051                         result = -EOPNOTSUPP;
1052                         goto bad_res;
1053                 }
1054
1055                 nla_for_each_nested(nl_txq_params,
1056                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1057                                     rem_txq_params) {
1058                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1059                                   nla_data(nl_txq_params),
1060                                   nla_len(nl_txq_params),
1061                                   txq_params_policy);
1062                         result = parse_txq_params(tb, &txq_params);
1063                         if (result)
1064                                 goto bad_res;
1065
1066                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1067                                                            &txq_params);
1068                         if (result)
1069                                 goto bad_res;
1070                 }
1071         }
1072
1073         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1074                 result = __nl80211_set_channel(rdev, wdev, info);
1075                 if (result)
1076                         goto bad_res;
1077         }
1078
1079         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1080                 enum nl80211_tx_power_setting type;
1081                 int idx, mbm = 0;
1082
1083                 if (!rdev->ops->set_tx_power) {
1084                         result = -EOPNOTSUPP;
1085                         goto bad_res;
1086                 }
1087
1088                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1089                 type = nla_get_u32(info->attrs[idx]);
1090
1091                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1092                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1093                         result = -EINVAL;
1094                         goto bad_res;
1095                 }
1096
1097                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1098                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1099                         mbm = nla_get_u32(info->attrs[idx]);
1100                 }
1101
1102                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1103                 if (result)
1104                         goto bad_res;
1105         }
1106
1107         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1108             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1109                 u32 tx_ant, rx_ant;
1110                 if (!rdev->wiphy.available_antennas || !rdev->ops->set_antenna) {
1111                         result = -EOPNOTSUPP;
1112                         goto bad_res;
1113                 }
1114
1115                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1116                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1117
1118                 /* reject antenna configurations which don't match the
1119                  * available antenna mask, except for the "all" mask */
1120                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas)) ||
1121                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas))) {
1122                         result = -EINVAL;
1123                         goto bad_res;
1124                 }
1125
1126                 tx_ant = tx_ant & rdev->wiphy.available_antennas;
1127                 rx_ant = rx_ant & rdev->wiphy.available_antennas;
1128
1129                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1130                 if (result)
1131                         goto bad_res;
1132         }
1133
1134         changed = 0;
1135
1136         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1137                 retry_short = nla_get_u8(
1138                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1139                 if (retry_short == 0) {
1140                         result = -EINVAL;
1141                         goto bad_res;
1142                 }
1143                 changed |= WIPHY_PARAM_RETRY_SHORT;
1144         }
1145
1146         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1147                 retry_long = nla_get_u8(
1148                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1149                 if (retry_long == 0) {
1150                         result = -EINVAL;
1151                         goto bad_res;
1152                 }
1153                 changed |= WIPHY_PARAM_RETRY_LONG;
1154         }
1155
1156         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1157                 frag_threshold = nla_get_u32(
1158                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1159                 if (frag_threshold < 256) {
1160                         result = -EINVAL;
1161                         goto bad_res;
1162                 }
1163                 if (frag_threshold != (u32) -1) {
1164                         /*
1165                          * Fragments (apart from the last one) are required to
1166                          * have even length. Make the fragmentation code
1167                          * simpler by stripping LSB should someone try to use
1168                          * odd threshold value.
1169                          */
1170                         frag_threshold &= ~0x1;
1171                 }
1172                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1173         }
1174
1175         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1176                 rts_threshold = nla_get_u32(
1177                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1178                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1179         }
1180
1181         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1182                 coverage_class = nla_get_u8(
1183                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1184                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1185         }
1186
1187         if (changed) {
1188                 u8 old_retry_short, old_retry_long;
1189                 u32 old_frag_threshold, old_rts_threshold;
1190                 u8 old_coverage_class;
1191
1192                 if (!rdev->ops->set_wiphy_params) {
1193                         result = -EOPNOTSUPP;
1194                         goto bad_res;
1195                 }
1196
1197                 old_retry_short = rdev->wiphy.retry_short;
1198                 old_retry_long = rdev->wiphy.retry_long;
1199                 old_frag_threshold = rdev->wiphy.frag_threshold;
1200                 old_rts_threshold = rdev->wiphy.rts_threshold;
1201                 old_coverage_class = rdev->wiphy.coverage_class;
1202
1203                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1204                         rdev->wiphy.retry_short = retry_short;
1205                 if (changed & WIPHY_PARAM_RETRY_LONG)
1206                         rdev->wiphy.retry_long = retry_long;
1207                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1208                         rdev->wiphy.frag_threshold = frag_threshold;
1209                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1210                         rdev->wiphy.rts_threshold = rts_threshold;
1211                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1212                         rdev->wiphy.coverage_class = coverage_class;
1213
1214                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1215                 if (result) {
1216                         rdev->wiphy.retry_short = old_retry_short;
1217                         rdev->wiphy.retry_long = old_retry_long;
1218                         rdev->wiphy.frag_threshold = old_frag_threshold;
1219                         rdev->wiphy.rts_threshold = old_rts_threshold;
1220                         rdev->wiphy.coverage_class = old_coverage_class;
1221                 }
1222         }
1223
1224  bad_res:
1225         mutex_unlock(&rdev->mtx);
1226         if (netdev)
1227                 dev_put(netdev);
1228         return result;
1229 }
1230
1231
1232 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1233                               struct cfg80211_registered_device *rdev,
1234                               struct net_device *dev)
1235 {
1236         void *hdr;
1237
1238         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1239         if (!hdr)
1240                 return -1;
1241
1242         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1243         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1244         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1245         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1246
1247         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1248                     rdev->devlist_generation ^
1249                         (cfg80211_rdev_list_generation << 2));
1250
1251         return genlmsg_end(msg, hdr);
1252
1253  nla_put_failure:
1254         genlmsg_cancel(msg, hdr);
1255         return -EMSGSIZE;
1256 }
1257
1258 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1259 {
1260         int wp_idx = 0;
1261         int if_idx = 0;
1262         int wp_start = cb->args[0];
1263         int if_start = cb->args[1];
1264         struct cfg80211_registered_device *rdev;
1265         struct wireless_dev *wdev;
1266
1267         mutex_lock(&cfg80211_mutex);
1268         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1269                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1270                         continue;
1271                 if (wp_idx < wp_start) {
1272                         wp_idx++;
1273                         continue;
1274                 }
1275                 if_idx = 0;
1276
1277                 mutex_lock(&rdev->devlist_mtx);
1278                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1279                         if (if_idx < if_start) {
1280                                 if_idx++;
1281                                 continue;
1282                         }
1283                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1284                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1285                                                rdev, wdev->netdev) < 0) {
1286                                 mutex_unlock(&rdev->devlist_mtx);
1287                                 goto out;
1288                         }
1289                         if_idx++;
1290                 }
1291                 mutex_unlock(&rdev->devlist_mtx);
1292
1293                 wp_idx++;
1294         }
1295  out:
1296         mutex_unlock(&cfg80211_mutex);
1297
1298         cb->args[0] = wp_idx;
1299         cb->args[1] = if_idx;
1300
1301         return skb->len;
1302 }
1303
1304 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1305 {
1306         struct sk_buff *msg;
1307         struct cfg80211_registered_device *dev = info->user_ptr[0];
1308         struct net_device *netdev = info->user_ptr[1];
1309
1310         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1311         if (!msg)
1312                 return -ENOMEM;
1313
1314         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1315                                dev, netdev) < 0) {
1316                 nlmsg_free(msg);
1317                 return -ENOBUFS;
1318         }
1319
1320         return genlmsg_reply(msg, info);
1321 }
1322
1323 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1324         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1325         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1326         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1327         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1328         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1329 };
1330
1331 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1332 {
1333         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1334         int flag;
1335
1336         *mntrflags = 0;
1337
1338         if (!nla)
1339                 return -EINVAL;
1340
1341         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1342                              nla, mntr_flags_policy))
1343                 return -EINVAL;
1344
1345         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1346                 if (flags[flag])
1347                         *mntrflags |= (1<<flag);
1348
1349         return 0;
1350 }
1351
1352 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1353                                struct net_device *netdev, u8 use_4addr,
1354                                enum nl80211_iftype iftype)
1355 {
1356         if (!use_4addr) {
1357                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1358                         return -EBUSY;
1359                 return 0;
1360         }
1361
1362         switch (iftype) {
1363         case NL80211_IFTYPE_AP_VLAN:
1364                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1365                         return 0;
1366                 break;
1367         case NL80211_IFTYPE_STATION:
1368                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1369                         return 0;
1370                 break;
1371         default:
1372                 break;
1373         }
1374
1375         return -EOPNOTSUPP;
1376 }
1377
1378 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1379 {
1380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1381         struct vif_params params;
1382         int err;
1383         enum nl80211_iftype otype, ntype;
1384         struct net_device *dev = info->user_ptr[1];
1385         u32 _flags, *flags = NULL;
1386         bool change = false;
1387
1388         memset(&params, 0, sizeof(params));
1389
1390         otype = ntype = dev->ieee80211_ptr->iftype;
1391
1392         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1393                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1394                 if (otype != ntype)
1395                         change = true;
1396                 if (ntype > NL80211_IFTYPE_MAX)
1397                         return -EINVAL;
1398         }
1399
1400         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1401                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1402
1403                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1404                         return -EINVAL;
1405                 if (netif_running(dev))
1406                         return -EBUSY;
1407
1408                 wdev_lock(wdev);
1409                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1410                              IEEE80211_MAX_MESH_ID_LEN);
1411                 wdev->mesh_id_up_len =
1412                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1413                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1414                        wdev->mesh_id_up_len);
1415                 wdev_unlock(wdev);
1416         }
1417
1418         if (info->attrs[NL80211_ATTR_4ADDR]) {
1419                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1420                 change = true;
1421                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1422                 if (err)
1423                         return err;
1424         } else {
1425                 params.use_4addr = -1;
1426         }
1427
1428         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1429                 if (ntype != NL80211_IFTYPE_MONITOR)
1430                         return -EINVAL;
1431                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1432                                           &_flags);
1433                 if (err)
1434                         return err;
1435
1436                 flags = &_flags;
1437                 change = true;
1438         }
1439
1440         if (change)
1441                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1442         else
1443                 err = 0;
1444
1445         if (!err && params.use_4addr != -1)
1446                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1447
1448         return err;
1449 }
1450
1451 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1452 {
1453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1454         struct vif_params params;
1455         struct net_device *dev;
1456         int err;
1457         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1458         u32 flags;
1459
1460         memset(&params, 0, sizeof(params));
1461
1462         if (!info->attrs[NL80211_ATTR_IFNAME])
1463                 return -EINVAL;
1464
1465         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1466                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1467                 if (type > NL80211_IFTYPE_MAX)
1468                         return -EINVAL;
1469         }
1470
1471         if (!rdev->ops->add_virtual_intf ||
1472             !(rdev->wiphy.interface_modes & (1 << type)))
1473                 return -EOPNOTSUPP;
1474
1475         if (info->attrs[NL80211_ATTR_4ADDR]) {
1476                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1477                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1478                 if (err)
1479                         return err;
1480         }
1481
1482         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1483                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1484                                   &flags);
1485         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1486                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1487                 type, err ? NULL : &flags, &params);
1488         if (IS_ERR(dev))
1489                 return PTR_ERR(dev);
1490
1491         if (type == NL80211_IFTYPE_MESH_POINT &&
1492             info->attrs[NL80211_ATTR_MESH_ID]) {
1493                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1494
1495                 wdev_lock(wdev);
1496                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1497                              IEEE80211_MAX_MESH_ID_LEN);
1498                 wdev->mesh_id_up_len =
1499                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1500                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1501                        wdev->mesh_id_up_len);
1502                 wdev_unlock(wdev);
1503         }
1504
1505         return 0;
1506 }
1507
1508 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1509 {
1510         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1511         struct net_device *dev = info->user_ptr[1];
1512
1513         if (!rdev->ops->del_virtual_intf)
1514                 return -EOPNOTSUPP;
1515
1516         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1517 }
1518
1519 struct get_key_cookie {
1520         struct sk_buff *msg;
1521         int error;
1522         int idx;
1523 };
1524
1525 static void get_key_callback(void *c, struct key_params *params)
1526 {
1527         struct nlattr *key;
1528         struct get_key_cookie *cookie = c;
1529
1530         if (params->key)
1531                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1532                         params->key_len, params->key);
1533
1534         if (params->seq)
1535                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1536                         params->seq_len, params->seq);
1537
1538         if (params->cipher)
1539                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1540                             params->cipher);
1541
1542         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1543         if (!key)
1544                 goto nla_put_failure;
1545
1546         if (params->key)
1547                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1548                         params->key_len, params->key);
1549
1550         if (params->seq)
1551                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1552                         params->seq_len, params->seq);
1553
1554         if (params->cipher)
1555                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1556                             params->cipher);
1557
1558         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1559
1560         nla_nest_end(cookie->msg, key);
1561
1562         return;
1563  nla_put_failure:
1564         cookie->error = 1;
1565 }
1566
1567 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1568 {
1569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1570         int err;
1571         struct net_device *dev = info->user_ptr[1];
1572         u8 key_idx = 0;
1573         const u8 *mac_addr = NULL;
1574         bool pairwise;
1575         struct get_key_cookie cookie = {
1576                 .error = 0,
1577         };
1578         void *hdr;
1579         struct sk_buff *msg;
1580
1581         if (info->attrs[NL80211_ATTR_KEY_IDX])
1582                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1583
1584         if (key_idx > 5)
1585                 return -EINVAL;
1586
1587         if (info->attrs[NL80211_ATTR_MAC])
1588                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1589
1590         pairwise = !!mac_addr;
1591         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1592                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1593                 if (kt >= NUM_NL80211_KEYTYPES)
1594                         return -EINVAL;
1595                 if (kt != NL80211_KEYTYPE_GROUP &&
1596                     kt != NL80211_KEYTYPE_PAIRWISE)
1597                         return -EINVAL;
1598                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1599         }
1600
1601         if (!rdev->ops->get_key)
1602                 return -EOPNOTSUPP;
1603
1604         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1605         if (!msg)
1606                 return -ENOMEM;
1607
1608         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1609                              NL80211_CMD_NEW_KEY);
1610         if (IS_ERR(hdr))
1611                 return PTR_ERR(hdr);
1612
1613         cookie.msg = msg;
1614         cookie.idx = key_idx;
1615
1616         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1617         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1618         if (mac_addr)
1619                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1620
1621         if (pairwise && mac_addr &&
1622             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1623                 return -ENOENT;
1624
1625         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1626                                  mac_addr, &cookie, get_key_callback);
1627
1628         if (err)
1629                 goto free_msg;
1630
1631         if (cookie.error)
1632                 goto nla_put_failure;
1633
1634         genlmsg_end(msg, hdr);
1635         return genlmsg_reply(msg, info);
1636
1637  nla_put_failure:
1638         err = -ENOBUFS;
1639  free_msg:
1640         nlmsg_free(msg);
1641         return err;
1642 }
1643
1644 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1645 {
1646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1647         struct key_parse key;
1648         int err;
1649         struct net_device *dev = info->user_ptr[1];
1650
1651         err = nl80211_parse_key(info, &key);
1652         if (err)
1653                 return err;
1654
1655         if (key.idx < 0)
1656                 return -EINVAL;
1657
1658         /* only support setting default key */
1659         if (!key.def && !key.defmgmt)
1660                 return -EINVAL;
1661
1662         wdev_lock(dev->ieee80211_ptr);
1663
1664         if (key.def) {
1665                 if (!rdev->ops->set_default_key) {
1666                         err = -EOPNOTSUPP;
1667                         goto out;
1668                 }
1669
1670                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1671                 if (err)
1672                         goto out;
1673
1674                 if (!(rdev->wiphy.flags &
1675                                 WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS)) {
1676                         if (!key.def_uni || !key.def_multi) {
1677                                 err = -EOPNOTSUPP;
1678                                 goto out;
1679                         }
1680                 }
1681
1682                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1683                                                  key.def_uni, key.def_multi);
1684
1685                 if (err)
1686                         goto out;
1687
1688 #ifdef CONFIG_CFG80211_WEXT
1689                 dev->ieee80211_ptr->wext.default_key = key.idx;
1690 #endif
1691         } else {
1692                 if (key.def_uni || !key.def_multi) {
1693                         err = -EINVAL;
1694                         goto out;
1695                 }
1696
1697                 if (!rdev->ops->set_default_mgmt_key) {
1698                         err = -EOPNOTSUPP;
1699                         goto out;
1700                 }
1701
1702                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1703                 if (err)
1704                         goto out;
1705
1706                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1707                                                       dev, key.idx);
1708                 if (err)
1709                         goto out;
1710
1711 #ifdef CONFIG_CFG80211_WEXT
1712                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1713 #endif
1714         }
1715
1716  out:
1717         wdev_unlock(dev->ieee80211_ptr);
1718
1719         return err;
1720 }
1721
1722 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1723 {
1724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1725         int err;
1726         struct net_device *dev = info->user_ptr[1];
1727         struct key_parse key;
1728         const u8 *mac_addr = NULL;
1729
1730         err = nl80211_parse_key(info, &key);
1731         if (err)
1732                 return err;
1733
1734         if (!key.p.key)
1735                 return -EINVAL;
1736
1737         if (info->attrs[NL80211_ATTR_MAC])
1738                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1739
1740         if (key.type == -1) {
1741                 if (mac_addr)
1742                         key.type = NL80211_KEYTYPE_PAIRWISE;
1743                 else
1744                         key.type = NL80211_KEYTYPE_GROUP;
1745         }
1746
1747         /* for now */
1748         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1749             key.type != NL80211_KEYTYPE_GROUP)
