cfg80211: add channel tracking for AP and mesh
[linux-3.10.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25
26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
28                                    struct genl_info *info,
29                                    struct cfg80211_crypto_settings *settings,
30                                    int cipher_limit);
31
32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
33                             struct genl_info *info);
34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
35                               struct genl_info *info);
36
37 /* the netlink family */
38 static struct genl_family nl80211_fam = {
39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
40         .name = "nl80211",      /* have users key off the name instead */
41         .hdrsize = 0,           /* no private header */
42         .version = 1,           /* no particular meaning now */
43         .maxattr = NL80211_ATTR_MAX,
44         .netnsok = true,
45         .pre_doit = nl80211_pre_doit,
46         .post_doit = nl80211_post_doit,
47 };
48
49 /* internal helper: get rdev and dev */
50 static int get_rdev_dev_by_ifindex(struct net *netns, struct nlattr **attrs,
51                                    struct cfg80211_registered_device **rdev,
52                                    struct net_device **dev)
53 {
54         int ifindex;
55
56         if (!attrs[NL80211_ATTR_IFINDEX])
57                 return -EINVAL;
58
59         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
60         *dev = dev_get_by_index(netns, ifindex);
61         if (!*dev)
62                 return -ENODEV;
63
64         *rdev = cfg80211_get_dev_from_ifindex(netns, ifindex);
65         if (IS_ERR(*rdev)) {
66                 dev_put(*dev);
67                 return PTR_ERR(*rdev);
68         }
69
70         return 0;
71 }
72
73 static struct cfg80211_registered_device *
74 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
75 {
76         struct cfg80211_registered_device *rdev = NULL, *tmp;
77         struct net_device *netdev;
78
79         assert_cfg80211_lock();
80
81         if (!attrs[NL80211_ATTR_WIPHY] &&
82             !attrs[NL80211_ATTR_IFINDEX])
83                 return ERR_PTR(-EINVAL);
84
85         if (attrs[NL80211_ATTR_WIPHY])
86                 rdev = cfg80211_rdev_by_wiphy_idx(
87                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
88
89         if (attrs[NL80211_ATTR_IFINDEX]) {
90                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
91                 netdev = dev_get_by_index(netns, ifindex);
92                 if (netdev) {
93                         if (netdev->ieee80211_ptr)
94                                 tmp = wiphy_to_dev(
95                                                 netdev->ieee80211_ptr->wiphy);
96                         else
97                                 tmp = NULL;
98
99                         dev_put(netdev);
100
101                         /* not wireless device -- return error */
102                         if (!tmp)
103                                 return ERR_PTR(-EINVAL);
104
105                         /* mismatch -- return error */
106                         if (rdev && tmp != rdev)
107                                 return ERR_PTR(-EINVAL);
108
109                         rdev = tmp;
110                 }
111         }
112
113         if (!rdev)
114                 return ERR_PTR(-ENODEV);
115
116         if (netns != wiphy_net(&rdev->wiphy))
117                 return ERR_PTR(-ENODEV);
118
119         return rdev;
120 }
121
122 /*
123  * This function returns a pointer to the driver
124  * that the genl_info item that is passed refers to.
125  * If successful, it returns non-NULL and also locks
126  * the driver's mutex!
127  *
128  * This means that you need to call cfg80211_unlock_rdev()
129  * before being allowed to acquire &cfg80211_mutex!
130  *
131  * This is necessary because we need to lock the global
132  * mutex to get an item off the list safely, and then
133  * we lock the rdev mutex so it doesn't go away under us.
134  *
135  * We don't want to keep cfg80211_mutex locked
136  * for all the time in order to allow requests on
137  * other interfaces to go through at the same time.
138  *
139  * The result of this can be a PTR_ERR and hence must
140  * be checked with IS_ERR() for errors.
141  */
142 static struct cfg80211_registered_device *
143 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
144 {
145         struct cfg80211_registered_device *rdev;
146
147         mutex_lock(&cfg80211_mutex);
148         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
149
150         /* if it is not an error we grab the lock on
151          * it to assure it won't be going away while
152          * we operate on it */
153         if (!IS_ERR(rdev))
154                 mutex_lock(&rdev->mtx);
155
156         mutex_unlock(&cfg80211_mutex);
157
158         return rdev;
159 }
160
161 /* policy for the attributes */
162 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
163         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
164         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
165                                       .len = 20-1 },
166         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
167         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
168         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
169         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
170         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
171         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
172         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
173         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
174
175         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
176         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
177         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
178
179         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
180         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
181
182         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
183         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
184                                     .len = WLAN_MAX_KEY_LEN },
185         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
186         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
187         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
188         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
189         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
190
191         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
192         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
193         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
194                                        .len = IEEE80211_MAX_DATA_LEN },
195         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
196                                        .len = IEEE80211_MAX_DATA_LEN },
197         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
198         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
199         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
200         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
201                                                .len = NL80211_MAX_SUPP_RATES },
202         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
203         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
204         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
205         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
206                                    .len = IEEE80211_MAX_MESH_ID_LEN },
207         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
208
209         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
210         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
211
212         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
213         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
214         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
215         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
216                                            .len = NL80211_MAX_SUPP_RATES },
217         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
218
219         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
220         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
221
222         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
223
224         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
225         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
226                               .len = IEEE80211_MAX_DATA_LEN },
227         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
228         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
229
230         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
231                                 .len = IEEE80211_MAX_SSID_LEN },
232         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
233         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
234         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
235         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
236         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
237         [NL80211_ATTR_STA_FLAGS2] = {
238                 .len = sizeof(struct nl80211_sta_flag_update),
239         },
240         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
241         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
242         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
243         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
244         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
245         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
246         [NL80211_ATTR_PID] = { .type = NLA_U32 },
247         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
248         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
249                                  .len = WLAN_PMKID_LEN },
250         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
251         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
252         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
253         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
254                                  .len = IEEE80211_MAX_DATA_LEN },
255         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
256         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
257         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
258         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
259         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
260         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
261         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
262         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
263         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
264         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
265         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
266         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
267         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
268         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
269         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
270         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
271         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
272         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
273         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
274         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
275                                          .len = IEEE80211_MAX_DATA_LEN },
276         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
277                                          .len = IEEE80211_MAX_DATA_LEN },
278         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
279         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
280         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
281         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
282         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
283         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
284         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
285         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
286         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
287         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
288                                       .len = IEEE80211_MAX_DATA_LEN },
289         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
290         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
291         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
292                 .len = NL80211_HT_CAPABILITY_LEN
293         },
294         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
295         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
296         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
297 };
298
299 /* policy for the key attributes */
300 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
301         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
302         [NL80211_KEY_IDX] = { .type = NLA_U8 },
303         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
304         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
305         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
306         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
307         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
308         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
309 };
310
311 /* policy for the key default flags */
312 static const struct nla_policy
313 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
314         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
315         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
316 };
317
318 /* policy for WoWLAN attributes */
319 static const struct nla_policy
320 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
321         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
322         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
323         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
324         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
325         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
326         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
327         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
328         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
329 };
330
331 /* policy for GTK rekey offload attributes */
332 static const struct nla_policy
333 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
334         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
335         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
