nl80211: advertise GTK rekey support, new triggers
[linux-2.6.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25
26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
27                             struct genl_info *info);
28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
29                               struct genl_info *info);
30
31 /* the netlink family */
32 static struct genl_family nl80211_fam = {
33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
34         .name = "nl80211",      /* have users key off the name instead */
35         .hdrsize = 0,           /* no private header */
36         .version = 1,           /* no particular meaning now */
37         .maxattr = NL80211_ATTR_MAX,
38         .netnsok = true,
39         .pre_doit = nl80211_pre_doit,
40         .post_doit = nl80211_post_doit,
41 };
42
43 /* internal helper: get rdev and dev */
44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
45                                        struct cfg80211_registered_device **rdev,
46                                        struct net_device **dev)
47 {
48         struct nlattr **attrs = info->attrs;
49         int ifindex;
50
51         if (!attrs[NL80211_ATTR_IFINDEX])
52                 return -EINVAL;
53
54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
56         if (!*dev)
57                 return -ENODEV;
58
59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
60         if (IS_ERR(*rdev)) {
61                 dev_put(*dev);
62                 return PTR_ERR(*rdev);
63         }
64
65         return 0;
66 }
67
68 /* policy for the attributes */
69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
72                                       .len = 20-1 },
73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
81
82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
85
86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
88
89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
91                                     .len = WLAN_MAX_KEY_LEN },
92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
96         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
97
98         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
99         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
100         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
101                                        .len = IEEE80211_MAX_DATA_LEN },
102         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
103                                        .len = IEEE80211_MAX_DATA_LEN },
104         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
105         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
106         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
107         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
108                                                .len = NL80211_MAX_SUPP_RATES },
109         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
110         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
111         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
112         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
113                                 .len = IEEE80211_MAX_MESH_ID_LEN },
114         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
115
116         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
117         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
118
119         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
120         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
121         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
122         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
123                                            .len = NL80211_MAX_SUPP_RATES },
124         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
125
126         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
127         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
128
129         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
130                                          .len = NL80211_HT_CAPABILITY_LEN },
131
132         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
133         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
134                               .len = IEEE80211_MAX_DATA_LEN },
135         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
136         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
137
138         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
139                                 .len = IEEE80211_MAX_SSID_LEN },
140         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
141         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
142         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
143         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
144         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
145         [NL80211_ATTR_STA_FLAGS2] = {
146                 .len = sizeof(struct nl80211_sta_flag_update),
147         },
148         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
149         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
150         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
151         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
152         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
153         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
154         [NL80211_ATTR_PID] = { .type = NLA_U32 },
155         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
156         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
157                                  .len = WLAN_PMKID_LEN },
158         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
159         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
160         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
161         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
162                                  .len = IEEE80211_MAX_DATA_LEN },
163         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
164         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
165         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
166         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
167         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
168         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
169         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
170         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
171         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
172         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
173         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
174         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
175         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
176         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
177         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
178         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
179         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
180 };
181
182 /* policy for the key attributes */
183 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
184         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
185         [NL80211_KEY_IDX] = { .type = NLA_U8 },
186         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
187         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
188         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
189         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
190         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
191         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
192 };
193
194 /* policy for the key default flags */
195 static const struct nla_policy
196 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
197         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
198         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
199 };
200
201 /* policy for WoWLAN attributes */
202 static const struct nla_policy
203 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
204         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
205         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
206         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
207         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
208         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
209         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
210         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
211         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
212 };
213
214 /* policy for GTK rekey offload attributes */
215 static const struct nla_policy
216 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
217         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
218         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
219         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
220 };
221
222 /* ifidx get helper */
223 static int nl80211_get_ifidx(struct netlink_callback *cb)
224 {
225         int res;
226
227         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
228                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
229                           nl80211_policy);
230         if (res)
231                 return res;
232
233         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
234                 return -EINVAL;
235
236         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
237         if (!res)
238                 return -EINVAL;
239         return res;
240 }
241
242 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
243                                        struct netlink_callback *cb,
244                                        struct cfg80211_registered_device **rdev,
245                                        struct net_device **dev)
246 {
247         int ifidx = cb->args[0];
248         int err;
249
250         if (!ifidx)
251                 ifidx = nl80211_get_ifidx(cb);
252         if (ifidx < 0)
253                 return ifidx;
254
255         cb->args[0] = ifidx;
256
257         rtnl_lock();
258
259         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
260         if (!*dev) {
261                 err = -ENODEV;
262                 goto out_rtnl;
263         }
264
265         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
266         if (IS_ERR(*rdev)) {
267                 err = PTR_ERR(*rdev);
268                 goto out_rtnl;
269         }
270
271         return 0;
272  out_rtnl:
273         rtnl_unlock();
274         return err;
275 }
276
277 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
278 {
279         cfg80211_unlock_rdev(rdev);
280         rtnl_unlock();
281 }
282
283 /* IE validation */
284 static bool is_valid_ie_attr(const struct nlattr *attr)
285 {
286         const u8 *pos;
287         int len;
288
289         if (!attr)
290                 return true;
291
292         pos = nla_data(attr);
293         len = nla_len(attr);
294
295         while (len) {
296                 u8 elemlen;
297
298                 if (len < 2)
299                         return false;
300                 len -= 2;
301
302                 elemlen = pos[1];
303                 if (elemlen > len)
304                         return false;
305
306                 len -= elemlen;
307                 pos += 2 + elemlen;
308         }
309
310         return true;
311 }
312
313 /* message building helper */
314 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
315                                    int flags, u8 cmd)
316 {
317         /* since there is no private header just add the generic one */
318         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
319 }
320
321 static int nl80211_msg_put_channel(struct sk_buff *msg,
322                                    struct ieee80211_channel *chan)
323 {
324         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
325                     chan->center_freq);
326
327         if (chan->flags & IEEE80211_CHAN_DISABLED)
328                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
329         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
330                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
331         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
332                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
333         if (chan->flags & IEEE80211_CHAN_RADAR)
334                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
335
336         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
337                     DBM_TO_MBM(chan->max_power));
338
339         return 0;
340
341  nla_put_failure:
342         return -ENOBUFS;
343 }
344
345 /* netlink command implementations */
346
347 struct key_parse {
348         struct key_params p;
349         int idx;
350         int type;
351         bool def, defmgmt;
352         bool def_uni, def_multi;
353 };
354
355 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
356 {
357         struct nlattr *tb[NL80211_KEY_MAX + 1];
358         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
359                                    nl80211_key_policy);
360         if (err)
361                 return err;
362
363         k->def = !!tb[NL80211_KEY_DEFAULT];
364         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
365
366         if (k->def) {
367                 k->def_uni = true;
368                 k->def_multi = true;
369         }
370         if (k->defmgmt)
371                 k->def_multi = true;
372
373         if (tb[NL80211_KEY_IDX])
374                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
375
376         if (tb[NL80211_KEY_DATA]) {
377                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
378                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
379         }
380
381         if (tb[NL80211_KEY_SEQ]) {
382                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
383                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
384         }
385
386         if (tb[NL80211_KEY_CIPHER])
387                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
388
389         if (tb[NL80211_KEY_TYPE]) {
390                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
391                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
392                         return -EINVAL;
393         }
394
395         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
396                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
397                 int err = nla_parse_nested(kdt,
398                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
399                                            tb[NL80211_KEY_DEFAULT_TYPES],
400                                            nl80211_key_default_policy);
401                 if (err)
402                         return err;
403
404                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
405                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
406         }
407
408         return 0;
409 }
410
411 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
412 {
413         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
414                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
415                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
416         }
417
418         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
419                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
420                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
421         }
422
423         if (info->attrs[NL80211_ATTR_KEY_IDX])
424                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
425
426         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
427                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
428
429         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
430         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
431
432         if (k->def) {
433                 k->def_uni = true;
434                 k->def_multi = true;
435         }
436         if (k->defmgmt)
437                 k->def_multi = true;
438
439         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
440                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
441                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
442                         return -EINVAL;
443         }
444
445         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
446                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
447                 int err = nla_parse_nested(
448                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
449                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
450                                 nl80211_key_default_policy);
451                 if (err)
452                         return err;
453
454                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
455                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
456         }
457
458         return 0;
459 }
460
461 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
462 {
463         int err;
464
465         memset(k, 0, sizeof(*k));
466         k->idx = -1;
467         k->type = -1;
468
469         if (info->attrs[NL80211_ATTR_KEY])
470                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
471         else
472                 err = nl80211_parse_key_old(info, k);
473
474         if (err)
475                 return err;
476
477         if (k->def && k->defmgmt)
478                 return -EINVAL;
479
480         if (k->defmgmt) {
481                 if (k->def_uni || !k->def_multi)
482                         return -EINVAL;
483         }
484
485         if (k->idx != -1) {
486                 if (k->defmgmt) {
487                         if (k->idx < 4 || k->idx > 5)
488                                 return -EINVAL;
489                 } else if (k->def) {
490                         if (k->idx < 0 || k->idx > 3)
491                                 return -EINVAL;
492                 } else {
493                         if (k->idx < 0 || k->idx > 5)
494                                 return -EINVAL;
495                 }
496         }
497
498         return 0;
499 }
500
501 static struct cfg80211_cached_keys *
502 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
503                        struct nlattr *keys)
504 {
505         struct key_parse parse;
506         struct nlattr *key;
507         struct cfg80211_cached_keys *result;
508         int rem, err, def = 0;
509
510         result = kzalloc(sizeof(*result), GFP_KERNEL);
511         if (!result)
512                 return ERR_PTR(-ENOMEM);
513
514         result->def = -1;
515         result->defmgmt = -1;
516
517         nla_for_each_nested(key, keys, rem) {
518                 memset(&parse, 0, sizeof(parse));
519                 parse.idx = -1;
520
521                 err = nl80211_parse_key_new(key, &parse);
522                 if (err)
523                         goto error;
524                 err = -EINVAL;
525                 if (!parse.p.key)
526                         goto error;
527                 if (parse.idx < 0 || parse.idx > 4)
528                         goto error;
529                 if (parse.def) {
530                         if (def)
531                                 goto error;
532                         def = 1;
533                         result->def = parse.idx;
534                         if (!parse.def_uni || !parse.def_multi)
535                                 goto error;
536                 } else if (parse.defmgmt)
537                         goto error;
538                 err = cfg80211_validate_key_settings(rdev, &parse.p,
539                                                      parse.idx, false, NULL);
540                 if (err)
541                         goto error;
542                 result->params[parse.idx].cipher = parse.p.cipher;
543                 result->params[parse.idx].key_len = parse.p.key_len;
544                 result->params[parse.idx].key = result->data[parse.idx];
545                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
546         }
547
548         return result;
549  error:
550         kfree(result);
551         return ERR_PTR(err);
552 }
553
554 static int nl80211_key_allowed(struct wireless_dev *wdev)
555 {
556         ASSERT_WDEV_LOCK(wdev);
557
558         switch (wdev->iftype) {
559         case NL80211_IFTYPE_AP:
560         case NL80211_IFTYPE_AP_VLAN:
561         case NL80211_IFTYPE_P2P_GO:
562         case NL80211_IFTYPE_MESH_POINT:
563                 break;
564         case NL80211_IFTYPE_ADHOC:
565                 if (!wdev->current_bss)
566                         return -ENOLINK;
567                 break;
568         case NL80211_IFTYPE_STATION:
569         case NL80211_IFTYPE_P2P_CLIENT:
570                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
571                         return -ENOLINK;
572                 break;
573         default:
574                 return -EINVAL;
575         }
576
577         return 0;
578 }
579
580 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
581 {
582         struct nlattr *nl_modes = nla_nest_start(msg, attr);
583         int i;
584
585         if (!nl_modes)
586                 goto nla_put_failure;
587
588         i = 0;
589         while (ifmodes) {
590                 if (ifmodes & 1)
591                         NLA_PUT_FLAG(msg, i);
592                 ifmodes >>= 1;
593                 i++;
594         }
595
596         nla_nest_end(msg, nl_modes);
597         return 0;
598
599 nla_put_failure:
600         return -ENOBUFS;
601 }
602
603 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
604                                           struct sk_buff *msg)
605 {
606         struct nlattr *nl_combis;
607         int i, j;
608
609         nl_combis = nla_nest_start(msg,
610                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
611         if (!nl_combis)
612                 goto nla_put_failure;
613
614         for (i = 0; i < wiphy->n_iface_combinations; i++) {
615                 const struct ieee80211_iface_combination *c;
616                 struct nlattr *nl_combi, *nl_limits;
617
618                 c = &wiphy->iface_combinations[i];
619
620                 nl_combi = nla_nest_start(msg, i + 1);
621                 if (!nl_combi)
622                         goto nla_put_failure;
623
624                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
625                 if (!nl_limits)
626                         goto nla_put_failure;
627
628                 for (j = 0; j < c->n_limits; j++) {
629                         struct nlattr *nl_limit;
630
631                         nl_limit = nla_nest_start(msg, j + 1);
632                         if (!nl_limit)
633                                 goto nla_put_failure;
634                         NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
635                                     c->limits[j].max);
636                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
637                                                 c->limits[j].types))
638                                 goto nla_put_failure;
639                         nla_nest_end(msg, nl_limit);
640                 }
641
642                 nla_nest_end(msg, nl_limits);
643
644                 if (c->beacon_int_infra_match)
645                         NLA_PUT_FLAG(msg,
646                                 NL80211_IFACE_COMB_STA_AP_BI_MATCH);
647                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
648                             c->num_different_channels);
649                 NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
650                             c->max_interfaces);
651
652                 nla_nest_end(msg, nl_combi);
653         }
654
655         nla_nest_end(msg, nl_combis);
656
657         return 0;
658 nla_put_failure:
659         return -ENOBUFS;
660 }
661
662 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
663                               struct cfg80211_registered_device *dev)
664 {
665         void *hdr;
666         struct nlattr *nl_bands, *nl_band;
667         struct nlattr *nl_freqs, *nl_freq;
668         struct nlattr *nl_rates, *nl_rate;
669         struct nlattr *nl_cmds;
670         enum ieee80211_band band;
671         struct ieee80211_channel *chan;
672         struct ieee80211_rate *rate;
673         int i;
674         const struct ieee80211_txrx_stypes *mgmt_stypes =
675                                 dev->wiphy.mgmt_stypes;
676
677         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
678         if (!hdr)
679                 return -1;
680
681         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
682         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
683
684         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
685                     cfg80211_rdev_list_generation);
686
687         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
688                    dev->wiphy.retry_short);
689         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
690                    dev->wiphy.retry_long);
691         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
692                     dev->wiphy.frag_threshold);
693         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
694                     dev->wiphy.rts_threshold);
695         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
696                     dev->wiphy.coverage_class);
697         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
698                    dev->wiphy.max_scan_ssids);
699         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
700                     dev->wiphy.max_scan_ie_len);
701
702         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
703                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
704         if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
705                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
706
707         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
708                 sizeof(u32) * dev->wiphy.n_cipher_suites,
709                 dev->wiphy.cipher_suites);
710
711         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
712                    dev->wiphy.max_num_pmkids);
713
714         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
715                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
716
717         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
718                     dev->wiphy.available_antennas_tx);
719         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
720                     dev->wiphy.available_antennas_rx);
721
722         if ((dev->wiphy.available_antennas_tx ||
723              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
724                 u32 tx_ant = 0, rx_ant = 0;
725                 int res;
726                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
727                 if (!res) {
728                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
729                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
730                 }
731         }
732
733         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
734                                 dev->wiphy.interface_modes))
735                 goto nla_put_failure;
736
737         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
738         if (!nl_bands)
739                 goto nla_put_failure;
740
741         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
742                 if (!dev->wiphy.bands[band])
743                         continue;
744
745                 nl_band = nla_nest_start(msg, band);
746                 if (!nl_band)
747                         goto nla_put_failure;
748
749                 /* add HT info */
750                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
751                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
752                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
753                                 &dev->wiphy.bands[band]->ht_cap.mcs);
754                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
755                                 dev->wiphy.bands[band]->ht_cap.cap);
756                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
757                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
758                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
759                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
760                 }
761
762                 /* add frequencies */
763                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
764                 if (!nl_freqs)
765                         goto nla_put_failure;
766
767                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
768                         nl_freq = nla_nest_start(msg, i);
769                         if (!nl_freq)
770                                 goto nla_put_failure;
771
772                         chan = &dev->wiphy.bands[band]->channels[i];
773
774                         if (nl80211_msg_put_channel(msg, chan))
775                                 goto nla_put_failure;
776
777                         nla_nest_end(msg, nl_freq);
778                 }
779
780                 nla_nest_end(msg, nl_freqs);
781
782                 /* add bitrates */
783                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
784                 if (!nl_rates)
785                         goto nla_put_failure;
786
787                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
788                         nl_rate = nla_nest_start(msg, i);
789                         if (!nl_rate)
790                                 goto nla_put_failure;
791
792                         rate = &dev->wiphy.bands[band]->bitrates[i];
793                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
794                                     rate->bitrate);
795                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
796                                 NLA_PUT_FLAG(msg,
797                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
798
799                         nla_nest_end(msg, nl_rate);
800                 }
801
802                 nla_nest_end(msg, nl_rates);
803
804                 nla_nest_end(msg, nl_band);
805         }
806         nla_nest_end(msg, nl_bands);
807
808         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
809         if (!nl_cmds)
810                 goto nla_put_failure;
811
812         i = 0;
813 #define CMD(op, n)                                              \
814          do {                                                   \
815                 if (dev->ops->op) {                             \
816                         i++;                                    \
817                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
818                 }                                               \
819         } while (0)
820
821         CMD(add_virtual_intf, NEW_INTERFACE);
822         CMD(change_virtual_intf, SET_INTERFACE);
823         CMD(add_key, NEW_KEY);
824         CMD(add_beacon, NEW_BEACON);
825         CMD(add_station, NEW_STATION);
826         CMD(add_mpath, NEW_MPATH);
827         CMD(update_mesh_config, SET_MESH_CONFIG);
828         CMD(change_bss, SET_BSS);
829         CMD(auth, AUTHENTICATE);
830         CMD(assoc, ASSOCIATE);
831         CMD(deauth, DEAUTHENTICATE);
832         CMD(disassoc, DISASSOCIATE);
833         CMD(join_ibss, JOIN_IBSS);
834         CMD(join_mesh, JOIN_MESH);
835         CMD(set_pmksa, SET_PMKSA);
836         CMD(del_pmksa, DEL_PMKSA);
837         CMD(flush_pmksa, FLUSH_PMKSA);
838         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
839         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
840         CMD(mgmt_tx, FRAME);
841         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
842         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
843                 i++;
844                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
845         }
846         CMD(set_channel, SET_CHANNEL);
847         CMD(set_wds_peer, SET_WDS_PEER);
848         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
849                 CMD(sched_scan_start, START_SCHED_SCAN);
850
851 #undef CMD
852
853         if (dev->ops->connect || dev->ops->auth) {
854                 i++;
855                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
856         }
857
858         if (dev->ops->disconnect || dev->ops->deauth) {
859                 i++;
860                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
861         }
862
863         nla_nest_end(msg, nl_cmds);
864
865         if (dev->ops->remain_on_channel)
866                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
867                             dev->wiphy.max_remain_on_channel_duration);
868
869         /* for now at least assume all drivers have it */
870         if (dev->ops->mgmt_tx)
871                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
872
873         if (mgmt_stypes) {
874                 u16 stypes;
875                 struct nlattr *nl_ftypes, *nl_ifs;
876                 enum nl80211_iftype ift;
877
878                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
879                 if (!nl_ifs)
880                         goto nla_put_failure;
881
882                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
883                         nl_ftypes = nla_nest_start(msg, ift);
884                         if (!nl_ftypes)
885                                 goto nla_put_failure;
886                         i = 0;
887                         stypes = mgmt_stypes[ift].tx;
888                         while (stypes) {
889                                 if (stypes & 1)
890                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
891                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
892                                 stypes >>= 1;
893                                 i++;
894                         }
895                         nla_nest_end(msg, nl_ftypes);
896                 }
897
898                 nla_nest_end(msg, nl_ifs);
899
900                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
901                 if (!nl_ifs)
902                         goto nla_put_failure;
903
904                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
905                         nl_ftypes = nla_nest_start(msg, ift);
906                         if (!nl_ftypes)
907                                 goto nla_put_failure;
908                         i = 0;
909                         stypes = mgmt_stypes[ift].rx;
910                         while (stypes) {
911                                 if (stypes & 1)
912                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
913                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
914                                 stypes >>= 1;
915                                 i++;
916                         }
917                         nla_nest_end(msg, nl_ftypes);
918                 }
919                 nla_nest_end(msg, nl_ifs);
920         }
921
922         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
923                 struct nlattr *nl_wowlan;
924
925                 nl_wowlan = nla_nest_start(msg,
926                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
927                 if (!nl_wowlan)
928                         goto nla_put_failure;
929
930                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
931                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
932                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
933                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
934                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
935                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
936                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
937                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
938                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
939                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
940                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
941                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
942                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
943                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
944                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
945                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
946                 if (dev->wiphy.wowlan.n_patterns) {
947                         struct nl80211_wowlan_pattern_support pat = {
948                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
949                                 .min_pattern_len =
950                                         dev->wiphy.wowlan.pattern_min_len,
951                                 .max_pattern_len =
952                                         dev->wiphy.wowlan.pattern_max_len,
953                         };
954                         NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
955                                 sizeof(pat), &pat);
956                 }
957
958                 nla_nest_end(msg, nl_wowlan);
959         }
960
961         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
962                                 dev->wiphy.software_iftypes))
963                 goto nla_put_failure;
964
965         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
966                 goto nla_put_failure;
967
968         return genlmsg_end(msg, hdr);
969
970  nla_put_failure:
971         genlmsg_cancel(msg, hdr);
972         return -EMSGSIZE;
973 }
974
975 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
976 {
977         int idx = 0;
978         int start = cb->args[0];
979         struct cfg80211_registered_device *dev;
980
981         mutex_lock(&cfg80211_mutex);
982         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
983                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
984                         continue;
985                 if (++idx <= start)
986                         continue;
987                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
988                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
989                                        dev) < 0) {
990                         idx--;
991                         break;
992                 }
993         }
994         mutex_unlock(&cfg80211_mutex);
995
996         cb->args[0] = idx;
997
998         return skb->len;
999 }
1000
1001 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1002 {
1003         struct sk_buff *msg;
1004         struct cfg80211_registered_device *dev = info->user_ptr[0];
1005
1006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1007         if (!msg)
1008                 return -ENOMEM;
1009
1010         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1011                 nlmsg_free(msg);
1012                 return -ENOBUFS;
1013         }
1014
1015         return genlmsg_reply(msg, info);
1016 }
1017
1018 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1019         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1020         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1021         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1022         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1023         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1024 };
1025
1026 static int parse_txq_params(struct nlattr *tb[],
1027                             struct ieee80211_txq_params *txq_params)
1028 {
1029         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1030             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1031             !tb[NL80211_TXQ_ATTR_AIFS])
1032                 return -EINVAL;
1033
1034         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
1035         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1036         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1037         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1038         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1039
1040         return 0;
1041 }
1042
1043 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1044 {
1045         /*
1046          * You can only set the channel explicitly for AP, mesh
1047          * and WDS type interfaces; all others have their channel
1048          * managed via their respective "establish a connection"
1049          * command (connect, join, ...)