1750                 return -EINVAL;
1751
1752         if (!rdev->ops->add_key)
1753                 return -EOPNOTSUPP;
1754
1755         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1756                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1757                                            mac_addr))
1758                 return -EINVAL;
1759
1760         wdev_lock(dev->ieee80211_ptr);
1761         err = nl80211_key_allowed(dev->ieee80211_ptr);
1762         if (!err)
1763                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1764                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1765                                          mac_addr, &key.p);
1766         wdev_unlock(dev->ieee80211_ptr);
1767
1768         return err;
1769 }
1770
1771 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1772 {
1773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1774         int err;
1775         struct net_device *dev = info->user_ptr[1];
1776         u8 *mac_addr = NULL;
1777         struct key_parse key;
1778
1779         err = nl80211_parse_key(info, &key);
1780         if (err)
1781                 return err;
1782
1783         if (info->attrs[NL80211_ATTR_MAC])
1784                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1785
1786         if (key.type == -1) {
1787                 if (mac_addr)
1788                         key.type = NL80211_KEYTYPE_PAIRWISE;
1789                 else
1790                         key.type = NL80211_KEYTYPE_GROUP;
1791         }
1792
1793         /* for now */
1794         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1795             key.type != NL80211_KEYTYPE_GROUP)
1796                 return -EINVAL;
1797
1798         if (!rdev->ops->del_key)
1799                 return -EOPNOTSUPP;
1800
1801         wdev_lock(dev->ieee80211_ptr);
1802         err = nl80211_key_allowed(dev->ieee80211_ptr);
1803
1804         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1805             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1806                 err = -ENOENT;
1807
1808         if (!err)
1809                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1810                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1811                                          mac_addr);
1812
1813 #ifdef CONFIG_CFG80211_WEXT
1814         if (!err) {
1815                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1816                         dev->ieee80211_ptr->wext.default_key = -1;
1817                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1818                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1819         }
1820 #endif
1821         wdev_unlock(dev->ieee80211_ptr);
1822
1823         return err;
1824 }
1825
1826 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1827 {
1828         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1829                     struct beacon_parameters *info);
1830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1831         struct net_device *dev = info->user_ptr[1];
1832         struct beacon_parameters params;
1833         int haveinfo = 0;
1834
1835         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1836                 return -EINVAL;
1837
1838         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1839             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1840                 return -EOPNOTSUPP;
1841
1842         switch (info->genlhdr->cmd) {
1843         case NL80211_CMD_NEW_BEACON:
1844                 /* these are required for NEW_BEACON */
1845                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1846                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1847                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1848                         return -EINVAL;
1849
1850                 call = rdev->ops->add_beacon;
1851                 break;
1852         case NL80211_CMD_SET_BEACON:
1853                 call = rdev->ops->set_beacon;
1854                 break;
1855         default:
1856                 WARN_ON(1);
1857                 return -EOPNOTSUPP;
1858         }
1859
1860         if (!call)
1861                 return -EOPNOTSUPP;
1862
1863         memset(&params, 0, sizeof(params));
1864
1865         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1866                 params.interval =
1867                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1868                 haveinfo = 1;
1869         }
1870
1871         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1872                 params.dtim_period =
1873                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1874                 haveinfo = 1;
1875         }
1876
1877         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1878                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1879                 params.head_len =
1880                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1881                 haveinfo = 1;
1882         }
1883
1884         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1885                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1886                 params.tail_len =
1887                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1888                 haveinfo = 1;
1889         }
1890
1891         if (!haveinfo)
1892                 return -EINVAL;
1893
1894         return call(&rdev->wiphy, dev, &params);
1895 }
1896
1897 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1898 {
1899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1900         struct net_device *dev = info->user_ptr[1];
1901
1902         if (!rdev->ops->del_beacon)
1903                 return -EOPNOTSUPP;
1904
1905         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1906             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1907                 return -EOPNOTSUPP;
1908
1909         return rdev->ops->del_beacon(&rdev->wiphy, dev);
1910 }
1911
1912 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1913         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1914         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1915         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1916         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1917 };
1918
1919 static int parse_station_flags(struct genl_info *info,
1920                                struct station_parameters *params)
1921 {
1922         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1923         struct nlattr *nla;
1924         int flag;
1925
1926         /*
1927          * Try parsing the new attribute first so userspace
1928          * can specify both for older kernels.
1929          */
1930         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1931         if (nla) {
1932                 struct nl80211_sta_flag_update *sta_flags;
1933
1934                 sta_flags = nla_data(nla);
1935                 params->sta_flags_mask = sta_flags->mask;
1936                 params->sta_flags_set = sta_flags->set;
1937                 if ((params->sta_flags_mask |
1938                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1939                         return -EINVAL;
1940                 return 0;
1941         }
1942
1943         /* if present, parse the old attribute */
1944
1945         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1946         if (!nla)
1947                 return 0;
1948
1949         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1950                              nla, sta_flags_policy))
1951                 return -EINVAL;
1952
1953         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1954         params->sta_flags_mask &= ~1;
1955
1956         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1957                 if (flags[flag])
1958                         params->sta_flags_set |= (1<<flag);
1959
1960         return 0;
1961 }
1962
1963 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1964                                 int flags, struct net_device *dev,
1965                                 const u8 *mac_addr, struct station_info *sinfo)
1966 {
1967         void *hdr;
1968         struct nlattr *sinfoattr, *txrate;
1969         u16 bitrate;
1970
1971         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1972         if (!hdr)
1973                 return -1;
1974
1975         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1976         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1977
1978         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1979
1980         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1981         if (!sinfoattr)
1982                 goto nla_put_failure;
1983         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1984                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1985                             sinfo->inactive_time);
1986         if (sinfo->filled & STATION_INFO_RX_BYTES)
1987                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1988                             sinfo->rx_bytes);
1989         if (sinfo->filled & STATION_INFO_TX_BYTES)
1990                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1991                             sinfo->tx_bytes);
1992         if (sinfo->filled & STATION_INFO_LLID)
1993                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1994                             sinfo->llid);
1995         if (sinfo->filled & STATION_INFO_PLID)
1996                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1997                             sinfo->plid);
1998         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1999                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2000                             sinfo->plink_state);
2001         if (sinfo->filled & STATION_INFO_SIGNAL)
2002                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2003                            sinfo->signal);
2004         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2005                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2006                            sinfo->signal_avg);
2007         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2008                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
2009                 if (!txrate)
2010                         goto nla_put_failure;
2011
2012                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2013                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
2014                 if (bitrate > 0)
2015                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2016
2017                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
2018                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
2019                                     sinfo->txrate.mcs);
2020                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2021                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2022                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
2023                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2024
2025                 nla_nest_end(msg, txrate);
2026         }
2027         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2028                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2029                             sinfo->rx_packets);
2030         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2031                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2032                             sinfo->tx_packets);
2033         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2034                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2035                             sinfo->tx_retries);
2036         if (sinfo->filled & STATION_INFO_TX_FAILED)
2037                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2038                             sinfo->tx_failed);
2039         nla_nest_end(msg, sinfoattr);
2040
2041         return genlmsg_end(msg, hdr);
2042
2043  nla_put_failure:
2044         genlmsg_cancel(msg, hdr);
2045         return -EMSGSIZE;
2046 }
2047
2048 static int nl80211_dump_station(struct sk_buff *skb,
2049                                 struct netlink_callback *cb)
2050 {
2051         struct station_info sinfo;
2052         struct cfg80211_registered_device *dev;
2053         struct net_device *netdev;
2054         u8 mac_addr[ETH_ALEN];
2055         int sta_idx = cb->args[1];
2056         int err;
2057
2058         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2059         if (err)
2060                 return err;
2061
2062         if (!dev->ops->dump_station) {
2063                 err = -EOPNOTSUPP;
2064                 goto out_err;
2065         }
2066
2067         while (1) {
2068                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2069                                              mac_addr, &sinfo);
2070                 if (err == -ENOENT)
2071                         break;
2072                 if (err)
2073                         goto out_err;
2074
2075                 if (nl80211_send_station(skb,
2076                                 NETLINK_CB(cb->skb).pid,
2077                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2078                                 netdev, mac_addr,
2079                                 &sinfo) < 0)
2080                         goto out;
2081
2082                 sta_idx++;
2083         }
2084
2085
2086  out:
2087         cb->args[1] = sta_idx;
2088         err = skb->len;
2089  out_err:
2090         nl80211_finish_netdev_dump(dev);
2091
2092         return err;
2093 }
2094
2095 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2096 {
2097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2098         struct net_device *dev = info->user_ptr[1];
2099         struct station_info sinfo;
2100         struct sk_buff *msg;
2101         u8 *mac_addr = NULL;
2102         int err;
2103
2104         memset(&sinfo, 0, sizeof(sinfo));
2105
2106         if (!info->attrs[NL80211_ATTR_MAC])
2107                 return -EINVAL;
2108
2109         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2110
2111         if (!rdev->ops->get_station)
2112                 return -EOPNOTSUPP;
2113
2114         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2115         if (err)
2116                 return err;
2117
2118         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2119         if (!msg)
2120                 return -ENOMEM;
2121
2122         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2123                                  dev, mac_addr, &sinfo) < 0) {
2124                 nlmsg_free(msg);
2125                 return -ENOBUFS;
2126         }
2127
2128         return genlmsg_reply(msg, info);
2129 }
2130
2131 /*
2132  * Get vlan interface making sure it is running and on the right wiphy.
2133  */
2134 static int get_vlan(struct genl_info *info,
2135                     struct cfg80211_registered_device *rdev,
2136                     struct net_device **vlan)
2137 {
2138         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2139         *vlan = NULL;
2140
2141         if (vlanattr) {
2142                 *vlan = dev_get_by_index(genl_info_net(info),
2143                                          nla_get_u32(vlanattr));
2144                 if (!*vlan)
2145                         return -ENODEV;
2146                 if (!(*vlan)->ieee80211_ptr)
2147                         return -EINVAL;
2148                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2149                         return -EINVAL;
2150                 if (!netif_running(*vlan))
2151                         return -ENETDOWN;
2152         }
2153         return 0;
2154 }
2155
2156 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2157 {
2158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2159         int err;
2160         struct net_device *dev = info->user_ptr[1];
2161         struct station_parameters params;
2162         u8 *mac_addr = NULL;
2163
2164         memset(&params, 0, sizeof(params));
2165
2166         params.listen_interval = -1;
2167
2168         if (info->attrs[NL80211_ATTR_STA_AID])
2169                 return -EINVAL;
2170
2171         if (!info->attrs[NL80211_ATTR_MAC])
2172                 return -EINVAL;
2173
2174         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2175
2176         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2177                 params.supported_rates =
2178                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2179                 params.supported_rates_len =
2180                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2181         }
2182
2183         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2184                 params.listen_interval =
2185                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2186
2187         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2188                 params.ht_capa =
2189                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2190
2191         if (parse_station_flags(info, &params))
2192                 return -EINVAL;
2193
2194         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2195                 params.plink_action =
2196                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2197
2198         err = get_vlan(info, rdev, &params.vlan);
2199         if (err)
2200                 goto out;
2201
2202         /* validate settings */
2203         err = 0;
2204
2205         switch (dev->ieee80211_ptr->iftype) {
2206         case NL80211_IFTYPE_AP:
2207         case NL80211_IFTYPE_AP_VLAN:
2208         case NL80211_IFTYPE_P2P_GO:
2209                 /* disallow mesh-specific things */
2210                 if (params.plink_action)
2211                         err = -EINVAL;
2212                 break;
2213         case NL80211_IFTYPE_P2P_CLIENT:
2214         case NL80211_IFTYPE_STATION:
2215                 /* disallow everything but AUTHORIZED flag */
2216                 if (params.plink_action)
2217                         err = -EINVAL;
2218                 if (params.vlan)
2219                         err = -EINVAL;
2220                 if (params.supported_rates)
2221                         err = -EINVAL;
2222                 if (params.ht_capa)
2223                         err = -EINVAL;
2224                 if (params.listen_interval >= 0)
2225                         err = -EINVAL;
2226                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2227                         err = -EINVAL;
2228                 break;
2229         case NL80211_IFTYPE_MESH_POINT:
2230                 /* disallow things mesh doesn't support */
2231                 if (params.vlan)
2232                         err = -EINVAL;
2233                 if (params.ht_capa)
2234                         err = -EINVAL;
2235                 if (params.listen_interval >= 0)
2236                         err = -EINVAL;
2237                 if (params.supported_rates)
2238                         err = -EINVAL;
2239                 if (params.sta_flags_mask)
2240                         err = -EINVAL;
2241                 break;
2242         default:
2243                 err = -EINVAL;
2244         }
2245
2246         if (err)
2247                 goto out;
2248
2249         if (!rdev->ops->change_station) {
2250                 err = -EOPNOTSUPP;
2251                 goto out;
2252         }
2253
2254         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2255
2256  out:
2257         if (params.vlan)
2258                 dev_put(params.vlan);
2259
2260         return err;
2261 }
2262
2263 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2264 {
2265         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2266         int err;
2267         struct net_device *dev = info->user_ptr[1];
2268         struct station_parameters params;
2269         u8 *mac_addr = NULL;
2270
2271         memset(&params, 0, sizeof(params));
2272
2273         if (!info->attrs[NL80211_ATTR_MAC])
2274                 return -EINVAL;
2275
2276         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2277                 return -EINVAL;
2278
2279         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2280                 return -EINVAL;
2281
2282         if (!info->attrs[NL80211_ATTR_STA_AID])
2283                 return -EINVAL;
2284
2285         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2286         params.supported_rates =
2287                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2288         params.supported_rates_len =
2289                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2290         params.listen_interval =
2291                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2292
2293         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2294         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2295                 return -EINVAL;
2296
2297         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2298                 params.ht_capa =
2299                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2300
2301         if (parse_station_flags(info, &params))
2302                 return -EINVAL;
2303
2304         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2305             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2306             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2307                 return -EINVAL;
2308
2309         err = get_vlan(info, rdev, &params.vlan);
2310         if (err)
2311                 goto out;
2312
2313         /* validate settings */
2314         err = 0;
2315
2316         if (!rdev->ops->add_station) {
2317                 err = -EOPNOTSUPP;
2318                 goto out;
2319         }
2320
2321         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2322
2323  out:
2324         if (params.vlan)
2325                 dev_put(params.vlan);
2326         return err;
2327 }
2328
2329 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2330 {
2331         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2332         struct net_device *dev = info->user_ptr[1];
2333         u8 *mac_addr = NULL;
2334
2335         if (info->attrs[NL80211_ATTR_MAC])
2336                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2337
2338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2340             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2341             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2342                 return -EINVAL;
2343
2344         if (!rdev->ops->del_station)
2345                 return -EOPNOTSUPP;
2346
2347         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2348 }
2349
2350 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2351                                 int flags, struct net_device *dev,
2352                                 u8 *dst, u8 *next_hop,
2353                                 struct mpath_info *pinfo)
2354 {
2355         void *hdr;
2356         struct nlattr *pinfoattr;
2357
2358         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2359         if (!hdr)
2360                 return -1;
2361
2362         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2363         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2364         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2365
2366         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2367
2368         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2369         if (!pinfoattr)
2370                 goto nla_put_failure;
2371         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2372                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2373                             pinfo->frame_qlen);
2374         if (pinfo->filled & MPATH_INFO_SN)
2375                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2376                             pinfo->sn);
2377         if (pinfo->filled & MPATH_INFO_METRIC)
2378                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2379                             pinfo->metric);
2380         if (pinfo->filled & MPATH_INFO_EXPTIME)
2381                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2382                             pinfo->exptime);
2383         if (pinfo->filled & MPATH_INFO_FLAGS)
2384                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2385                             pinfo->flags);
2386         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2387                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2388                             pinfo->discovery_timeout);
2389         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2390                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2391                             pinfo->discovery_retries);
2392
2393         nla_nest_end(msg, pinfoattr);
2394
2395         return genlmsg_end(msg, hdr);
2396
2397  nla_put_failure:
2398         genlmsg_cancel(msg, hdr);
2399         return -EMSGSIZE;
2400 }
2401
2402 static int nl80211_dump_mpath(struct sk_buff *skb,
2403                               struct netlink_callback *cb)
2404 {
2405         struct mpath_info pinfo;
2406         struct cfg80211_registered_device *dev;
2407         struct net_device *netdev;
2408         u8 dst[ETH_ALEN];
2409         u8 next_hop[ETH_ALEN];
2410         int path_idx = cb->args[1];
2411         int err;
2412
2413         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2414         if (err)
2415                 return err;
2416
2417         if (!dev->ops->dump_mpath) {
2418                 err = -EOPNOTSUPP;
2419                 goto out_err;
2420         }
2421
2422         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2423                 err = -EOPNOTSUPP;
2424                 goto out_err;
2425         }
2426
2427         while (1) {
2428                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2429                                            dst, next_hop, &pinfo);
2430                 if (err == -ENOENT)
2431                         break;
2432                 if (err)
2433                         goto out_err;
2434
2435                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2436                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2437                                        netdev, dst, next_hop,
2438                                        &pinfo) < 0)