336         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
337 };
338
339 static const struct nla_policy
340 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
341         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
342                                                  .len = IEEE80211_MAX_SSID_LEN },
343         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
344 };
345
346 /* ifidx get helper */
347 static int nl80211_get_ifidx(struct netlink_callback *cb)
348 {
349         int res;
350
351         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
352                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
353                           nl80211_policy);
354         if (res)
355                 return res;
356
357         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
358                 return -EINVAL;
359
360         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
361         if (!res)
362                 return -EINVAL;
363         return res;
364 }
365
366 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
367                                        struct netlink_callback *cb,
368                                        struct cfg80211_registered_device **rdev,
369                                        struct net_device **dev)
370 {
371         int ifidx = cb->args[0];
372         int err;
373
374         if (!ifidx)
375                 ifidx = nl80211_get_ifidx(cb);
376         if (ifidx < 0)
377                 return ifidx;
378
379         cb->args[0] = ifidx;
380
381         rtnl_lock();
382
383         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
384         if (!*dev) {
385                 err = -ENODEV;
386                 goto out_rtnl;
387         }
388
389         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
390         if (IS_ERR(*rdev)) {
391                 err = PTR_ERR(*rdev);
392                 goto out_rtnl;
393         }
394
395         return 0;
396  out_rtnl:
397         rtnl_unlock();
398         return err;
399 }
400
401 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
402 {
403         cfg80211_unlock_rdev(rdev);
404         rtnl_unlock();
405 }
406
407 /* IE validation */
408 static bool is_valid_ie_attr(const struct nlattr *attr)
409 {
410         const u8 *pos;
411         int len;
412
413         if (!attr)
414                 return true;
415
416         pos = nla_data(attr);
417         len = nla_len(attr);
418
419         while (len) {
420                 u8 elemlen;
421
422                 if (len < 2)
423                         return false;
424                 len -= 2;
425
426                 elemlen = pos[1];
427                 if (elemlen > len)
428                         return false;
429
430                 len -= elemlen;
431                 pos += 2 + elemlen;
432         }
433
434         return true;
435 }
436
437 /* message building helper */
438 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
439                                    int flags, u8 cmd)
440 {
441         /* since there is no private header just add the generic one */
442         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
443 }
444
445 static int nl80211_msg_put_channel(struct sk_buff *msg,
446                                    struct ieee80211_channel *chan)
447 {
448         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
449                         chan->center_freq))
450                 goto nla_put_failure;
451
452         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
453             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
454                 goto nla_put_failure;
455         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
456             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
457                 goto nla_put_failure;
458         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
459             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
460                 goto nla_put_failure;
461         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
462             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
463                 goto nla_put_failure;
464
465         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
466                         DBM_TO_MBM(chan->max_power)))
467                 goto nla_put_failure;
468
469         return 0;
470
471  nla_put_failure:
472         return -ENOBUFS;
473 }
474
475 /* netlink command implementations */
476
477 struct key_parse {
478         struct key_params p;
479         int idx;
480         int type;
481         bool def, defmgmt;
482         bool def_uni, def_multi;
483 };
484
485 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
486 {
487         struct nlattr *tb[NL80211_KEY_MAX + 1];
488         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
489                                    nl80211_key_policy);
490         if (err)
491                 return err;
492
493         k->def = !!tb[NL80211_KEY_DEFAULT];
494         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
495
496         if (k->def) {
497                 k->def_uni = true;
498                 k->def_multi = true;
499         }
500         if (k->defmgmt)
501                 k->def_multi = true;
502
503         if (tb[NL80211_KEY_IDX])
504                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
505
506         if (tb[NL80211_KEY_DATA]) {
507                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
508                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
509         }
510
511         if (tb[NL80211_KEY_SEQ]) {
512                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
513                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
514         }
515
516         if (tb[NL80211_KEY_CIPHER])
517                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
518
519         if (tb[NL80211_KEY_TYPE]) {
520                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
521                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
522                         return -EINVAL;
523         }
524
525         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
526                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
527                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
528                                        tb[NL80211_KEY_DEFAULT_TYPES],
529                                        nl80211_key_default_policy);
530                 if (err)
531                         return err;
532
533                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
534                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
535         }
536
537         return 0;
538 }
539
540 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
541 {
542         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
543                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
544                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
545         }
546
547         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
548                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
549                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
550         }
551
552         if (info->attrs[NL80211_ATTR_KEY_IDX])
553                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
554
555         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
556                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
557
558         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
559         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
560
561         if (k->def) {
562                 k->def_uni = true;
563                 k->def_multi = true;
564         }
565         if (k->defmgmt)
566                 k->def_multi = true;
567
568         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
569                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
570                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
571                         return -EINVAL;
572         }
573
574         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
575                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
576                 int err = nla_parse_nested(
577                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
578                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
579                                 nl80211_key_default_policy);
580                 if (err)
581                         return err;
582
583                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
584                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
585         }
586
587         return 0;
588 }
589
590 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
591 {
592         int err;
593
594         memset(k, 0, sizeof(*k));
595         k->idx = -1;
596         k->type = -1;
597
598         if (info->attrs[NL80211_ATTR_KEY])
599                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
600         else
601                 err = nl80211_parse_key_old(info, k);
602
603         if (err)
604                 return err;
605
606         if (k->def && k->defmgmt)
607                 return -EINVAL;
608
609         if (k->defmgmt) {
610                 if (k->def_uni || !k->def_multi)
611                         return -EINVAL;
612         }
613
614         if (k->idx != -1) {
615                 if (k->defmgmt) {
616                         if (k->idx < 4 || k->idx > 5)
617                                 return -EINVAL;
618                 } else if (k->def) {
619                         if (k->idx < 0 || k->idx > 3)
620                                 return -EINVAL;
621                 } else {
622                         if (k->idx < 0 || k->idx > 5)
623                                 return -EINVAL;
624                 }
625         }
626
627         return 0;
628 }
629
630 static struct cfg80211_cached_keys *
631 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
632                        struct nlattr *keys)
633 {
634         struct key_parse parse;
635         struct nlattr *key;
636         struct cfg80211_cached_keys *result;
637         int rem, err, def = 0;
638
639         result = kzalloc(sizeof(*result), GFP_KERNEL);
640         if (!result)
641                 return ERR_PTR(-ENOMEM);
642
643         result->def = -1;
644         result->defmgmt = -1;
645
646         nla_for_each_nested(key, keys, rem) {
647                 memset(&parse, 0, sizeof(parse));
648                 parse.idx = -1;
649
650                 err = nl80211_parse_key_new(key, &parse);
651                 if (err)
652                         goto error;
653                 err = -EINVAL;
654                 if (!parse.p.key)
655                         goto error;
656                 if (parse.idx < 0 || parse.idx > 4)
657                         goto error;
658                 if (parse.def) {
659                         if (def)
660                                 goto error;
661                         def = 1;
662                         result->def = parse.idx;
663                         if (!parse.def_uni || !parse.def_multi)
664                                 goto error;
665                 } else if (parse.defmgmt)
666                         goto error;
667                 err = cfg80211_validate_key_settings(rdev, &parse.p,
668                                                      parse.idx, false, NULL);
669                 if (err)
670                         goto error;
671                 result->params[parse.idx].cipher = parse.p.cipher;
672                 result->params[parse.idx].key_len = parse.p.key_len;
673                 result->params[parse.idx].key = result->data[parse.idx];
674                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
675         }
676
677         return result;
678  error:
679         kfree(result);
680         return ERR_PTR(err);
681 }
682
683 static int nl80211_key_allowed(struct wireless_dev *wdev)
684 {
685         ASSERT_WDEV_LOCK(wdev);
686
687         switch (wdev->iftype) {
688         case NL80211_IFTYPE_AP:
689         case NL80211_IFTYPE_AP_VLAN:
690         case NL80211_IFTYPE_P2P_GO:
691         case NL80211_IFTYPE_MESH_POINT:
692                 break;
693         case NL80211_IFTYPE_ADHOC:
694                 if (!wdev->current_bss)
695                         return -ENOLINK;
696                 break;
697         case NL80211_IFTYPE_STATION:
698         case NL80211_IFTYPE_P2P_CLIENT:
699                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
700                         return -ENOLINK;
701                 break;
702         default:
703                 return -EINVAL;
704         }
705
706         return 0;
707 }
708
709 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
710 {
711         struct nlattr *nl_modes = nla_nest_start(msg, attr);
712         int i;
713
714         if (!nl_modes)
715                 goto nla_put_failure;
716
717         i = 0;
718         while (ifmodes) {
719                 if ((ifmodes & 1) && nla_put_flag(msg, i))
720                         goto nla_put_failure;
721                 ifmodes >>= 1;
722                 i++;
723         }
724
725         nla_nest_end(msg, nl_modes);
726         return 0;
727
728 nla_put_failure:
729         return -ENOBUFS;
730 }
731
732 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
733                                           struct sk_buff *msg)
734 {
735         struct nlattr *nl_combis;
736         int i, j;
737
738         nl_combis = nla_nest_start(msg,
739                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
740         if (!nl_combis)
741                 goto nla_put_failure;
742
743         for (i = 0; i < wiphy->n_iface_combinations; i++) {
744                 const struct ieee80211_iface_combination *c;
745                 struct nlattr *nl_combi, *nl_limits;
746
747                 c = &wiphy->iface_combinations[i];
748
749                 nl_combi = nla_nest_start(msg, i + 1);
750                 if (!nl_combi)
751                         goto nla_put_failure;
752
753                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
754                 if (!nl_limits)
755                         goto nla_put_failure;
756
757                 for (j = 0; j < c->n_limits; j++) {
758                         struct nlattr *nl_limit;
759
760                         nl_limit = nla_nest_start(msg, j + 1);
761                         if (!nl_limit)
762                                 goto nla_put_failure;
763                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
764                                         c->limits[j].max))
765                                 goto nla_put_failure;
766                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
767                                                 c->limits[j].types))