1050          *
1051          * Monitors are special as they are normally slaved to
1052          * whatever else is going on, so they behave as though
1053          * you tried setting the wiphy channel itself.
1054          */
1055         return !wdev ||
1056                 wdev->iftype == NL80211_IFTYPE_AP ||
1057                 wdev->iftype == NL80211_IFTYPE_WDS ||
1058                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1059                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1060                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1061 }
1062
1063 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1064                                  struct wireless_dev *wdev,
1065                                  struct genl_info *info)
1066 {
1067         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1068         u32 freq;
1069         int result;
1070
1071         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1072                 return -EINVAL;
1073
1074         if (!nl80211_can_set_dev_channel(wdev))
1075                 return -EOPNOTSUPP;
1076
1077         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1078                 channel_type = nla_get_u32(info->attrs[
1079                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1080                 if (channel_type != NL80211_CHAN_NO_HT &&
1081                     channel_type != NL80211_CHAN_HT20 &&
1082                     channel_type != NL80211_CHAN_HT40PLUS &&
1083                     channel_type != NL80211_CHAN_HT40MINUS)
1084                         return -EINVAL;
1085         }
1086
1087         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1088
1089         mutex_lock(&rdev->devlist_mtx);
1090         if (wdev) {
1091                 wdev_lock(wdev);
1092                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
1093                 wdev_unlock(wdev);
1094         } else {
1095                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
1096         }
1097         mutex_unlock(&rdev->devlist_mtx);
1098
1099         return result;
1100 }
1101
1102 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1103 {
1104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1105         struct net_device *netdev = info->user_ptr[1];
1106
1107         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1108 }
1109
1110 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1111 {
1112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1113         struct net_device *dev = info->user_ptr[1];
1114         struct wireless_dev *wdev = dev->ieee80211_ptr;
1115         const u8 *bssid;
1116
1117         if (!info->attrs[NL80211_ATTR_MAC])
1118                 return -EINVAL;
1119
1120         if (netif_running(dev))
1121                 return -EBUSY;
1122
1123         if (!rdev->ops->set_wds_peer)
1124                 return -EOPNOTSUPP;
1125
1126         if (wdev->iftype != NL80211_IFTYPE_WDS)
1127                 return -EOPNOTSUPP;
1128
1129         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1130         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1131 }
1132
1133
1134 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1135 {
1136         struct cfg80211_registered_device *rdev;
1137         struct net_device *netdev = NULL;
1138         struct wireless_dev *wdev;
1139         int result = 0, rem_txq_params = 0;
1140         struct nlattr *nl_txq_params;
1141         u32 changed;
1142         u8 retry_short = 0, retry_long = 0;
1143         u32 frag_threshold = 0, rts_threshold = 0;
1144         u8 coverage_class = 0;
1145
1146         /*
1147          * Try to find the wiphy and netdev. Normally this
1148          * function shouldn't need the netdev, but this is
1149          * done for backward compatibility -- previously
1150          * setting the channel was done per wiphy, but now
1151          * it is per netdev. Previous userland like hostapd
1152          * also passed a netdev to set_wiphy, so that it is
1153          * possible to let that go to the right netdev!
1154          */
1155         mutex_lock(&cfg80211_mutex);
1156
1157         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1158                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1159
1160                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1161                 if (netdev && netdev->ieee80211_ptr) {
1162                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1163                         mutex_lock(&rdev->mtx);
1164                 } else
1165                         netdev = NULL;
1166         }
1167
1168         if (!netdev) {
1169                 rdev = __cfg80211_rdev_from_info(info);
1170                 if (IS_ERR(rdev)) {
1171                         mutex_unlock(&cfg80211_mutex);
1172                         return PTR_ERR(rdev);
1173                 }
1174                 wdev = NULL;
1175                 netdev = NULL;
1176                 result = 0;
1177
1178                 mutex_lock(&rdev->mtx);
1179         } else if (netif_running(netdev) &&
1180                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1181                 wdev = netdev->ieee80211_ptr;
1182         else
1183                 wdev = NULL;
1184
1185         /*
1186          * end workaround code, by now the rdev is available
1187          * and locked, and wdev may or may not be NULL.
1188          */
1189
1190         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1191                 result = cfg80211_dev_rename(
1192                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1193
1194         mutex_unlock(&cfg80211_mutex);
1195
1196         if (result)
1197                 goto bad_res;
1198
1199         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1200                 struct ieee80211_txq_params txq_params;
1201                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1202
1203                 if (!rdev->ops->set_txq_params) {
1204                         result = -EOPNOTSUPP;
1205                         goto bad_res;
1206                 }
1207
1208                 nla_for_each_nested(nl_txq_params,
1209                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1210                                     rem_txq_params) {
1211                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1212                                   nla_data(nl_txq_params),
1213                                   nla_len(nl_txq_params),
1214                                   txq_params_policy);
1215                         result = parse_txq_params(tb, &txq_params);
1216                         if (result)
1217                                 goto bad_res;
1218
1219                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1220                                                            &txq_params);
1221                         if (result)
1222                                 goto bad_res;
1223                 }
1224         }
1225
1226         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1227                 result = __nl80211_set_channel(rdev, wdev, info);
1228                 if (result)
1229                         goto bad_res;
1230         }
1231
1232         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1233                 enum nl80211_tx_power_setting type;
1234                 int idx, mbm = 0;
1235
1236                 if (!rdev->ops->set_tx_power) {
1237                         result = -EOPNOTSUPP;
1238                         goto bad_res;
1239                 }
1240
1241                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1242                 type = nla_get_u32(info->attrs[idx]);
1243
1244                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1245                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1246                         result = -EINVAL;
1247                         goto bad_res;
1248                 }
1249
1250                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1251                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1252                         mbm = nla_get_u32(info->attrs[idx]);
1253                 }
1254
1255                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1256                 if (result)
1257                         goto bad_res;
1258         }
1259
1260         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1261             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1262                 u32 tx_ant, rx_ant;
1263                 if ((!rdev->wiphy.available_antennas_tx &&
1264                      !rdev->wiphy.available_antennas_rx) ||
1265                     !rdev->ops->set_antenna) {
1266                         result = -EOPNOTSUPP;
1267                         goto bad_res;
1268                 }
1269
1270                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1271                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1272
1273                 /* reject antenna configurations which don't match the
1274                  * available antenna masks, except for the "all" mask */
1275                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1276                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1277                         result = -EINVAL;
1278                         goto bad_res;
1279                 }
1280
1281                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1282                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1283
1284                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1285                 if (result)
1286                         goto bad_res;
1287         }
1288
1289         changed = 0;
1290
1291         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1292                 retry_short = nla_get_u8(
1293                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1294                 if (retry_short == 0) {
1295                         result = -EINVAL;
1296                         goto bad_res;
1297                 }
1298                 changed |= WIPHY_PARAM_RETRY_SHORT;
1299         }
1300
1301         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1302                 retry_long = nla_get_u8(
1303                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1304                 if (retry_long == 0) {
1305                         result = -EINVAL;
1306                         goto bad_res;
1307                 }
1308                 changed |= WIPHY_PARAM_RETRY_LONG;
1309         }
1310
1311         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1312                 frag_threshold = nla_get_u32(
1313                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1314                 if (frag_threshold < 256) {
1315                         result = -EINVAL;
1316                         goto bad_res;
1317                 }
1318                 if (frag_threshold != (u32) -1) {
1319                         /*
1320                          * Fragments (apart from the last one) are required to
1321                          * have even length. Make the fragmentation code
1322                          * simpler by stripping LSB should someone try to use
1323                          * odd threshold value.
1324                          */
1325                         frag_threshold &= ~0x1;
1326                 }
1327                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1328         }
1329
1330         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1331                 rts_threshold = nla_get_u32(
1332                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1333                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1334         }
1335
1336         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1337                 coverage_class = nla_get_u8(
1338                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1339                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1340         }
1341
1342         if (changed) {
1343                 u8 old_retry_short, old_retry_long;
1344                 u32 old_frag_threshold, old_rts_threshold;
1345                 u8 old_coverage_class;
1346
1347                 if (!rdev->ops->set_wiphy_params) {
1348                         result = -EOPNOTSUPP;
1349                         goto bad_res;
1350                 }
1351
1352                 old_retry_short = rdev->wiphy.retry_short;
1353                 old_retry_long = rdev->wiphy.retry_long;
1354                 old_frag_threshold = rdev->wiphy.frag_threshold;
1355                 old_rts_threshold = rdev->wiphy.rts_threshold;
1356                 old_coverage_class = rdev->wiphy.coverage_class;
1357
1358                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1359                         rdev->wiphy.retry_short = retry_short;
1360                 if (changed & WIPHY_PARAM_RETRY_LONG)
1361                         rdev->wiphy.retry_long = retry_long;
1362                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1363                         rdev->wiphy.frag_threshold = frag_threshold;
1364                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1365                         rdev->wiphy.rts_threshold = rts_threshold;
1366                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1367                         rdev->wiphy.coverage_class = coverage_class;
1368
1369                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1370                 if (result) {
1371                         rdev->wiphy.retry_short = old_retry_short;
1372                         rdev->wiphy.retry_long = old_retry_long;
1373                         rdev->wiphy.frag_threshold = old_frag_threshold;
1374                         rdev->wiphy.rts_threshold = old_rts_threshold;
1375                         rdev->wiphy.coverage_class = old_coverage_class;
1376                 }
1377         }
1378
1379  bad_res:
1380         mutex_unlock(&rdev->mtx);
1381         if (netdev)
1382                 dev_put(netdev);
1383         return result;
1384 }
1385
1386
1387 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1388                               struct cfg80211_registered_device *rdev,
1389                               struct net_device *dev)
1390 {
1391         void *hdr;
1392
1393         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1394         if (!hdr)
1395                 return -1;
1396
1397         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1398         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1399         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1400         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1401
1402         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1403                     rdev->devlist_generation ^
1404                         (cfg80211_rdev_list_generation << 2));
1405
1406         return genlmsg_end(msg, hdr);
1407
1408  nla_put_failure:
1409         genlmsg_cancel(msg, hdr);
1410         return -EMSGSIZE;
1411 }
1412
1413 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1414 {
1415         int wp_idx = 0;
1416         int if_idx = 0;
1417         int wp_start = cb->args[0];
1418         int if_start = cb->args[1];
1419         struct cfg80211_registered_device *rdev;
1420         struct wireless_dev *wdev;
1421
1422         mutex_lock(&cfg80211_mutex);
1423         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1424                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1425                         continue;
1426                 if (wp_idx < wp_start) {
1427                         wp_idx++;
1428                         continue;
1429                 }
1430                 if_idx = 0;
1431
1432                 mutex_lock(&rdev->devlist_mtx);
1433                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1434                         if (if_idx < if_start) {
1435                                 if_idx++;
1436                                 continue;
1437                         }
1438                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1439                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1440                                                rdev, wdev->netdev) < 0) {
1441                                 mutex_unlock(&rdev->devlist_mtx);
1442                                 goto out;
1443                         }
1444                         if_idx++;
1445                 }
1446                 mutex_unlock(&rdev->devlist_mtx);
1447
1448                 wp_idx++;
1449         }
1450  out:
1451         mutex_unlock(&cfg80211_mutex);
1452
1453         cb->args[0] = wp_idx;
1454         cb->args[1] = if_idx;
1455
1456         return skb->len;
1457 }
1458
1459 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1460 {
1461         struct sk_buff *msg;
1462         struct cfg80211_registered_device *dev = info->user_ptr[0];
1463         struct net_device *netdev = info->user_ptr[1];
1464
1465         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1466         if (!msg)
1467                 return -ENOMEM;
1468
1469         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1470                                dev, netdev) < 0) {
1471                 nlmsg_free(msg);
1472                 return -ENOBUFS;
1473         }
1474
1475         return genlmsg_reply(msg, info);
1476 }
1477
1478 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1479         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1480         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1481         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1482         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1483         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1484 };
1485
1486 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1487 {
1488         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1489         int flag;
1490
1491         *mntrflags = 0;
1492
1493         if (!nla)
1494                 return -EINVAL;
1495
1496         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1497                              nla, mntr_flags_policy))
1498                 return -EINVAL;
1499
1500         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1501                 if (flags[flag])
1502                         *mntrflags |= (1<<flag);
1503
1504         return 0;
1505 }
1506
1507 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1508                                struct net_device *netdev, u8 use_4addr,
1509                                enum nl80211_iftype iftype)
1510 {
1511         if (!use_4addr) {
1512                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1513                         return -EBUSY;
1514                 return 0;
1515         }
1516
1517         switch (iftype) {
1518         case NL80211_IFTYPE_AP_VLAN:
1519                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1520                         return 0;
1521                 break;
1522         case NL80211_IFTYPE_STATION:
1523                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1524                         return 0;
1525                 break;
1526         default:
1527                 break;
1528         }
1529
1530         return -EOPNOTSUPP;
1531 }
1532
1533 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1534 {
1535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1536         struct vif_params params;
1537         int err;
1538         enum nl80211_iftype otype, ntype;
1539         struct net_device *dev = info->user_ptr[1];
1540         u32 _flags, *flags = NULL;
1541         bool change = false;
1542
1543         memset(&params, 0, sizeof(params));
1544
1545         otype = ntype = dev->ieee80211_ptr->iftype;
1546
1547         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1548                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1549                 if (otype != ntype)
1550                         change = true;
1551                 if (ntype > NL80211_IFTYPE_MAX)
1552                         return -EINVAL;
1553         }
1554
1555         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1556                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1557
1558                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1559                         return -EINVAL;
1560                 if (netif_running(dev))
1561                         return -EBUSY;
1562
1563                 wdev_lock(wdev);
1564                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1565                              IEEE80211_MAX_MESH_ID_LEN);
1566                 wdev->mesh_id_up_len =
1567                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1568                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1569                        wdev->mesh_id_up_len);
1570                 wdev_unlock(wdev);
1571         }
1572
1573         if (info->attrs[NL80211_ATTR_4ADDR]) {
1574                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1575                 change = true;
1576                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1577                 if (err)
1578                         return err;
1579         } else {
1580                 params.use_4addr = -1;
1581         }
1582
1583         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1584                 if (ntype != NL80211_IFTYPE_MONITOR)
1585                         return -EINVAL;
1586                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1587                                           &_flags);
1588                 if (err)
1589                         return err;
1590
1591                 flags = &_flags;
1592                 change = true;
1593         }
1594
1595         if (change)
1596                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1597         else
1598                 err = 0;
1599
1600         if (!err && params.use_4addr != -1)
1601                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1602
1603         return err;
1604 }
1605
1606 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1607 {
1608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1609         struct vif_params params;
1610         struct net_device *dev;
1611         int err;
1612         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1613         u32 flags;
1614
1615         memset(&params, 0, sizeof(params));
1616
1617         if (!info->attrs[NL80211_ATTR_IFNAME])
1618                 return -EINVAL;
1619
1620         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1621                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1622                 if (type > NL80211_IFTYPE_MAX)
1623                         return -EINVAL;
1624         }
1625
1626         if (!rdev->ops->add_virtual_intf ||
1627             !(rdev->wiphy.interface_modes & (1 << type)))
1628                 return -EOPNOTSUPP;
1629
1630         if (info->attrs[NL80211_ATTR_4ADDR]) {
1631                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1632                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1633                 if (err)
1634                         return err;
1635         }
1636
1637         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1638                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1639                                   &flags);
1640         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1641                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1642                 type, err ? NULL : &flags, &params);
1643         if (IS_ERR(dev))
1644                 return PTR_ERR(dev);
1645
1646         if (type == NL80211_IFTYPE_MESH_POINT &&
1647             info->attrs[NL80211_ATTR_MESH_ID]) {
1648                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1649
1650                 wdev_lock(wdev);
1651                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1652                              IEEE80211_MAX_MESH_ID_LEN);
1653                 wdev->mesh_id_up_len =
1654                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1655                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1656                        wdev->mesh_id_up_len);
1657                 wdev_unlock(wdev);
1658         }
1659
1660         return 0;
1661 }
1662
1663 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1664 {
1665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1666         struct net_device *dev = info->user_ptr[1];
1667
1668         if (!rdev->ops->del_virtual_intf)