2439                         goto out;
2440
2441                 path_idx++;
2442         }
2443
2444
2445  out:
2446         cb->args[1] = path_idx;
2447         err = skb->len;
2448  out_err:
2449         nl80211_finish_netdev_dump(dev);
2450         return err;
2451 }
2452
2453 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2454 {
2455         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2456         int err;
2457         struct net_device *dev = info->user_ptr[1];
2458         struct mpath_info pinfo;
2459         struct sk_buff *msg;
2460         u8 *dst = NULL;
2461         u8 next_hop[ETH_ALEN];
2462
2463         memset(&pinfo, 0, sizeof(pinfo));
2464
2465         if (!info->attrs[NL80211_ATTR_MAC])
2466                 return -EINVAL;
2467
2468         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2469
2470         if (!rdev->ops->get_mpath)
2471                 return -EOPNOTSUPP;
2472
2473         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2474                 return -EOPNOTSUPP;
2475
2476         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2477         if (err)
2478                 return err;
2479
2480         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2481         if (!msg)
2482                 return -ENOMEM;
2483
2484         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2485                                  dev, dst, next_hop, &pinfo) < 0) {
2486                 nlmsg_free(msg);
2487                 return -ENOBUFS;
2488         }
2489
2490         return genlmsg_reply(msg, info);
2491 }
2492
2493 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2494 {
2495         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2496         struct net_device *dev = info->user_ptr[1];
2497         u8 *dst = NULL;
2498         u8 *next_hop = NULL;
2499
2500         if (!info->attrs[NL80211_ATTR_MAC])
2501                 return -EINVAL;
2502
2503         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2504                 return -EINVAL;
2505
2506         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2507         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2508
2509         if (!rdev->ops->change_mpath)
2510                 return -EOPNOTSUPP;
2511
2512         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2513                 return -EOPNOTSUPP;
2514
2515         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2516 }
2517
2518 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2519 {
2520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2521         struct net_device *dev = info->user_ptr[1];
2522         u8 *dst = NULL;
2523         u8 *next_hop = NULL;
2524
2525         if (!info->attrs[NL80211_ATTR_MAC])
2526                 return -EINVAL;
2527
2528         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2529                 return -EINVAL;
2530
2531         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2532         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2533
2534         if (!rdev->ops->add_mpath)
2535                 return -EOPNOTSUPP;
2536
2537         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2538                 return -EOPNOTSUPP;
2539
2540         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2541 }
2542
2543 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2544 {
2545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2546         struct net_device *dev = info->user_ptr[1];
2547         u8 *dst = NULL;
2548
2549         if (info->attrs[NL80211_ATTR_MAC])
2550                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2551
2552         if (!rdev->ops->del_mpath)
2553                 return -EOPNOTSUPP;
2554
2555         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2556 }
2557
2558 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2559 {
2560         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2561         struct net_device *dev = info->user_ptr[1];
2562         struct bss_parameters params;
2563
2564         memset(&params, 0, sizeof(params));
2565         /* default to not changing parameters */
2566         params.use_cts_prot = -1;
2567         params.use_short_preamble = -1;
2568         params.use_short_slot_time = -1;
2569         params.ap_isolate = -1;
2570         params.ht_opmode = -1;
2571
2572         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2573                 params.use_cts_prot =
2574                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2575         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2576                 params.use_short_preamble =
2577                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2578         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2579                 params.use_short_slot_time =
2580                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2581         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2582                 params.basic_rates =
2583                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2584                 params.basic_rates_len =
2585                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2586         }
2587         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2588                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2589         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2590                 params.ht_opmode =
2591                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2592
2593         if (!rdev->ops->change_bss)
2594                 return -EOPNOTSUPP;
2595
2596         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2597             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2598                 return -EOPNOTSUPP;
2599
2600         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2601 }
2602
2603 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2604         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2605         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2606         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2607         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2608         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2609         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2610 };
2611
2612 static int parse_reg_rule(struct nlattr *tb[],
2613         struct ieee80211_reg_rule *reg_rule)
2614 {
2615         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2616         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2617
2618         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2619                 return -EINVAL;
2620         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2621                 return -EINVAL;
2622         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2623                 return -EINVAL;
2624         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2625                 return -EINVAL;
2626         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2627                 return -EINVAL;
2628
2629         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2630
2631         freq_range->start_freq_khz =
2632                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2633         freq_range->end_freq_khz =
2634                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2635         freq_range->max_bandwidth_khz =
2636                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2637
2638         power_rule->max_eirp =
2639                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2640
2641         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2642                 power_rule->max_antenna_gain =
2643                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2644
2645         return 0;
2646 }
2647
2648 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2649 {
2650         int r;
2651         char *data = NULL;
2652
2653         /*
2654          * You should only get this when cfg80211 hasn't yet initialized
2655          * completely when built-in to the kernel right between the time
2656          * window between nl80211_init() and regulatory_init(), if that is
2657          * even possible.
2658          */
2659         mutex_lock(&cfg80211_mutex);
2660         if (unlikely(!cfg80211_regdomain)) {
2661                 mutex_unlock(&cfg80211_mutex);
2662                 return -EINPROGRESS;
2663         }
2664         mutex_unlock(&cfg80211_mutex);
2665
2666         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2667                 return -EINVAL;
2668
2669         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2670
2671         r = regulatory_hint_user(data);
2672
2673         return r;
2674 }
2675
2676 static int nl80211_get_mesh_config(struct sk_buff *skb,
2677                                    struct genl_info *info)
2678 {
2679         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2680         struct net_device *dev = info->user_ptr[1];
2681         struct wireless_dev *wdev = dev->ieee80211_ptr;
2682         struct mesh_config cur_params;
2683         int err = 0;
2684         void *hdr;
2685         struct nlattr *pinfoattr;
2686         struct sk_buff *msg;
2687
2688         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2689                 return -EOPNOTSUPP;
2690
2691         if (!rdev->ops->get_mesh_config)
2692                 return -EOPNOTSUPP;
2693
2694         wdev_lock(wdev);
2695         /* If not connected, get default parameters */
2696         if (!wdev->mesh_id_len)
2697                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
2698         else
2699                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
2700                                                  &cur_params);
2701         wdev_unlock(wdev);
2702
2703         if (err)
2704                 return err;
2705
2706         /* Draw up a netlink message to send back */
2707         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2708         if (!msg)
2709                 return -ENOMEM;
2710         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2711                              NL80211_CMD_GET_MESH_CONFIG);
2712         if (!hdr)
2713                 goto nla_put_failure;
2714         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
2715         if (!pinfoattr)
2716                 goto nla_put_failure;
2717         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2718         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2719                         cur_params.dot11MeshRetryTimeout);
2720         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2721                         cur_params.dot11MeshConfirmTimeout);
2722         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2723                         cur_params.dot11MeshHoldingTimeout);
2724         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2725                         cur_params.dot11MeshMaxPeerLinks);
2726         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2727                         cur_params.dot11MeshMaxRetries);
2728         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2729                         cur_params.dot11MeshTTL);
2730         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
2731                         cur_params.element_ttl);
2732         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2733                         cur_params.auto_open_plinks);
2734         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2735                         cur_params.dot11MeshHWMPmaxPREQretries);
2736         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2737                         cur_params.path_refresh_time);
2738         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2739                         cur_params.min_discovery_timeout);
2740         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2741                         cur_params.dot11MeshHWMPactivePathTimeout);
2742         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2743                         cur_params.dot11MeshHWMPpreqMinInterval);
2744         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2745                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2746         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2747                         cur_params.dot11MeshHWMPRootMode);
2748         nla_nest_end(msg, pinfoattr);
2749         genlmsg_end(msg, hdr);
2750         return genlmsg_reply(msg, info);
2751
2752  nla_put_failure:
2753         genlmsg_cancel(msg, hdr);
2754         nlmsg_free(msg);
2755         return -ENOBUFS;
2756 }
2757
2758 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2759         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2760         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2761         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2762         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2763         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2764         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2765         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
2766         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2767
2768         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2769         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2770         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2771         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2772         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2773         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2774 };
2775
2776 static const struct nla_policy
2777         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
2778         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
2779         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
2780         [NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE] = { .type = NLA_BINARY,
2781                 .len = IEEE80211_MAX_DATA_LEN },
2782 };
2783
2784 static int nl80211_parse_mesh_config(struct genl_info *info,
2785                                      struct mesh_config *cfg,
2786                                      u32 *mask_out)
2787 {
2788         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2789         u32 mask = 0;
2790
2791 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2792 do {\
2793         if (table[attr_num]) {\
2794                 cfg->param = nla_fn(table[attr_num]); \
2795                 mask |= (1 << (attr_num - 1)); \
2796         } \
2797 } while (0);\
2798
2799
2800         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
2801                 return -EINVAL;
2802         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2803                              info->attrs[NL80211_ATTR_MESH_CONFIG],
2804                              nl80211_meshconf_params_policy))
2805                 return -EINVAL;
2806
2807         /* This makes sure that there aren't more than 32 mesh config
2808          * parameters (otherwise our bitfield scheme would not work.) */
2809         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2810
2811         /* Fill in the params struct */
2812         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2813                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2814         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2815                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2816         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2817                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2818         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2819                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2820         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2821                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2822         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2823                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2824         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
2825                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
2826         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2827                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2828         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2829                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2830                         nla_get_u8);
2831         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2832                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2833         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2834                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2835                         nla_get_u16);
2836         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2837                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2838                         nla_get_u32);
2839         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2840                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2841                         nla_get_u16);
2842         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2843                         dot11MeshHWMPnetDiameterTraversalTime,
2844                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2845                         nla_get_u16);
2846         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2847                         dot11MeshHWMPRootMode, mask,
2848                         NL80211_MESHCONF_HWMP_ROOTMODE,
2849                         nla_get_u8);
2850         if (mask_out)
2851                 *mask_out = mask;
2852
2853         return 0;
2854
2855 #undef FILL_IN_MESH_PARAM_IF_SET
2856 }
2857
2858 static int nl80211_parse_mesh_setup(struct genl_info *info,
2859                                      struct mesh_setup *setup)
2860 {
2861         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
2862
2863         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
2864                 return -EINVAL;
2865         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
2866                              info->attrs[NL80211_ATTR_MESH_SETUP],
2867                              nl80211_mesh_setup_params_policy))
2868                 return -EINVAL;
2869
2870         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
2871                 setup->path_sel_proto =
2872                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
2873                  IEEE80211_PATH_PROTOCOL_VENDOR :
2874                  IEEE80211_PATH_PROTOCOL_HWMP;
2875
2876         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
2877                 setup->path_metric =
2878                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
2879                  IEEE80211_PATH_METRIC_VENDOR :
2880                  IEEE80211_PATH_METRIC_AIRTIME;
2881
2882         if (tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE]) {
2883                 struct nlattr *ieattr =
2884                         tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE];
2885                 if (!is_valid_ie_attr(ieattr))
2886                         return -EINVAL;
2887                 setup->vendor_ie = nla_data(ieattr);
2888                 setup->vendor_ie_len = nla_len(ieattr);
2889         }
2890
2891         return 0;
2892 }
2893
2894 static int nl80211_update_mesh_config(struct sk_buff *skb,
2895                                       struct genl_info *info)
2896 {
2897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2898         struct net_device *dev = info->user_ptr[1];
2899         struct wireless_dev *wdev = dev->ieee80211_ptr;
2900         struct mesh_config cfg;
2901         u32 mask;
2902         int err;
2903
2904         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2905                 return -EOPNOTSUPP;
2906
2907         if (!rdev->ops->update_mesh_config)
2908                 return -EOPNOTSUPP;
2909
2910         err = nl80211_parse_mesh_config(info, &cfg, &mask);
2911         if (err)
2912                 return err;
2913
2914         wdev_lock(wdev);
2915         if (!wdev->mesh_id_len)
2916                 err = -ENOLINK;
2917
2918         if (!err)
2919                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
2920                                                     mask, &cfg);
2921
2922         wdev_unlock(wdev);
2923
2924         return err;
2925 }
2926
2927 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2928 {
2929         struct sk_buff *msg;
2930         void *hdr = NULL;
2931         struct nlattr *nl_reg_rules;
2932         unsigned int i;
2933         int err = -EINVAL;
2934
2935         mutex_lock(&cfg80211_mutex);
2936
2937         if (!cfg80211_regdomain)
2938                 goto out;
2939
2940         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2941         if (!msg) {
2942                 err = -ENOBUFS;
2943                 goto out;
2944         }
2945
2946         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2947                              NL80211_CMD_GET_REG);
2948         if (!hdr)
2949                 goto nla_put_failure;
2950
2951         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2952                 cfg80211_regdomain->alpha2);
2953
2954         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2955         if (!nl_reg_rules)
2956                 goto nla_put_failure;
2957
2958         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2959                 struct nlattr *nl_reg_rule;
2960                 const struct ieee80211_reg_rule *reg_rule;
2961                 const struct ieee80211_freq_range *freq_range;
2962                 const struct ieee80211_power_rule *power_rule;
2963
2964                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2965                 freq_range = &reg_rule->freq_range;
2966                 power_rule = &reg_rule->power_rule;
2967
2968                 nl_reg_rule = nla_nest_start(msg, i);
2969                 if (!nl_reg_rule)
2970                         goto nla_put_failure;
2971
2972                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2973                         reg_rule->flags);
2974                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2975                         freq_range->start_freq_khz);
2976                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2977                         freq_range->end_freq_khz);
2978                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2979                         freq_range->max_bandwidth_khz);
2980                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2981                         power_rule->max_antenna_gain);
2982                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2983                         power_rule->max_eirp);
2984
2985                 nla_nest_end(msg, nl_reg_rule);
2986         }
2987
2988         nla_nest_end(msg, nl_reg_rules);
2989
2990         genlmsg_end(msg, hdr);
2991         err = genlmsg_reply(msg, info);
2992         goto out;
2993
2994 nla_put_failure:
2995         genlmsg_cancel(msg, hdr);
2996         nlmsg_free(msg);
2997         err = -EMSGSIZE;
2998 out:
2999         mutex_unlock(&cfg80211_mutex);
3000         return err;
3001 }
3002
3003 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3004 {
3005         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3006         struct nlattr *nl_reg_rule;
3007         char *alpha2 = NULL;
3008         int rem_reg_rules = 0, r = 0;
3009         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3010         struct ieee80211_regdomain *rd = NULL;
3011
3012         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3013                 return -EINVAL;
3014
3015         if (!info->attrs[NL80211_ATTR_REG_RULES])
3016                 return -EINVAL;
3017
3018         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3019
3020         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3021                         rem_reg_rules) {
3022                 num_rules++;
3023                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3024                         return -EINVAL;
3025         }
3026
3027         mutex_lock(&cfg80211_mutex);
3028
3029         if (!reg_is_valid_request(alpha2)) {
3030                 r = -EINVAL;
3031                 goto bad_reg;
3032         }
3033
3034         size_of_regd = sizeof(struct ieee80211_regdomain) +
3035                 (num_rules * sizeof(struct ieee80211_reg_rule));
3036
3037         rd = kzalloc(size_of_regd, GFP_KERNEL);
3038         if (!rd) {
3039                 r = -ENOMEM;
3040                 goto bad_reg;
3041         }
3042
3043         rd->n_reg_rules = num_rules;
3044         rd->alpha2[0] = alpha2[0];
3045         rd->alpha2[1] = alpha2[1];
3046
3047         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3048                         rem_reg_rules) {
3049                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3050                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3051                         reg_rule_policy);
3052                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3053                 if (r)
3054                         goto bad_reg;
3055
3056                 rule_idx++;
3057
3058                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3059                         r = -EINVAL;
3060                         goto bad_reg;
3061                 }
3062         }
3063
3064         BUG_ON(rule_idx != num_rules);
3065
3066         r = set_regdom(rd);
3067
3068         mutex_unlock(&cfg80211_mutex);
3069
3070         return r;
3071
3072  bad_reg:
3073         mutex_unlock(&cfg80211_mutex);
3074         kfree(rd);
3075         return r;
3076 }
3077
3078 static int validate_scan_freqs(struct nlattr *freqs)
3079 {
3080         struct nlattr *attr1, *attr2;
3081         int n_channels = 0, tmp1, tmp2;
3082
3083         nla_for_each_nested(attr1, freqs, tmp1) {
3084                 n_channels++;
3085                 /*
3086                  * Some hardware has a limited channel list for
3087                  * scanning, and it is pretty much nonsensical
3088                  * to scan for a channel twice, so disallow that
3089                  * and don't require drivers to check that the
3090                  * channel list they get isn't longer than what
3091                  * they can scan, as long as they can scan all
3092                  * the channels they registered at once.