768                                 goto nla_put_failure;
769                         nla_nest_end(msg, nl_limit);
770                 }
771
772                 nla_nest_end(msg, nl_limits);
773
774                 if (c->beacon_int_infra_match &&
775                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
776                         goto nla_put_failure;
777                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
778                                 c->num_different_channels) ||
779                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
780                                 c->max_interfaces))
781                         goto nla_put_failure;
782
783                 nla_nest_end(msg, nl_combi);
784         }
785
786         nla_nest_end(msg, nl_combis);
787
788         return 0;
789 nla_put_failure:
790         return -ENOBUFS;
791 }
792
793 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
794                               struct cfg80211_registered_device *dev)
795 {
796         void *hdr;
797         struct nlattr *nl_bands, *nl_band;
798         struct nlattr *nl_freqs, *nl_freq;
799         struct nlattr *nl_rates, *nl_rate;
800         struct nlattr *nl_cmds;
801         enum ieee80211_band band;
802         struct ieee80211_channel *chan;
803         struct ieee80211_rate *rate;
804         int i;
805         const struct ieee80211_txrx_stypes *mgmt_stypes =
806                                 dev->wiphy.mgmt_stypes;
807
808         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
809         if (!hdr)
810                 return -1;
811
812         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
813             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
814             nla_put_u32(msg, NL80211_ATTR_GENERATION,
815                         cfg80211_rdev_list_generation) ||
816             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
817                        dev->wiphy.retry_short) ||
818             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
819                        dev->wiphy.retry_long) ||
820             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
821                         dev->wiphy.frag_threshold) ||
822             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
823                         dev->wiphy.rts_threshold) ||
824             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
825                        dev->wiphy.coverage_class) ||
826             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
827                        dev->wiphy.max_scan_ssids) ||
828             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
829                        dev->wiphy.max_sched_scan_ssids) ||
830             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
831                         dev->wiphy.max_scan_ie_len) ||
832             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
833                         dev->wiphy.max_sched_scan_ie_len) ||
834             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
835                        dev->wiphy.max_match_sets))
836                 goto nla_put_failure;
837
838         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
839             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
840                 goto nla_put_failure;
841         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
842             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
843                 goto nla_put_failure;
844         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
845             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
846                 goto nla_put_failure;
847         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
848             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
849                 goto nla_put_failure;
850         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
851             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
852                 goto nla_put_failure;
853         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
854             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
855                 goto nla_put_failure;
856
857         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
858                     sizeof(u32) * dev->wiphy.n_cipher_suites,
859                     dev->wiphy.cipher_suites))
860                 goto nla_put_failure;
861
862         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
863                        dev->wiphy.max_num_pmkids))
864                 goto nla_put_failure;
865
866         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
867             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
868                 goto nla_put_failure;
869
870         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
871                         dev->wiphy.available_antennas_tx) ||
872             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
873                         dev->wiphy.available_antennas_rx))
874                 goto nla_put_failure;
875
876         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
877             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
878                         dev->wiphy.probe_resp_offload))
879                 goto nla_put_failure;
880
881         if ((dev->wiphy.available_antennas_tx ||
882              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
883                 u32 tx_ant = 0, rx_ant = 0;
884                 int res;
885                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
886                 if (!res) {
887                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
888                                         tx_ant) ||
889                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
890                                         rx_ant))
891                                 goto nla_put_failure;
892                 }
893         }
894
895         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
896                                 dev->wiphy.interface_modes))
897                 goto nla_put_failure;
898
899         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
900         if (!nl_bands)
901                 goto nla_put_failure;
902
903         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
904                 if (!dev->wiphy.bands[band])
905                         continue;
906
907                 nl_band = nla_nest_start(msg, band);
908                 if (!nl_band)
909                         goto nla_put_failure;
910
911                 /* add HT info */
912                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
913                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
914                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
915                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
916                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
917                                  dev->wiphy.bands[band]->ht_cap.cap) ||
918                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
919                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
920                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
921                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
922                         goto nla_put_failure;
923
924                 /* add VHT info */
925                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
926                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
927                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
928                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
929                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
930                                  dev->wiphy.bands[band]->vht_cap.cap)))
931                         goto nla_put_failure;
932
933                 /* add frequencies */
934                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
935                 if (!nl_freqs)
936                         goto nla_put_failure;
937
938                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
939                         nl_freq = nla_nest_start(msg, i);
940                         if (!nl_freq)
941                                 goto nla_put_failure;
942
943                         chan = &dev->wiphy.bands[band]->channels[i];
944
945                         if (nl80211_msg_put_channel(msg, chan))
946                                 goto nla_put_failure;
947
948                         nla_nest_end(msg, nl_freq);
949                 }
950
951                 nla_nest_end(msg, nl_freqs);
952
953                 /* add bitrates */
954                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
955                 if (!nl_rates)
956                         goto nla_put_failure;
957
958                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
959                         nl_rate = nla_nest_start(msg, i);
960                         if (!nl_rate)
961                                 goto nla_put_failure;
962
963                         rate = &dev->wiphy.bands[band]->bitrates[i];
964                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
965                                         rate->bitrate))
966                                 goto nla_put_failure;
967                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
968                             nla_put_flag(msg,
969                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
970                                 goto nla_put_failure;
971
972                         nla_nest_end(msg, nl_rate);
973                 }
974
975                 nla_nest_end(msg, nl_rates);
976
977                 nla_nest_end(msg, nl_band);
978         }
979         nla_nest_end(msg, nl_bands);
980
981         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
982         if (!nl_cmds)
983                 goto nla_put_failure;
984
985         i = 0;
986 #define CMD(op, n)                                              \
987          do {                                                   \
988                 if (dev->ops->op) {                             \
989                         i++;                                    \
990                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
991                                 goto nla_put_failure;           \
992                 }                                               \
993         } while (0)
994
995         CMD(add_virtual_intf, NEW_INTERFACE);
996         CMD(change_virtual_intf, SET_INTERFACE);
997         CMD(add_key, NEW_KEY);
998         CMD(start_ap, START_AP);
999         CMD(add_station, NEW_STATION);
1000         CMD(add_mpath, NEW_MPATH);
1001         CMD(update_mesh_config, SET_MESH_CONFIG);
1002         CMD(change_bss, SET_BSS);
1003         CMD(auth, AUTHENTICATE);
1004         CMD(assoc, ASSOCIATE);
1005         CMD(deauth, DEAUTHENTICATE);
1006         CMD(disassoc, DISASSOCIATE);
1007         CMD(join_ibss, JOIN_IBSS);
1008         CMD(join_mesh, JOIN_MESH);
1009         CMD(set_pmksa, SET_PMKSA);
1010         CMD(del_pmksa, DEL_PMKSA);
1011         CMD(flush_pmksa, FLUSH_PMKSA);
1012         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1013                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1014         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1015         CMD(mgmt_tx, FRAME);
1016         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1017         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1018                 i++;
1019                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1020                         goto nla_put_failure;
1021         }
1022         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1023             dev->ops->join_mesh) {
1024                 i++;
1025                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1026                         goto nla_put_failure;
1027         }
1028         CMD(set_wds_peer, SET_WDS_PEER);
1029         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1030                 CMD(tdls_mgmt, TDLS_MGMT);
1031                 CMD(tdls_oper, TDLS_OPER);
1032         }
1033         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1034                 CMD(sched_scan_start, START_SCHED_SCAN);
1035         CMD(probe_client, PROBE_CLIENT);
1036         CMD(set_noack_map, SET_NOACK_MAP);
1037         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1038                 i++;
1039                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1040                         goto nla_put_failure;
1041         }
1042
1043 #ifdef CONFIG_NL80211_TESTMODE
1044         CMD(testmode_cmd, TESTMODE);
1045 #endif
1046
1047 #undef CMD
1048
1049         if (dev->ops->connect || dev->ops->auth) {
1050                 i++;
1051                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1052                         goto nla_put_failure;
1053         }
1054
1055         if (dev->ops->disconnect || dev->ops->deauth) {
1056                 i++;
1057                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1058                         goto nla_put_failure;
1059         }
1060
1061         nla_nest_end(msg, nl_cmds);
1062
1063         if (dev->ops->remain_on_channel &&
1064             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1065             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1066                         dev->wiphy.max_remain_on_channel_duration))
1067                 goto nla_put_failure;
1068
1069         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1070             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1071                 goto nla_put_failure;
1072
1073         if (mgmt_stypes) {
1074                 u16 stypes;
1075                 struct nlattr *nl_ftypes, *nl_ifs;
1076                 enum nl80211_iftype ift;
1077
1078                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1079                 if (!nl_ifs)
1080                         goto nla_put_failure;
1081
1082                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1083                         nl_ftypes = nla_nest_start(msg, ift);
1084                         if (!nl_ftypes)
1085                                 goto nla_put_failure;
1086                         i = 0;
1087                         stypes = mgmt_stypes[ift].tx;
1088                         while (stypes) {
1089                                 if ((stypes & 1) &&
1090                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1091                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1092                                         goto nla_put_failure;
1093                                 stypes >>= 1;
1094                                 i++;