1669                 return -EOPNOTSUPP;
1670
1671         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1672 }
1673
1674 struct get_key_cookie {
1675         struct sk_buff *msg;
1676         int error;
1677         int idx;
1678 };
1679
1680 static void get_key_callback(void *c, struct key_params *params)
1681 {
1682         struct nlattr *key;
1683         struct get_key_cookie *cookie = c;
1684
1685         if (params->key)
1686                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1687                         params->key_len, params->key);
1688
1689         if (params->seq)
1690                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1691                         params->seq_len, params->seq);
1692
1693         if (params->cipher)
1694                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1695                             params->cipher);
1696
1697         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1698         if (!key)
1699                 goto nla_put_failure;
1700
1701         if (params->key)
1702                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1703                         params->key_len, params->key);
1704
1705         if (params->seq)
1706                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1707                         params->seq_len, params->seq);
1708
1709         if (params->cipher)
1710                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1711                             params->cipher);
1712
1713         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1714
1715         nla_nest_end(cookie->msg, key);
1716
1717         return;
1718  nla_put_failure:
1719         cookie->error = 1;
1720 }
1721
1722 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1723 {
1724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1725         int err;
1726         struct net_device *dev = info->user_ptr[1];
1727         u8 key_idx = 0;
1728         const u8 *mac_addr = NULL;
1729         bool pairwise;
1730         struct get_key_cookie cookie = {
1731                 .error = 0,
1732         };
1733         void *hdr;
1734         struct sk_buff *msg;
1735
1736         if (info->attrs[NL80211_ATTR_KEY_IDX])
1737                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1738
1739         if (key_idx > 5)
1740                 return -EINVAL;
1741
1742         if (info->attrs[NL80211_ATTR_MAC])
1743                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1744
1745         pairwise = !!mac_addr;
1746         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1747                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1748                 if (kt >= NUM_NL80211_KEYTYPES)
1749                         return -EINVAL;
1750                 if (kt != NL80211_KEYTYPE_GROUP &&
1751                     kt != NL80211_KEYTYPE_PAIRWISE)
1752                         return -EINVAL;
1753                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1754         }
1755
1756         if (!rdev->ops->get_key)
1757                 return -EOPNOTSUPP;
1758
1759         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1760         if (!msg)
1761                 return -ENOMEM;
1762
1763         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1764                              NL80211_CMD_NEW_KEY);
1765         if (IS_ERR(hdr))
1766                 return PTR_ERR(hdr);
1767
1768         cookie.msg = msg;
1769         cookie.idx = key_idx;
1770
1771         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1772         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1773         if (mac_addr)
1774                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1775
1776         if (pairwise && mac_addr &&
1777             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1778                 return -ENOENT;
1779
1780         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1781                                  mac_addr, &cookie, get_key_callback);
1782
1783         if (err)
1784                 goto free_msg;
1785
1786         if (cookie.error)
1787                 goto nla_put_failure;
1788
1789         genlmsg_end(msg, hdr);
1790         return genlmsg_reply(msg, info);
1791
1792  nla_put_failure:
1793         err = -ENOBUFS;
1794  free_msg:
1795         nlmsg_free(msg);
1796         return err;
1797 }
1798
1799 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1800 {
1801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1802         struct key_parse key;
1803         int err;
1804         struct net_device *dev = info->user_ptr[1];
1805
1806         err = nl80211_parse_key(info, &key);
1807         if (err)
1808                 return err;
1809
1810         if (key.idx < 0)
1811                 return -EINVAL;
1812
1813         /* only support setting default key */
1814         if (!key.def && !key.defmgmt)
1815                 return -EINVAL;
1816
1817         wdev_lock(dev->ieee80211_ptr);
1818
1819         if (key.def) {
1820                 if (!rdev->ops->set_default_key) {
1821                         err = -EOPNOTSUPP;
1822                         goto out;
1823                 }
1824
1825                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1826                 if (err)
1827                         goto out;
1828
1829                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1830                                                  key.def_uni, key.def_multi);
1831
1832                 if (err)
1833                         goto out;
1834
1835 #ifdef CONFIG_CFG80211_WEXT
1836                 dev->ieee80211_ptr->wext.default_key = key.idx;
1837 #endif
1838         } else {
1839                 if (key.def_uni || !key.def_multi) {
1840                         err = -EINVAL;
1841                         goto out;
1842                 }
1843
1844                 if (!rdev->ops->set_default_mgmt_key) {
1845                         err = -EOPNOTSUPP;
1846                         goto out;
1847                 }
1848
1849                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1850                 if (err)
1851                         goto out;
1852
1853                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1854                                                       dev, key.idx);
1855                 if (err)
1856                         goto out;
1857
1858 #ifdef CONFIG_CFG80211_WEXT
1859                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1860 #endif
1861         }
1862
1863  out:
1864         wdev_unlock(dev->ieee80211_ptr);
1865
1866         return err;
1867 }
1868
1869 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1870 {
1871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1872         int err;
1873         struct net_device *dev = info->user_ptr[1];
1874         struct key_parse key;
1875         const u8 *mac_addr = NULL;
1876
1877         err = nl80211_parse_key(info, &key);
1878         if (err)
1879                 return err;
1880
1881         if (!key.p.key)
1882                 return -EINVAL;
1883
1884         if (info->attrs[NL80211_ATTR_MAC])
1885                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1886
1887         if (key.type == -1) {
1888                 if (mac_addr)
1889                         key.type = NL80211_KEYTYPE_PAIRWISE;
1890                 else
1891                         key.type = NL80211_KEYTYPE_GROUP;
1892         }
1893
1894         /* for now */
1895         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1896             key.type != NL80211_KEYTYPE_GROUP)
1897                 return -EINVAL;
1898
1899         if (!rdev->ops->add_key)
1900                 return -EOPNOTSUPP;
1901
1902         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1903                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1904                                            mac_addr))
1905                 return -EINVAL;
1906
1907         wdev_lock(dev->ieee80211_ptr);
1908         err = nl80211_key_allowed(dev->ieee80211_ptr);
1909         if (!err)
1910                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1911                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1912                                          mac_addr, &key.p);
1913         wdev_unlock(dev->ieee80211_ptr);
1914
1915         return err;
1916 }
1917
1918 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1919 {
1920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1921         int err;
1922         struct net_device *dev = info->user_ptr[1];
1923         u8 *mac_addr = NULL;
1924         struct key_parse key;
1925
1926         err = nl80211_parse_key(info, &key);
1927         if (err)
1928                 return err;
1929
1930         if (info->attrs[NL80211_ATTR_MAC])
1931                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1932
1933         if (key.type == -1) {
1934                 if (mac_addr)
1935                         key.type = NL80211_KEYTYPE_PAIRWISE;
1936                 else
1937                         key.type = NL80211_KEYTYPE_GROUP;
1938         }
1939
1940         /* for now */
1941         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1942             key.type != NL80211_KEYTYPE_GROUP)
1943                 return -EINVAL;
1944
1945         if (!rdev->ops->del_key)
1946                 return -EOPNOTSUPP;
1947
1948         wdev_lock(dev->ieee80211_ptr);
1949         err = nl80211_key_allowed(dev->ieee80211_ptr);
1950
1951         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1952             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1953                 err = -ENOENT;
1954
1955         if (!err)
1956                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1957                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1958                                          mac_addr);
1959
1960 #ifdef CONFIG_CFG80211_WEXT
1961         if (!err) {
1962                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1963                         dev->ieee80211_ptr->wext.default_key = -1;
1964                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1965                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1966         }
1967 #endif
1968         wdev_unlock(dev->ieee80211_ptr);
1969
1970         return err;
1971 }
1972
1973 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1974 {
1975         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1976                     struct beacon_parameters *info);
1977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1978         struct net_device *dev = info->user_ptr[1];
1979         struct wireless_dev *wdev = dev->ieee80211_ptr;
1980         struct beacon_parameters params;
1981         int haveinfo = 0, err;
1982
1983         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1984                 return -EINVAL;
1985
1986         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1987             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1988                 return -EOPNOTSUPP;
1989
1990         memset(&params, 0, sizeof(params));
1991
1992         switch (info->genlhdr->cmd) {
1993         case NL80211_CMD_NEW_BEACON:
1994                 /* these are required for NEW_BEACON */
1995                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1996                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1997                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1998                         return -EINVAL;
1999
2000                 params.interval =
2001                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2002                 params.dtim_period =
2003                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2004
2005                 err = cfg80211_validate_beacon_int(rdev, params.interval);
2006                 if (err)
2007                         return err;
2008
2009                 call = rdev->ops->add_beacon;
2010                 break;
2011         case NL80211_CMD_SET_BEACON:
2012                 call = rdev->ops->set_beacon;
2013                 break;
2014         default:
2015                 WARN_ON(1);
2016                 return -EOPNOTSUPP;
2017         }
2018
2019         if (!call)
2020                 return -EOPNOTSUPP;
2021
2022         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2023                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2024                 params.head_len =
2025                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2026                 haveinfo = 1;
2027         }
2028
2029         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2030                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2031                 params.tail_len =
2032                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2033                 haveinfo = 1;
2034         }
2035
2036         if (!haveinfo)
2037                 return -EINVAL;
2038
2039         err = call(&rdev->wiphy, dev, &params);
2040         if (!err && params.interval)
2041                 wdev->beacon_interval = params.interval;
2042         return err;
2043 }
2044
2045 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
2046 {
2047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2048         struct net_device *dev = info->user_ptr[1];
2049         struct wireless_dev *wdev = dev->ieee80211_ptr;
2050         int err;
2051
2052         if (!rdev->ops->del_beacon)
2053                 return -EOPNOTSUPP;
2054
2055         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2056             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2057                 return -EOPNOTSUPP;
2058
2059         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
2060         if (!err)
2061                 wdev->beacon_interval = 0;
2062         return err;
2063 }
2064
2065 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2066         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2067         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2068         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2069         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2070         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2071 };
2072
2073 static int parse_station_flags(struct genl_info *info,
2074                                struct station_parameters *params)
2075 {
2076         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2077         struct nlattr *nla;
2078         int flag;
2079
2080         /*
2081          * Try parsing the new attribute first so userspace
2082          * can specify both for older kernels.
2083          */
2084         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2085         if (nla) {
2086                 struct nl80211_sta_flag_update *sta_flags;
2087
2088                 sta_flags = nla_data(nla);
2089                 params->sta_flags_mask = sta_flags->mask;
2090                 params->sta_flags_set = sta_flags->set;
2091                 if ((params->sta_flags_mask |
2092                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2093                         return -EINVAL;
2094                 return 0;
2095         }
2096
2097         /* if present, parse the old attribute */
2098
2099         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2100         if (!nla)
2101                 return 0;
2102
2103         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2104                              nla, sta_flags_policy))
2105                 return -EINVAL;
2106
2107         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
2108         params->sta_flags_mask &= ~1;
2109
2110         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
2111                 if (flags[flag])
2112                         params->sta_flags_set |= (1<<flag);
2113
2114         return 0;
2115 }
2116
2117 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2118                                  int attr)
2119 {
2120         struct nlattr *rate;
2121         u16 bitrate;
2122
2123         rate = nla_nest_start(msg, attr);
2124         if (!rate)
2125                 goto nla_put_failure;
2126
2127         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2128         bitrate = cfg80211_calculate_bitrate(info);
2129         if (bitrate > 0)
2130                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
2131
2132         if (info->flags & RATE_INFO_FLAGS_MCS)
2133                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
2134         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
2135                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
2136         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
2137                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
2138
2139         nla_nest_end(msg, rate);
2140         return true;
2141
2142 nla_put_failure:
2143         return false;
2144 }
2145
2146 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2147                                 int flags, struct net_device *dev,
2148                                 const u8 *mac_addr, struct station_info *sinfo)
2149 {
2150         void *hdr;
2151         struct nlattr *sinfoattr, *bss_param;
2152
2153         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2154         if (!hdr)
2155                 return -1;
2156
2157         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2158         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2159
2160         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2161
2162         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2163         if (!sinfoattr)
2164                 goto nla_put_failure;
2165         if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
2166                 NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2167                             sinfo->connected_time);
2168         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2169                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2170                             sinfo->inactive_time);
2171         if (sinfo->filled & STATION_INFO_RX_BYTES)
2172                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2173                             sinfo->rx_bytes);
2174         if (sinfo->filled & STATION_INFO_TX_BYTES)
2175                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2176                             sinfo->tx_bytes);
2177         if (sinfo->filled & STATION_INFO_LLID)
2178                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2179                             sinfo->llid);
2180         if (sinfo->filled & STATION_INFO_PLID)
2181                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2182                             sinfo->plid);
2183         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2184                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2185                             sinfo->plink_state);
2186         if (sinfo->filled & STATION_INFO_SIGNAL)
2187                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2188                            sinfo->signal);
2189         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2190                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2191                            sinfo->signal_avg);
2192         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2193                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2194                                           NL80211_STA_INFO_TX_BITRATE))
2195                         goto nla_put_failure;
2196         }
2197         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2198                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2199                                           NL80211_STA_INFO_RX_BITRATE))
2200                         goto nla_put_failure;
2201         }
2202         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2203                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2204                             sinfo->rx_packets);
2205         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2206                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2207                             sinfo->tx_packets);
2208         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2209                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2210                             sinfo->tx_retries);
2211         if (sinfo->filled & STATION_INFO_TX_FAILED)
2212                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2213                             sinfo->tx_failed);
2214         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2215                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2216                 if (!bss_param)
2217                         goto nla_put_failure;
2218
2219                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2220                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2221                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2222                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2223                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2224                         NLA_PUT_FLAG(msg,
2225                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2226                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2227                            sinfo->bss_param.dtim_period);
2228                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2229                             sinfo->bss_param.beacon_interval);
2230
2231                 nla_nest_end(msg, bss_param);
2232         }
2233         nla_nest_end(msg, sinfoattr);
2234
2235         return genlmsg_end(msg, hdr);
2236
2237  nla_put_failure:
2238         genlmsg_cancel(msg, hdr);
2239         return -EMSGSIZE;
2240 }
2241
2242 static int nl80211_dump_station(struct sk_buff *skb,
2243                                 struct netlink_callback *cb)
2244 {
2245         struct station_info sinfo;
2246         struct cfg80211_registered_device *dev;
2247         struct net_device *netdev;
2248         u8 mac_addr[ETH_ALEN];
2249         int sta_idx = cb->args[1];
2250         int err;
2251
2252         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2253         if (err)
2254                 return err;
2255
2256         if (!dev->ops->dump_station) {
2257                 err = -EOPNOTSUPP;
2258                 goto out_err;
2259         }
2260
2261         while (1) {
2262                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2263                                              mac_addr, &sinfo);
2264                 if (err == -ENOENT)
2265                         break;
2266                 if (err)
2267                         goto out_err;
2268
2269                 if (nl80211_send_station(skb,
2270                                 NETLINK_CB(cb->skb).pid,
2271                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2272                                 netdev, mac_addr,
2273                                 &sinfo) < 0)
2274                         goto out;
2275
2276                 sta_idx++;
2277         }
2278
2279
2280  out:
2281         cb->args[1] = sta_idx;
2282         err = skb->len;
2283  out_err:
2284         nl80211_finish_netdev_dump(dev);
2285
2286         return err;
2287 }
2288
2289 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2290 {
2291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2292         struct net_device *dev = info->user_ptr[1];
2293         struct station_info sinfo;
2294         struct sk_buff *msg;
2295         u8 *mac_addr = NULL;
2296         int err;
2297
2298         memset(&sinfo, 0, sizeof(sinfo));
2299
2300         if (!info->attrs[NL80211_ATTR_MAC])
2301                 return -EINVAL;
2302
2303         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2304
2305         if (!rdev->ops->get_station)
2306                 return -EOPNOTSUPP;
2307
2308         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2309         if (err)
2310                 return err;
2311
2312         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2313         if (!msg)
2314                 return -ENOMEM;
2315
2316         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2317                                  dev, mac_addr, &sinfo) < 0) {
2318                 nlmsg_free(msg);
2319                 return -ENOBUFS;
2320         }
2321
2322         return genlmsg_reply(msg, info);
2323 }
2324
2325 /*
2326  * Get vlan interface making sure it is running and on the right wiphy.