3093                  */
3094                 nla_for_each_nested(attr2, freqs, tmp2)
3095                         if (attr1 != attr2 &&
3096                             nla_get_u32(attr1) == nla_get_u32(attr2))
3097                                 return 0;
3098         }
3099
3100         return n_channels;
3101 }
3102
3103 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3104 {
3105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3106         struct net_device *dev = info->user_ptr[1];
3107         struct cfg80211_scan_request *request;
3108         struct cfg80211_ssid *ssid;
3109         struct ieee80211_channel *channel;
3110         struct nlattr *attr;
3111         struct wiphy *wiphy;
3112         int err, tmp, n_ssids = 0, n_channels, i;
3113         enum ieee80211_band band;
3114         size_t ie_len;
3115
3116         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3117                 return -EINVAL;
3118
3119         wiphy = &rdev->wiphy;
3120
3121         if (!rdev->ops->scan)
3122                 return -EOPNOTSUPP;
3123
3124         if (rdev->scan_req)
3125                 return -EBUSY;
3126
3127         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3128                 n_channels = validate_scan_freqs(
3129                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3130                 if (!n_channels)
3131                         return -EINVAL;
3132         } else {
3133                 n_channels = 0;
3134
3135                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3136                         if (wiphy->bands[band])
3137                                 n_channels += wiphy->bands[band]->n_channels;
3138         }
3139
3140         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3141                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3142                         n_ssids++;
3143
3144         if (n_ssids > wiphy->max_scan_ssids)
3145                 return -EINVAL;
3146
3147         if (info->attrs[NL80211_ATTR_IE])
3148                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3149         else
3150                 ie_len = 0;
3151
3152         if (ie_len > wiphy->max_scan_ie_len)
3153                 return -EINVAL;
3154
3155         request = kzalloc(sizeof(*request)
3156                         + sizeof(*ssid) * n_ssids
3157                         + sizeof(channel) * n_channels
3158                         + ie_len, GFP_KERNEL);
3159         if (!request)
3160                 return -ENOMEM;
3161
3162         if (n_ssids)
3163                 request->ssids = (void *)&request->channels[n_channels];
3164         request->n_ssids = n_ssids;
3165         if (ie_len) {
3166                 if (request->ssids)
3167                         request->ie = (void *)(request->ssids + n_ssids);
3168                 else
3169                         request->ie = (void *)(request->channels + n_channels);
3170         }
3171
3172         i = 0;
3173         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3174                 /* user specified, bail out if channel not found */
3175                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3176                         struct ieee80211_channel *chan;
3177
3178                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3179
3180                         if (!chan) {
3181                                 err = -EINVAL;
3182                                 goto out_free;
3183                         }
3184
3185                         /* ignore disabled channels */
3186                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3187                                 continue;
3188
3189                         request->channels[i] = chan;
3190                         i++;
3191                 }
3192         } else {
3193                 /* all channels */
3194                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3195                         int j;
3196                         if (!wiphy->bands[band])
3197                                 continue;
3198                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3199                                 struct ieee80211_channel *chan;
3200
3201                                 chan = &wiphy->bands[band]->channels[j];
3202
3203                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3204                                         continue;
3205
3206                                 request->channels[i] = chan;
3207                                 i++;
3208                         }
3209                 }
3210         }
3211
3212         if (!i) {
3213                 err = -EINVAL;
3214                 goto out_free;
3215         }
3216
3217         request->n_channels = i;
3218
3219         i = 0;
3220         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3221                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3222                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3223                                 err = -EINVAL;
3224                                 goto out_free;
3225                         }
3226                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3227                         request->ssids[i].ssid_len = nla_len(attr);
3228                         i++;
3229                 }
3230         }
3231
3232         if (info->attrs[NL80211_ATTR_IE]) {
3233                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3234                 memcpy((void *)request->ie,
3235                        nla_data(info->attrs[NL80211_ATTR_IE]),
3236                        request->ie_len);
3237         }
3238
3239         request->dev = dev;
3240         request->wiphy = &rdev->wiphy;
3241
3242         rdev->scan_req = request;
3243         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3244
3245         if (!err) {
3246                 nl80211_send_scan_start(rdev, dev);
3247                 dev_hold(dev);
3248         } else {
3249  out_free:
3250                 rdev->scan_req = NULL;
3251                 kfree(request);
3252         }
3253
3254         return err;
3255 }
3256
3257 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3258                             struct cfg80211_registered_device *rdev,
3259                             struct wireless_dev *wdev,
3260                             struct cfg80211_internal_bss *intbss)
3261 {
3262         struct cfg80211_bss *res = &intbss->pub;
3263         void *hdr;
3264         struct nlattr *bss;
3265         int i;
3266
3267         ASSERT_WDEV_LOCK(wdev);
3268
3269         hdr = nl80211hdr_put(msg, pid, seq, flags,
3270                              NL80211_CMD_NEW_SCAN_RESULTS);
3271         if (!hdr)
3272                 return -1;
3273
3274         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3275         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3276
3277         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3278         if (!bss)
3279                 goto nla_put_failure;
3280         if (!is_zero_ether_addr(res->bssid))
3281                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3282         if (res->information_elements && res->len_information_elements)
3283                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3284                         res->len_information_elements,
3285                         res->information_elements);
3286         if (res->beacon_ies && res->len_beacon_ies &&
3287             res->beacon_ies != res->information_elements)
3288                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3289                         res->len_beacon_ies, res->beacon_ies);
3290         if (res->tsf)
3291                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3292         if (res->beacon_interval)
3293                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3294         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3295         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3296         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3297                 jiffies_to_msecs(jiffies - intbss->ts));
3298
3299         switch (rdev->wiphy.signal_type) {
3300         case CFG80211_SIGNAL_TYPE_MBM:
3301                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3302                 break;
3303         case CFG80211_SIGNAL_TYPE_UNSPEC:
3304                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3305                 break;
3306         default:
3307                 break;
3308         }
3309
3310         switch (wdev->iftype) {
3311         case NL80211_IFTYPE_P2P_CLIENT:
3312         case NL80211_IFTYPE_STATION:
3313                 if (intbss == wdev->current_bss)
3314                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3315                                     NL80211_BSS_STATUS_ASSOCIATED);
3316                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3317                         if (intbss != wdev->auth_bsses[i])
3318                                 continue;
3319                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3320                                     NL80211_BSS_STATUS_AUTHENTICATED);
3321                         break;
3322                 }
3323                 break;
3324         case NL80211_IFTYPE_ADHOC:
3325                 if (intbss == wdev->current_bss)
3326                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3327                                     NL80211_BSS_STATUS_IBSS_JOINED);
3328                 break;
3329         default:
3330                 break;
3331         }
3332
3333         nla_nest_end(msg, bss);
3334
3335         return genlmsg_end(msg, hdr);
3336
3337  nla_put_failure:
3338         genlmsg_cancel(msg, hdr);
3339         return -EMSGSIZE;
3340 }
3341
3342 static int nl80211_dump_scan(struct sk_buff *skb,
3343                              struct netlink_callback *cb)
3344 {
3345         struct cfg80211_registered_device *rdev;
3346         struct net_device *dev;
3347         struct cfg80211_internal_bss *scan;
3348         struct wireless_dev *wdev;
3349         int start = cb->args[1], idx = 0;
3350         int err;
3351
3352         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3353         if (err)
3354                 return err;
3355
3356         wdev = dev->ieee80211_ptr;
3357
3358         wdev_lock(wdev);
3359         spin_lock_bh(&rdev->bss_lock);
3360         cfg80211_bss_expire(rdev);
3361
3362         list_for_each_entry(scan, &rdev->bss_list, list) {
3363                 if (++idx <= start)
3364                         continue;
3365                 if (nl80211_send_bss(skb,
3366                                 NETLINK_CB(cb->skb).pid,
3367                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3368                                 rdev, wdev, scan) < 0) {
3369                         idx--;
3370                         break;
3371                 }
3372         }
3373
3374         spin_unlock_bh(&rdev->bss_lock);
3375         wdev_unlock(wdev);
3376
3377         cb->args[1] = idx;
3378         nl80211_finish_netdev_dump(rdev);
3379
3380         return skb->len;
3381 }
3382
3383 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3384                                 int flags, struct net_device *dev,
3385                                 struct survey_info *survey)
3386 {
3387         void *hdr;
3388         struct nlattr *infoattr;
3389
3390         /* Survey without a channel doesn't make sense */
3391         if (!survey->channel)
3392                 return -EINVAL;
3393
3394         hdr = nl80211hdr_put(msg, pid, seq, flags,
3395                              NL80211_CMD_NEW_SURVEY_RESULTS);
3396         if (!hdr)
3397                 return -ENOMEM;
3398
3399         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3400
3401         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3402         if (!infoattr)
3403                 goto nla_put_failure;
3404
3405         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3406                     survey->channel->center_freq);
3407         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3408                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3409                             survey->noise);
3410         if (survey->filled & SURVEY_INFO_IN_USE)
3411                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3412         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3413                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3414                             survey->channel_time);
3415         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3416                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3417                             survey->channel_time_busy);
3418         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3419                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3420                             survey->channel_time_ext_busy);
3421         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3422                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3423                             survey->channel_time_rx);
3424         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3425                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3426                             survey->channel_time_tx);
3427
3428         nla_nest_end(msg, infoattr);
3429
3430         return genlmsg_end(msg, hdr);
3431
3432  nla_put_failure:
3433         genlmsg_cancel(msg, hdr);
3434         return -EMSGSIZE;
3435 }
3436
3437 static int nl80211_dump_survey(struct sk_buff *skb,
3438                         struct netlink_callback *cb)
3439 {
3440         struct survey_info survey;
3441         struct cfg80211_registered_device *dev;
3442         struct net_device *netdev;
3443         int survey_idx = cb->args[1];
3444         int res;
3445
3446         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3447         if (res)
3448                 return res;
3449
3450         if (!dev->ops->dump_survey) {
3451                 res = -EOPNOTSUPP;
3452                 goto out_err;
3453         }
3454
3455         while (1) {
3456                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3457                                             &survey);
3458                 if (res == -ENOENT)
3459                         break;
3460                 if (res)
3461                         goto out_err;
3462
3463                 if (nl80211_send_survey(skb,
3464                                 NETLINK_CB(cb->skb).pid,
3465                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3466                                 netdev,
3467                                 &survey) < 0)
3468                         goto out;
3469                 survey_idx++;
3470         }
3471
3472  out:
3473         cb->args[1] = survey_idx;
3474         res = skb->len;
3475  out_err:
3476         nl80211_finish_netdev_dump(dev);
3477         return res;
3478 }
3479
3480 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3481 {
3482         return auth_type <= NL80211_AUTHTYPE_MAX;
3483 }
3484
3485 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3486 {
3487         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3488                                   NL80211_WPA_VERSION_2));
3489 }
3490
3491 static bool nl80211_valid_akm_suite(u32 akm)
3492 {
3493         return akm == WLAN_AKM_SUITE_8021X ||
3494                 akm == WLAN_AKM_SUITE_PSK;
3495 }
3496
3497 static bool nl80211_valid_cipher_suite(u32 cipher)
3498 {
3499         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3500                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3501                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3502                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3503                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3504 }
3505
3506
3507 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3508 {
3509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3510         struct net_device *dev = info->user_ptr[1];
3511         struct ieee80211_channel *chan;
3512         const u8 *bssid, *ssid, *ie = NULL;
3513         int err, ssid_len, ie_len = 0;
3514         enum nl80211_auth_type auth_type;
3515         struct key_parse key;
3516         bool local_state_change;
3517
3518         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3519                 return -EINVAL;
3520
3521         if (!info->attrs[NL80211_ATTR_MAC])
3522                 return -EINVAL;
3523
3524         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3525                 return -EINVAL;
3526
3527         if (!info->attrs[NL80211_ATTR_SSID])
3528                 return -EINVAL;
3529
3530         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3531                 return -EINVAL;
3532
3533         err = nl80211_parse_key(info, &key);
3534         if (err)
3535                 return err;
3536
3537         if (key.idx >= 0) {
3538                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
3539                         return -EINVAL;
3540                 if (!key.p.key || !key.p.key_len)
3541                         return -EINVAL;
3542                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3543                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3544                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3545                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3546                         return -EINVAL;
3547                 if (key.idx > 4)
3548                         return -EINVAL;
3549         } else {
3550                 key.p.key_len = 0;
3551                 key.p.key = NULL;
3552         }
3553
3554         if (key.idx >= 0) {
3555                 int i;
3556                 bool ok = false;
3557                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3558                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3559                                 ok = true;
3560                                 break;
3561                         }
3562                 }
3563                 if (!ok)
3564                         return -EINVAL;
3565         }
3566
3567         if (!rdev->ops->auth)
3568                 return -EOPNOTSUPP;
3569
3570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3572                 return -EOPNOTSUPP;
3573
3574         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3575         chan = ieee80211_get_channel(&rdev->wiphy,
3576                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3577         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3578                 return -EINVAL;
3579
3580         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3581         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3582
3583         if (info->attrs[NL80211_ATTR_IE]) {
3584                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3585                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3586         }
3587
3588         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3589         if (!nl80211_valid_auth_type(auth_type))
3590                 return -EINVAL;
3591
3592         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3593
3594         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3595                                   ssid, ssid_len, ie, ie_len,
3596                                   key.p.key, key.p.key_len, key.idx,
3597                                   local_state_change);
3598 }
3599
3600 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
3601                                    struct genl_info *info,
3602                                    struct cfg80211_crypto_settings *settings,
3603                                    int cipher_limit)
3604 {
3605         memset(settings, 0, sizeof(*settings));
3606
3607         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3608
3609         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
3610                 u16 proto;
3611                 proto = nla_get_u16(
3612                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3613                 settings->control_port_ethertype = cpu_to_be16(proto);
3614                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
3615                     proto != ETH_P_PAE)
3616                         return -EINVAL;
3617                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
3618                         settings->control_port_no_encrypt = true;
3619         } else
3620                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
3621
3622         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3623                 void *data;
3624                 int len, i;
3625
3626                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3627                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3628                 settings->n_ciphers_pairwise = len / sizeof(u32);
3629
3630                 if (len % sizeof(u32))
3631                         return -EINVAL;
3632
3633                 if (settings->n_ciphers_pairwise > cipher_limit)
3634                         return -EINVAL;
3635
3636                 memcpy(settings->ciphers_pairwise, data, len);
3637
3638                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3639                         if (!nl80211_valid_cipher_suite(
3640                                         settings->ciphers_pairwise[i]))
3641                                 return -EINVAL;
3642         }
3643
3644         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3645                 settings->cipher_group =
3646                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3647                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3648                         return -EINVAL;
3649         }
3650
3651         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3652                 settings->wpa_versions =
3653                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3654                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3655                         return -EINVAL;
3656         }
3657
3658         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3659                 void *data;
3660                 int len, i;
3661
3662                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3663                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3664                 settings->n_akm_suites = len / sizeof(u32);
3665
3666                 if (len % sizeof(u32))