1095                         }
1096                         nla_nest_end(msg, nl_ftypes);
1097                 }
1098
1099                 nla_nest_end(msg, nl_ifs);
1100
1101                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1102                 if (!nl_ifs)
1103                         goto nla_put_failure;
1104
1105                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1106                         nl_ftypes = nla_nest_start(msg, ift);
1107                         if (!nl_ftypes)
1108                                 goto nla_put_failure;
1109                         i = 0;
1110                         stypes = mgmt_stypes[ift].rx;
1111                         while (stypes) {
1112                                 if ((stypes & 1) &&
1113                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1114                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1115                                         goto nla_put_failure;
1116                                 stypes >>= 1;
1117                                 i++;
1118                         }
1119                         nla_nest_end(msg, nl_ftypes);
1120                 }
1121                 nla_nest_end(msg, nl_ifs);
1122         }
1123
1124 #ifdef CONFIG_PM
1125         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1126                 struct nlattr *nl_wowlan;
1127
1128                 nl_wowlan = nla_nest_start(msg,
1129                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1130                 if (!nl_wowlan)
1131                         goto nla_put_failure;
1132
1133                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1134                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1135                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1136                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1137                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1138                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1139                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1140                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1141                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1142                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1143                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1144                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1145                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1146                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1147                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1148                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1149                     goto nla_put_failure;
1150                 if (dev->wiphy.wowlan.n_patterns) {
1151                         struct nl80211_wowlan_pattern_support pat = {
1152                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1153                                 .min_pattern_len =
1154                                         dev->wiphy.wowlan.pattern_min_len,
1155                                 .max_pattern_len =
1156                                         dev->wiphy.wowlan.pattern_max_len,
1157                         };
1158                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1159                                     sizeof(pat), &pat))
1160                                 goto nla_put_failure;
1161                 }
1162
1163                 nla_nest_end(msg, nl_wowlan);
1164         }
1165 #endif
1166
1167         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1168                                 dev->wiphy.software_iftypes))
1169                 goto nla_put_failure;
1170
1171         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1172                 goto nla_put_failure;
1173
1174         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1175             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1176                         dev->wiphy.ap_sme_capa))
1177                 goto nla_put_failure;
1178
1179         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1180                         dev->wiphy.features))
1181                 goto nla_put_failure;
1182
1183         if (dev->wiphy.ht_capa_mod_mask &&
1184             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1185                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1186                     dev->wiphy.ht_capa_mod_mask))
1187                 goto nla_put_failure;
1188
1189         return genlmsg_end(msg, hdr);
1190
1191  nla_put_failure:
1192         genlmsg_cancel(msg, hdr);
1193         return -EMSGSIZE;
1194 }
1195
1196 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1197 {
1198         int idx = 0;
1199         int start = cb->args[0];
1200         struct cfg80211_registered_device *dev;
1201
1202         mutex_lock(&cfg80211_mutex);
1203         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1204                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1205                         continue;
1206                 if (++idx <= start)
1207                         continue;
1208                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
1209                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1210                                        dev) < 0) {
1211                         idx--;
1212                         break;
1213                 }
1214         }
1215         mutex_unlock(&cfg80211_mutex);
1216
1217         cb->args[0] = idx;
1218
1219         return skb->len;
1220 }
1221
1222 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1223 {
1224         struct sk_buff *msg;
1225         struct cfg80211_registered_device *dev = info->user_ptr[0];
1226
1227         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1228         if (!msg)
1229                 return -ENOMEM;
1230
1231         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
1232                 nlmsg_free(msg);
1233                 return -ENOBUFS;
1234         }
1235
1236         return genlmsg_reply(msg, info);
1237 }
1238
1239 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1240         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1241         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1242         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1243         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1244         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1245 };
1246
1247 static int parse_txq_params(struct nlattr *tb[],
1248                             struct ieee80211_txq_params *txq_params)
1249 {
1250         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1251             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1252             !tb[NL80211_TXQ_ATTR_AIFS])
1253                 return -EINVAL;
1254
1255         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1256         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1257         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1258         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1259         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1260
1261         if (txq_params->ac >= NL80211_NUM_ACS)
1262                 return -EINVAL;
1263
1264         return 0;
1265 }
1266
1267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1268 {
1269         /*
1270          * You can only set the channel explicitly for WDS interfaces,
1271          * all others have their channel managed via their respective
1272          * "establish a connection" command (connect, join, ...)
1273          *
1274          * For AP/GO and mesh mode, the channel can be set with the
1275          * channel userspace API, but is only stored and passed to the
1276          * low-level driver when the AP starts or the mesh is joined.
1277          * This is for backward compatibility, userspace can also give
1278          * the channel in the start-ap or join-mesh commands instead.
1279          *
1280          * Monitors are special as they are normally slaved to
1281          * whatever else is going on, so they have their own special
1282          * operation to set the monitor channel if possible.
1283          */
1284         return !wdev ||
1285                 wdev->iftype == NL80211_IFTYPE_AP ||
1286                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1287                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1288                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1289 }
1290
1291 static bool nl80211_valid_channel_type(struct genl_info *info,
1292                                        enum nl80211_channel_type *channel_type)
1293 {
1294         enum nl80211_channel_type tmp;
1295
1296         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1297                 return false;
1298
1299         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1300         if (tmp != NL80211_CHAN_NO_HT &&
1301             tmp != NL80211_CHAN_HT20 &&
1302             tmp != NL80211_CHAN_HT40PLUS &&
1303             tmp != NL80211_CHAN_HT40MINUS)
1304                 return false;
1305
1306         if (channel_type)
1307                 *channel_type = tmp;
1308
1309         return true;
1310 }
1311
1312 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1313                                  struct wireless_dev *wdev,
1314                                  struct genl_info *info)
1315 {
1316         struct ieee80211_channel *channel;
1317         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1318         u32 freq;
1319         int result;
1320         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1321
1322         if (wdev)
1323                 iftype = wdev->iftype;
1324
1325         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1326                 return -EINVAL;
1327
1328         if (!nl80211_can_set_dev_channel(wdev))
1329                 return -EOPNOTSUPP;
1330
1331         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1332             !nl80211_valid_channel_type(info, &channel_type))
1333                 return -EINVAL;
1334
1335         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1336
1337         mutex_lock(&rdev->devlist_mtx);
1338         switch (iftype) {
1339         case NL80211_IFTYPE_AP:
1340         case NL80211_IFTYPE_P2P_GO:
1341                 if (wdev->beacon_interval) {
1342                         result = -EBUSY;
1343                         break;
1344                 }
1345                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1346                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1347                                                               channel,
1348                                                               channel_type)) {
1349                         result = -EINVAL;
1350                         break;
1351                 }
1352                 wdev->preset_chan = channel;
1353                 wdev->preset_chantype = channel_type;
1354                 result = 0;
1355                 break;
1356         case NL80211_IFTYPE_MESH_POINT:
1357                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1358                 break;
1359         case NL80211_IFTYPE_MONITOR:
1360                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1361                 break;
1362         default:
1363                 result = -EINVAL;
1364         }
1365         mutex_unlock(&rdev->devlist_mtx);
1366
1367         return result;
1368 }
1369
1370 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1371 {
1372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1373         struct net_device *netdev = info->user_ptr[1];
1374
1375         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1376 }
1377
1378 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1379 {
1380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1381         struct net_device *dev = info->user_ptr[1];
1382         struct wireless_dev *wdev = dev->ieee80211_ptr;
1383         const u8 *bssid;
1384
1385         if (!info->attrs[NL80211_ATTR_MAC])
1386                 return -EINVAL;
1387
1388         if (netif_running(dev))
1389                 return -EBUSY;
1390
1391         if (!rdev->ops->set_wds_peer)
1392                 return -EOPNOTSUPP;
1393
1394         if (wdev->iftype != NL80211_IFTYPE_WDS)
1395                 return -EOPNOTSUPP;
1396
1397         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1398         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1399 }
1400
1401
1402 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1403 {
1404         struct cfg80211_registered_device *rdev;
1405         struct net_device *netdev = NULL;
1406         struct wireless_dev *wdev;
1407         int result = 0, rem_txq_params = 0;
1408         struct nlattr *nl_txq_params;
1409         u32 changed;
1410         u8 retry_short = 0, retry_long = 0;
1411         u32 frag_threshold = 0, rts_threshold = 0;
1412         u8 coverage_class = 0;
1413
1414         /*
1415          * Try to find the wiphy and netdev. Normally this
1416          * function shouldn't need the netdev, but this is
1417          * done for backward compatibility -- previously
1418          * setting the channel was done per wiphy, but now
1419          * it is per netdev. Previous userland like hostapd
1420          * also passed a netdev to set_wiphy, so that it is
1421          * possible to let that go to the right netdev!
1422          */
1423         mutex_lock(&cfg80211_mutex);
1424
1425         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1426                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1427
1428                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1429                 if (netdev && netdev->ieee80211_ptr) {
1430                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1431                         mutex_lock(&rdev->mtx);
1432                 } else
1433                         netdev = NULL;
1434         }
1435
1436         if (!netdev) {
1437                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1438                                                   info->attrs);
1439                 if (IS_ERR(rdev)) {
1440                         mutex_unlock(&cfg80211_mutex);
1441                         return PTR_ERR(rdev);
1442                 }
1443                 wdev = NULL;
1444                 netdev = NULL;
1445                 result = 0;
1446
1447                 mutex_lock(&rdev->mtx);
1448         } else if (nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1449                 wdev = netdev->ieee80211_ptr;
1450         else
1451                 wdev = NULL;
1452
1453         /*
1454          * end workaround code, by now the rdev is available
1455          * and locked, and wdev may or may not be NULL.