2327  */
2328 static int get_vlan(struct genl_info *info,
2329                     struct cfg80211_registered_device *rdev,
2330                     struct net_device **vlan)
2331 {
2332         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2333         *vlan = NULL;
2334
2335         if (vlanattr) {
2336                 *vlan = dev_get_by_index(genl_info_net(info),
2337                                          nla_get_u32(vlanattr));
2338                 if (!*vlan)
2339                         return -ENODEV;
2340                 if (!(*vlan)->ieee80211_ptr)
2341                         return -EINVAL;
2342                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2343                         return -EINVAL;
2344                 if (!netif_running(*vlan))
2345                         return -ENETDOWN;
2346         }
2347         return 0;
2348 }
2349
2350 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2351 {
2352         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2353         int err;
2354         struct net_device *dev = info->user_ptr[1];
2355         struct station_parameters params;
2356         u8 *mac_addr = NULL;
2357
2358         memset(&params, 0, sizeof(params));
2359
2360         params.listen_interval = -1;
2361         params.plink_state = -1;
2362
2363         if (info->attrs[NL80211_ATTR_STA_AID])
2364                 return -EINVAL;
2365
2366         if (!info->attrs[NL80211_ATTR_MAC])
2367                 return -EINVAL;
2368
2369         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2370
2371         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2372                 params.supported_rates =
2373                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2374                 params.supported_rates_len =
2375                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2376         }
2377
2378         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2379                 params.listen_interval =
2380                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2381
2382         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2383                 params.ht_capa =
2384                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2385
2386         if (parse_station_flags(info, &params))
2387                 return -EINVAL;
2388
2389         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2390                 params.plink_action =
2391                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2392
2393         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2394                 params.plink_state =
2395                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2396
2397         err = get_vlan(info, rdev, &params.vlan);
2398         if (err)
2399                 goto out;
2400
2401         /* validate settings */
2402         err = 0;
2403
2404         switch (dev->ieee80211_ptr->iftype) {
2405         case NL80211_IFTYPE_AP:
2406         case NL80211_IFTYPE_AP_VLAN:
2407         case NL80211_IFTYPE_P2P_GO:
2408                 /* disallow mesh-specific things */
2409                 if (params.plink_action)
2410                         err = -EINVAL;
2411                 break;
2412         case NL80211_IFTYPE_P2P_CLIENT:
2413         case NL80211_IFTYPE_STATION:
2414                 /* disallow everything but AUTHORIZED flag */
2415                 if (params.plink_action)
2416                         err = -EINVAL;
2417                 if (params.vlan)
2418                         err = -EINVAL;
2419                 if (params.supported_rates)
2420                         err = -EINVAL;
2421                 if (params.ht_capa)
2422                         err = -EINVAL;
2423                 if (params.listen_interval >= 0)
2424                         err = -EINVAL;
2425                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2426                         err = -EINVAL;
2427                 break;
2428         case NL80211_IFTYPE_MESH_POINT:
2429                 /* disallow things mesh doesn't support */
2430                 if (params.vlan)
2431                         err = -EINVAL;
2432                 if (params.ht_capa)
2433                         err = -EINVAL;
2434                 if (params.listen_interval >= 0)
2435                         err = -EINVAL;
2436                 if (params.sta_flags_mask &
2437                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2438                                   BIT(NL80211_STA_FLAG_MFP) |
2439                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
2440                         err = -EINVAL;
2441                 break;
2442         default:
2443                 err = -EINVAL;
2444         }
2445
2446         if (err)
2447                 goto out;
2448
2449         if (!rdev->ops->change_station) {
2450                 err = -EOPNOTSUPP;
2451                 goto out;
2452         }
2453
2454         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2455
2456  out:
2457         if (params.vlan)
2458                 dev_put(params.vlan);
2459
2460         return err;
2461 }
2462
2463 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2464 {
2465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2466         int err;
2467         struct net_device *dev = info->user_ptr[1];
2468         struct station_parameters params;
2469         u8 *mac_addr = NULL;
2470
2471         memset(&params, 0, sizeof(params));
2472
2473         if (!info->attrs[NL80211_ATTR_MAC])
2474                 return -EINVAL;
2475
2476         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2477                 return -EINVAL;
2478
2479         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2480                 return -EINVAL;
2481
2482         if (!info->attrs[NL80211_ATTR_STA_AID])
2483                 return -EINVAL;
2484
2485         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2486         params.supported_rates =
2487                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2488         params.supported_rates_len =
2489                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2490         params.listen_interval =
2491                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2492
2493         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2494         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2495                 return -EINVAL;
2496
2497         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2498                 params.ht_capa =
2499                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2500
2501         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2502                 params.plink_action =
2503                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2504
2505         if (parse_station_flags(info, &params))
2506                 return -EINVAL;
2507
2508         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2509             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2510             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2511             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2512                 return -EINVAL;
2513
2514         err = get_vlan(info, rdev, &params.vlan);
2515         if (err)
2516                 goto out;
2517
2518         /* validate settings */
2519         err = 0;
2520
2521         if (!rdev->ops->add_station) {
2522                 err = -EOPNOTSUPP;
2523                 goto out;
2524         }
2525
2526         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2527
2528  out:
2529         if (params.vlan)
2530                 dev_put(params.vlan);
2531         return err;
2532 }
2533
2534 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2535 {
2536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2537         struct net_device *dev = info->user_ptr[1];
2538         u8 *mac_addr = NULL;
2539
2540         if (info->attrs[NL80211_ATTR_MAC])
2541                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2542
2543         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2544             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2545             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2546             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2547                 return -EINVAL;
2548
2549         if (!rdev->ops->del_station)
2550                 return -EOPNOTSUPP;
2551
2552         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2553 }
2554
2555 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2556                                 int flags, struct net_device *dev,
2557                                 u8 *dst, u8 *next_hop,
2558                                 struct mpath_info *pinfo)
2559 {
2560         void *hdr;
2561         struct nlattr *pinfoattr;
2562
2563         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2564         if (!hdr)
2565                 return -1;
2566
2567         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2568         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2569         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2570
2571         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2572
2573         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2574         if (!pinfoattr)
2575                 goto nla_put_failure;
2576         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2577                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2578                             pinfo->frame_qlen);
2579         if (pinfo->filled & MPATH_INFO_SN)
2580                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2581                             pinfo->sn);
2582         if (pinfo->filled & MPATH_INFO_METRIC)
2583                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2584                             pinfo->metric);
2585         if (pinfo->filled & MPATH_INFO_EXPTIME)
2586                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2587                             pinfo->exptime);
2588         if (pinfo->filled & MPATH_INFO_FLAGS)
2589                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2590                             pinfo->flags);
2591         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2592                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2593                             pinfo->discovery_timeout);
2594         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2595                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2596                             pinfo->discovery_retries);
2597
2598         nla_nest_end(msg, pinfoattr);
2599
2600         return genlmsg_end(msg, hdr);
2601
2602  nla_put_failure:
2603         genlmsg_cancel(msg, hdr);
2604         return -EMSGSIZE;
2605 }
2606
2607 static int nl80211_dump_mpath(struct sk_buff *skb,
2608                               struct netlink_callback *cb)
2609 {
2610         struct mpath_info pinfo;
2611         struct cfg80211_registered_device *dev;
2612         struct net_device *netdev;
2613         u8 dst[ETH_ALEN];
2614         u8 next_hop[ETH_ALEN];
2615         int path_idx = cb->args[1];
2616         int err;
2617
2618         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2619         if (err)
2620                 return err;
2621
2622         if (!dev->ops->dump_mpath) {
2623                 err = -EOPNOTSUPP;
2624                 goto out_err;
2625         }
2626
2627         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2628                 err = -EOPNOTSUPP;
2629                 goto out_err;
2630         }
2631
2632         while (1) {
2633                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2634                                            dst, next_hop, &pinfo);
2635                 if (err == -ENOENT)
2636                         break;
2637                 if (err)
2638                         goto out_err;
2639
2640                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2641                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2642                                        netdev, dst, next_hop,
2643                                        &pinfo) < 0)
2644                         goto out;
2645
2646                 path_idx++;
2647         }
2648
2649
2650  out:
2651         cb->args[1] = path_idx;
2652         err = skb->len;
2653  out_err:
2654         nl80211_finish_netdev_dump(dev);
2655         return err;
2656 }
2657
2658 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2659 {
2660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2661         int err;
2662         struct net_device *dev = info->user_ptr[1];
2663         struct mpath_info pinfo;
2664         struct sk_buff *msg;
2665         u8 *dst = NULL;
2666         u8 next_hop[ETH_ALEN];
2667
2668         memset(&pinfo, 0, sizeof(pinfo));
2669
2670         if (!info->attrs[NL80211_ATTR_MAC])
2671                 return -EINVAL;
2672
2673         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2674
2675         if (!rdev->ops->get_mpath)
2676                 return -EOPNOTSUPP;
2677
2678         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2679                 return -EOPNOTSUPP;
2680
2681         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2682         if (err)
2683                 return err;
2684
2685         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2686         if (!msg)
2687                 return -ENOMEM;
2688
2689         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2690                                  dev, dst, next_hop, &pinfo) < 0) {
2691                 nlmsg_free(msg);
2692                 return -ENOBUFS;
2693         }
2694
2695         return genlmsg_reply(msg, info);
2696 }
2697
2698 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2699 {
2700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2701         struct net_device *dev = info->user_ptr[1];
2702         u8 *dst = NULL;
2703         u8 *next_hop = NULL;
2704
2705         if (!info->attrs[NL80211_ATTR_MAC])
2706                 return -EINVAL;
2707
2708         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2709                 return -EINVAL;
2710
2711         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2712         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2713
2714         if (!rdev->ops->change_mpath)
2715                 return -EOPNOTSUPP;
2716
2717         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2718                 return -EOPNOTSUPP;
2719
2720         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2721 }
2722
2723 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2724 {
2725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2726         struct net_device *dev = info->user_ptr[1];
2727         u8 *dst = NULL;
2728         u8 *next_hop = NULL;
2729
2730         if (!info->attrs[NL80211_ATTR_MAC])
2731                 return -EINVAL;
2732
2733         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2734                 return -EINVAL;
2735
2736         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2737         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2738
2739         if (!rdev->ops->add_mpath)
2740                 return -EOPNOTSUPP;
2741
2742         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2743                 return -EOPNOTSUPP;
2744
2745         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2746 }
2747
2748 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2749 {
2750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2751         struct net_device *dev = info->user_ptr[1];
2752         u8 *dst = NULL;
2753
2754         if (info->attrs[NL80211_ATTR_MAC])
2755                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2756
2757         if (!rdev->ops->del_mpath)
2758                 return -EOPNOTSUPP;
2759
2760         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2761 }
2762
2763 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2764 {
2765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2766         struct net_device *dev = info->user_ptr[1];
2767         struct bss_parameters params;
2768
2769         memset(&params, 0, sizeof(params));
2770         /* default to not changing parameters */
2771         params.use_cts_prot = -1;
2772         params.use_short_preamble = -1;
2773         params.use_short_slot_time = -1;
2774         params.ap_isolate = -1;
2775         params.ht_opmode = -1;
2776
2777         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2778                 params.use_cts_prot =
2779                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2780         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2781                 params.use_short_preamble =
2782                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2783         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2784                 params.use_short_slot_time =
2785                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2786         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2787                 params.basic_rates =
2788                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2789                 params.basic_rates_len =
2790                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2791         }
2792         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2793                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2794         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2795                 params.ht_opmode =
2796                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2797
2798         if (!rdev->ops->change_bss)
2799                 return -EOPNOTSUPP;
2800
2801         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2802             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2803                 return -EOPNOTSUPP;
2804
2805         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2806 }
2807
2808 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2809         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2810         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2811         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2812         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2813         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2814         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2815 };
2816
2817 static int parse_reg_rule(struct nlattr *tb[],
2818         struct ieee80211_reg_rule *reg_rule)
2819 {
2820         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2821         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2822
2823         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2824                 return -EINVAL;
2825         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2826                 return -EINVAL;
2827         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2828                 return -EINVAL;
2829         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2830                 return -EINVAL;
2831         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2832                 return -EINVAL;
2833
2834         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2835
2836         freq_range->start_freq_khz =
2837                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2838         freq_range->end_freq_khz =
2839                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2840         freq_range->max_bandwidth_khz =
2841                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2842
2843         power_rule->max_eirp =
2844                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2845
2846         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2847                 power_rule->max_antenna_gain =
2848                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2849
2850         return 0;
2851 }
2852
2853 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2854 {
2855         int r;
2856         char *data = NULL;
2857
2858         /*
2859          * You should only get this when cfg80211 hasn't yet initialized
2860          * completely when built-in to the kernel right between the time
2861          * window between nl80211_init() and regulatory_init(), if that is
2862          * even possible.
2863          */
2864         mutex_lock(&cfg80211_mutex);
2865         if (unlikely(!cfg80211_regdomain)) {
2866                 mutex_unlock(&cfg80211_mutex);
2867                 return -EINPROGRESS;
2868         }
2869         mutex_unlock(&cfg80211_mutex);
2870
2871         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2872                 return -EINVAL;
2873
2874         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2875
2876         r = regulatory_hint_user(data);
2877
2878         return r;
2879 }
2880
2881 static int nl80211_get_mesh_config(struct sk_buff *skb,
2882                                    struct genl_info *info)
2883 {
2884         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2885         struct net_device *dev = info->user_ptr[1];
2886         struct wireless_dev *wdev = dev->ieee80211_ptr;
2887         struct mesh_config cur_params;
2888         int err = 0;
2889         void *hdr;
2890         struct nlattr *pinfoattr;
2891         struct sk_buff *msg;
2892
2893         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2894                 return -EOPNOTSUPP;
2895
2896         if (!rdev->ops->get_mesh_config)
2897                 return -EOPNOTSUPP;
2898
2899         wdev_lock(wdev);
2900         /* If not connected, get default parameters */
2901         if (!wdev->mesh_id_len)
2902                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
2903         else
2904                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
2905                                                  &cur_params);
2906         wdev_unlock(wdev);
2907
2908         if (err)
2909                 return err;
2910
2911         /* Draw up a netlink message to send back */
2912         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2913         if (!msg)
2914                 return -ENOMEM;
2915         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2916                              NL80211_CMD_GET_MESH_CONFIG);
2917         if (!hdr)
2918                 goto out;
2919         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
2920         if (!pinfoattr)
2921                 goto nla_put_failure;
2922         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2923         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2924                         cur_params.dot11MeshRetryTimeout);
2925         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2926                         cur_params.dot11MeshConfirmTimeout);
2927         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2928                         cur_params.dot11MeshHoldingTimeout);
2929         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2930                         cur_params.dot11MeshMaxPeerLinks);
2931         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2932                         cur_params.dot11MeshMaxRetries);
2933         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2934                         cur_params.dot11MeshTTL);
2935         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
2936                         cur_params.element_ttl);
2937         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2938                         cur_params.auto_open_plinks);
2939         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2940                         cur_params.dot11MeshHWMPmaxPREQretries);
2941         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2942                         cur_params.path_refresh_time);
2943         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2944                         cur_params.min_discovery_timeout);
2945         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2946                         cur_params.dot11MeshHWMPactivePathTimeout);
2947         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2948                         cur_params.dot11MeshHWMPpreqMinInterval);
2949         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2950                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2951         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2952                         cur_params.dot11MeshHWMPRootMode);
2953         nla_nest_end(msg, pinfoattr);
2954         genlmsg_end(msg, hdr);
2955         return genlmsg_reply(msg, info);
2956
2957  nla_put_failure:
2958         genlmsg_cancel(msg, hdr);
2959  out:
2960         nlmsg_free(msg);
2961         return -ENOBUFS;
2962 }
2963
2964 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2965         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2966         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2967         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2968         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2969         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2970         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2971         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
2972         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2973
2974         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2975         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2976         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2977         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2978         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2979         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2980 };
2981
2982 static const struct nla_policy
2983         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
2984         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
2985         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
2986         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
2987         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
2988                 .len = IEEE80211_MAX_DATA_LEN },
2989         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
2990 };
2991
2992 static int nl80211_parse_mesh_config(struct genl_info *info,
2993                                      struct mesh_config *cfg,
2994                                      u32 *mask_out)
2995 {
2996         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2997         u32 mask = 0;
2998
2999 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3000 do {\
3001         if (table[attr_num]) {\
3002                 cfg->param = nla_fn(table[attr_num]); \
3003                 mask |= (1 << (attr_num - 1)); \
3004         } \
3005 } while (0);\
3006
3007
3008         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3009                 return -EINVAL;
3010         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3011                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3012                              nl80211_meshconf_params_policy))
3013                 return -EINVAL;
3014
3015         /* This makes sure that there aren't more than 32 mesh config
3016          * parameters (otherwise our bitfield scheme would not work.) */
3017         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3018
3019         /* Fill in the params struct */
3020         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3021                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
3022         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3023                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
3024         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3025                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
3026         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3027                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
3028         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3029                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
3030         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3031                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
3032         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3033                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
3034         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3035                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
3036         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3037                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3038                         nla_get_u8);
3039         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3040                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
3041         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3042                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3043                         nla_get_u16);
3044         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
3045                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3046                         nla_get_u32);
3047         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3048                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3049                         nla_get_u16);
3050         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3051                         dot11MeshHWMPnetDiameterTraversalTime,
3052                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3053                         nla_get_u16);
3054         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3055                         dot11MeshHWMPRootMode, mask,
3056                         NL80211_MESHCONF_HWMP_ROOTMODE,
3057                         nla_get_u8);
3058         if (mask_out)
3059                 *mask_out = mask;
3060
3061         return 0;
3062
3063 #undef FILL_IN_MESH_PARAM_IF_SET
3064 }
3065
3066 static int nl80211_parse_mesh_setup(struct genl_info *info,
3067                                      struct mesh_setup *setup)
3068 {
3069         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3070
3071         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3072                 return -EINVAL;
3073         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3074                              info->attrs[NL80211_ATTR_MESH_SETUP],
3075                              nl80211_mesh_setup_params_policy))
3076                 return -EINVAL;
3077
3078         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3079                 setup->path_sel_proto =
3080                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3081                  IEEE80211_PATH_PROTOCOL_VENDOR :
3082                  IEEE80211_PATH_PROTOCOL_HWMP;
3083
3084         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3085                 setup->path_metric =
3086                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3087                  IEEE80211_PATH_METRIC_VENDOR :
3088                  IEEE80211_PATH_METRIC_AIRTIME;
3089
3090
3091         if (tb[NL80211_MESH_SETUP_IE]) {
3092                 struct nlattr *ieattr =
3093                         tb[NL80211_MESH_SETUP_IE];
3094                 if (!is_valid_ie_attr(ieattr))
3095                         return -EINVAL;
3096                 setup->ie = nla_data(ieattr);
3097                 setup->ie_len = nla_len(ieattr);
3098         }
3099         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3100         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3101
3102         return 0;
3103 }
3104
3105 static int nl80211_update_mesh_config(struct sk_buff *skb,
3106                                       struct genl_info *info)
3107 {
3108         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3109         struct net_device *dev = info->user_ptr[1];
3110         struct wireless_dev *wdev = dev->ieee80211_ptr;
3111         struct mesh_config cfg;
3112         u32 mask;
3113         int err;
3114
3115         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3116                 return -EOPNOTSUPP;
3117
3118         if (!rdev->ops->update_mesh_config)
3119                 return -EOPNOTSUPP;
3120
3121         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3122         if (err)
3123                 return err;
3124
3125         wdev_lock(wdev);
3126         if (!wdev->mesh_id_len)
3127                 err = -ENOLINK;
3128
3129         if (!err)
3130                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3131                                                     mask, &cfg);
3132
3133         wdev_unlock(wdev);
3134
3135         return err;
3136 }
3137
3138 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3139 {
3140         struct sk_buff *msg;
3141         void *hdr = NULL;
3142         struct nlattr *nl_reg_rules;
3143         unsigned int i;
3144         int err = -EINVAL;
3145
3146         mutex_lock(&cfg80211_mutex);
3147
3148         if (!cfg80211_regdomain)
3149                 goto out;
3150
3151         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3152         if (!msg) {
3153                 err = -ENOBUFS;
3154                 goto out;
3155         }
3156
3157         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3158                              NL80211_CMD_GET_REG);
3159         if (!hdr)
3160                 goto put_failure;
3161
3162         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
3163                 cfg80211_regdomain->alpha2);
3164
3165         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3166         if (!nl_reg_rules)
3167                 goto nla_put_failure;
3168
3169         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3170                 struct nlattr *nl_reg_rule;
3171                 const struct ieee80211_reg_rule *reg_rule;
3172                 const struct ieee80211_freq_range *freq_range;
3173                 const struct ieee80211_power_rule *power_rule;
3174
3175                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3176                 freq_range = &reg_rule->freq_range;
3177                 power_rule = &reg_rule->power_rule;
3178
3179                 nl_reg_rule = nla_nest_start(msg, i);
3180                 if (!nl_reg_rule)
3181                         goto nla_put_failure;
3182
3183                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3184                         reg_rule->flags);
3185                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3186                         freq_range->start_freq_khz);
3187                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3188                         freq_range->end_freq_khz);
3189                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3190                         freq_range->max_bandwidth_khz);
3191                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3192                         power_rule->max_antenna_gain);
3193                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3194                         power_rule->max_eirp);
3195
3196                 nla_nest_end(msg, nl_reg_rule);
3197         }
3198
3199         nla_nest_end(msg, nl_reg_rules);
3200
3201         genlmsg_end(msg, hdr);
3202         err = genlmsg_reply(msg, info);
3203         goto out;
3204
3205 nla_put_failure:
3206         genlmsg_cancel(msg, hdr);
3207 put_failure:
3208         nlmsg_free(msg);
3209         err = -EMSGSIZE;
3210 out:
3211         mutex_unlock(&cfg80211_mutex);
3212         return err;
3213 }
3214
3215 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3216 {
3217         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3218         struct nlattr *nl_reg_rule;
3219         char *alpha2 = NULL;
3220         int rem_reg_rules = 0, r = 0;
3221         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3222         struct ieee80211_regdomain *rd = NULL;
3223
3224         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3225                 return -EINVAL;
3226
3227         if (!info->attrs[NL80211_ATTR_REG_RULES])
3228                 return -EINVAL;
3229
3230         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3231
3232         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3233                         rem_reg_rules) {
3234                 num_rules++;
3235                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3236                         return -EINVAL;
3237         }
3238
3239         mutex_lock(&cfg80211_mutex);
3240
3241         if (!reg_is_valid_request(alpha2)) {
3242                 r = -EINVAL;
3243                 goto bad_reg;
3244         }
3245
3246         size_of_regd = sizeof(struct ieee80211_regdomain) +
3247                 (num_rules * sizeof(struct ieee80211_reg_rule));
3248
3249         rd = kzalloc(size_of_regd, GFP_KERNEL);
3250         if (!rd) {
3251                 r = -ENOMEM;
3252                 goto bad_reg;
3253         }
3254
3255         rd->n_reg_rules = num_rules;
3256         rd->alpha2[0] = alpha2[0];
3257         rd->alpha2[1] = alpha2[1];
3258
3259         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3260                         rem_reg_rules) {
3261                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3262                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3263                         reg_rule_policy);
3264                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3265                 if (r)
3266                         goto bad_reg;
3267
3268                 rule_idx++;
3269
3270                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3271                         r = -EINVAL;
3272                         goto bad_reg;
3273                 }
3274         }
3275
3276         BUG_ON(rule_idx != num_rules);
3277
3278         r = set_regdom(rd);
3279
3280         mutex_unlock(&cfg80211_mutex);
3281
3282         return r;
3283
3284  bad_reg:
3285         mutex_unlock(&cfg80211_mutex);
3286         kfree(rd);
3287         return r;
3288 }
3289
3290 static int validate_scan_freqs(struct nlattr *freqs)
3291 {
3292         struct nlattr *attr1, *attr2;
3293         int n_channels = 0, tmp1, tmp2;
3294
3295         nla_for_each_nested(attr1, freqs, tmp1) {
3296                 n_channels++;
3297                 /*
3298                  * Some hardware has a limited channel list for
3299                  * scanning, and it is pretty much nonsensical
3300                  * to scan for a channel twice, so disallow that
3301                  * and don't require drivers to check that the
3302                  * channel list they get isn't longer than what
3303                  * they can scan, as long as they can scan all
3304                  * the channels they registered at once.