3667                         return -EINVAL;
3668
3669                 memcpy(settings->akm_suites, data, len);
3670
3671                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3672                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3673                                 return -EINVAL;
3674         }
3675
3676         return 0;
3677 }
3678
3679 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3680 {
3681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3682         struct net_device *dev = info->user_ptr[1];
3683         struct cfg80211_crypto_settings crypto;
3684         struct ieee80211_channel *chan;
3685         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3686         int err, ssid_len, ie_len = 0;
3687         bool use_mfp = false;
3688
3689         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3690                 return -EINVAL;
3691
3692         if (!info->attrs[NL80211_ATTR_MAC] ||
3693             !info->attrs[NL80211_ATTR_SSID] ||
3694             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3695                 return -EINVAL;
3696
3697         if (!rdev->ops->assoc)
3698                 return -EOPNOTSUPP;
3699
3700         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3701             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3702                 return -EOPNOTSUPP;
3703
3704         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3705
3706         chan = ieee80211_get_channel(&rdev->wiphy,
3707                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3708         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3709                 return -EINVAL;
3710
3711         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3712         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3713
3714         if (info->attrs[NL80211_ATTR_IE]) {
3715                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3716                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3717         }
3718
3719         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3720                 enum nl80211_mfp mfp =
3721                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3722                 if (mfp == NL80211_MFP_REQUIRED)
3723                         use_mfp = true;
3724                 else if (mfp != NL80211_MFP_NO)
3725                         return -EINVAL;
3726         }
3727
3728         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3729                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3730
3731         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
3732         if (!err)
3733                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3734                                           ssid, ssid_len, ie, ie_len, use_mfp,
3735                                           &crypto);
3736
3737         return err;
3738 }
3739
3740 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3741 {
3742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3743         struct net_device *dev = info->user_ptr[1];
3744         const u8 *ie = NULL, *bssid;
3745         int ie_len = 0;
3746         u16 reason_code;
3747         bool local_state_change;
3748
3749         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3750                 return -EINVAL;
3751
3752         if (!info->attrs[NL80211_ATTR_MAC])
3753                 return -EINVAL;
3754
3755         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3756                 return -EINVAL;
3757
3758         if (!rdev->ops->deauth)
3759                 return -EOPNOTSUPP;
3760
3761         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3762             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3763                 return -EOPNOTSUPP;
3764
3765         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3766
3767         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3768         if (reason_code == 0) {
3769                 /* Reason Code 0 is reserved */
3770                 return -EINVAL;
3771         }
3772
3773         if (info->attrs[NL80211_ATTR_IE]) {
3774                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3775                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3776         }
3777
3778         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3779
3780         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3781                                     local_state_change);
3782 }
3783
3784 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3785 {
3786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3787         struct net_device *dev = info->user_ptr[1];
3788         const u8 *ie = NULL, *bssid;
3789         int ie_len = 0;
3790         u16 reason_code;
3791         bool local_state_change;
3792
3793         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3794                 return -EINVAL;
3795
3796         if (!info->attrs[NL80211_ATTR_MAC])
3797                 return -EINVAL;
3798
3799         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3800                 return -EINVAL;
3801
3802         if (!rdev->ops->disassoc)
3803                 return -EOPNOTSUPP;
3804
3805         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3806             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3807                 return -EOPNOTSUPP;
3808
3809         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3810
3811         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3812         if (reason_code == 0) {
3813                 /* Reason Code 0 is reserved */
3814                 return -EINVAL;
3815         }
3816
3817         if (info->attrs[NL80211_ATTR_IE]) {
3818                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3819                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3820         }
3821
3822         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3823
3824         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3825                                       local_state_change);
3826 }
3827
3828 static bool
3829 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
3830                          int mcast_rate[IEEE80211_NUM_BANDS],
3831                          int rateval)
3832 {
3833         struct wiphy *wiphy = &rdev->wiphy;
3834         bool found = false;
3835         int band, i;
3836
3837         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3838                 struct ieee80211_supported_band *sband;
3839
3840                 sband = wiphy->bands[band];
3841                 if (!sband)
3842                         continue;
3843
3844                 for (i = 0; i < sband->n_bitrates; i++) {
3845                         if (sband->bitrates[i].bitrate == rateval) {
3846                                 mcast_rate[band] = i + 1;
3847                                 found = true;
3848                                 break;
3849                         }
3850                 }
3851         }
3852
3853         return found;
3854 }
3855
3856 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3857 {
3858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3859         struct net_device *dev = info->user_ptr[1];
3860         struct cfg80211_ibss_params ibss;
3861         struct wiphy *wiphy;
3862         struct cfg80211_cached_keys *connkeys = NULL;
3863         int err;
3864
3865         memset(&ibss, 0, sizeof(ibss));
3866
3867         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3868                 return -EINVAL;
3869
3870         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3871             !info->attrs[NL80211_ATTR_SSID] ||
3872             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3873                 return -EINVAL;
3874
3875         ibss.beacon_interval = 100;
3876
3877         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3878                 ibss.beacon_interval =
3879                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3880                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3881                         return -EINVAL;
3882         }
3883
3884         if (!rdev->ops->join_ibss)
3885                 return -EOPNOTSUPP;
3886
3887         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3888                 return -EOPNOTSUPP;
3889
3890         wiphy = &rdev->wiphy;
3891
3892         if (info->attrs[NL80211_ATTR_MAC])
3893                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3894         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3895         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3896
3897         if (info->attrs[NL80211_ATTR_IE]) {
3898                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3899                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3900         }
3901
3902         ibss.channel = ieee80211_get_channel(wiphy,
3903                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3904         if (!ibss.channel ||
3905             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3906             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
3907                 return -EINVAL;
3908
3909         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3910         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3911
3912         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3913                 u8 *rates =
3914                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3915                 int n_rates =
3916                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3917                 struct ieee80211_supported_band *sband =
3918                         wiphy->bands[ibss.channel->band];
3919                 int i, j;
3920
3921                 if (n_rates == 0)
3922                         return -EINVAL;
3923
3924                 for (i = 0; i < n_rates; i++) {
3925                         int rate = (rates[i] & 0x7f) * 5;
3926                         bool found = false;
3927
3928                         for (j = 0; j < sband->n_bitrates; j++) {
3929                                 if (sband->bitrates[j].bitrate == rate) {
3930                                         found = true;
3931                                         ibss.basic_rates |= BIT(j);
3932                                         break;
3933                                 }
3934                         }
3935                         if (!found)
3936                                 return -EINVAL;
3937                 }
3938         }
3939
3940         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
3941             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
3942                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
3943                 return -EINVAL;
3944
3945         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3946                 connkeys = nl80211_parse_connkeys(rdev,
3947                                         info->attrs[NL80211_ATTR_KEYS]);
3948                 if (IS_ERR(connkeys))
3949                         return PTR_ERR(connkeys);
3950         }
3951
3952         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3953         if (err)
3954                 kfree(connkeys);
3955         return err;
3956 }
3957
3958 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3959 {
3960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3961         struct net_device *dev = info->user_ptr[1];
3962
3963         if (!rdev->ops->leave_ibss)
3964                 return -EOPNOTSUPP;
3965
3966         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3967                 return -EOPNOTSUPP;
3968
3969         return cfg80211_leave_ibss(rdev, dev, false);
3970 }
3971
3972 #ifdef CONFIG_NL80211_TESTMODE
3973 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3974         .name = "testmode",
3975 };
3976
3977 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3978 {
3979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3980         int err;
3981
3982         if (!info->attrs[NL80211_ATTR_TESTDATA])
3983                 return -EINVAL;
3984
3985         err = -EOPNOTSUPP;
3986         if (rdev->ops->testmode_cmd) {
3987                 rdev->testmode_info = info;
3988                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3989                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3990                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3991                 rdev->testmode_info = NULL;
3992         }
3993
3994         return err;
3995 }
3996
3997 static struct sk_buff *
3998 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3999                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4000 {
4001         struct sk_buff *skb;
4002         void *hdr;
4003         struct nlattr *data;
4004
4005         skb = nlmsg_new(approxlen + 100, gfp);
4006         if (!skb)
4007                 return NULL;
4008
4009         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4010         if (!hdr) {
4011                 kfree_skb(skb);
4012                 return NULL;
4013         }
4014
4015         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4016         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4017
4018         ((void **)skb->cb)[0] = rdev;
4019         ((void **)skb->cb)[1] = hdr;
4020         ((void **)skb->cb)[2] = data;
4021
4022         return skb;
4023
4024  nla_put_failure:
4025         kfree_skb(skb);
4026         return NULL;
4027 }
4028
4029 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4030                                                   int approxlen)
4031 {
4032         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4033
4034         if (WARN_ON(!rdev->testmode_info))
4035                 return NULL;
4036
4037         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4038                                 rdev->testmode_info->snd_pid,
4039                                 rdev->testmode_info->snd_seq,
4040                                 GFP_KERNEL);
4041 }
4042 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4043
4044 int cfg80211_testmode_reply(struct sk_buff *skb)
4045 {
4046         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4047         void *hdr = ((void **)skb->cb)[1];
4048         struct nlattr *data = ((void **)skb->cb)[2];
4049
4050         if (WARN_ON(!rdev->testmode_info)) {
4051                 kfree_skb(skb);
4052                 return -EINVAL;
4053         }
4054
4055         nla_nest_end(skb, data);
4056         genlmsg_end(skb, hdr);
4057         return genlmsg_reply(skb, rdev->testmode_info);
4058 }
4059 EXPORT_SYMBOL(cfg80211_testmode_reply);
4060
4061 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4062                                                   int approxlen, gfp_t gfp)
4063 {
4064         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4065
4066         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4067 }
4068 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4069
4070 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4071 {
4072         void *hdr = ((void **)skb->cb)[1];
4073         struct nlattr *data = ((void **)skb->cb)[2];
4074
4075         nla_nest_end(skb, data);
4076         genlmsg_end(skb, hdr);
4077         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4078 }
4079 EXPORT_SYMBOL(cfg80211_testmode_event);
4080 #endif
4081
4082 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4083 {
4084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4085         struct net_device *dev = info->user_ptr[1];
4086         struct cfg80211_connect_params connect;
4087         struct wiphy *wiphy;
4088         struct cfg80211_cached_keys *connkeys = NULL;
4089         int err;
4090
4091         memset(&connect, 0, sizeof(connect));
4092
4093         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4094                 return -EINVAL;
4095
4096         if (!info->attrs[NL80211_ATTR_SSID] ||
4097             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4098                 return -EINVAL;
4099
4100         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4101                 connect.auth_type =
4102                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4103                 if (!nl80211_valid_auth_type(connect.auth_type))
4104                         return -EINVAL;
4105         } else
4106                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4107
4108         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4109
4110         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4111                                       NL80211_MAX_NR_CIPHER_SUITES);
4112         if (err)
4113                 return err;
4114
4115         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4116             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4117                 return -EOPNOTSUPP;
4118
4119         wiphy = &rdev->wiphy;
4120
4121         if (info->attrs[NL80211_ATTR_MAC])
4122                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4123         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4124         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4125
4126         if (info->attrs[NL80211_ATTR_IE]) {
4127                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4128                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4129         }
4130
4131         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4132                 connect.channel =
4133                         ieee80211_get_channel(wiphy,
4134                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4135                 if (!connect.channel ||
4136                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4137                         return -EINVAL;
4138         }
4139
4140         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4141                 connkeys = nl80211_parse_connkeys(rdev,
4142                                         info->attrs[NL80211_ATTR_KEYS]);
4143                 if (IS_ERR(connkeys))
4144                         return PTR_ERR(connkeys);
4145         }
4146
4147         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4148         if (err)
4149                 kfree(connkeys);
4150         return err;
4151 }
4152
4153 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4154 {
4155         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4156         struct net_device *dev = info->user_ptr[1];
4157         u16 reason;
4158
4159         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4160                 reason = WLAN_REASON_DEAUTH_LEAVING;
4161         else
4162                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4163
4164         if (reason == 0)
4165                 return -EINVAL;
4166
4167         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4168             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4169                 return -EOPNOTSUPP;
4170
4171         return cfg80211_disconnect(rdev, dev, reason, true);
4172 }
4173
4174 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4175 {
4176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4177         struct net *net;
4178         int err;
4179         u32 pid;
4180
4181         if (!info->attrs[NL80211_ATTR_PID])
4182                 return -EINVAL;
4183
4184         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4185
4186         net = get_net_ns_by_pid(pid);
4187         if (IS_ERR(net))
4188                 return PTR_ERR(net);
4189
4190         err = 0;
4191
4192         /* check if anything to do */
4193         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4194                 err = cfg80211_switch_netns(rdev, net);
4195
4196         put_net(net);
4197         return err;
4198 }
4199
4200 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4201 {
4202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4203         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4204                         struct cfg80211_pmksa *pmksa) = NULL;
4205         struct net_device *dev = info->user_ptr[1];
4206         struct cfg80211_pmksa pmksa;
4207
4208         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4209
4210         if (!info->attrs[NL80211_ATTR_MAC])
4211                 return -EINVAL;
4212
4213         if (!info->attrs[NL80211_ATTR_PMKID])
4214                 return -EINVAL;
4215
4216         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4217         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4218
4219         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4220             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4221                 return -EOPNOTSUPP;
4222
4223         switch (info->genlhdr->cmd) {
4224         case NL80211_CMD_SET_PMKSA:
4225                 rdev_ops = rdev->ops->set_pmksa;
4226                 break;
4227         case NL80211_CMD_DEL_PMKSA:
4228                 rdev_ops = rdev->ops->del_pmksa;
4229                 break;
4230         default:
4231                 WARN_ON(1);
4232                 break;
4233         }
4234
4235         if (!rdev_ops)
4236                 return -EOPNOTSUPP;
4237
4238         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4239 }
4240
4241 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4242 {
4243         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4244         struct net_device *dev = info->user_ptr[1];
4245
4246         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4247             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4248                 return -EOPNOTSUPP;
4249
4250         if (!rdev->ops->flush_pmksa)
4251                 return -EOPNOTSUPP;
4252
4253         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4254 }
4255
4256 static int nl80211_remain_on_channel(struct sk_buff *skb,
4257                                      struct genl_info *info)
4258 {
4259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4260         struct net_device *dev = info->user_ptr[1];
4261         struct ieee80211_channel *chan;
4262         struct sk_buff *msg;
4263         void *hdr;
4264         u64 cookie;
4265         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4266         u32 freq, duration;
4267         int err;
4268
4269         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4270             !info->attrs[NL80211_ATTR_DURATION])
4271                 return -EINVAL;
4272
4273         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4274
4275         /*
4276          * We should be on that channel for at least one jiffie,
4277          * and more than 5 seconds seems excessive.