1456          */
1457
1458         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1459                 result = cfg80211_dev_rename(
1460                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1461
1462         mutex_unlock(&cfg80211_mutex);
1463
1464         if (result)
1465                 goto bad_res;
1466
1467         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1468                 struct ieee80211_txq_params txq_params;
1469                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1470
1471                 if (!rdev->ops->set_txq_params) {
1472                         result = -EOPNOTSUPP;
1473                         goto bad_res;
1474                 }
1475
1476                 if (!netdev) {
1477                         result = -EINVAL;
1478                         goto bad_res;
1479                 }
1480
1481                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1482                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1483                         result = -EINVAL;
1484                         goto bad_res;
1485                 }
1486
1487                 if (!netif_running(netdev)) {
1488                         result = -ENETDOWN;
1489                         goto bad_res;
1490                 }
1491
1492                 nla_for_each_nested(nl_txq_params,
1493                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1494                                     rem_txq_params) {
1495                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1496                                   nla_data(nl_txq_params),
1497                                   nla_len(nl_txq_params),
1498                                   txq_params_policy);
1499                         result = parse_txq_params(tb, &txq_params);
1500                         if (result)
1501                                 goto bad_res;
1502
1503                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1504                                                            netdev,
1505                                                            &txq_params);
1506                         if (result)
1507                                 goto bad_res;
1508                 }
1509         }
1510
1511         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1512                 result = __nl80211_set_channel(rdev, wdev, info);
1513                 if (result)
1514                         goto bad_res;
1515         }
1516
1517         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1518                 enum nl80211_tx_power_setting type;
1519                 int idx, mbm = 0;
1520
1521                 if (!rdev->ops->set_tx_power) {
1522                         result = -EOPNOTSUPP;
1523                         goto bad_res;
1524                 }
1525
1526                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1527                 type = nla_get_u32(info->attrs[idx]);
1528
1529                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1530                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1531                         result = -EINVAL;
1532                         goto bad_res;
1533                 }
1534
1535                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1536                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1537                         mbm = nla_get_u32(info->attrs[idx]);
1538                 }
1539
1540                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1541                 if (result)
1542                         goto bad_res;
1543         }
1544
1545         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1546             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1547                 u32 tx_ant, rx_ant;
1548                 if ((!rdev->wiphy.available_antennas_tx &&
1549                      !rdev->wiphy.available_antennas_rx) ||
1550                     !rdev->ops->set_antenna) {
1551                         result = -EOPNOTSUPP;
1552                         goto bad_res;
1553                 }
1554
1555                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1556                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1557
1558                 /* reject antenna configurations which don't match the
1559                  * available antenna masks, except for the "all" mask */
1560                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1561                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1562                         result = -EINVAL;
1563                         goto bad_res;
1564                 }
1565
1566                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1567                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1568
1569                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1570                 if (result)
1571                         goto bad_res;
1572         }
1573
1574         changed = 0;
1575
1576         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1577                 retry_short = nla_get_u8(
1578                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1579                 if (retry_short == 0) {
1580                         result = -EINVAL;
1581                         goto bad_res;
1582                 }
1583                 changed |= WIPHY_PARAM_RETRY_SHORT;
1584         }
1585
1586         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1587                 retry_long = nla_get_u8(
1588                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1589                 if (retry_long == 0) {
1590                         result = -EINVAL;
1591                         goto bad_res;
1592                 }
1593                 changed |= WIPHY_PARAM_RETRY_LONG;
1594         }
1595
1596         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1597                 frag_threshold = nla_get_u32(
1598                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1599                 if (frag_threshold < 256) {
1600                         result = -EINVAL;
1601                         goto bad_res;
1602                 }
1603                 if (frag_threshold != (u32) -1) {
1604                         /*
1605                          * Fragments (apart from the last one) are required to
1606                          * have even length. Make the fragmentation code
1607                          * simpler by stripping LSB should someone try to use
1608                          * odd threshold value.
1609                          */
1610                         frag_threshold &= ~0x1;
1611                 }
1612                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1613         }
1614
1615         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1616                 rts_threshold = nla_get_u32(
1617                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1618                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1619         }
1620
1621         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1622                 coverage_class = nla_get_u8(
1623                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1624                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1625         }
1626
1627         if (changed) {
1628                 u8 old_retry_short, old_retry_long;
1629                 u32 old_frag_threshold, old_rts_threshold;
1630                 u8 old_coverage_class;
1631
1632                 if (!rdev->ops->set_wiphy_params) {
1633                         result = -EOPNOTSUPP;
1634                         goto bad_res;
1635                 }
1636
1637                 old_retry_short = rdev->wiphy.retry_short;
1638                 old_retry_long = rdev->wiphy.retry_long;
1639                 old_frag_threshold = rdev->wiphy.frag_threshold;
1640                 old_rts_threshold = rdev->wiphy.rts_threshold;
1641                 old_coverage_class = rdev->wiphy.coverage_class;
1642
1643                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1644                         rdev->wiphy.retry_short = retry_short;
1645                 if (changed & WIPHY_PARAM_RETRY_LONG)
1646                         rdev->wiphy.retry_long = retry_long;
1647                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1648                         rdev->wiphy.frag_threshold = frag_threshold;
1649                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1650                         rdev->wiphy.rts_threshold = rts_threshold;
1651                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1652                         rdev->wiphy.coverage_class = coverage_class;
1653
1654                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1655                 if (result) {
1656                         rdev->wiphy.retry_short = old_retry_short;
1657                         rdev->wiphy.retry_long = old_retry_long;
1658                         rdev->wiphy.frag_threshold = old_frag_threshold;
1659                         rdev->wiphy.rts_threshold = old_rts_threshold;
1660                         rdev->wiphy.coverage_class = old_coverage_class;
1661                 }
1662         }
1663
1664  bad_res:
1665         mutex_unlock(&rdev->mtx);
1666         if (netdev)
1667                 dev_put(netdev);
1668         return result;
1669 }
1670
1671
1672 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1673                               struct cfg80211_registered_device *rdev,
1674                               struct net_device *dev)
1675 {
1676         void *hdr;
1677
1678         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1679         if (!hdr)
1680                 return -1;
1681
1682         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1683             nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1684             nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
1685             nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1686                         dev->ieee80211_ptr->iftype) ||
1687             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1688                         rdev->devlist_generation ^
1689                         (cfg80211_rdev_list_generation << 2)))
1690                 goto nla_put_failure;
1691
1692         if (rdev->ops->get_channel) {
1693                 struct ieee80211_channel *chan;
1694                 enum nl80211_channel_type channel_type;
1695
1696                 chan = rdev->ops->get_channel(&rdev->wiphy, &channel_type);
1697                 if (chan &&
1698                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1699                                     chan->center_freq) ||
1700                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1701                                     channel_type)))
1702                         goto nla_put_failure;
1703         }
1704
1705         return genlmsg_end(msg, hdr);
1706
1707  nla_put_failure:
1708         genlmsg_cancel(msg, hdr);
1709         return -EMSGSIZE;
1710 }
1711
1712 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1713 {
1714         int wp_idx = 0;
1715         int if_idx = 0;
1716         int wp_start = cb->args[0];
1717         int if_start = cb->args[1];
1718         struct cfg80211_registered_device *rdev;
1719         struct wireless_dev *wdev;
1720
1721         mutex_lock(&cfg80211_mutex);
1722         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1723                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1724                         continue;
1725                 if (wp_idx < wp_start) {
1726                         wp_idx++;
1727                         continue;
1728                 }
1729                 if_idx = 0;
1730
1731                 mutex_lock(&rdev->devlist_mtx);
1732                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1733                         if (if_idx < if_start) {
1734                                 if_idx++;
1735                                 continue;
1736                         }
1737                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1738                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1739                                                rdev, wdev->netdev) < 0) {
1740                                 mutex_unlock(&rdev->devlist_mtx);
1741                                 goto out;
1742                         }
1743                         if_idx++;
1744                 }
1745                 mutex_unlock(&rdev->devlist_mtx);
1746
1747                 wp_idx++;
1748         }
1749  out:
1750         mutex_unlock(&cfg80211_mutex);
1751
1752         cb->args[0] = wp_idx;
1753         cb->args[1] = if_idx;
1754
1755         return skb->len;
1756 }
1757
1758 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1759 {
1760         struct sk_buff *msg;
1761         struct cfg80211_registered_device *dev = info->user_ptr[0];
1762         struct net_device *netdev = info->user_ptr[1];
1763
1764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1765         if (!msg)
1766                 return -ENOMEM;
1767
1768         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1769                                dev, netdev) < 0) {
1770                 nlmsg_free(msg);
1771                 return -ENOBUFS;
1772         }
1773
1774         return genlmsg_reply(msg, info);
1775 }
1776
1777 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1778         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1779         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1780         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1781         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1782         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1783 };
1784
1785 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1786 {
1787         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1788         int flag;
1789
1790         *mntrflags = 0;
1791
1792         if (!nla)
1793                 return -EINVAL;
1794