3305                  */
3306                 nla_for_each_nested(attr2, freqs, tmp2)
3307                         if (attr1 != attr2 &&
3308                             nla_get_u32(attr1) == nla_get_u32(attr2))
3309                                 return 0;
3310         }
3311
3312         return n_channels;
3313 }
3314
3315 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3316 {
3317         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3318         struct net_device *dev = info->user_ptr[1];
3319         struct cfg80211_scan_request *request;
3320         struct nlattr *attr;
3321         struct wiphy *wiphy;
3322         int err, tmp, n_ssids = 0, n_channels, i;
3323         enum ieee80211_band band;
3324         size_t ie_len;
3325
3326         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3327                 return -EINVAL;
3328
3329         wiphy = &rdev->wiphy;
3330
3331         if (!rdev->ops->scan)
3332                 return -EOPNOTSUPP;
3333
3334         if (rdev->scan_req)
3335                 return -EBUSY;
3336
3337         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3338                 n_channels = validate_scan_freqs(
3339                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3340                 if (!n_channels)
3341                         return -EINVAL;
3342         } else {
3343                 n_channels = 0;
3344
3345                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3346                         if (wiphy->bands[band])
3347                                 n_channels += wiphy->bands[band]->n_channels;
3348         }
3349
3350         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3351                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3352                         n_ssids++;
3353
3354         if (n_ssids > wiphy->max_scan_ssids)
3355                 return -EINVAL;
3356
3357         if (info->attrs[NL80211_ATTR_IE])
3358                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3359         else
3360                 ie_len = 0;
3361
3362         if (ie_len > wiphy->max_scan_ie_len)
3363                 return -EINVAL;
3364
3365         request = kzalloc(sizeof(*request)
3366                         + sizeof(*request->ssids) * n_ssids
3367                         + sizeof(*request->channels) * n_channels
3368                         + ie_len, GFP_KERNEL);
3369         if (!request)
3370                 return -ENOMEM;
3371
3372         if (n_ssids)
3373                 request->ssids = (void *)&request->channels[n_channels];
3374         request->n_ssids = n_ssids;
3375         if (ie_len) {
3376                 if (request->ssids)
3377                         request->ie = (void *)(request->ssids + n_ssids);
3378                 else
3379                         request->ie = (void *)(request->channels + n_channels);
3380         }
3381
3382         i = 0;
3383         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3384                 /* user specified, bail out if channel not found */
3385                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3386                         struct ieee80211_channel *chan;
3387
3388                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3389
3390                         if (!chan) {
3391                                 err = -EINVAL;
3392                                 goto out_free;
3393                         }
3394
3395                         /* ignore disabled channels */
3396                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3397                                 continue;
3398
3399                         request->channels[i] = chan;
3400                         i++;
3401                 }
3402         } else {
3403                 /* all channels */
3404                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3405                         int j;
3406                         if (!wiphy->bands[band])
3407                                 continue;
3408                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3409                                 struct ieee80211_channel *chan;
3410
3411                                 chan = &wiphy->bands[band]->channels[j];
3412
3413                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3414                                         continue;
3415
3416                                 request->channels[i] = chan;
3417                                 i++;
3418                         }
3419                 }
3420         }
3421
3422         if (!i) {
3423                 err = -EINVAL;
3424                 goto out_free;
3425         }
3426
3427         request->n_channels = i;
3428
3429         i = 0;
3430         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3431                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3432                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3433                                 err = -EINVAL;
3434                                 goto out_free;
3435                         }
3436                         request->ssids[i].ssid_len = nla_len(attr);
3437                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3438                         i++;
3439                 }
3440         }
3441
3442         if (info->attrs[NL80211_ATTR_IE]) {
3443                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3444                 memcpy((void *)request->ie,
3445                        nla_data(info->attrs[NL80211_ATTR_IE]),
3446                        request->ie_len);
3447         }
3448
3449         request->dev = dev;
3450         request->wiphy = &rdev->wiphy;
3451
3452         rdev->scan_req = request;
3453         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3454
3455         if (!err) {
3456                 nl80211_send_scan_start(rdev, dev);
3457                 dev_hold(dev);
3458         } else {
3459  out_free:
3460                 rdev->scan_req = NULL;
3461                 kfree(request);
3462         }
3463
3464         return err;
3465 }
3466
3467 static int nl80211_start_sched_scan(struct sk_buff *skb,
3468                                     struct genl_info *info)
3469 {
3470         struct cfg80211_sched_scan_request *request;
3471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3472         struct net_device *dev = info->user_ptr[1];
3473         struct nlattr *attr;
3474         struct wiphy *wiphy;
3475         int err, tmp, n_ssids = 0, n_channels, i;
3476         u32 interval;
3477         enum ieee80211_band band;
3478         size_t ie_len;
3479
3480         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3481             !rdev->ops->sched_scan_start)
3482                 return -EOPNOTSUPP;
3483
3484         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3485                 return -EINVAL;
3486
3487         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
3488                 return -EINVAL;
3489
3490         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
3491         if (interval == 0)
3492                 return -EINVAL;
3493
3494         wiphy = &rdev->wiphy;
3495
3496         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3497                 n_channels = validate_scan_freqs(
3498                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3499                 if (!n_channels)
3500                         return -EINVAL;
3501         } else {
3502                 n_channels = 0;
3503
3504                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3505                         if (wiphy->bands[band])
3506                                 n_channels += wiphy->bands[band]->n_channels;
3507         }
3508
3509         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3510                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3511                                     tmp)
3512                         n_ssids++;
3513
3514         if (n_ssids > wiphy->max_scan_ssids)
3515                 return -EINVAL;
3516
3517         if (info->attrs[NL80211_ATTR_IE])
3518                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3519         else
3520                 ie_len = 0;
3521
3522         if (ie_len > wiphy->max_scan_ie_len)
3523                 return -EINVAL;
3524
3525         mutex_lock(&rdev->sched_scan_mtx);
3526
3527         if (rdev->sched_scan_req) {
3528                 err = -EINPROGRESS;
3529                 goto out;
3530         }
3531
3532         request = kzalloc(sizeof(*request)
3533                         + sizeof(*request->ssids) * n_ssids
3534                         + sizeof(*request->channels) * n_channels
3535                         + ie_len, GFP_KERNEL);
3536         if (!request) {
3537                 err = -ENOMEM;
3538                 goto out;
3539         }
3540
3541         if (n_ssids)
3542                 request->ssids = (void *)&request->channels[n_channels];
3543         request->n_ssids = n_ssids;
3544         if (ie_len) {
3545                 if (request->ssids)
3546                         request->ie = (void *)(request->ssids + n_ssids);
3547                 else
3548                         request->ie = (void *)(request->channels + n_channels);
3549         }
3550
3551         i = 0;
3552         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3553                 /* user specified, bail out if channel not found */
3554                 nla_for_each_nested(attr,
3555                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
3556                                     tmp) {
3557                         struct ieee80211_channel *chan;
3558
3559                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3560
3561                         if (!chan) {
3562                                 err = -EINVAL;
3563                                 goto out_free;
3564                         }
3565
3566                         /* ignore disabled channels */
3567                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3568                                 continue;
3569
3570                         request->channels[i] = chan;
3571                         i++;
3572                 }
3573         } else {
3574                 /* all channels */
3575                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3576                         int j;
3577                         if (!wiphy->bands[band])
3578                                 continue;
3579                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3580                                 struct ieee80211_channel *chan;
3581
3582                                 chan = &wiphy->bands[band]->channels[j];
3583
3584                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3585                                         continue;
3586
3587                                 request->channels[i] = chan;
3588                                 i++;
3589                         }
3590                 }
3591         }
3592
3593         if (!i) {
3594                 err = -EINVAL;
3595                 goto out_free;
3596         }
3597
3598         request->n_channels = i;
3599
3600         i = 0;
3601         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3602                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3603                                     tmp) {
3604                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3605                                 err = -EINVAL;
3606                                 goto out_free;
3607                         }
3608                         request->ssids[i].ssid_len = nla_len(attr);
3609                         memcpy(request->ssids[i].ssid, nla_data(attr),
3610                                nla_len(attr));
3611                         i++;
3612                 }
3613         }
3614
3615         if (info->attrs[NL80211_ATTR_IE]) {
3616                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3617                 memcpy((void *)request->ie,
3618                        nla_data(info->attrs[NL80211_ATTR_IE]),
3619                        request->ie_len);
3620         }
3621
3622         request->dev = dev;
3623         request->wiphy = &rdev->wiphy;
3624         request->interval = interval;
3625
3626         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
3627         if (!err) {
3628                 rdev->sched_scan_req = request;
3629                 nl80211_send_sched_scan(rdev, dev,
3630                                         NL80211_CMD_START_SCHED_SCAN);
3631                 goto out;
3632         }
3633
3634 out_free:
3635         kfree(request);
3636 out:
3637         mutex_unlock(&rdev->sched_scan_mtx);
3638         return err;
3639 }
3640
3641 static int nl80211_stop_sched_scan(struct sk_buff *skb,
3642                                    struct genl_info *info)
3643 {
3644         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3645         int err;
3646
3647         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
3648             !rdev->ops->sched_scan_stop)
3649                 return -EOPNOTSUPP;
3650
3651         mutex_lock(&rdev->sched_scan_mtx);
3652         err = __cfg80211_stop_sched_scan(rdev, false);
3653         mutex_unlock(&rdev->sched_scan_mtx);
3654
3655         return err;
3656 }
3657
3658 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
3659                             u32 seq, int flags,
3660                             struct cfg80211_registered_device *rdev,
3661                             struct wireless_dev *wdev,
3662                             struct cfg80211_internal_bss *intbss)
3663 {
3664         struct cfg80211_bss *res = &intbss->pub;
3665         void *hdr;
3666         struct nlattr *bss;
3667         int i;
3668
3669         ASSERT_WDEV_LOCK(wdev);
3670
3671         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
3672                              NL80211_CMD_NEW_SCAN_RESULTS);
3673         if (!hdr)
3674                 return -1;
3675
3676         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
3677
3678         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3679         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3680
3681         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3682         if (!bss)
3683                 goto nla_put_failure;
3684         if (!is_zero_ether_addr(res->bssid))
3685                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3686         if (res->information_elements && res->len_information_elements)
3687                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3688                         res->len_information_elements,
3689                         res->information_elements);
3690         if (res->beacon_ies && res->len_beacon_ies &&
3691             res->beacon_ies != res->information_elements)
3692                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3693                         res->len_beacon_ies, res->beacon_ies);
3694         if (res->tsf)
3695                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3696         if (res->beacon_interval)
3697                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3698         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3699         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3700         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3701                 jiffies_to_msecs(jiffies - intbss->ts));
3702
3703         switch (rdev->wiphy.signal_type) {
3704         case CFG80211_SIGNAL_TYPE_MBM:
3705                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3706                 break;
3707         case CFG80211_SIGNAL_TYPE_UNSPEC:
3708                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3709                 break;
3710         default:
3711                 break;
3712         }
3713
3714         switch (wdev->iftype) {
3715         case NL80211_IFTYPE_P2P_CLIENT:
3716         case NL80211_IFTYPE_STATION:
3717                 if (intbss == wdev->current_bss)
3718                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3719                                     NL80211_BSS_STATUS_ASSOCIATED);
3720                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3721                         if (intbss != wdev->auth_bsses[i])
3722                                 continue;
3723                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3724                                     NL80211_BSS_STATUS_AUTHENTICATED);
3725                         break;
3726                 }
3727                 break;
3728         case NL80211_IFTYPE_ADHOC:
3729                 if (intbss == wdev->current_bss)
3730                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3731                                     NL80211_BSS_STATUS_IBSS_JOINED);
3732                 break;
3733         default:
3734                 break;
3735         }
3736
3737         nla_nest_end(msg, bss);
3738
3739         return genlmsg_end(msg, hdr);
3740
3741  nla_put_failure:
3742         genlmsg_cancel(msg, hdr);
3743         return -EMSGSIZE;
3744 }
3745
3746 static int nl80211_dump_scan(struct sk_buff *skb,
3747                              struct netlink_callback *cb)
3748 {
3749         struct cfg80211_registered_device *rdev;
3750         struct net_device *dev;
3751         struct cfg80211_internal_bss *scan;
3752         struct wireless_dev *wdev;
3753         int start = cb->args[1], idx = 0;
3754         int err;
3755
3756         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3757         if (err)
3758                 return err;
3759
3760         wdev = dev->ieee80211_ptr;
3761
3762         wdev_lock(wdev);
3763         spin_lock_bh(&rdev->bss_lock);
3764         cfg80211_bss_expire(rdev);
3765
3766         cb->seq = rdev->bss_generation;
3767
3768         list_for_each_entry(scan, &rdev->bss_list, list) {
3769                 if (++idx <= start)
3770                         continue;
3771                 if (nl80211_send_bss(skb, cb,
3772                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3773                                 rdev, wdev, scan) < 0) {
3774                         idx--;
3775                         break;
3776                 }
3777         }
3778
3779         spin_unlock_bh(&rdev->bss_lock);
3780         wdev_unlock(wdev);
3781
3782         cb->args[1] = idx;
3783         nl80211_finish_netdev_dump(rdev);
3784
3785         return skb->len;
3786 }
3787
3788 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3789                                 int flags, struct net_device *dev,
3790                                 struct survey_info *survey)
3791 {
3792         void *hdr;
3793         struct nlattr *infoattr;
3794
3795         hdr = nl80211hdr_put(msg, pid, seq, flags,
3796                              NL80211_CMD_NEW_SURVEY_RESULTS);
3797         if (!hdr)
3798                 return -ENOMEM;
3799
3800         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3801
3802         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3803         if (!infoattr)
3804                 goto nla_put_failure;
3805
3806         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3807                     survey->channel->center_freq);
3808         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3809                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3810                             survey->noise);
3811         if (survey->filled & SURVEY_INFO_IN_USE)
3812                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3813         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3814                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3815                             survey->channel_time);
3816         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3817                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3818                             survey->channel_time_busy);
3819         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3820                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3821                             survey->channel_time_ext_busy);
3822         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3823                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3824                             survey->channel_time_rx);
3825         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3826                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3827                             survey->channel_time_tx);
3828
3829         nla_nest_end(msg, infoattr);
3830
3831         return genlmsg_end(msg, hdr);
3832
3833  nla_put_failure:
3834         genlmsg_cancel(msg, hdr);
3835         return -EMSGSIZE;
3836 }
3837
3838 static int nl80211_dump_survey(struct sk_buff *skb,
3839                         struct netlink_callback *cb)
3840 {
3841         struct survey_info survey;
3842         struct cfg80211_registered_device *dev;
3843         struct net_device *netdev;
3844         int survey_idx = cb->args[1];
3845         int res;
3846
3847         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3848         if (res)
3849                 return res;
3850
3851         if (!dev->ops->dump_survey) {
3852                 res = -EOPNOTSUPP;
3853                 goto out_err;
3854         }
3855
3856         while (1) {
3857                 struct ieee80211_channel *chan;
3858
3859                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3860                                             &survey);
3861                 if (res == -ENOENT)
3862                         break;
3863                 if (res)
3864                         goto out_err;
3865
3866                 /* Survey without a channel doesn't make sense */
3867                 if (!survey.channel) {
3868                         res = -EINVAL;
3869                         goto out;
3870                 }
3871
3872                 chan = ieee80211_get_channel(&dev->wiphy,
3873                                              survey.channel->center_freq);
3874                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
3875                         survey_idx++;
3876                         continue;
3877                 }
3878
3879                 if (nl80211_send_survey(skb,
3880                                 NETLINK_CB(cb->skb).pid,
3881                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3882                                 netdev,
3883                                 &survey) < 0)
3884                         goto out;
3885                 survey_idx++;
3886         }
3887
3888  out:
3889         cb->args[1] = survey_idx;
3890         res = skb->len;
3891  out_err:
3892         nl80211_finish_netdev_dump(dev);
3893         return res;
3894 }
3895
3896 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3897 {
3898         return auth_type <= NL80211_AUTHTYPE_MAX;
3899 }
3900
3901 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3902 {
3903         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3904                                   NL80211_WPA_VERSION_2));
3905 }
3906
3907 static bool nl80211_valid_akm_suite(u32 akm)
3908 {
3909         return akm == WLAN_AKM_SUITE_8021X ||
3910                 akm == WLAN_AKM_SUITE_PSK;
3911 }
3912
3913 static bool nl80211_valid_cipher_suite(u32 cipher)
3914 {
3915         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3916                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3917                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3918                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3919                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3920 }
3921
3922
3923 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3924 {
3925         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3926         struct net_device *dev = info->user_ptr[1];
3927         struct ieee80211_channel *chan;
3928         const u8 *bssid, *ssid, *ie = NULL;
3929         int err, ssid_len, ie_len = 0;
3930         enum nl80211_auth_type auth_type;
3931         struct key_parse key;
3932         bool local_state_change;
3933
3934         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3935                 return -EINVAL;
3936
3937         if (!info->attrs[NL80211_ATTR_MAC])
3938                 return -EINVAL;
3939
3940         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3941                 return -EINVAL;
3942
3943         if (!info->attrs[NL80211_ATTR_SSID])
3944                 return -EINVAL;
3945
3946         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3947                 return -EINVAL;
3948
3949         err = nl80211_parse_key(info, &key);
3950         if (err)
3951                 return err;
3952
3953         if (key.idx >= 0) {
3954                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
3955                         return -EINVAL;
3956                 if (!key.p.key || !key.p.key_len)
3957                         return -EINVAL;
3958                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3959                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3960                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3961                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3962                         return -EINVAL;
3963                 if (key.idx > 4)
3964                         return -EINVAL;
3965         } else {
3966                 key.p.key_len = 0;
3967                 key.p.key = NULL;
3968         }
3969
3970         if (key.idx >= 0) {
3971                 int i;
3972                 bool ok = false;
3973                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3974                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3975                                 ok = true;
3976                                 break;
3977                         }
3978                 }
3979                 if (!ok)
3980                         return -EINVAL;
3981         }
3982
3983         if (!rdev->ops->auth)
3984                 return -EOPNOTSUPP;
3985
3986         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3987             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3988                 return -EOPNOTSUPP;
3989
3990         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3991         chan = ieee80211_get_channel(&rdev->wiphy,
3992                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3993         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3994                 return -EINVAL;
3995
3996         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3997         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3998
3999         if (info->attrs[NL80211_ATTR_IE]) {
4000                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4001                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4002         }
4003
4004         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4005         if (!nl80211_valid_auth_type(auth_type))
4006                 return -EINVAL;
4007
4008         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4009
4010         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4011                                   ssid, ssid_len, ie, ie_len,
4012                                   key.p.key, key.p.key_len, key.idx,
4013                                   local_state_change);
4014 }
4015
4016 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4017                                    struct genl_info *info,
4018                                    struct cfg80211_crypto_settings *settings,
4019                                    int cipher_limit)
4020 {
4021         memset(settings, 0, sizeof(*settings));
4022
4023         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4024
4025         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4026                 u16 proto;
4027                 proto = nla_get_u16(
4028                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4029                 settings->control_port_ethertype = cpu_to_be16(proto);
4030                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4031                     proto != ETH_P_PAE)