4278          */
4279         if (!duration || !msecs_to_jiffies(duration) ||
4280             duration > rdev->wiphy.max_remain_on_channel_duration)
4281                 return -EINVAL;
4282
4283         if (!rdev->ops->remain_on_channel)
4284                 return -EOPNOTSUPP;
4285
4286         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4287                 channel_type = nla_get_u32(
4288                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4289                 if (channel_type != NL80211_CHAN_NO_HT &&
4290                     channel_type != NL80211_CHAN_HT20 &&
4291                     channel_type != NL80211_CHAN_HT40PLUS &&
4292                     channel_type != NL80211_CHAN_HT40MINUS)
4293                         return -EINVAL;
4294         }
4295
4296         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4297         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4298         if (chan == NULL)
4299                 return -EINVAL;
4300
4301         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4302         if (!msg)
4303                 return -ENOMEM;
4304
4305         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4306                              NL80211_CMD_REMAIN_ON_CHANNEL);
4307
4308         if (IS_ERR(hdr)) {
4309                 err = PTR_ERR(hdr);
4310                 goto free_msg;
4311         }
4312
4313         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4314                                            channel_type, duration, &cookie);
4315
4316         if (err)
4317                 goto free_msg;
4318
4319         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4320
4321         genlmsg_end(msg, hdr);
4322
4323         return genlmsg_reply(msg, info);
4324
4325  nla_put_failure:
4326         err = -ENOBUFS;
4327  free_msg:
4328         nlmsg_free(msg);
4329         return err;
4330 }
4331
4332 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4333                                             struct genl_info *info)
4334 {
4335         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4336         struct net_device *dev = info->user_ptr[1];
4337         u64 cookie;
4338
4339         if (!info->attrs[NL80211_ATTR_COOKIE])
4340                 return -EINVAL;
4341
4342         if (!rdev->ops->cancel_remain_on_channel)
4343                 return -EOPNOTSUPP;
4344
4345         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4346
4347         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4348 }
4349
4350 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4351                            u8 *rates, u8 rates_len)
4352 {
4353         u8 i;
4354         u32 mask = 0;
4355
4356         for (i = 0; i < rates_len; i++) {
4357                 int rate = (rates[i] & 0x7f) * 5;
4358                 int ridx;
4359                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4360                         struct ieee80211_rate *srate =
4361                                 &sband->bitrates[ridx];
4362                         if (rate == srate->bitrate) {
4363                                 mask |= 1 << ridx;
4364                                 break;
4365                         }
4366                 }
4367                 if (ridx == sband->n_bitrates)
4368                         return 0; /* rate not found */
4369         }
4370
4371         return mask;
4372 }
4373
4374 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4375         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4376                                     .len = NL80211_MAX_SUPP_RATES },
4377 };
4378
4379 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4380                                        struct genl_info *info)
4381 {
4382         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4384         struct cfg80211_bitrate_mask mask;
4385         int rem, i;
4386         struct net_device *dev = info->user_ptr[1];
4387         struct nlattr *tx_rates;
4388         struct ieee80211_supported_band *sband;
4389
4390         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4391                 return -EINVAL;
4392
4393         if (!rdev->ops->set_bitrate_mask)
4394                 return -EOPNOTSUPP;
4395
4396         memset(&mask, 0, sizeof(mask));
4397         /* Default to all rates enabled */
4398         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4399                 sband = rdev->wiphy.bands[i];
4400                 mask.control[i].legacy =
4401                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4402         }
4403
4404         /*
4405          * The nested attribute uses enum nl80211_band as the index. This maps
4406          * directly to the enum ieee80211_band values used in cfg80211.
4407          */
4408         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4409         {
4410                 enum ieee80211_band band = nla_type(tx_rates);
4411                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4412                         return -EINVAL;
4413                 sband = rdev->wiphy.bands[band];
4414                 if (sband == NULL)
4415                         return -EINVAL;
4416                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4417                           nla_len(tx_rates), nl80211_txattr_policy);
4418                 if (tb[NL80211_TXRATE_LEGACY]) {
4419                         mask.control[band].legacy = rateset_to_mask(
4420                                 sband,
4421                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4422                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4423                         if (mask.control[band].legacy == 0)
4424                                 return -EINVAL;
4425                 }
4426         }
4427
4428         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4429 }
4430
4431 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4432 {
4433         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4434         struct net_device *dev = info->user_ptr[1];
4435         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4436
4437         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4438                 return -EINVAL;
4439
4440         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4441                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4442
4443         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4444             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4445             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4446             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4447             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4448             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4449             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4450                 return -EOPNOTSUPP;
4451
4452         /* not much point in registering if we can't reply */
4453         if (!rdev->ops->mgmt_tx)
4454                 return -EOPNOTSUPP;
4455
4456         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4457                         frame_type,
4458                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4459                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4460 }
4461
4462 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4463 {
4464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4465         struct net_device *dev = info->user_ptr[1];
4466         struct ieee80211_channel *chan;
4467         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4468         bool channel_type_valid = false;
4469         u32 freq;
4470         int err;
4471         void *hdr;
4472         u64 cookie;
4473         struct sk_buff *msg;
4474         unsigned int wait = 0;
4475         bool offchan;
4476
4477         if (!info->attrs[NL80211_ATTR_FRAME] ||
4478             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4479                 return -EINVAL;
4480
4481         if (!rdev->ops->mgmt_tx)
4482                 return -EOPNOTSUPP;
4483
4484         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4485             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4486             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4487             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4488             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4489             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4490             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4491                 return -EOPNOTSUPP;
4492
4493         if (info->attrs[NL80211_ATTR_DURATION]) {
4494                 if (!rdev->ops->mgmt_tx_cancel_wait)
4495                         return -EINVAL;
4496                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4497         }
4498
4499         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4500                 channel_type = nla_get_u32(
4501                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4502                 if (channel_type != NL80211_CHAN_NO_HT &&
4503                     channel_type != NL80211_CHAN_HT20 &&
4504                     channel_type != NL80211_CHAN_HT40PLUS &&
4505                     channel_type != NL80211_CHAN_HT40MINUS)
4506                         return -EINVAL;
4507                 channel_type_valid = true;
4508         }
4509
4510         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
4511
4512         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4513         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4514         if (chan == NULL)
4515                 return -EINVAL;
4516
4517         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4518         if (!msg)
4519                 return -ENOMEM;
4520
4521         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4522                              NL80211_CMD_FRAME);
4523
4524         if (IS_ERR(hdr)) {
4525                 err = PTR_ERR(hdr);
4526                 goto free_msg;
4527         }
4528         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
4529                                     channel_type_valid, wait,
4530                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
4531                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
4532                                     &cookie);
4533         if (err)
4534                 goto free_msg;
4535
4536         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4537
4538         genlmsg_end(msg, hdr);
4539         return genlmsg_reply(msg, info);
4540
4541  nla_put_failure:
4542         err = -ENOBUFS;
4543  free_msg:
4544         nlmsg_free(msg);
4545         return err;
4546 }
4547
4548 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
4549 {
4550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4551         struct net_device *dev = info->user_ptr[1];
4552         u64 cookie;
4553
4554         if (!info->attrs[NL80211_ATTR_COOKIE])
4555                 return -EINVAL;
4556
4557         if (!rdev->ops->mgmt_tx_cancel_wait)
4558                 return -EOPNOTSUPP;
4559
4560         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4561             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4562             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4563             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4564             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4565             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4566                 return -EOPNOTSUPP;
4567
4568         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4569
4570         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
4571 }
4572
4573 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4574 {
4575         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4576         struct wireless_dev *wdev;
4577         struct net_device *dev = info->user_ptr[1];
4578         u8 ps_state;
4579         bool state;
4580         int err;
4581
4582         if (!info->attrs[NL80211_ATTR_PS_STATE])
4583                 return -EINVAL;
4584
4585         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4586
4587         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
4588                 return -EINVAL;
4589
4590         wdev = dev->ieee80211_ptr;
4591
4592         if (!rdev->ops->set_power_mgmt)
4593                 return -EOPNOTSUPP;
4594
4595         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4596
4597         if (state == wdev->ps)
4598                 return 0;
4599
4600         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
4601                                         wdev->ps_timeout);
4602         if (!err)
4603                 wdev->ps = state;
4604         return err;
4605 }
4606
4607 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4608 {
4609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4610         enum nl80211_ps_state ps_state;
4611         struct wireless_dev *wdev;
4612         struct net_device *dev = info->user_ptr[1];
4613         struct sk_buff *msg;
4614         void *hdr;
4615         int err;
4616
4617         wdev = dev->ieee80211_ptr;
4618
4619         if (!rdev->ops->set_power_mgmt)
4620                 return -EOPNOTSUPP;
4621
4622         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4623         if (!msg)
4624                 return -ENOMEM;
4625
4626         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4627                              NL80211_CMD_GET_POWER_SAVE);
4628         if (!hdr) {
4629                 err = -ENOBUFS;
4630                 goto free_msg;
4631         }
4632
4633         if (wdev->ps)
4634                 ps_state = NL80211_PS_ENABLED;
4635         else
4636                 ps_state = NL80211_PS_DISABLED;
4637
4638         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4639
4640         genlmsg_end(msg, hdr);
4641         return genlmsg_reply(msg, info);
4642
4643  nla_put_failure:
4644         err = -ENOBUFS;
4645  free_msg:
4646         nlmsg_free(msg);
4647         return err;
4648 }
4649
4650 static struct nla_policy
4651 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4652         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4653         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4654         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4655 };
4656
4657 static int nl80211_set_cqm_rssi(struct genl_info *info,
4658                                 s32 threshold, u32 hysteresis)
4659 {
4660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4661         struct wireless_dev *wdev;
4662         struct net_device *dev = info->user_ptr[1];
4663
4664         if (threshold > 0)
4665                 return -EINVAL;
4666
4667         wdev = dev->ieee80211_ptr;
4668
4669         if (!rdev->ops->set_cqm_rssi_config)
4670                 return -EOPNOTSUPP;
4671
4672         if (wdev->iftype != NL80211_IFTYPE_STATION &&
4673             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
4674                 return -EOPNOTSUPP;
4675
4676         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4677                                               threshold, hysteresis);
4678 }
4679
4680 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4681 {
4682         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4683         struct nlattr *cqm;
4684         int err;
4685
4686         cqm = info->attrs[NL80211_ATTR_CQM];
4687         if (!cqm) {
4688                 err = -EINVAL;
4689                 goto out;
4690         }
4691
4692         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4693                                nl80211_attr_cqm_policy);
4694         if (err)
4695                 goto out;
4696
4697         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4698             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4699                 s32 threshold;
4700                 u32 hysteresis;
4701                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4702                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4703                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4704         } else
4705                 err = -EINVAL;
4706
4707 out:
4708         return err;
4709 }
4710
4711 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
4712 {
4713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4714         struct net_device *dev = info->user_ptr[1];
4715         struct mesh_config cfg;
4716         struct mesh_setup setup;
4717         int err;
4718
4719         /* start with default */
4720         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
4721         memcpy(&setup, &default_mesh_setup, sizeof(setup));
4722
4723         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
4724                 /* and parse parameters if given */
4725                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
4726                 if (err)
4727                         return err;
4728         }
4729
4730         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
4731             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
4732                 return -EINVAL;
4733
4734         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
4735         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4736
4737         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
4738                 /* parse additional setup parameters if given */
4739                 err = nl80211_parse_mesh_setup(info, &setup);
4740                 if (err)
4741                         return err;
4742         }
4743
4744         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
4745 }
4746
4747 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
4748 {
4749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4750         struct net_device *dev = info->user_ptr[1];
4751
4752         return cfg80211_leave_mesh(rdev, dev);
4753 }
4754
4755 #define NL80211_FLAG_NEED_WIPHY         0x01
4756 #define NL80211_FLAG_NEED_NETDEV        0x02
4757 #define NL80211_FLAG_NEED_RTNL          0x04
4758 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
4759 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
4760                                          NL80211_FLAG_CHECK_NETDEV_UP)
4761
4762 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
4763                             struct genl_info *info)
4764 {
4765         struct cfg80211_registered_device *rdev;
4766         struct net_device *dev;
4767         int err;
4768         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
4769
4770         if (rtnl)
4771                 rtnl_lock();
4772
4773         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
4774                 rdev = cfg80211_get_dev_from_info(info);
4775                 if (IS_ERR(rdev)) {
4776                         if (rtnl)
4777                                 rtnl_unlock();
4778                         return PTR_ERR(rdev);
4779                 }
4780                 info->user_ptr[0] = rdev;
4781         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
4782                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4783                 if (err) {
4784                         if (rtnl)
4785                                 rtnl_unlock();
4786                         return err;
4787                 }
4788                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
4789                     !netif_running(dev)) {
4790                         cfg80211_unlock_rdev(rdev);
4791                         dev_put(dev);
4792                         if (rtnl)
4793                                 rtnl_unlock();
4794                         return -ENETDOWN;
4795                 }
4796                 info->user_ptr[0] = rdev;
4797                 info->user_ptr[1] = dev;
4798         }
4799
4800         return 0;
4801 }
4802
4803 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
4804                               struct genl_info *info)
4805 {
4806         if (info->user_ptr[0])
4807                 cfg80211_unlock_rdev(info->user_ptr[0]);
4808         if (info->user_ptr[1])
4809                 dev_put(info->user_ptr[1]);
4810         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
4811                 rtnl_unlock();
4812 }
4813
4814 static struct genl_ops nl80211_ops[] = {
4815         {
4816                 .cmd = NL80211_CMD_GET_WIPHY,
4817                 .doit = nl80211_get_wiphy,
4818                 .dumpit = nl80211_dump_wiphy,
4819                 .policy = nl80211_policy,
4820                 /* can be retrieved by unprivileged users */
4821                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
4822         },
4823         {
4824                 .cmd = NL80211_CMD_SET_WIPHY,
4825                 .doit = nl80211_set_wiphy,
4826                 .policy = nl80211_policy,
4827                 .flags = GENL_ADMIN_PERM,
4828                 .internal_flags = NL80211_FLAG_NEED_RTNL,
4829         },
4830         {
4831                 .cmd = NL80211_CMD_GET_INTERFACE,
4832                 .doit = nl80211_get_interface,
4833                 .dumpit = nl80211_dump_interface,
4834                 .policy = nl80211_policy,
4835                 /* can be retrieved by unprivileged users */
4836                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
4837         },
4838         {
4839                 .cmd = NL80211_CMD_SET_INTERFACE,
4840                 .doit = nl80211_set_interface,
4841                 .policy = nl80211_policy,
4842                 .flags = GENL_ADMIN_PERM,
4843                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4844                                   NL80211_FLAG_NEED_RTNL,
4845         },
4846         {
4847                 .cmd = NL80211_CMD_NEW_INTERFACE,
4848                 .doit = nl80211_new_interface,
4849                 .policy = nl80211_policy,
4850                 .flags = GENL_ADMIN_PERM,
4851                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4852                                   NL80211_FLAG_NEED_RTNL,
4853         },
4854         {
4855                 .cmd = NL80211_CMD_DEL_INTERFACE,
4856                 .doit = nl80211_del_interface,
4857                 .policy = nl80211_policy,
4858                 .flags = GENL_ADMIN_PERM,
4859                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4860                                   NL80211_FLAG_NEED_RTNL,
4861         },
4862         {
4863                 .cmd = NL80211_CMD_GET_KEY,