1795         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1796                              nla, mntr_flags_policy))
1797                 return -EINVAL;
1798
1799         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1800                 if (flags[flag])
1801                         *mntrflags |= (1<<flag);
1802
1803         return 0;
1804 }
1805
1806 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1807                                struct net_device *netdev, u8 use_4addr,
1808                                enum nl80211_iftype iftype)
1809 {
1810         if (!use_4addr) {
1811                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1812                         return -EBUSY;
1813                 return 0;
1814         }
1815
1816         switch (iftype) {
1817         case NL80211_IFTYPE_AP_VLAN:
1818                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1819                         return 0;
1820                 break;
1821         case NL80211_IFTYPE_STATION:
1822                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1823                         return 0;
1824                 break;
1825         default:
1826                 break;
1827         }
1828
1829         return -EOPNOTSUPP;
1830 }
1831
1832 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1833 {
1834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1835         struct vif_params params;
1836         int err;
1837         enum nl80211_iftype otype, ntype;
1838         struct net_device *dev = info->user_ptr[1];
1839         u32 _flags, *flags = NULL;
1840         bool change = false;
1841
1842         memset(&params, 0, sizeof(params));
1843
1844         otype = ntype = dev->ieee80211_ptr->iftype;
1845
1846         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1847                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1848                 if (otype != ntype)
1849                         change = true;
1850                 if (ntype > NL80211_IFTYPE_MAX)
1851                         return -EINVAL;
1852         }
1853
1854         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1855                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1856
1857                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1858                         return -EINVAL;
1859                 if (netif_running(dev))
1860                         return -EBUSY;
1861
1862                 wdev_lock(wdev);
1863                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1864                              IEEE80211_MAX_MESH_ID_LEN);
1865                 wdev->mesh_id_up_len =
1866                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1867                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1868                        wdev->mesh_id_up_len);
1869                 wdev_unlock(wdev);
1870         }
1871
1872         if (info->attrs[NL80211_ATTR_4ADDR]) {
1873                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1874                 change = true;
1875                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1876                 if (err)
1877                         return err;
1878         } else {
1879                 params.use_4addr = -1;
1880         }
1881
1882         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1883                 if (ntype != NL80211_IFTYPE_MONITOR)
1884                         return -EINVAL;
1885                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1886                                           &_flags);
1887                 if (err)
1888                         return err;
1889
1890                 flags = &_flags;
1891                 change = true;
1892         }
1893
1894         if (change)
1895                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1896         else
1897                 err = 0;
1898
1899         if (!err && params.use_4addr != -1)
1900                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1901
1902         return err;
1903 }
1904
1905 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908         struct vif_params params;
1909         struct net_device *dev;
1910         int err;
1911         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1912         u32 flags;
1913
1914         memset(&params, 0, sizeof(params));
1915
1916         if (!info->attrs[NL80211_ATTR_IFNAME])
1917                 return -EINVAL;
1918
1919         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1920                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1921                 if (type > NL80211_IFTYPE_MAX)
1922                         return -EINVAL;
1923         }
1924
1925         if (!rdev->ops->add_virtual_intf ||
1926             !(rdev->wiphy.interface_modes & (1 << type)))
1927                 return -EOPNOTSUPP;
1928
1929         if (info->attrs[NL80211_ATTR_4ADDR]) {
1930                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1931                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1932                 if (err)
1933                         return err;
1934         }
1935
1936         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1937                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1938                                   &flags);
1939         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1940                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1941                 type, err ? NULL : &flags, &params);
1942         if (IS_ERR(dev))
1943                 return PTR_ERR(dev);
1944
1945         if (type == NL80211_IFTYPE_MESH_POINT &&
1946             info->attrs[NL80211_ATTR_MESH_ID]) {
1947                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1948
1949                 wdev_lock(wdev);
1950                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1951                              IEEE80211_MAX_MESH_ID_LEN);
1952                 wdev->mesh_id_up_len =
1953                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1954                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1955                        wdev->mesh_id_up_len);
1956                 wdev_unlock(wdev);
1957         }
1958
1959         return 0;
1960 }
1961
1962 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1963 {
1964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1965         struct net_device *dev = info->user_ptr[1];
1966
1967         if (!rdev->ops->del_virtual_intf)
1968                 return -EOPNOTSUPP;
1969
1970         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1971 }
1972
1973 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
1974 {
1975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1976         struct net_device *dev = info->user_ptr[1];
1977         u16 noack_map;
1978
1979         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
1980                 return -EINVAL;
1981
1982         if (!rdev->ops->set_noack_map)
1983                 return -EOPNOTSUPP;
1984
1985         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
1986
1987         return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
1988 }
1989
1990 struct get_key_cookie {
1991         struct sk_buff *msg;
1992         int error;
1993         int idx;
1994 };
1995
1996 static void get_key_callback(void *c, struct key_params *params)
1997 {
1998         struct nlattr *key;
1999         struct get_key_cookie *cookie = c;
2000
2001         if ((params->key &&
2002              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2003                      params->key_len, params->key)) ||
2004             (params->seq &&
2005              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2006                      params->seq_len, params->seq)) ||
2007             (params->cipher &&
2008              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2009                          params->cipher)))
2010                 goto nla_put_failure;
2011
2012         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2013         if (!key)
2014                 goto nla_put_failure;
2015
2016         if ((params->key &&
2017              nla_put(cookie->msg, NL80211_KEY_DATA,
2018                      params->key_len, params->key)) ||
2019             (params->seq &&
2020              nla_put(cookie->msg, NL80211_KEY_SEQ,
2021                      params->seq_len, params->seq)) ||
2022             (params->cipher &&
2023              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2024                          params->cipher)))
2025                 goto nla_put_failure;
2026
2027         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2028                 goto nla_put_failure;
2029
2030         nla_nest_end(cookie->msg, key);
2031
2032         return;
2033  nla_put_failure:
2034         cookie->error = 1;
2035 }
2036
2037 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2038 {
2039         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2040         int err;
2041         struct net_device *dev = info->user_ptr[1];
2042         u8 key_idx = 0;
2043         const u8 *mac_addr = NULL;
2044         bool pairwise;
2045         struct get_key_cookie cookie = {
2046                 .error = 0,
2047         };
2048         void *hdr;
2049         struct sk_buff *msg;
2050
2051         if (info->attrs[NL80211_ATTR_KEY_IDX])
2052                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2053
2054         if (key_idx > 5)
2055                 return -EINVAL;
2056
2057         if (info->attrs[NL80211_ATTR_MAC])
2058                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2059
2060         pairwise = !!mac_addr;
2061         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2062                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2063                 if (kt >= NUM_NL80211_KEYTYPES)
2064                         return -EINVAL;
2065                 if (kt != NL80211_KEYTYPE_GROUP &&
2066                     kt != NL80211_KEYTYPE_PAIRWISE)
2067                         return -EINVAL;
2068                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2069         }
2070
2071         if (!rdev->ops->get_key)
2072                 return -EOPNOTSUPP;
2073
2074         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2075         if (!msg)
2076                 return -ENOMEM;
2077
2078         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2079                              NL80211_CMD_NEW_KEY);
2080         if (IS_ERR(hdr))
2081                 return PTR_ERR(hdr);
2082
2083         cookie.msg = msg;
2084         cookie.idx = key_idx;
2085
2086         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2087             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2088                 goto nla_put_failure;
2089         if (mac_addr &&
2090             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2091                 goto nla_put_failure;
2092
2093         if (pairwise && mac_addr &&
2094             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2095                 return -ENOENT;
2096
2097         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
2098                                  mac_addr, &cookie, get_key_callback);
2099
2100         if (err)
2101                 goto free_msg;
2102
2103         if (cookie.error)
2104                 goto nla_put_failure;
2105
2106         genlmsg_end(msg, hdr);
2107         return genlmsg_reply(msg, info);
2108
2109  nla_put_failure:
2110         err = -ENOBUFS;
2111  free_msg:
2112         nlmsg_free(msg);
2113         return err;
2114 }
2115
2116 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2117 {
2118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2119         struct key_parse key;
2120         int err;
2121         struct net_device *dev = info->user_ptr[1];
2122
2123         err = nl80211_parse_key(info, &key);
2124         if (err)
2125                 return err;
2126
2127         if (key.idx < 0)
2128                 return -EINVAL;
2129
2130         /* only support setting default key */
2131         if (!key.def && !key.defmgmt)
2132                 return -EINVAL;
2133
2134         wdev_lock(dev->ieee80211_ptr);
2135
2136         if (key.def) {
2137                 if (!rdev->ops->set_default_key) {
2138                         err = -EOPNOTSUPP;
2139                         goto out;
2140                 }
2141
2142                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2143                 if (err)
2144                         goto out;
2145
2146                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
2147                                                  key.def_uni, key.def_multi);
2148
2149                 if (err)
2150                         goto out;
2151
2152 #ifdef CONFIG_CFG80211_WEXT
2153                 dev->ieee80211_ptr->wext.default_key = key.idx;
2154 #endif
2155         } else {
2156                 if (key.def_uni || !key.def_multi) {
2157                         err = -EINVAL;
2158                         goto out;
2159                 }
2160
2161                 if (!rdev->ops->set_default_mgmt_key) {
2162                         err = -EOPNOTSUPP;
2163                         goto out;
2164                 }
2165
2166                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2167                 if (err)
2168                         goto out;
2169
2170                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
2171                                                       dev, key.idx);
2172                 if (err)
2173                         goto out;
2174
2175 #ifdef CONFIG_CFG80211_WEXT
2176                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2177 #endif
2178         }
2179
2180  out:
2181         wdev_unlock(dev->ieee80211_ptr);
2182
2183         return err;
2184 }
2185
2186 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2187 {
2188         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2189         int err;
2190         struct net_device *dev = info->user_ptr[1];
2191         struct key_parse key;