4032                         return -EINVAL;
4033                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4034                         settings->control_port_no_encrypt = true;
4035         } else
4036                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4037
4038         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4039                 void *data;
4040                 int len, i;
4041
4042                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4043                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4044                 settings->n_ciphers_pairwise = len / sizeof(u32);
4045
4046                 if (len % sizeof(u32))
4047                         return -EINVAL;
4048
4049                 if (settings->n_ciphers_pairwise > cipher_limit)
4050                         return -EINVAL;
4051
4052                 memcpy(settings->ciphers_pairwise, data, len);
4053
4054                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4055                         if (!nl80211_valid_cipher_suite(
4056                                         settings->ciphers_pairwise[i]))
4057                                 return -EINVAL;
4058         }
4059
4060         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4061                 settings->cipher_group =
4062                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4063                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
4064                         return -EINVAL;
4065         }
4066
4067         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4068                 settings->wpa_versions =
4069                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4070                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4071                         return -EINVAL;
4072         }
4073
4074         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4075                 void *data;
4076                 int len, i;
4077
4078                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4079                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4080                 settings->n_akm_suites = len / sizeof(u32);
4081
4082                 if (len % sizeof(u32))
4083                         return -EINVAL;
4084
4085                 memcpy(settings->akm_suites, data, len);
4086
4087                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4088                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
4089                                 return -EINVAL;
4090         }
4091
4092         return 0;
4093 }
4094
4095 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4096 {
4097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4098         struct net_device *dev = info->user_ptr[1];
4099         struct cfg80211_crypto_settings crypto;
4100         struct ieee80211_channel *chan;
4101         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4102         int err, ssid_len, ie_len = 0;
4103         bool use_mfp = false;
4104
4105         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4106                 return -EINVAL;
4107
4108         if (!info->attrs[NL80211_ATTR_MAC] ||
4109             !info->attrs[NL80211_ATTR_SSID] ||
4110             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4111                 return -EINVAL;
4112
4113         if (!rdev->ops->assoc)
4114                 return -EOPNOTSUPP;
4115
4116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4118                 return -EOPNOTSUPP;
4119
4120         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4121
4122         chan = ieee80211_get_channel(&rdev->wiphy,
4123                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4124         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4125                 return -EINVAL;
4126
4127         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4128         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4129
4130         if (info->attrs[NL80211_ATTR_IE]) {
4131                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4132                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4133         }
4134
4135         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4136                 enum nl80211_mfp mfp =
4137                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4138                 if (mfp == NL80211_MFP_REQUIRED)
4139                         use_mfp = true;
4140                 else if (mfp != NL80211_MFP_NO)
4141                         return -EINVAL;
4142         }
4143
4144         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4145                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4146
4147         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4148         if (!err)
4149                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4150                                           ssid, ssid_len, ie, ie_len, use_mfp,
4151                                           &crypto);
4152
4153         return err;
4154 }
4155
4156 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4157 {
4158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4159         struct net_device *dev = info->user_ptr[1];
4160         const u8 *ie = NULL, *bssid;
4161         int ie_len = 0;
4162         u16 reason_code;
4163         bool local_state_change;
4164
4165         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4166                 return -EINVAL;
4167
4168         if (!info->attrs[NL80211_ATTR_MAC])
4169                 return -EINVAL;
4170
4171         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4172                 return -EINVAL;
4173
4174         if (!rdev->ops->deauth)
4175                 return -EOPNOTSUPP;
4176
4177         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4178             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4179                 return -EOPNOTSUPP;
4180
4181         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4182
4183         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4184         if (reason_code == 0) {
4185                 /* Reason Code 0 is reserved */
4186                 return -EINVAL;
4187         }
4188
4189         if (info->attrs[NL80211_ATTR_IE]) {
4190                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4191                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4192         }
4193
4194         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4195
4196         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
4197                                     local_state_change);
4198 }
4199
4200 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
4201 {
4202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4203         struct net_device *dev = info->user_ptr[1];
4204         const u8 *ie = NULL, *bssid;
4205         int ie_len = 0;
4206         u16 reason_code;
4207         bool local_state_change;
4208
4209         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4210                 return -EINVAL;
4211
4212         if (!info->attrs[NL80211_ATTR_MAC])
4213                 return -EINVAL;
4214
4215         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4216                 return -EINVAL;
4217
4218         if (!rdev->ops->disassoc)
4219                 return -EOPNOTSUPP;
4220
4221         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4222             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4223                 return -EOPNOTSUPP;
4224
4225         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4226
4227         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4228         if (reason_code == 0) {
4229                 /* Reason Code 0 is reserved */
4230                 return -EINVAL;
4231         }
4232
4233         if (info->attrs[NL80211_ATTR_IE]) {
4234                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4235                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4236         }
4237
4238         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4239
4240         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
4241                                       local_state_change);
4242 }
4243
4244 static bool
4245 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
4246                          int mcast_rate[IEEE80211_NUM_BANDS],
4247                          int rateval)
4248 {
4249         struct wiphy *wiphy = &rdev->wiphy;
4250         bool found = false;
4251         int band, i;
4252
4253         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4254                 struct ieee80211_supported_band *sband;
4255
4256                 sband = wiphy->bands[band];
4257                 if (!sband)
4258                         continue;
4259
4260                 for (i = 0; i < sband->n_bitrates; i++) {
4261                         if (sband->bitrates[i].bitrate == rateval) {
4262                                 mcast_rate[band] = i + 1;
4263                                 found = true;
4264                                 break;
4265                         }
4266                 }
4267         }
4268
4269         return found;
4270 }
4271
4272 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
4273 {
4274         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4275         struct net_device *dev = info->user_ptr[1];
4276         struct cfg80211_ibss_params ibss;
4277         struct wiphy *wiphy;
4278         struct cfg80211_cached_keys *connkeys = NULL;
4279         int err;
4280
4281         memset(&ibss, 0, sizeof(ibss));
4282
4283         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4284                 return -EINVAL;
4285
4286         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4287             !info->attrs[NL80211_ATTR_SSID] ||
4288             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4289                 return -EINVAL;
4290
4291         ibss.beacon_interval = 100;
4292
4293         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
4294                 ibss.beacon_interval =
4295                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4296                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
4297                         return -EINVAL;
4298         }
4299
4300         if (!rdev->ops->join_ibss)
4301                 return -EOPNOTSUPP;
4302
4303         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4304                 return -EOPNOTSUPP;
4305
4306         wiphy = &rdev->wiphy;
4307
4308         if (info->attrs[NL80211_ATTR_MAC])
4309                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4310         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4311         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4312
4313         if (info->attrs[NL80211_ATTR_IE]) {
4314                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4315                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4316         }
4317
4318         ibss.channel = ieee80211_get_channel(wiphy,
4319                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4320         if (!ibss.channel ||
4321             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
4322             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
4323                 return -EINVAL;
4324
4325         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
4326         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4327
4328         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4329                 u8 *rates =
4330                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4331                 int n_rates =
4332                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4333                 struct ieee80211_supported_band *sband =
4334                         wiphy->bands[ibss.channel->band];
4335                 int i, j;
4336
4337                 if (n_rates == 0)
4338                         return -EINVAL;
4339
4340                 for (i = 0; i < n_rates; i++) {
4341                         int rate = (rates[i] & 0x7f) * 5;
4342                         bool found = false;
4343
4344                         for (j = 0; j < sband->n_bitrates; j++) {
4345                                 if (sband->bitrates[j].bitrate == rate) {
4346                                         found = true;
4347                                         ibss.basic_rates |= BIT(j);
4348                                         break;
4349                                 }
4350                         }
4351                         if (!found)
4352                                 return -EINVAL;
4353                 }
4354         }
4355
4356         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
4357             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
4358                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
4359                 return -EINVAL;
4360
4361         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4362                 connkeys = nl80211_parse_connkeys(rdev,
4363                                         info->attrs[NL80211_ATTR_KEYS]);
4364                 if (IS_ERR(connkeys))
4365                         return PTR_ERR(connkeys);
4366         }
4367
4368         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4369         if (err)
4370                 kfree(connkeys);
4371         return err;
4372 }
4373
4374 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4375 {
4376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4377         struct net_device *dev = info->user_ptr[1];
4378
4379         if (!rdev->ops->leave_ibss)
4380                 return -EOPNOTSUPP;
4381
4382         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4383                 return -EOPNOTSUPP;
4384
4385         return cfg80211_leave_ibss(rdev, dev, false);
4386 }
4387
4388 #ifdef CONFIG_NL80211_TESTMODE
4389 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4390         .name = "testmode",
4391 };
4392
4393 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4394 {
4395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4396         int err;
4397
4398         if (!info->attrs[NL80211_ATTR_TESTDATA])
4399                 return -EINVAL;
4400
4401         err = -EOPNOTSUPP;
4402         if (rdev->ops->testmode_cmd) {
4403                 rdev->testmode_info = info;
4404                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4405                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4406                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4407                 rdev->testmode_info = NULL;
4408         }
4409
4410         return err;
4411 }
4412
4413 static int nl80211_testmode_dump(struct sk_buff *skb,
4414                                  struct netlink_callback *cb)
4415 {
4416         struct cfg80211_registered_device *dev;
4417         int err;
4418         long phy_idx;
4419         void *data = NULL;
4420         int data_len = 0;
4421
4422         if (cb->args[0]) {
4423                 /*
4424                  * 0 is a valid index, but not valid for args[0],
4425                  * so we need to offset by 1.
4426                  */
4427                 phy_idx = cb->args[0] - 1;
4428         } else {
4429                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
4430                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
4431                                   nl80211_policy);
4432                 if (err)
4433                         return err;
4434                 if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
4435                         return -EINVAL;
4436                 phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
4437                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
4438                         cb->args[1] =
4439                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
4440         }
4441
4442         if (cb->args[1]) {
4443                 data = nla_data((void *)cb->args[1]);
4444                 data_len = nla_len((void *)cb->args[1]);
4445         }
4446
4447         mutex_lock(&cfg80211_mutex);
4448         dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
4449         if (!dev) {
4450                 mutex_unlock(&cfg80211_mutex);
4451                 return -ENOENT;
4452         }
4453         cfg80211_lock_rdev(dev);
4454         mutex_unlock(&cfg80211_mutex);
4455
4456         if (!dev->ops->testmode_dump) {
4457                 err = -EOPNOTSUPP;
4458                 goto out_err;
4459         }
4460
4461         while (1) {
4462                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
4463                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
4464                                            NL80211_CMD_TESTMODE);
4465                 struct nlattr *tmdata;
4466
4467                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
4468                         genlmsg_cancel(skb, hdr);
4469                         break;
4470                 }
4471
4472                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4473                 if (!tmdata) {
4474                         genlmsg_cancel(skb, hdr);
4475                         break;
4476                 }
4477                 err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
4478                                               data, data_len);
4479                 nla_nest_end(skb, tmdata);
4480
4481                 if (err == -ENOBUFS || err == -ENOENT) {
4482                         genlmsg_cancel(skb, hdr);
4483                         break;
4484                 } else if (err) {
4485                         genlmsg_cancel(skb, hdr);
4486                         goto out_err;
4487                 }
4488
4489                 genlmsg_end(skb, hdr);
4490         }
4491
4492         err = skb->len;
4493         /* see above */
4494         cb->args[0] = phy_idx + 1;
4495  out_err:
4496         cfg80211_unlock_rdev(dev);
4497         return err;
4498 }
4499
4500 static struct sk_buff *
4501 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4502                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4503 {
4504         struct sk_buff *skb;
4505         void *hdr;
4506         struct nlattr *data;
4507
4508         skb = nlmsg_new(approxlen + 100, gfp);
4509         if (!skb)
4510                 return NULL;
4511
4512         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4513         if (!hdr) {
4514                 kfree_skb(skb);
4515                 return NULL;
4516         }
4517
4518         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4519         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4520
4521         ((void **)skb->cb)[0] = rdev;
4522         ((void **)skb->cb)[1] = hdr;
4523         ((void **)skb->cb)[2] = data;
4524
4525         return skb;
4526
4527  nla_put_failure:
4528         kfree_skb(skb);
4529         return NULL;
4530 }
4531
4532 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4533                                                   int approxlen)
4534 {
4535         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4536
4537         if (WARN_ON(!rdev->testmode_info))
4538                 return NULL;
4539
4540         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4541                                 rdev->testmode_info->snd_pid,
4542                                 rdev->testmode_info->snd_seq,
4543                                 GFP_KERNEL);
4544 }
4545 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4546
4547 int cfg80211_testmode_reply(struct sk_buff *skb)
4548 {
4549         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4550         void *hdr = ((void **)skb->cb)[1];
4551         struct nlattr *data = ((void **)skb->cb)[2];
4552
4553         if (WARN_ON(!rdev->testmode_info)) {
4554                 kfree_skb(skb);
4555                 return -EINVAL;
4556         }
4557
4558         nla_nest_end(skb, data);
4559         genlmsg_end(skb, hdr);
4560         return genlmsg_reply(skb, rdev->testmode_info);
4561 }
4562 EXPORT_SYMBOL(cfg80211_testmode_reply);
4563
4564 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4565                                                   int approxlen, gfp_t gfp)
4566 {
4567         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4568
4569         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4570 }
4571 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4572
4573 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4574 {
4575         void *hdr = ((void **)skb->cb)[1];
4576         struct nlattr *data = ((void **)skb->cb)[2];
4577
4578         nla_nest_end(skb, data);
4579         genlmsg_end(skb, hdr);
4580         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4581 }
4582 EXPORT_SYMBOL(cfg80211_testmode_event);
4583 #endif
4584
4585 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4586 {
4587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4588         struct net_device *dev = info->user_ptr[1];
4589         struct cfg80211_connect_params connect;
4590         struct wiphy *wiphy;
4591         struct cfg80211_cached_keys *connkeys = NULL;
4592         int err;
4593
4594         memset(&connect, 0, sizeof(connect));
4595
4596         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4597                 return -EINVAL;
4598
4599         if (!info->attrs[NL80211_ATTR_SSID] ||
4600             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4601                 return -EINVAL;
4602
4603         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4604                 connect.auth_type =
4605                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4606                 if (!nl80211_valid_auth_type(connect.auth_type))
4607                         return -EINVAL;
4608         } else
4609                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4610
4611         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4612
4613         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4614                                       NL80211_MAX_NR_CIPHER_SUITES);
4615         if (err)
4616                 return err;
4617
4618         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4619             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4620                 return -EOPNOTSUPP;
4621
4622         wiphy = &rdev->wiphy;
4623
4624         if (info->attrs[NL80211_ATTR_MAC])
4625                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4626         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4627         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4628
4629         if (info->attrs[NL80211_ATTR_IE]) {
4630                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4631                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4632         }
4633
4634         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4635                 connect.channel =
4636                         ieee80211_get_channel(wiphy,
4637                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4638                 if (!connect.channel ||
4639                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4640                         return -EINVAL;
4641         }
4642
4643         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4644                 connkeys = nl80211_parse_connkeys(rdev,
4645                                         info->attrs[NL80211_ATTR_KEYS]);
4646                 if (IS_ERR(connkeys))
4647                         return PTR_ERR(connkeys);
4648         }
4649
4650         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4651         if (err)
4652                 kfree(connkeys);
4653         return err;
4654 }
4655
4656 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4657 {
4658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4659         struct net_device *dev = info->user_ptr[1];
4660         u16 reason;
4661
4662         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4663                 reason = WLAN_REASON_DEAUTH_LEAVING;
4664         else
4665                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4666
4667         if (reason == 0)
4668                 return -EINVAL;
4669
4670         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4671             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4672                 return -EOPNOTSUPP;
4673
4674         return cfg80211_disconnect(rdev, dev, reason, true);
4675 }
4676
4677 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4678 {
4679         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4680         struct net *net;
4681         int err;
4682         u32 pid;
4683
4684         if (!info->attrs[NL80211_ATTR_PID])
4685                 return -EINVAL;
4686
4687         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4688
4689         net = get_net_ns_by_pid(pid);
4690         if (IS_ERR(net))
4691                 return PTR_ERR(net);
4692
4693         err = 0;
4694
4695         /* check if anything to do */
4696         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4697                 err = cfg80211_switch_netns(rdev, net);
4698
4699         put_net(net);
4700         return err;
4701 }
4702
4703 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4704 {
4705         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4706         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4707                         struct cfg80211_pmksa *pmksa) = NULL;
4708         struct net_device *dev = info->user_ptr[1];
4709         struct cfg80211_pmksa pmksa;
4710
4711         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4712
4713         if (!info->attrs[NL80211_ATTR_MAC])
4714                 return -EINVAL;
4715
4716         if (!info->attrs[NL80211_ATTR_PMKID])
4717                 return -EINVAL;
4718
4719         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4720         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4721
4722         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4723             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4724                 return -EOPNOTSUPP;
4725
4726         switch (info->genlhdr->cmd) {
4727         case NL80211_CMD_SET_PMKSA:
4728                 rdev_ops = rdev->ops->set_pmksa;
4729                 break;
4730         case NL80211_CMD_DEL_PMKSA:
4731                 rdev_ops = rdev->ops->del_pmksa;
4732                 break;
4733         default:
4734                 WARN_ON(1);
4735                 break;
4736         }
4737
4738         if (!rdev_ops)
4739                 return -EOPNOTSUPP;
4740
4741         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4742 }
4743
4744 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4745 {
4746         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4747         struct net_device *dev = info->user_ptr[1];
4748
4749         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4750             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4751                 return -EOPNOTSUPP;
4752
4753         if (!rdev->ops->flush_pmksa)
4754                 return -EOPNOTSUPP;
4755
4756         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4757 }
4758
4759 static int nl80211_remain_on_channel(struct sk_buff *skb,
4760                                      struct genl_info *info)
4761 {
4762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4763         struct net_device *dev = info->user_ptr[1];
4764         struct ieee80211_channel *chan;
4765         struct sk_buff *msg;
4766         void *hdr;
4767         u64 cookie;
4768         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4769         u32 freq, duration;
4770         int err;
4771
4772         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4773             !info->attrs[NL80211_ATTR_DURATION])
4774                 return -EINVAL;
4775
4776         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4777
4778         /*
4779          * We should be on that channel for at least one jiffie,
4780          * and more than 5 seconds seems excessive.