4864                 .doit = nl80211_get_key,
4865                 .policy = nl80211_policy,
4866                 .flags = GENL_ADMIN_PERM,
4867                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4868                                   NL80211_FLAG_NEED_RTNL,
4869         },
4870         {
4871                 .cmd = NL80211_CMD_SET_KEY,
4872                 .doit = nl80211_set_key,
4873                 .policy = nl80211_policy,
4874                 .flags = GENL_ADMIN_PERM,
4875                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4876                                   NL80211_FLAG_NEED_RTNL,
4877         },
4878         {
4879                 .cmd = NL80211_CMD_NEW_KEY,
4880                 .doit = nl80211_new_key,
4881                 .policy = nl80211_policy,
4882                 .flags = GENL_ADMIN_PERM,
4883                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4884                                   NL80211_FLAG_NEED_RTNL,
4885         },
4886         {
4887                 .cmd = NL80211_CMD_DEL_KEY,
4888                 .doit = nl80211_del_key,
4889                 .policy = nl80211_policy,
4890                 .flags = GENL_ADMIN_PERM,
4891                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4892                                   NL80211_FLAG_NEED_RTNL,
4893         },
4894         {
4895                 .cmd = NL80211_CMD_SET_BEACON,
4896                 .policy = nl80211_policy,
4897                 .flags = GENL_ADMIN_PERM,
4898                 .doit = nl80211_addset_beacon,
4899                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4900                                   NL80211_FLAG_NEED_RTNL,
4901         },
4902         {
4903                 .cmd = NL80211_CMD_NEW_BEACON,
4904                 .policy = nl80211_policy,
4905                 .flags = GENL_ADMIN_PERM,
4906                 .doit = nl80211_addset_beacon,
4907                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4908                                   NL80211_FLAG_NEED_RTNL,
4909         },
4910         {
4911                 .cmd = NL80211_CMD_DEL_BEACON,
4912                 .policy = nl80211_policy,
4913                 .flags = GENL_ADMIN_PERM,
4914                 .doit = nl80211_del_beacon,
4915                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4916                                   NL80211_FLAG_NEED_RTNL,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_GET_STATION,
4920                 .doit = nl80211_get_station,
4921                 .dumpit = nl80211_dump_station,
4922                 .policy = nl80211_policy,
4923                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4924                                   NL80211_FLAG_NEED_RTNL,
4925         },
4926         {
4927                 .cmd = NL80211_CMD_SET_STATION,
4928                 .doit = nl80211_set_station,
4929                 .policy = nl80211_policy,
4930                 .flags = GENL_ADMIN_PERM,
4931                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4932                                   NL80211_FLAG_NEED_RTNL,
4933         },
4934         {
4935                 .cmd = NL80211_CMD_NEW_STATION,
4936                 .doit = nl80211_new_station,
4937                 .policy = nl80211_policy,
4938                 .flags = GENL_ADMIN_PERM,
4939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4940                                   NL80211_FLAG_NEED_RTNL,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_DEL_STATION,
4944                 .doit = nl80211_del_station,
4945                 .policy = nl80211_policy,
4946                 .flags = GENL_ADMIN_PERM,
4947                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4948                                   NL80211_FLAG_NEED_RTNL,
4949         },
4950         {
4951                 .cmd = NL80211_CMD_GET_MPATH,
4952                 .doit = nl80211_get_mpath,
4953                 .dumpit = nl80211_dump_mpath,
4954                 .policy = nl80211_policy,
4955                 .flags = GENL_ADMIN_PERM,
4956                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4957                                   NL80211_FLAG_NEED_RTNL,
4958         },
4959         {
4960                 .cmd = NL80211_CMD_SET_MPATH,
4961                 .doit = nl80211_set_mpath,
4962                 .policy = nl80211_policy,
4963                 .flags = GENL_ADMIN_PERM,
4964                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4965                                   NL80211_FLAG_NEED_RTNL,
4966         },
4967         {
4968                 .cmd = NL80211_CMD_NEW_MPATH,
4969                 .doit = nl80211_new_mpath,
4970                 .policy = nl80211_policy,
4971                 .flags = GENL_ADMIN_PERM,
4972                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4973                                   NL80211_FLAG_NEED_RTNL,
4974         },
4975         {
4976                 .cmd = NL80211_CMD_DEL_MPATH,
4977                 .doit = nl80211_del_mpath,
4978                 .policy = nl80211_policy,
4979                 .flags = GENL_ADMIN_PERM,
4980                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4981                                   NL80211_FLAG_NEED_RTNL,
4982         },
4983         {
4984                 .cmd = NL80211_CMD_SET_BSS,
4985                 .doit = nl80211_set_bss,
4986                 .policy = nl80211_policy,
4987                 .flags = GENL_ADMIN_PERM,
4988                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4989                                   NL80211_FLAG_NEED_RTNL,
4990         },
4991         {
4992                 .cmd = NL80211_CMD_GET_REG,
4993                 .doit = nl80211_get_reg,
4994                 .policy = nl80211_policy,
4995                 /* can be retrieved by unprivileged users */
4996         },
4997         {
4998                 .cmd = NL80211_CMD_SET_REG,
4999                 .doit = nl80211_set_reg,
5000                 .policy = nl80211_policy,
5001                 .flags = GENL_ADMIN_PERM,
5002         },
5003         {
5004                 .cmd = NL80211_CMD_REQ_SET_REG,
5005                 .doit = nl80211_req_set_reg,
5006                 .policy = nl80211_policy,
5007                 .flags = GENL_ADMIN_PERM,
5008         },
5009         {
5010                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5011                 .doit = nl80211_get_mesh_config,
5012                 .policy = nl80211_policy,
5013                 /* can be retrieved by unprivileged users */
5014                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5015                                   NL80211_FLAG_NEED_RTNL,
5016         },
5017         {
5018                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5019                 .doit = nl80211_update_mesh_config,
5020                 .policy = nl80211_policy,
5021                 .flags = GENL_ADMIN_PERM,
5022                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5023                                   NL80211_FLAG_NEED_RTNL,
5024         },
5025         {
5026                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5027                 .doit = nl80211_trigger_scan,
5028                 .policy = nl80211_policy,
5029                 .flags = GENL_ADMIN_PERM,
5030                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5031                                   NL80211_FLAG_NEED_RTNL,
5032         },
5033         {
5034                 .cmd = NL80211_CMD_GET_SCAN,
5035                 .policy = nl80211_policy,
5036                 .dumpit = nl80211_dump_scan,
5037         },
5038         {
5039                 .cmd = NL80211_CMD_AUTHENTICATE,
5040                 .doit = nl80211_authenticate,
5041                 .policy = nl80211_policy,
5042                 .flags = GENL_ADMIN_PERM,
5043                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5044                                   NL80211_FLAG_NEED_RTNL,
5045         },
5046         {
5047                 .cmd = NL80211_CMD_ASSOCIATE,
5048                 .doit = nl80211_associate,
5049                 .policy = nl80211_policy,
5050                 .flags = GENL_ADMIN_PERM,
5051                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5052                                   NL80211_FLAG_NEED_RTNL,
5053         },
5054         {
5055                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5056                 .doit = nl80211_deauthenticate,
5057                 .policy = nl80211_policy,
5058                 .flags = GENL_ADMIN_PERM,
5059                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5060                                   NL80211_FLAG_NEED_RTNL,
5061         },
5062         {
5063                 .cmd = NL80211_CMD_DISASSOCIATE,
5064                 .doit = nl80211_disassociate,
5065                 .policy = nl80211_policy,
5066                 .flags = GENL_ADMIN_PERM,
5067                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5068                                   NL80211_FLAG_NEED_RTNL,
5069         },
5070         {
5071                 .cmd = NL80211_CMD_JOIN_IBSS,
5072                 .doit = nl80211_join_ibss,
5073                 .policy = nl80211_policy,
5074                 .flags = GENL_ADMIN_PERM,
5075                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5076                                   NL80211_FLAG_NEED_RTNL,
5077         },
5078         {
5079                 .cmd = NL80211_CMD_LEAVE_IBSS,
5080                 .doit = nl80211_leave_ibss,
5081                 .policy = nl80211_policy,
5082                 .flags = GENL_ADMIN_PERM,
5083                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5084                                   NL80211_FLAG_NEED_RTNL,
5085         },
5086 #ifdef CONFIG_NL80211_TESTMODE
5087         {
5088                 .cmd = NL80211_CMD_TESTMODE,
5089                 .doit = nl80211_testmode_do,
5090                 .policy = nl80211_policy,
5091                 .flags = GENL_ADMIN_PERM,
5092                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5093                                   NL80211_FLAG_NEED_RTNL,
5094         },
5095 #endif
5096         {
5097                 .cmd = NL80211_CMD_CONNECT,
5098                 .doit = nl80211_connect,
5099                 .policy = nl80211_policy,
5100                 .flags = GENL_ADMIN_PERM,
5101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5102                                   NL80211_FLAG_NEED_RTNL,
5103         },
5104         {
5105                 .cmd = NL80211_CMD_DISCONNECT,
5106                 .doit = nl80211_disconnect,
5107                 .policy = nl80211_policy,
5108                 .flags = GENL_ADMIN_PERM,
5109                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5110                                   NL80211_FLAG_NEED_RTNL,
5111         },
5112         {
5113                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5114                 .doit = nl80211_wiphy_netns,
5115                 .policy = nl80211_policy,
5116                 .flags = GENL_ADMIN_PERM,
5117                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5118                                   NL80211_FLAG_NEED_RTNL,
5119         },
5120         {
5121                 .cmd = NL80211_CMD_GET_SURVEY,
5122                 .policy = nl80211_policy,
5123                 .dumpit = nl80211_dump_survey,
5124         },
5125         {
5126                 .cmd = NL80211_CMD_SET_PMKSA,
5127                 .doit = nl80211_setdel_pmksa,
5128                 .policy = nl80211_policy,
5129                 .flags = GENL_ADMIN_PERM,
5130                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5131                                   NL80211_FLAG_NEED_RTNL,
5132         },
5133         {
5134                 .cmd = NL80211_CMD_DEL_PMKSA,
5135                 .doit = nl80211_setdel_pmksa,
5136                 .policy = nl80211_policy,
5137                 .flags = GENL_ADMIN_PERM,
5138                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5139                                   NL80211_FLAG_NEED_RTNL,
5140         },
5141         {
5142                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5143                 .doit = nl80211_flush_pmksa,
5144                 .policy = nl80211_policy,
5145                 .flags = GENL_ADMIN_PERM,
5146                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5147                                   NL80211_FLAG_NEED_RTNL,
5148         },
5149         {
5150                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5151                 .doit = nl80211_remain_on_channel,
5152                 .policy = nl80211_policy,
5153                 .flags = GENL_ADMIN_PERM,
5154                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5155                                   NL80211_FLAG_NEED_RTNL,
5156         },
5157         {
5158                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5159                 .doit = nl80211_cancel_remain_on_channel,
5160                 .policy = nl80211_policy,
5161                 .flags = GENL_ADMIN_PERM,
5162                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5163                                   NL80211_FLAG_NEED_RTNL,
5164         },
5165         {
5166                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5167                 .doit = nl80211_set_tx_bitrate_mask,
5168                 .policy = nl80211_policy,
5169                 .flags = GENL_ADMIN_PERM,
5170                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5171                                   NL80211_FLAG_NEED_RTNL,
5172         },
5173         {
5174                 .cmd = NL80211_CMD_REGISTER_FRAME,
5175                 .doit = nl80211_register_mgmt,
5176                 .policy = nl80211_policy,
5177                 .flags = GENL_ADMIN_PERM,
5178                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5179                                   NL80211_FLAG_NEED_RTNL,
5180         },
5181         {
5182                 .cmd = NL80211_CMD_FRAME,
5183                 .doit = nl80211_tx_mgmt,
5184                 .policy = nl80211_policy,
5185                 .flags = GENL_ADMIN_PERM,
5186                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5187                                   NL80211_FLAG_NEED_RTNL,
5188         },
5189         {
5190                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
5191                 .doit = nl80211_tx_mgmt_cancel_wait,
5192                 .policy = nl80211_policy,
5193                 .flags = GENL_ADMIN_PERM,
5194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5195                                   NL80211_FLAG_NEED_RTNL,
5196         },
5197         {
5198                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5199                 .doit = nl80211_set_power_save,
5200                 .policy = nl80211_policy,
5201                 .flags = GENL_ADMIN_PERM,
5202                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5203                                   NL80211_FLAG_NEED_RTNL,
5204         },
5205         {
5206                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5207                 .doit = nl80211_get_power_save,
5208                 .policy = nl80211_policy,
5209                 /* can be retrieved by unprivileged users */
5210                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5211                                   NL80211_FLAG_NEED_RTNL,
5212         },
5213         {
5214                 .cmd = NL80211_CMD_SET_CQM,
5215                 .doit = nl80211_set_cqm,
5216                 .policy = nl80211_policy,
5217                 .flags = GENL_ADMIN_PERM,
5218                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5219                                   NL80211_FLAG_NEED_RTNL,
5220         },
5221         {
5222                 .cmd = NL80211_CMD_SET_CHANNEL,
5223                 .doit = nl80211_set_channel,
5224                 .policy = nl80211_policy,
5225                 .flags = GENL_ADMIN_PERM,
5226                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5227                                   NL80211_FLAG_NEED_RTNL,
5228         },
5229         {
5230                 .cmd = NL80211_CMD_SET_WDS_PEER,
5231                 .doit = nl80211_set_wds_peer,
5232                 .policy = nl80211_policy,
5233                 .flags = GENL_ADMIN_PERM,
5234                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5235                                   NL80211_FLAG_NEED_RTNL,
5236         },
5237         {
5238                 .cmd = NL80211_CMD_JOIN_MESH,
5239                 .doit = nl80211_join_mesh,
5240                 .policy = nl80211_policy,
5241                 .flags = GENL_ADMIN_PERM,
5242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5243                                   NL80211_FLAG_NEED_RTNL,
5244         },
5245         {
5246                 .cmd = NL80211_CMD_LEAVE_MESH,
5247                 .doit = nl80211_leave_mesh,
5248                 .policy = nl80211_policy,
5249                 .flags = GENL_ADMIN_PERM,
5250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5251                                   NL80211_FLAG_NEED_RTNL,
5252         },
5253 };
5254
5255 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5256         .name = "mlme",
5257 };
5258
5259 /* multicast groups */
5260 static struct genl_multicast_group nl80211_config_mcgrp = {
5261         .name = "config",
5262 };
5263 static struct genl_multicast_group nl80211_scan_mcgrp = {
5264         .name = "scan",
5265 };
5266 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5267         .name = "regulatory",
5268 };
5269
5270 /* notification functions */
5271
5272 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5273 {
5274         struct sk_buff *msg;
5275
5276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5277         if (!msg)
5278                 return;
5279
5280         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5281                 nlmsg_free(msg);
5282                 return;
5283         }
5284
5285         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5286                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5287 }
5288
5289 static int nl80211_add_scan_req(struct sk_buff *msg,
5290                                 struct cfg80211_registered_device *rdev)
5291 {
5292         struct cfg80211_scan_request *req = rdev->scan_req;
5293         struct nlattr *nest;
5294         int i;
5295
5296         ASSERT_RDEV_LOCK(rdev);
5297
5298         if (WARN_ON(!req))
5299                 return 0;
5300
5301         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5302         if (!nest)
5303                 goto nla_put_failure;
5304         for (i = 0; i < req->n_ssids; i++)
5305                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5306         nla_nest_end(msg, nest);
5307
5308         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5309         if (!nest)
5310                 goto nla_put_failure;
5311         for (i = 0; i < req->n_channels; i++)
5312                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5313         nla_nest_end(msg, nest);
5314
5315         if (req->ie)
5316                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5317
5318         return 0;
5319  nla_put_failure:
5320         return -ENOBUFS;
5321 }
5322
5323 static int nl80211_send_scan_msg(struct sk_buff *msg,
5324                                  struct cfg80211_registered_device *rdev,
5325                                  struct net_device *netdev,
5326                                  u32 pid, u32 seq, int flags,
5327                                  u32 cmd)
5328 {
5329         void *hdr;
5330
5331         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5332         if (!hdr)
5333                 return -1;
5334
5335         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5336         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5337
5338         /* ignore errors and send incomplete event anyway */
5339         nl80211_add_scan_req(msg, rdev);
5340
5341         return genlmsg_end(msg, hdr);
5342
5343  nla_put_failure:
5344         genlmsg_cancel(msg, hdr);
5345         return -EMSGSIZE;
5346 }
5347
5348 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5349                              struct net_device *netdev)
5350 {
5351         struct sk_buff *msg;
5352
5353         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5354         if (!msg)
5355                 return;
5356
5357         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5358                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5359                 nlmsg_free(msg);
5360                 return;
5361         }
5362
5363         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5364                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5365 }
5366
5367 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5368                             struct net_device *netdev)
5369 {
5370         struct sk_buff *msg;
5371
5372         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5373         if (!msg)
5374                 return;
5375
5376         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5377                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5378                 nlmsg_free(msg);
5379                 return;
5380         }
5381
5382         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5383                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5384 }
5385
5386 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5387                                struct net_device *netdev)
5388 {
5389         struct sk_buff *msg;
5390
5391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5392         if (!msg)
5393                 return;
5394
5395         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5396                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5397                 nlmsg_free(msg);
5398                 return;
5399         }
5400
5401         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5402                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5403 }
5404
5405 /*
5406  * This can happen on global regulatory changes or device specific settings
5407  * based on custom world regulatory domains.