2192         const u8 *mac_addr = NULL;
2193
2194         err = nl80211_parse_key(info, &key);
2195         if (err)
2196                 return err;
2197
2198         if (!key.p.key)
2199                 return -EINVAL;
2200
2201         if (info->attrs[NL80211_ATTR_MAC])
2202                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2203
2204         if (key.type == -1) {
2205                 if (mac_addr)
2206                         key.type = NL80211_KEYTYPE_PAIRWISE;
2207                 else
2208                         key.type = NL80211_KEYTYPE_GROUP;
2209         }
2210
2211         /* for now */
2212         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2213             key.type != NL80211_KEYTYPE_GROUP)
2214                 return -EINVAL;
2215
2216         if (!rdev->ops->add_key)
2217                 return -EOPNOTSUPP;
2218
2219         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2220                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2221                                            mac_addr))
2222                 return -EINVAL;
2223
2224         wdev_lock(dev->ieee80211_ptr);
2225         err = nl80211_key_allowed(dev->ieee80211_ptr);
2226         if (!err)
2227                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2228                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2229                                          mac_addr, &key.p);
2230         wdev_unlock(dev->ieee80211_ptr);
2231
2232         return err;
2233 }
2234
2235 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2236 {
2237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2238         int err;
2239         struct net_device *dev = info->user_ptr[1];
2240         u8 *mac_addr = NULL;
2241         struct key_parse key;
2242
2243         err = nl80211_parse_key(info, &key);
2244         if (err)
2245                 return err;
2246
2247         if (info->attrs[NL80211_ATTR_MAC])
2248                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2249
2250         if (key.type == -1) {
2251                 if (mac_addr)
2252                         key.type = NL80211_KEYTYPE_PAIRWISE;
2253                 else
2254                         key.type = NL80211_KEYTYPE_GROUP;
2255         }
2256
2257         /* for now */
2258         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2259             key.type != NL80211_KEYTYPE_GROUP)
2260                 return -EINVAL;
2261
2262         if (!rdev->ops->del_key)
2263                 return -EOPNOTSUPP;
2264
2265         wdev_lock(dev->ieee80211_ptr);
2266         err = nl80211_key_allowed(dev->ieee80211_ptr);
2267
2268         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2269             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2270                 err = -ENOENT;
2271
2272         if (!err)
2273                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2274                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2275                                          mac_addr);
2276
2277 #ifdef CONFIG_CFG80211_WEXT
2278         if (!err) {
2279                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2280                         dev->ieee80211_ptr->wext.default_key = -1;
2281                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2282                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2283         }
2284 #endif
2285         wdev_unlock(dev->ieee80211_ptr);
2286
2287         return err;
2288 }
2289
2290 static int nl80211_parse_beacon(struct genl_info *info,
2291                                 struct cfg80211_beacon_data *bcn)
2292 {
2293         bool haveinfo = false;
2294
2295         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2296             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2297             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2298             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2299                 return -EINVAL;
2300
2301         memset(bcn, 0, sizeof(*bcn));
2302
2303         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2304                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2305                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2306                 if (!bcn->head_len)
2307                         return -EINVAL;
2308                 haveinfo = true;
2309         }
2310
2311         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2312                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2313                 bcn->tail_len =
2314                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2315                 haveinfo = true;
2316         }
2317
2318         if (!haveinfo)
2319                 return -EINVAL;
2320
2321         if (info->attrs[NL80211_ATTR_IE]) {
2322                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2323                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2324         }
2325
2326         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2327                 bcn->proberesp_ies =
2328                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2329                 bcn->proberesp_ies_len =
2330                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2331         }
2332
2333         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2334                 bcn->assocresp_ies =
2335                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2336                 bcn->assocresp_ies_len =
2337                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2338         }
2339
2340         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2341                 bcn->probe_resp =
2342                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2343                 bcn->probe_resp_len =
2344                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2345         }
2346
2347         return 0;
2348 }
2349
2350 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2351                                    struct cfg80211_ap_settings *params)
2352 {
2353         struct wireless_dev *wdev;
2354         bool ret = false;
2355
2356         mutex_lock(&rdev->devlist_mtx);
2357
2358         list_for_each_entry(wdev, &rdev->netdev_list, list) {
2359                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2360                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2361                         continue;
2362
2363                 if (!wdev->preset_chan)
2364                         continue;
2365
2366                 params->channel = wdev->preset_chan;
2367                 params->channel_type = wdev->preset_chantype;
2368                 ret = true;
2369                 break;
2370         }
2371
2372         mutex_unlock(&rdev->devlist_mtx);
2373
2374         return ret;
2375 }
2376
2377 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2378 {
2379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2380         struct net_device *dev = info->user_ptr[1];
2381         struct wireless_dev *wdev = dev->ieee80211_ptr;
2382         struct cfg80211_ap_settings params;
2383         int err;
2384
2385         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2386             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2387                 return -EOPNOTSUPP;
2388
2389         if (!rdev->ops->start_ap)
2390                 return -EOPNOTSUPP;
2391
2392         if (wdev->beacon_interval)
2393                 return -EALREADY;
2394
2395         memset(&params, 0, sizeof(params));
2396
2397         /* these are required for START_AP */
2398         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2399             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2400             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2401                 return -EINVAL;
2402
2403         err = nl80211_parse_beacon(info, &params.beacon);
2404         if (err)
2405                 return err;
2406
2407         params.beacon_interval =
2408                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2409         params.dtim_period =
2410                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2411
2412         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2413         if (err)
2414                 return err;
2415
2416         /*
2417          * In theory, some of these attributes should be required here
2418          * but since they were not used when the command was originally
2419          * added, keep them optional for old user space programs to let
2420          * them continue to work with drivers that do not need the
2421          * additional information -- drivers must check!
2422          */
2423         if (info->attrs[NL80211_ATTR_SSID]) {
2424                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2425                 params.ssid_len =
2426                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2427                 if (params.ssid_len == 0 ||
2428                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2429                         return -EINVAL;
2430         }
2431
2432         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2433                 params.hidden_ssid = nla_get_u32(
2434                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2435                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2436                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2437                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2438                         return -EINVAL;
2439         }
2440
2441         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2442
2443         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2444                 params.auth_type = nla_get_u32(
2445                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2446                 if (!nl80211_valid_auth_type(params.auth_type))
2447                         return -EINVAL;
2448         } else
2449                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2450
2451         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2452                                       NL80211_MAX_NR_CIPHER_SUITES);
2453         if (err)
2454                 return err;
2455
2456         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2457                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2458                         return -EOPNOTSUPP;
2459                 params.inactivity_timeout = nla_get_u16(
2460                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2461         }
2462
2463         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2464                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2465
2466                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2467                     !nl80211_valid_channel_type(info, &channel_type))
2468                         return -EINVAL;
2469
2470                 params.channel = rdev_freq_to_chan(rdev,
2471                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2472                         channel_type);
2473                 if (!params.channel)
2474                         return -EINVAL;
2475                 params.channel_type = channel_type;
2476         } else if (wdev->preset_chan) {
2477                 params.channel = wdev->preset_chan;
2478                 params.channel_type = wdev->preset_chantype;
2479         } else if (!nl80211_get_ap_channel(rdev, &params))
2480                 return -EINVAL;
2481
2482         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2483                                           params.channel_type))
2484                 return -EINVAL;
2485
2486         err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
2487         if (!err) {
2488                 wdev->preset_chan = params.channel;
2489                 wdev->preset_chantype = params.channel_type;
2490                 wdev->beacon_interval = params.beacon_interval;
2491                 wdev->channel = params.channel;
2492         }
2493         return err;
2494 }
2495
2496 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2497 {
2498         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2499         struct net_device *dev = info->user_ptr[1];
2500         struct wireless_dev *wdev = dev->ieee80211_ptr;
2501         struct cfg80211_beacon_data params;
2502         int err;
2503
2504         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2505             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2506                 return -EOPNOTSUPP;
2507
2508         if (!rdev->ops->change_beacon)
2509                 return -EOPNOTSUPP;
2510
2511         if (!wdev->beacon_interval)
2512                 return -EINVAL;
2513
2514         err = nl80211_parse_beacon(info, &params);
2515         if (err)
2516                 return err;
2517
2518         return rdev->ops->change_beacon(&rdev->wiphy, dev, &params);
2519 }
2520
2521 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2522 {
2523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2524         struct net_device *dev = info->user_ptr[1];
2525
2526         return cfg80211_stop_ap(rdev, dev);
2527 }
2528
2529 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2530         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2531         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2532         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2533         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2534         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2535         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2536 };
2537
2538 static int parse_station_flags(struct genl_info *info,
2539                                enum nl80211_iftype iftype,
2540                                struct station_parameters *params)
2541 {
2542         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2543         struct nlattr *nla;
2544         int flag;
2545
2546         /*
2547          * Try parsing the new attribute first so userspace
2548          * can specify both for older kernels.