4781          */
4782         if (!duration || !msecs_to_jiffies(duration) ||
4783             duration > rdev->wiphy.max_remain_on_channel_duration)
4784                 return -EINVAL;
4785
4786         if (!rdev->ops->remain_on_channel)
4787                 return -EOPNOTSUPP;
4788
4789         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4790                 channel_type = nla_get_u32(
4791                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4792                 if (channel_type != NL80211_CHAN_NO_HT &&
4793                     channel_type != NL80211_CHAN_HT20 &&
4794                     channel_type != NL80211_CHAN_HT40PLUS &&
4795                     channel_type != NL80211_CHAN_HT40MINUS)
4796                         return -EINVAL;
4797         }
4798
4799         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4800         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4801         if (chan == NULL)
4802                 return -EINVAL;
4803
4804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4805         if (!msg)
4806                 return -ENOMEM;
4807
4808         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4809                              NL80211_CMD_REMAIN_ON_CHANNEL);
4810
4811         if (IS_ERR(hdr)) {
4812                 err = PTR_ERR(hdr);
4813                 goto free_msg;
4814         }
4815
4816         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4817                                            channel_type, duration, &cookie);
4818
4819         if (err)
4820                 goto free_msg;
4821
4822         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4823
4824         genlmsg_end(msg, hdr);
4825
4826         return genlmsg_reply(msg, info);
4827
4828  nla_put_failure:
4829         err = -ENOBUFS;
4830  free_msg:
4831         nlmsg_free(msg);
4832         return err;
4833 }
4834
4835 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4836                                             struct genl_info *info)
4837 {
4838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4839         struct net_device *dev = info->user_ptr[1];
4840         u64 cookie;
4841
4842         if (!info->attrs[NL80211_ATTR_COOKIE])
4843                 return -EINVAL;
4844
4845         if (!rdev->ops->cancel_remain_on_channel)
4846                 return -EOPNOTSUPP;
4847
4848         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4849
4850         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4851 }
4852
4853 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4854                            u8 *rates, u8 rates_len)
4855 {
4856         u8 i;
4857         u32 mask = 0;
4858
4859         for (i = 0; i < rates_len; i++) {
4860                 int rate = (rates[i] & 0x7f) * 5;
4861                 int ridx;
4862                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4863                         struct ieee80211_rate *srate =
4864                                 &sband->bitrates[ridx];
4865                         if (rate == srate->bitrate) {
4866                                 mask |= 1 << ridx;
4867                                 break;
4868                         }
4869                 }
4870                 if (ridx == sband->n_bitrates)
4871                         return 0; /* rate not found */
4872         }
4873
4874         return mask;
4875 }
4876
4877 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4878         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4879                                     .len = NL80211_MAX_SUPP_RATES },
4880 };
4881
4882 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4883                                        struct genl_info *info)
4884 {
4885         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4887         struct cfg80211_bitrate_mask mask;
4888         int rem, i;
4889         struct net_device *dev = info->user_ptr[1];
4890         struct nlattr *tx_rates;
4891         struct ieee80211_supported_band *sband;
4892
4893         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4894                 return -EINVAL;
4895
4896         if (!rdev->ops->set_bitrate_mask)
4897                 return -EOPNOTSUPP;
4898
4899         memset(&mask, 0, sizeof(mask));
4900         /* Default to all rates enabled */
4901         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4902                 sband = rdev->wiphy.bands[i];
4903                 mask.control[i].legacy =
4904                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4905         }
4906
4907         /*
4908          * The nested attribute uses enum nl80211_band as the index. This maps
4909          * directly to the enum ieee80211_band values used in cfg80211.
4910          */
4911         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4912         {
4913                 enum ieee80211_band band = nla_type(tx_rates);
4914                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4915                         return -EINVAL;
4916                 sband = rdev->wiphy.bands[band];
4917                 if (sband == NULL)
4918                         return -EINVAL;
4919                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4920                           nla_len(tx_rates), nl80211_txattr_policy);
4921                 if (tb[NL80211_TXRATE_LEGACY]) {
4922                         mask.control[band].legacy = rateset_to_mask(
4923                                 sband,
4924                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4925                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4926                         if (mask.control[band].legacy == 0)
4927                                 return -EINVAL;
4928                 }
4929         }
4930
4931         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4932 }
4933
4934 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4935 {
4936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4937         struct net_device *dev = info->user_ptr[1];
4938         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4939
4940         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4941                 return -EINVAL;
4942
4943         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4944                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4945
4946         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4947             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4948             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4949             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4950             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4951             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4952             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4953                 return -EOPNOTSUPP;
4954
4955         /* not much point in registering if we can't reply */
4956         if (!rdev->ops->mgmt_tx)
4957                 return -EOPNOTSUPP;
4958
4959         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4960                         frame_type,
4961                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4962                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4963 }
4964
4965 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4966 {
4967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4968         struct net_device *dev = info->user_ptr[1];
4969         struct ieee80211_channel *chan;
4970         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4971         bool channel_type_valid = false;
4972         u32 freq;
4973         int err;
4974         void *hdr;
4975         u64 cookie;
4976         struct sk_buff *msg;
4977         unsigned int wait = 0;
4978         bool offchan;
4979
4980         if (!info->attrs[NL80211_ATTR_FRAME] ||
4981             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4982                 return -EINVAL;
4983
4984         if (!rdev->ops->mgmt_tx)
4985                 return -EOPNOTSUPP;
4986
4987         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4988             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4989             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4990             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4991             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4992             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4993             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4994                 return -EOPNOTSUPP;
4995
4996         if (info->attrs[NL80211_ATTR_DURATION]) {
4997                 if (!rdev->ops->mgmt_tx_cancel_wait)
4998                         return -EINVAL;
4999                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5000         }
5001
5002         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5003                 channel_type = nla_get_u32(
5004                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
5005                 if (channel_type != NL80211_CHAN_NO_HT &&
5006                     channel_type != NL80211_CHAN_HT20 &&
5007                     channel_type != NL80211_CHAN_HT40PLUS &&
5008                     channel_type != NL80211_CHAN_HT40MINUS)
5009                         return -EINVAL;
5010                 channel_type_valid = true;
5011         }
5012
5013         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
5014
5015         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5016         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5017         if (chan == NULL)
5018                 return -EINVAL;
5019
5020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5021         if (!msg)
5022                 return -ENOMEM;
5023
5024         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5025                              NL80211_CMD_FRAME);
5026
5027         if (IS_ERR(hdr)) {
5028                 err = PTR_ERR(hdr);
5029                 goto free_msg;
5030         }
5031         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
5032                                     channel_type_valid, wait,
5033                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
5034                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
5035                                     &cookie);
5036         if (err)
5037                 goto free_msg;
5038
5039         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5040
5041         genlmsg_end(msg, hdr);
5042         return genlmsg_reply(msg, info);
5043
5044  nla_put_failure:
5045         err = -ENOBUFS;
5046  free_msg:
5047         nlmsg_free(msg);
5048         return err;
5049 }
5050
5051 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
5052 {
5053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5054         struct net_device *dev = info->user_ptr[1];
5055         u64 cookie;
5056
5057         if (!info->attrs[NL80211_ATTR_COOKIE])
5058                 return -EINVAL;
5059
5060         if (!rdev->ops->mgmt_tx_cancel_wait)
5061                 return -EOPNOTSUPP;
5062
5063         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5064             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5065             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
5066             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5067             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5068             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5069                 return -EOPNOTSUPP;
5070
5071         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5072
5073         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
5074 }
5075
5076 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
5077 {
5078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5079         struct wireless_dev *wdev;
5080         struct net_device *dev = info->user_ptr[1];
5081         u8 ps_state;
5082         bool state;
5083         int err;
5084
5085         if (!info->attrs[NL80211_ATTR_PS_STATE])
5086                 return -EINVAL;
5087
5088         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
5089
5090         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
5091                 return -EINVAL;
5092
5093         wdev = dev->ieee80211_ptr;
5094
5095         if (!rdev->ops->set_power_mgmt)
5096                 return -EOPNOTSUPP;
5097
5098         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
5099
5100         if (state == wdev->ps)
5101                 return 0;
5102
5103         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
5104                                         wdev->ps_timeout);
5105         if (!err)
5106                 wdev->ps = state;
5107         return err;
5108 }
5109
5110 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
5111 {
5112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5113         enum nl80211_ps_state ps_state;
5114         struct wireless_dev *wdev;
5115         struct net_device *dev = info->user_ptr[1];
5116         struct sk_buff *msg;
5117         void *hdr;
5118         int err;
5119
5120         wdev = dev->ieee80211_ptr;
5121
5122         if (!rdev->ops->set_power_mgmt)
5123                 return -EOPNOTSUPP;
5124
5125         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5126         if (!msg)
5127                 return -ENOMEM;
5128
5129         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5130                              NL80211_CMD_GET_POWER_SAVE);
5131         if (!hdr) {
5132                 err = -ENOBUFS;
5133                 goto free_msg;
5134         }
5135
5136         if (wdev->ps)
5137                 ps_state = NL80211_PS_ENABLED;
5138         else
5139                 ps_state = NL80211_PS_DISABLED;
5140
5141         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
5142
5143         genlmsg_end(msg, hdr);
5144         return genlmsg_reply(msg, info);
5145
5146  nla_put_failure:
5147         err = -ENOBUFS;
5148  free_msg:
5149         nlmsg_free(msg);
5150         return err;
5151 }
5152
5153 static struct nla_policy
5154 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
5155         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
5156         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
5157         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
5158 };
5159
5160 static int nl80211_set_cqm_rssi(struct genl_info *info,
5161                                 s32 threshold, u32 hysteresis)
5162 {
5163         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5164         struct wireless_dev *wdev;
5165         struct net_device *dev = info->user_ptr[1];
5166
5167         if (threshold > 0)
5168                 return -EINVAL;
5169
5170         wdev = dev->ieee80211_ptr;
5171
5172         if (!rdev->ops->set_cqm_rssi_config)
5173                 return -EOPNOTSUPP;
5174
5175         if (wdev->iftype != NL80211_IFTYPE_STATION &&
5176             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
5177                 return -EOPNOTSUPP;
5178
5179         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5180                                               threshold, hysteresis);
5181 }
5182
5183 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5184 {
5185         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5186         struct nlattr *cqm;
5187         int err;
5188
5189         cqm = info->attrs[NL80211_ATTR_CQM];
5190         if (!cqm) {
5191                 err = -EINVAL;
5192                 goto out;
5193         }
5194
5195         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5196                                nl80211_attr_cqm_policy);
5197         if (err)
5198                 goto out;
5199
5200         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5201             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5202                 s32 threshold;
5203                 u32 hysteresis;
5204                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5205                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5206                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5207         } else
5208                 err = -EINVAL;
5209
5210 out:
5211         return err;
5212 }
5213
5214 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
5215 {
5216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5217         struct net_device *dev = info->user_ptr[1];
5218         struct mesh_config cfg;
5219         struct mesh_setup setup;
5220         int err;
5221
5222         /* start with default */
5223         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
5224         memcpy(&setup, &default_mesh_setup, sizeof(setup));
5225
5226         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
5227                 /* and parse parameters if given */
5228                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
5229                 if (err)
5230                         return err;
5231         }
5232
5233         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
5234             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
5235                 return -EINVAL;
5236
5237         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
5238         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
5239
5240         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
5241                 /* parse additional setup parameters if given */
5242                 err = nl80211_parse_mesh_setup(info, &setup);
5243                 if (err)
5244                         return err;
5245         }
5246
5247         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
5248 }
5249
5250 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
5251 {
5252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5253         struct net_device *dev = info->user_ptr[1];
5254
5255         return cfg80211_leave_mesh(rdev, dev);
5256 }
5257
5258 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
5259 {
5260         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5261         struct sk_buff *msg;
5262         void *hdr;
5263
5264         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5265                 return -EOPNOTSUPP;
5266
5267         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5268         if (!msg)
5269                 return -ENOMEM;
5270
5271         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5272                              NL80211_CMD_GET_WOWLAN);
5273         if (!hdr)
5274                 goto nla_put_failure;
5275
5276         if (rdev->wowlan) {
5277                 struct nlattr *nl_wowlan;
5278
5279                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
5280                 if (!nl_wowlan)
5281                         goto nla_put_failure;
5282
5283                 if (rdev->wowlan->any)
5284                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
5285                 if (rdev->wowlan->disconnect)
5286                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
5287                 if (rdev->wowlan->magic_pkt)
5288                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
5289                 if (rdev->wowlan->gtk_rekey_failure)
5290                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
5291                 if (rdev->wowlan->eap_identity_req)
5292                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
5293                 if (rdev->wowlan->four_way_handshake)
5294                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
5295                 if (rdev->wowlan->rfkill_release)
5296                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
5297                 if (rdev->wowlan->n_patterns) {
5298                         struct nlattr *nl_pats, *nl_pat;
5299                         int i, pat_len;
5300
5301                         nl_pats = nla_nest_start(msg,
5302                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
5303                         if (!nl_pats)
5304                                 goto nla_put_failure;
5305
5306                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
5307                                 nl_pat = nla_nest_start(msg, i + 1);
5308                                 if (!nl_pat)
5309                                         goto nla_put_failure;
5310                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
5311                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
5312                                         DIV_ROUND_UP(pat_len, 8),
5313                                         rdev->wowlan->patterns[i].mask);
5314                                 NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
5315                                         pat_len,
5316                                         rdev->wowlan->patterns[i].pattern);
5317                                 nla_nest_end(msg, nl_pat);
5318                         }
5319                         nla_nest_end(msg, nl_pats);
5320                 }
5321
5322                 nla_nest_end(msg, nl_wowlan);
5323         }
5324
5325         genlmsg_end(msg, hdr);
5326         return genlmsg_reply(msg, info);
5327
5328 nla_put_failure:
5329         nlmsg_free(msg);
5330         return -ENOBUFS;
5331 }
5332
5333 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
5334 {
5335         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5336         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
5337         struct cfg80211_wowlan no_triggers = {};
5338         struct cfg80211_wowlan new_triggers = {};
5339         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
5340         int err, i;
5341
5342         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
5343                 return -EOPNOTSUPP;
5344
5345         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
5346                 goto no_triggers;
5347
5348         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
5349                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5350                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
5351                         nl80211_wowlan_policy);
5352         if (err)
5353                 return err;
5354
5355         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
5356                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
5357                         return -EINVAL;
5358                 new_triggers.any = true;
5359         }
5360
5361         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
5362                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
5363                         return -EINVAL;
5364                 new_triggers.disconnect = true;
5365         }
5366
5367         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
5368                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
5369                         return -EINVAL;
5370                 new_triggers.magic_pkt = true;
5371         }
5372
5373         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
5374                 return -EINVAL;
5375
5376         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
5377                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
5378                         return -EINVAL;
5379                 new_triggers.gtk_rekey_failure = true;
5380         }
5381
5382         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
5383                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
5384                         return -EINVAL;
5385                 new_triggers.eap_identity_req = true;
5386         }
5387
5388         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
5389                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
5390                         return -EINVAL;
5391                 new_triggers.four_way_handshake = true;
5392         }
5393
5394         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
5395                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
5396                         return -EINVAL;
5397                 new_triggers.rfkill_release = true;