5408  */
5409 void nl80211_send_reg_change_event(struct regulatory_request *request)
5410 {
5411         struct sk_buff *msg;
5412         void *hdr;
5413
5414         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5415         if (!msg)
5416                 return;
5417
5418         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5419         if (!hdr) {
5420                 nlmsg_free(msg);
5421                 return;
5422         }
5423
5424         /* Userspace can always count this one always being set */
5425         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5426
5427         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5428                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5429                            NL80211_REGDOM_TYPE_WORLD);
5430         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5431                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5432                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5433         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5434                  request->intersect)
5435                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5436                            NL80211_REGDOM_TYPE_INTERSECTION);
5437         else {
5438                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5439                            NL80211_REGDOM_TYPE_COUNTRY);
5440                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5441         }
5442
5443         if (wiphy_idx_valid(request->wiphy_idx))
5444                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5445
5446         if (genlmsg_end(msg, hdr) < 0) {
5447                 nlmsg_free(msg);
5448                 return;
5449         }
5450
5451         rcu_read_lock();
5452         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5453                                 GFP_ATOMIC);
5454         rcu_read_unlock();
5455
5456         return;
5457
5458 nla_put_failure:
5459         genlmsg_cancel(msg, hdr);
5460         nlmsg_free(msg);
5461 }
5462
5463 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5464                                     struct net_device *netdev,
5465                                     const u8 *buf, size_t len,
5466                                     enum nl80211_commands cmd, gfp_t gfp)
5467 {
5468         struct sk_buff *msg;
5469         void *hdr;
5470
5471         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5472         if (!msg)
5473                 return;
5474
5475         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5476         if (!hdr) {
5477                 nlmsg_free(msg);
5478                 return;
5479         }
5480
5481         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5482         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5483         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5484
5485         if (genlmsg_end(msg, hdr) < 0) {
5486                 nlmsg_free(msg);
5487                 return;
5488         }
5489
5490         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5491                                 nl80211_mlme_mcgrp.id, gfp);
5492         return;
5493
5494  nla_put_failure:
5495         genlmsg_cancel(msg, hdr);
5496         nlmsg_free(msg);
5497 }
5498
5499 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5500                           struct net_device *netdev, const u8 *buf,
5501                           size_t len, gfp_t gfp)
5502 {
5503         nl80211_send_mlme_event(rdev, netdev, buf, len,
5504                                 NL80211_CMD_AUTHENTICATE, gfp);
5505 }
5506
5507 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5508                            struct net_device *netdev, const u8 *buf,
5509                            size_t len, gfp_t gfp)
5510 {
5511         nl80211_send_mlme_event(rdev, netdev, buf, len,
5512                                 NL80211_CMD_ASSOCIATE, gfp);
5513 }
5514
5515 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5516                          struct net_device *netdev, const u8 *buf,
5517                          size_t len, gfp_t gfp)
5518 {
5519         nl80211_send_mlme_event(rdev, netdev, buf, len,
5520                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5521 }
5522
5523 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5524                            struct net_device *netdev, const u8 *buf,
5525                            size_t len, gfp_t gfp)
5526 {
5527         nl80211_send_mlme_event(rdev, netdev, buf, len,
5528                                 NL80211_CMD_DISASSOCIATE, gfp);
5529 }
5530
5531 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
5532                                 struct net_device *netdev, const u8 *buf,
5533                                 size_t len, gfp_t gfp)
5534 {
5535         nl80211_send_mlme_event(rdev, netdev, buf, len,
5536                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
5537 }
5538
5539 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
5540                                   struct net_device *netdev, const u8 *buf,
5541                                   size_t len, gfp_t gfp)
5542 {
5543         nl80211_send_mlme_event(rdev, netdev, buf, len,
5544                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
5545 }
5546
5547 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5548                                       struct net_device *netdev, int cmd,
5549                                       const u8 *addr, gfp_t gfp)
5550 {
5551         struct sk_buff *msg;
5552         void *hdr;
5553
5554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5555         if (!msg)
5556                 return;
5557
5558         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5559         if (!hdr) {
5560                 nlmsg_free(msg);
5561                 return;
5562         }
5563
5564         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5565         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5566         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5567         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5568
5569         if (genlmsg_end(msg, hdr) < 0) {
5570                 nlmsg_free(msg);
5571                 return;
5572         }
5573
5574         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5575                                 nl80211_mlme_mcgrp.id, gfp);
5576         return;
5577
5578  nla_put_failure:
5579         genlmsg_cancel(msg, hdr);
5580         nlmsg_free(msg);
5581 }
5582
5583 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5584                                struct net_device *netdev, const u8 *addr,
5585                                gfp_t gfp)
5586 {
5587         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5588                                   addr, gfp);
5589 }
5590
5591 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5592                                 struct net_device *netdev, const u8 *addr,
5593                                 gfp_t gfp)
5594 {
5595         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5596                                   addr, gfp);
5597 }
5598
5599 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5600                                  struct net_device *netdev, const u8 *bssid,
5601                                  const u8 *req_ie, size_t req_ie_len,
5602                                  const u8 *resp_ie, size_t resp_ie_len,
5603                                  u16 status, gfp_t gfp)
5604 {
5605         struct sk_buff *msg;
5606         void *hdr;
5607
5608         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5609         if (!msg)
5610                 return;
5611
5612         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5613         if (!hdr) {
5614                 nlmsg_free(msg);
5615                 return;
5616         }
5617
5618         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5619         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5620         if (bssid)
5621                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5622         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5623         if (req_ie)
5624                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5625         if (resp_ie)
5626                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5627
5628         if (genlmsg_end(msg, hdr) < 0) {
5629                 nlmsg_free(msg);
5630                 return;
5631         }
5632
5633         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5634                                 nl80211_mlme_mcgrp.id, gfp);
5635         return;
5636
5637  nla_put_failure:
5638         genlmsg_cancel(msg, hdr);
5639         nlmsg_free(msg);
5640
5641 }
5642
5643 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5644                          struct net_device *netdev, const u8 *bssid,
5645                          const u8 *req_ie, size_t req_ie_len,
5646                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5647 {
5648         struct sk_buff *msg;
5649         void *hdr;
5650
5651         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5652         if (!msg)
5653                 return;
5654
5655         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5656         if (!hdr) {
5657                 nlmsg_free(msg);
5658                 return;
5659         }
5660
5661         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5662         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5663         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5664         if (req_ie)
5665                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5666         if (resp_ie)
5667                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5668
5669         if (genlmsg_end(msg, hdr) < 0) {
5670                 nlmsg_free(msg);
5671                 return;
5672         }
5673
5674         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5675                                 nl80211_mlme_mcgrp.id, gfp);
5676         return;
5677
5678  nla_put_failure:
5679         genlmsg_cancel(msg, hdr);
5680         nlmsg_free(msg);
5681
5682 }
5683
5684 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5685                                struct net_device *netdev, u16 reason,
5686                                const u8 *ie, size_t ie_len, bool from_ap)
5687 {
5688         struct sk_buff *msg;
5689         void *hdr;
5690
5691         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5692         if (!msg)
5693                 return;
5694
5695         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5696         if (!hdr) {
5697                 nlmsg_free(msg);
5698                 return;
5699         }
5700
5701         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5702         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5703         if (from_ap && reason)
5704                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5705         if (from_ap)
5706                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5707         if (ie)
5708                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5709
5710         if (genlmsg_end(msg, hdr) < 0) {
5711                 nlmsg_free(msg);
5712                 return;
5713         }
5714
5715         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5716                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5717         return;
5718
5719  nla_put_failure:
5720         genlmsg_cancel(msg, hdr);
5721         nlmsg_free(msg);
5722
5723 }
5724
5725 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5726                              struct net_device *netdev, const u8 *bssid,
5727                              gfp_t gfp)
5728 {
5729         struct sk_buff *msg;
5730         void *hdr;
5731
5732         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5733         if (!msg)
5734                 return;
5735
5736         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5737         if (!hdr) {
5738                 nlmsg_free(msg);
5739                 return;
5740         }
5741
5742         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5743         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5744         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5745
5746         if (genlmsg_end(msg, hdr) < 0) {
5747                 nlmsg_free(msg);
5748                 return;
5749         }
5750
5751         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5752                                 nl80211_mlme_mcgrp.id, gfp);
5753         return;
5754
5755  nla_put_failure:
5756         genlmsg_cancel(msg, hdr);
5757         nlmsg_free(msg);
5758 }
5759
5760 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5761                                  struct net_device *netdev, const u8 *addr,
5762                                  enum nl80211_key_type key_type, int key_id,
5763                                  const u8 *tsc, gfp_t gfp)
5764 {
5765         struct sk_buff *msg;
5766         void *hdr;
5767
5768         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5769         if (!msg)
5770                 return;
5771
5772         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5773         if (!hdr) {
5774                 nlmsg_free(msg);
5775                 return;
5776         }
5777
5778         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5779         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5780         if (addr)
5781                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5782         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5783         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5784         if (tsc)
5785                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5786
5787         if (genlmsg_end(msg, hdr) < 0) {
5788                 nlmsg_free(msg);
5789                 return;
5790         }
5791
5792         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5793                                 nl80211_mlme_mcgrp.id, gfp);
5794         return;
5795
5796  nla_put_failure:
5797         genlmsg_cancel(msg, hdr);
5798         nlmsg_free(msg);
5799 }
5800
5801 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5802                                     struct ieee80211_channel *channel_before,
5803                                     struct ieee80211_channel *channel_after)
5804 {
5805         struct sk_buff *msg;
5806         void *hdr;
5807         struct nlattr *nl_freq;
5808
5809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5810         if (!msg)
5811                 return;
5812
5813         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5814         if (!hdr) {
5815                 nlmsg_free(msg);
5816                 return;
5817         }
5818
5819         /*
5820          * Since we are applying the beacon hint to a wiphy we know its
5821          * wiphy_idx is valid
5822          */
5823         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5824
5825         /* Before */
5826         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5827         if (!nl_freq)
5828                 goto nla_put_failure;
5829         if (nl80211_msg_put_channel(msg, channel_before))
5830                 goto nla_put_failure;
5831         nla_nest_end(msg, nl_freq);
5832
5833         /* After */
5834         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5835         if (!nl_freq)
5836                 goto nla_put_failure;
5837         if (nl80211_msg_put_channel(msg, channel_after))
5838                 goto nla_put_failure;
5839         nla_nest_end(msg, nl_freq);
5840
5841         if (genlmsg_end(msg, hdr) < 0) {
5842                 nlmsg_free(msg);
5843                 return;
5844         }
5845
5846         rcu_read_lock();
5847         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5848                                 GFP_ATOMIC);
5849         rcu_read_unlock();
5850
5851         return;
5852
5853 nla_put_failure:
5854         genlmsg_cancel(msg, hdr);
5855         nlmsg_free(msg);
5856 }
5857
5858 static void nl80211_send_remain_on_chan_event(
5859         int cmd, struct cfg80211_registered_device *rdev,
5860         struct net_device *netdev, u64 cookie,
5861         struct ieee80211_channel *chan,
5862         enum nl80211_channel_type channel_type,
5863         unsigned int duration, gfp_t gfp)
5864 {
5865         struct sk_buff *msg;
5866         void *hdr;
5867
5868         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5869         if (!msg)
5870                 return;
5871
5872         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5873         if (!hdr) {
5874                 nlmsg_free(msg);
5875                 return;
5876         }
5877
5878         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5879         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5880         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5881         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5882         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5883
5884         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5885                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5886
5887         if (genlmsg_end(msg, hdr) < 0) {
5888                 nlmsg_free(msg);
5889                 return;
5890         }
5891
5892         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5893                                 nl80211_mlme_mcgrp.id, gfp);
5894         return;
5895
5896  nla_put_failure:
5897         genlmsg_cancel(msg, hdr);
5898         nlmsg_free(msg);
5899 }
5900
5901 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5902                                     struct net_device *netdev, u64 cookie,
5903                                     struct ieee80211_channel *chan,
5904                                     enum nl80211_channel_type channel_type,
5905                                     unsigned int duration, gfp_t gfp)
5906 {
5907         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5908                                           rdev, netdev, cookie, chan,
5909                                           channel_type, duration, gfp);
5910 }
5911
5912 void nl80211_send_remain_on_channel_cancel(
5913         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5914         u64 cookie, struct ieee80211_channel *chan,
5915         enum nl80211_channel_type channel_type, gfp_t gfp)
5916 {
5917         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5918                                           rdev, netdev, cookie, chan,
5919                                           channel_type, 0, gfp);
5920 }
5921
5922 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5923                             struct net_device *dev, const u8 *mac_addr,
5924                             struct station_info *sinfo, gfp_t gfp)
5925 {
5926         struct sk_buff *msg;
5927
5928         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5929         if (!msg)
5930                 return;
5931
5932         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5933                 nlmsg_free(msg);
5934                 return;
5935         }
5936
5937         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5938                                 nl80211_mlme_mcgrp.id, gfp);
5939 }
5940
5941 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
5942                       struct net_device *netdev, u32 nlpid,
5943                       int freq, const u8 *buf, size_t len, gfp_t gfp)
5944 {
5945         struct sk_buff *msg;
5946         void *hdr;
5947         int err;
5948
5949         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5950         if (!msg)
5951                 return -ENOMEM;
5952
5953         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
5954         if (!hdr) {
5955                 nlmsg_free(msg);
5956                 return -ENOMEM;
5957         }
5958
5959         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5960         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5961         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5962         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5963
5964         err = genlmsg_end(msg, hdr);
5965         if (err < 0) {
5966                 nlmsg_free(msg);
5967                 return err;
5968         }
5969
5970         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5971         if (err < 0)
5972                 return err;
5973         return 0;
5974
5975  nla_put_failure:
5976         genlmsg_cancel(msg, hdr);
5977         nlmsg_free(msg);
5978         return -ENOBUFS;
5979 }
5980
5981 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
5982                                  struct net_device *netdev, u64 cookie,
5983                                  const u8 *buf, size_t len, bool ack,
5984                                  gfp_t gfp)
5985 {
5986         struct sk_buff *msg;
5987         void *hdr;
5988
5989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5990         if (!msg)
5991                 return;
5992
5993         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
5994         if (!hdr) {
5995                 nlmsg_free(msg);
5996                 return;
5997         }
5998
5999         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6000         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6001         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6002         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6003         if (ack)
6004                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
6005
6006         if (genlmsg_end(msg, hdr) < 0) {
6007                 nlmsg_free(msg);
6008                 return;
6009         }
6010
6011         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
6012         return;
6013
6014  nla_put_failure:
6015         genlmsg_cancel(msg, hdr);
6016         nlmsg_free(msg);
6017 }
6018
6019 void
6020 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
6021                              struct net_device *netdev,
6022                              enum nl80211_cqm_rssi_threshold_event rssi_event,
6023                              gfp_t gfp)
6024 {
6025         struct sk_buff *msg;
6026         struct nlattr *pinfoattr;
6027         void *hdr;
6028
6029         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6030         if (!msg)
6031                 return;
6032
6033         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6034         if (!hdr) {
6035                 nlmsg_free(msg);
6036                 return;
6037         }
6038
6039         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6040         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6041
6042         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6043         if (!pinfoattr)
6044                 goto nla_put_failure;
6045
6046         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
6047                     rssi_event);
6048
6049         nla_nest_end(msg, pinfoattr);
6050
6051         if (genlmsg_end(msg, hdr) < 0) {
6052                 nlmsg_free(msg);
6053                 return;
6054         }
6055
6056         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6057                                 nl80211_mlme_mcgrp.id, gfp);
6058         return;
6059
6060  nla_put_failure:
6061         genlmsg_cancel(msg, hdr);
6062         nlmsg_free(msg);
6063 }
6064
6065 void
6066 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
6067                                 struct net_device *netdev, const u8 *peer,
6068                                 u32 num_packets, gfp_t gfp)
6069 {
6070         struct&nb