5398         }
5399
5400         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
5401                 struct nlattr *pat;
5402                 int n_patterns = 0;
5403                 int rem, pat_len, mask_len;
5404                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
5405
5406                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5407                                     rem)
5408                         n_patterns++;
5409                 if (n_patterns > wowlan->n_patterns)
5410                         return -EINVAL;
5411
5412                 new_triggers.patterns = kcalloc(n_patterns,
5413                                                 sizeof(new_triggers.patterns[0]),
5414                                                 GFP_KERNEL);
5415                 if (!new_triggers.patterns)
5416                         return -ENOMEM;
5417
5418                 new_triggers.n_patterns = n_patterns;
5419                 i = 0;
5420
5421                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
5422                                     rem) {
5423                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
5424                                   nla_data(pat), nla_len(pat), NULL);
5425                         err = -EINVAL;
5426                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
5427                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
5428                                 goto error;
5429                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
5430                         mask_len = DIV_ROUND_UP(pat_len, 8);
5431                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
5432                             mask_len)
5433                                 goto error;
5434                         if (pat_len > wowlan->pattern_max_len ||
5435                             pat_len < wowlan->pattern_min_len)
5436                                 goto error;
5437
5438                         new_triggers.patterns[i].mask =
5439                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
5440                         if (!new_triggers.patterns[i].mask) {
5441                                 err = -ENOMEM;
5442                                 goto error;
5443                         }
5444                         new_triggers.patterns[i].pattern =
5445                                 new_triggers.patterns[i].mask + mask_len;
5446                         memcpy(new_triggers.patterns[i].mask,
5447                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
5448                                mask_len);
5449                         new_triggers.patterns[i].pattern_len = pat_len;
5450                         memcpy(new_triggers.patterns[i].pattern,
5451                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
5452                                pat_len);
5453                         i++;
5454                 }
5455         }
5456
5457         if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
5458                 struct cfg80211_wowlan *ntrig;
5459                 ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
5460                                 GFP_KERNEL);
5461                 if (!ntrig) {
5462                         err = -ENOMEM;
5463                         goto error;
5464                 }
5465                 cfg80211_rdev_free_wowlan(rdev);
5466                 rdev->wowlan = ntrig;
5467         } else {
5468  no_triggers:
5469                 cfg80211_rdev_free_wowlan(rdev);
5470                 rdev->wowlan = NULL;
5471         }
5472
5473         return 0;
5474  error:
5475         for (i = 0; i < new_triggers.n_patterns; i++)
5476                 kfree(new_triggers.patterns[i].mask);
5477         kfree(new_triggers.patterns);
5478         return err;
5479 }
5480
5481 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
5482 {
5483         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5484         struct net_device *dev = info->user_ptr[1];
5485         struct wireless_dev *wdev = dev->ieee80211_ptr;
5486         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
5487         struct cfg80211_gtk_rekey_data rekey_data;
5488         int err;
5489
5490         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
5491                 return -EINVAL;
5492
5493         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
5494                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
5495                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
5496                         nl80211_rekey_policy);
5497         if (err)
5498                 return err;
5499
5500         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
5501                 return -ERANGE;
5502         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
5503                 return -ERANGE;
5504         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
5505                 return -ERANGE;
5506
5507         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
5508                NL80211_KEK_LEN);
5509         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
5510                NL80211_KCK_LEN);
5511         memcpy(rekey_data.replay_ctr,
5512                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
5513                NL80211_REPLAY_CTR_LEN);
5514
5515         wdev_lock(wdev);
5516         if (!wdev->current_bss) {
5517                 err = -ENOTCONN;
5518                 goto out;
5519         }
5520
5521         if (!rdev->ops->set_rekey_data) {
5522                 err = -EOPNOTSUPP;
5523                 goto out;
5524         }
5525
5526         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
5527  out:
5528         wdev_unlock(wdev);
5529         return err;
5530 }
5531
5532 #define NL80211_FLAG_NEED_WIPHY         0x01
5533 #define NL80211_FLAG_NEED_NETDEV        0x02
5534 #define NL80211_FLAG_NEED_RTNL          0x04
5535 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
5536 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
5537                                          NL80211_FLAG_CHECK_NETDEV_UP)
5538
5539 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
5540                             struct genl_info *info)
5541 {
5542         struct cfg80211_registered_device *rdev;
5543         struct net_device *dev;
5544         int err;
5545         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
5546
5547         if (rtnl)
5548                 rtnl_lock();
5549
5550         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
5551                 rdev = cfg80211_get_dev_from_info(info);
5552                 if (IS_ERR(rdev)) {
5553                         if (rtnl)
5554                                 rtnl_unlock();
5555                         return PTR_ERR(rdev);
5556                 }
5557                 info->user_ptr[0] = rdev;
5558         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
5559                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
5560                 if (err) {
5561                         if (rtnl)
5562                                 rtnl_unlock();
5563                         return err;
5564                 }
5565                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
5566                     !netif_running(dev)) {
5567                         cfg80211_unlock_rdev(rdev);
5568                         dev_put(dev);
5569                         if (rtnl)
5570                                 rtnl_unlock();
5571                         return -ENETDOWN;
5572                 }
5573                 info->user_ptr[0] = rdev;
5574                 info->user_ptr[1] = dev;
5575         }
5576
5577         return 0;
5578 }
5579
5580 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
5581                               struct genl_info *info)
5582 {
5583         if (info->user_ptr[0])
5584                 cfg80211_unlock_rdev(info->user_ptr[0]);
5585         if (info->user_ptr[1])
5586                 dev_put(info->user_ptr[1]);
5587         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
5588                 rtnl_unlock();
5589 }
5590
5591 static struct genl_ops nl80211_ops[] = {
5592         {
5593                 .cmd = NL80211_CMD_GET_WIPHY,
5594                 .doit = nl80211_get_wiphy,
5595                 .dumpit = nl80211_dump_wiphy,
5596                 .policy = nl80211_policy,
5597                 /* can be retrieved by unprivileged users */
5598                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
5599         },
5600         {
5601                 .cmd = NL80211_CMD_SET_WIPHY,
5602                 .doit = nl80211_set_wiphy,
5603                 .policy = nl80211_policy,
5604                 .flags = GENL_ADMIN_PERM,
5605                 .internal_flags = NL80211_FLAG_NEED_RTNL,
5606         },
5607         {
5608                 .cmd = NL80211_CMD_GET_INTERFACE,
5609                 .doit = nl80211_get_interface,
5610                 .dumpit = nl80211_dump_interface,
5611                 .policy = nl80211_policy,
5612                 /* can be retrieved by unprivileged users */
5613                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
5614         },
5615         {
5616                 .cmd = NL80211_CMD_SET_INTERFACE,
5617                 .doit = nl80211_set_interface,
5618                 .policy = nl80211_policy,
5619                 .flags = GENL_ADMIN_PERM,
5620                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5621                                   NL80211_FLAG_NEED_RTNL,
5622         },
5623         {
5624                 .cmd = NL80211_CMD_NEW_INTERFACE,
5625                 .doit = nl80211_new_interface,
5626                 .policy = nl80211_policy,
5627                 .flags = GENL_ADMIN_PERM,
5628                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5629                                   NL80211_FLAG_NEED_RTNL,
5630         },
5631         {
5632                 .cmd = NL80211_CMD_DEL_INTERFACE,
5633                 .doit = nl80211_del_interface,
5634                 .policy = nl80211_policy,
5635                 .flags = GENL_ADMIN_PERM,
5636                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5637                                   NL80211_FLAG_NEED_RTNL,
5638         },
5639         {
5640                 .cmd = NL80211_CMD_GET_KEY,
5641                 .doit = nl80211_get_key,
5642                 .policy = nl80211_policy,
5643                 .flags = GENL_ADMIN_PERM,
5644                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5645                                   NL80211_FLAG_NEED_RTNL,
5646         },
5647         {
5648                 .cmd = NL80211_CMD_SET_KEY,
5649                 .doit = nl80211_set_key,
5650                 .policy = nl80211_policy,
5651                 .flags = GENL_ADMIN_PERM,
5652                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5653                                   NL80211_FLAG_NEED_RTNL,
5654         },
5655         {
5656                 .cmd = NL80211_CMD_NEW_KEY,
5657                 .doit = nl80211_new_key,
5658                 .policy = nl80211_policy,
5659                 .flags = GENL_ADMIN_PERM,
5660                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5661                                   NL80211_FLAG_NEED_RTNL,
5662         },
5663         {
5664                 .cmd = NL80211_CMD_DEL_KEY,
5665                 .doit = nl80211_del_key,
5666                 .policy = nl80211_policy,
5667                 .flags = GENL_ADMIN_PERM,
5668                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5669                                   NL80211_FLAG_NEED_RTNL,
5670         },
5671         {
5672                 .cmd = NL80211_CMD_SET_BEACON,
5673                 .policy = nl80211_policy,
5674                 .flags = GENL_ADMIN_PERM,
5675                 .doit = nl80211_addset_beacon,
5676                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5677                                   NL80211_FLAG_NEED_RTNL,
5678         },
5679         {
5680                 .cmd = NL80211_CMD_NEW_BEACON,
5681                 .policy = nl80211_policy,
5682                 .flags = GENL_ADMIN_PERM,
5683                 .doit = nl80211_addset_beacon,
5684                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5685                                   NL80211_FLAG_NEED_RTNL,
5686         },
5687         {
5688                 .cmd = NL80211_CMD_DEL_BEACON,
5689                 .policy = nl80211_policy,
5690                 .flags = GENL_ADMIN_PERM,
5691                 .doit = nl80211_del_beacon,
5692                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5693                                   NL80211_FLAG_NEED_RTNL,
5694         },
5695         {
5696                 .cmd = NL80211_CMD_GET_STATION,
5697                 .doit = nl80211_get_station,
5698                 .dumpit = nl80211_dump_station,
5699                 .policy = nl80211_policy,
5700                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5701                                   NL80211_FLAG_NEED_RTNL,
5702         },
5703         {
5704                 .cmd = NL80211_CMD_SET_STATION,
5705                 .doit = nl80211_set_station,
5706                 .policy = nl80211_policy,
5707                 .flags = GENL_ADMIN_PERM,
5708                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5709                                   NL80211_FLAG_NEED_RTNL,
5710         },
5711         {
5712                 .cmd = NL80211_CMD_NEW_STATION,
5713                 .doit = nl80211_new_station,
5714                 .policy = nl80211_policy,
5715                 .flags = GENL_ADMIN_PERM,
5716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5717                                   NL80211_FLAG_NEED_RTNL,
5718         },
5719         {
5720                 .cmd = NL80211_CMD_DEL_STATION,
5721                 .doit = nl80211_del_station,
5722                 .policy = nl80211_policy,
5723                 .flags = GENL_ADMIN_PERM,
5724                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5725                                   NL80211_FLAG_NEED_RTNL,
5726         },
5727         {
5728                 .cmd = NL80211_CMD_GET_MPATH,
5729                 .doit = nl80211_get_mpath,
5730                 .dumpit = nl80211_dump_mpath,
5731                 .policy = nl80211_policy,
5732                 .flags = GENL_ADMIN_PERM,
5733                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5734                                   NL80211_FLAG_NEED_RTNL,
5735         },
5736         {
5737                 .cmd = NL80211_CMD_SET_MPATH,
5738                 .doit = nl80211_set_mpath,
5739                 .policy = nl80211_policy,
5740                 .flags = GENL_ADMIN_PERM,
5741                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5742                                   NL80211_FLAG_NEED_RTNL,
5743         },
5744         {
5745                 .cmd = NL80211_CMD_NEW_MPATH,
5746                 .doit = nl80211_new_mpath,
5747                 .policy = nl80211_policy,
5748                 .flags = GENL_ADMIN_PERM,
5749                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5750                                   NL80211_FLAG_NEED_RTNL,
5751         },
5752         {
5753                 .cmd = NL80211_CMD_DEL_MPATH,
5754                 .doit = nl80211_del_mpath,
5755                 .policy = nl80211_policy,
5756                 .flags = GENL_ADMIN_PERM,
5757                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5758                                   NL80211_FLAG_NEED_RTNL,
5759         },
5760         {
5761                 .cmd = NL80211_CMD_SET_BSS,
5762                 .doit = nl80211_set_bss,
5763                 .policy = nl80211_policy,
5764                 .flags = GENL_ADMIN_PERM,
5765                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5766                                   NL80211_FLAG_NEED_RTNL,
5767         },
5768         {
5769                 .cmd = NL80211_CMD_GET_REG,
5770                 .doit = nl80211_get_reg,
5771                 .policy = nl80211_policy,
5772                 /* can be retrieved by unprivileged users */
5773         },
5774         {
5775                 .cmd = NL80211_CMD_SET_REG,
5776                 .doit = nl80211_set_reg,
5777                 .policy = nl80211_policy,
5778                 .flags = GENL_ADMIN_PERM,
5779         },
5780         {
5781                 .cmd = NL80211_CMD_REQ_SET_REG,
5782                 .doit = nl80211_req_set_reg,
5783                 .policy = nl80211_policy,
5784                 .flags = GENL_ADMIN_PERM,
5785         },
5786         {
5787                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5788                 .doit = nl80211_get_mesh_config,
5789                 .policy = nl80211_policy,
5790                 /* can be retrieved by unprivileged users */
5791                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5792                                   NL80211_FLAG_NEED_RTNL,
5793         },
5794         {
5795                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5796                 .doit = nl80211_update_mesh_config,
5797                 .policy = nl80211_policy,
5798                 .flags = GENL_ADMIN_PERM,
5799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5800                                   NL80211_FLAG_NEED_RTNL,
5801         },
5802         {
5803                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5804                 .doit = nl80211_trigger_scan,
5805                 .policy = nl80211_policy,
5806                 .flags = GENL_ADMIN_PERM,
5807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5808                                   NL80211_FLAG_NEED_RTNL,
5809         },
5810         {
5811                 .cmd = NL80211_CMD_GET_SCAN,
5812                 .policy = nl80211_policy,
5813                 .dumpit = nl80211_dump_scan,
5814         },
5815         {
5816                 .cmd = NL80211_CMD_START_SCHED_SCAN,
5817                 .doit = nl80211_start_sched_scan,
5818                 .policy = nl80211_policy,
5819                 .flags = GENL_ADMIN_PERM,
5820                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5821                                   NL80211_FLAG_NEED_RTNL,
5822         },
5823         {
5824                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
5825                 .doit = nl80211_stop_sched_scan,
5826                 .policy = nl80211_policy,
5827                 .flags = GENL_ADMIN_PERM,
5828                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5829                                   NL80211_FLAG_NEED_RTNL,
5830         },
5831         {
5832                 .cmd = NL80211_CMD_AUTHENTICATE,
5833                 .doit = nl80211_authenticate,
5834                 .policy = nl80211_policy,
5835                 .flags = GENL_ADMIN_PERM,
5836                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5837                                   NL80211_FLAG_NEED_RTNL,
5838         },
5839         {
5840                 .cmd = NL80211_CMD_ASSOCIATE,
5841                 .doit = nl80211_associate,
5842                 .policy = nl80211_policy,
5843                 .flags = GENL_ADMIN_PERM,
5844                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5845                                   NL80211_FLAG_NEED_RTNL,
5846         },
5847         {
5848                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5849                 .doit = nl80211_deauthenticate,
5850                 .policy = nl80211_policy,
5851                 .flags = GENL_ADMIN_PERM,
5852                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5853                                   NL80211_FLAG_NEED_RTNL,
5854         },
5855         {
5856                 .cmd = NL80211_CMD_DISASSOCIATE,
5857                 .doit = nl80211_disassociate,
5858                 .policy = nl80211_policy,
5859                 .flags = GENL_ADMIN_PERM,
5860                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5861                                   NL80211_FLAG_NEED_RTNL,
5862         },
5863         {
5864                 .cmd = NL80211_CMD_JOIN_IBSS,
5865                 .doit = nl80211_join_ibss,
5866                 .policy = nl80211_policy,
5867                 .flags = GENL_ADMIN_PERM,
5868                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5869                                   NL80211_FLAG_NEED_RTNL,
5870         },
5871         {
5872                 .cmd = NL80211_CMD_LEAVE_IBSS,
5873                 .doit = nl80211_leave_ibss,
5874                 .policy = nl80211_policy,
5875                 .flags = GENL_ADMIN_PERM,
5876                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5877                                   NL80211_FLAG_NEED_RTNL,
5878         },
5879 #ifdef CONFIG_NL80211_TESTMODE
5880         {
5881                 .cmd = NL80211_CMD_TESTMODE,
5882                 .doit = nl80211_testmode_do,
5883                 .dumpit = nl80211_testmode_dump,
5884                 .policy = nl80211_policy,
5885                 .flags = GENL_ADMIN_PERM,
5886                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5887                                   NL80211_FLAG_NEED_RTNL,
5888         },
5889 #endif
5890         {
5891                 .cmd = NL80211_CMD_CONNECT,
5892                 .doit = nl80211_connect,
5893                 .policy = nl80211_policy,
5894                 .flags = GENL_ADMIN_PERM,
5895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5896                                   NL80211_FLAG_NEED_RTNL,
5897         },
5898         {
5899                 .cmd = NL80211_CMD_DISCONNECT,
5900                 .doit = nl80211_disconnect,
5901                 .policy = nl80211_policy,
5902                 .flags = GENL_ADMIN_PERM,
5903                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5904                                   NL80211_FLAG_NEED_RTNL,
5905         },
5906         {
5907                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5908                 .doit = nl80211_wiphy_netns,
5909                 .policy = nl80211_policy,
5910                 .flags = GENL_ADMIN_PERM,
5911                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5912                                   NL80211_FLAG_NEED_RTNL,
5913         },
5914         {
5915                 .cmd = NL80211_CMD_GET_SURVEY,
5916                 .policy = nl80211_policy,
5917                 .dumpit = nl80211_dump_survey,
5918         },
5919         {
5920                 .cmd = NL80211_CMD_SET_PMKSA,
5921                 .doit = nl80211_setdel_pmksa,
5922                 .policy = nl80211_policy,
5923                 .flags = GENL_ADMIN_PERM,
5924                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5925                                   NL80211_FLAG_NEED_RTNL,
5926         },
5927         {
5928                 .cmd = NL80211_CMD_DEL_PMKSA,
5929                 .doit = nl80211_setdel_pmksa,
5930                 .policy = nl80211_policy,
5931                 .flags = GENL_ADMIN_PERM,
5932                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5933                                   NL80211_FLAG_NEED_RTNL,
5934         },
5935         {
5936                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5937                 .doit = nl80211_flush_pmksa,
5938                 .policy = nl80211_policy,
5939                 .flags = GENL_ADMIN_PERM,
5940                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5941                                   NL80211_FLAG_NEED_RTNL,
5942         },
5943         {
5944                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5945                 .doit = nl80211_remain_on_channel,
5946                 .policy = nl80211_policy,
5947                 .flags = GENL_ADMIN_PERM,
5948                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5949                       &nb