2549          */
2550         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2551         if (nla) {
2552                 struct nl80211_sta_flag_update *sta_flags;
2553
2554                 sta_flags = nla_data(nla);
2555                 params->sta_flags_mask = sta_flags->mask;
2556                 params->sta_flags_set = sta_flags->set;
2557                 if ((params->sta_flags_mask |
2558                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2559                         return -EINVAL;
2560                 return 0;
2561         }
2562
2563         /* if present, parse the old attribute */
2564
2565         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2566         if (!nla)
2567                 return 0;
2568
2569         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2570                              nla, sta_flags_policy))
2571                 return -EINVAL;
2572
2573         /*
2574          * Only allow certain flags for interface types so that
2575          * other attributes are silently ignored. Remember that
2576          * this is backward compatibility code with old userspace
2577          * and shouldn't be hit in other cases anyway.
2578          */
2579         switch (iftype) {
2580         case NL80211_IFTYPE_AP:
2581         case NL80211_IFTYPE_AP_VLAN:
2582         case NL80211_IFTYPE_P2P_GO:
2583                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2584                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2585                                          BIT(NL80211_STA_FLAG_WME) |
2586                                          BIT(NL80211_STA_FLAG_MFP);
2587                 break;
2588         case NL80211_IFTYPE_P2P_CLIENT:
2589         case NL80211_IFTYPE_STATION:
2590                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2591                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2592                 break;
2593         case NL80211_IFTYPE_MESH_POINT:
2594                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2595                                          BIT(NL80211_STA_FLAG_MFP) |
2596                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2597         default:
2598                 return -EINVAL;
2599         }
2600
2601         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2602                 if (flags[flag]) {
2603                         params->sta_flags_set |= (1<<flag);
2604
2605                         /* no longer support new API additions in old API */
2606                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2607                                 return -EINVAL;
2608                 }
2609         }
2610
2611         return 0;
2612 }
2613
2614 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2615                                  int attr)
2616 {
2617         struct nlattr *rate;
2618         u16 bitrate;
2619
2620         rate = nla_nest_start(msg, attr);
2621         if (!rate)
2622                 goto nla_put_failure;
2623
2624         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2625         bitrate = cfg80211_calculate_bitrate(info);
2626         if ((bitrate > 0 &&
2627              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate)) ||
2628             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2629              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2630             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2631              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2632             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2633              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2634                 goto nla_put_failure;
2635
2636         nla_nest_end(msg, rate);
2637         return true;
2638
2639 nla_put_failure:
2640         return false;
2641 }
2642
2643 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2644                                 int flags,
2645                                 struct cfg80211_registered_device *rdev,
2646                                 struct net_device *dev,
2647                                 const u8 *mac_addr, struct station_info *sinfo)
2648 {
2649         void *hdr;
2650         struct nlattr *sinfoattr, *bss_param;
2651
2652         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2653         if (!hdr)
2654                 return -1;
2655
2656         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2657             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2658             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2659                 goto nla_put_failure;
2660
2661         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2662         if (!sinfoattr)
2663                 goto nla_put_failure;
2664         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2665             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2666                         sinfo->connected_time))
2667                 goto nla_put_failure;
2668         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2669             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2670                         sinfo->inactive_time))
2671                 goto nla_put_failure;
2672         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2673             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2674                         sinfo->rx_bytes))
2675                 goto nla_put_failure;
2676         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2677             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2678                         sinfo->tx_bytes))
2679                 goto nla_put_failure;
2680         if ((sinfo->filled & STATION_INFO_LLID) &&
2681             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2682                 goto nla_put_failure;
2683         if ((sinfo->filled & STATION_INFO_PLID) &&
2684             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2685                 goto nla_put_failure;
2686         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2687             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2688                        sinfo->plink_state))
2689                 goto nla_put_failure;
2690         switch (rdev->wiphy.signal_type) {
2691         case CFG80211_SIGNAL_TYPE_MBM:
2692                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2693                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2694                                sinfo->signal))
2695                         goto nla_put_failure;
2696                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2697                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2698                                sinfo->signal_avg))
2699                         goto nla_put_failure;
2700                 break;
2701         default:
2702                 break;
2703         }
2704         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2705                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2706                                           NL80211_STA_INFO_TX_BITRATE))
2707                         goto nla_put_failure;
2708         }
2709         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2710                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2711                                           NL80211_STA_INFO_RX_BITRATE))
2712                         goto nla_put_failure;
2713         }
2714         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2715             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2716                         sinfo->rx_packets))
2717                 goto nla_put_failure;
2718         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2719             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2720                         sinfo->tx_packets))
2721                 goto nla_put_failure;
2722         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2723             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2724                         sinfo->tx_retries))
2725                 goto nla_put_failure;
2726         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2727             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2728                         sinfo->tx_failed))
2729                 goto nla_put_failure;
2730         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2731             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2732                         sinfo->beacon_loss_count))
2733                 goto nla_put_failure;
2734         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2735                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2736                 if (!bss_param)
2737                         goto nla_put_failure;
2738
2739                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2740                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2741                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2742                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2743                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2744                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2745                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2746                                sinfo->bss_param.dtim_period) ||
2747                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2748                                 sinfo->bss_param.beacon_interval))
2749                         goto nla_put_failure;
2750
2751                 nla_nest_end(msg, bss_param);
2752         }
2753         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2754             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2755                     sizeof(struct nl80211_sta_flag_update),
2756                     &sinfo->sta_flags))
2757                 goto nla_put_failure;
2758         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2759                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2760                             sinfo->t_offset))
2761                 goto nla_put_failure;
2762         nla_nest_end(msg, sinfoattr);
2763
2764         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2765             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2766                     sinfo->assoc_req_ies))
2767                 goto nla_put_failure;
2768
2769         return genlmsg_end(msg, hdr);
2770
2771  nla_put_failure:
2772         genlmsg_cancel(msg, hdr);
2773         return -EMSGSIZE;
2774 }
2775
2776 static int nl80211_dump_station(struct sk_buff *skb,
2777                                 struct netlink_callback *cb)
2778 {
2779         struct station_info sinfo;
2780         struct cfg80211_registered_device *dev;
2781         struct net_device *netdev;
2782         u8 mac_addr[ETH_ALEN];
2783         int sta_idx = cb->args[1];
2784         int err;
2785
2786         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2787         if (err)
2788                 return err;
2789
2790         if (!dev->ops->dump_station) {
2791                 err = -EOPNOTSUPP;
2792                 goto out_err;
2793         }
2794
2795         while (1) {
2796                 memset(&sinfo, 0, sizeof(sinfo));
2797                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2798                                              mac_addr, &sinfo);
2799                 if (err == -ENOENT)
2800                         break;
2801                 if (err)
2802                         goto out_err;
2803
2804                 if (nl80211_send_station(skb,
2805                                 NETLINK_CB(cb->skb).pid,
2806                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2807                                 dev, netdev, mac_addr,
2808                                 &sinfo) < 0)
2809                         goto out;
2810
2811                 sta_idx++;
2812         }
2813
2814
2815  out:
2816         cb->args[1] = sta_idx;
2817         err = skb->len;
2818  out_err:
2819         nl80211_finish_netdev_dump(dev);
2820
2821         return err;
2822 }
2823
2824 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2825 {
2826         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2827         struct net_device *dev = info->user_ptr[1];
2828         struct station_info sinfo;
2829         struct sk_buff *msg;
2830         u8 *mac_addr = NULL;
2831         int err;
2832
2833         memset(&sinfo, 0, sizeof(sinfo));
2834
2835         if (!info->attrs[NL80211_ATTR_MAC])
2836                 return -EINVAL;
2837
2838         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2839
2840         if (!rdev->ops->get_station)
2841                 return -EOPNOTSUPP;
2842
2843         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2844         if (err)
2845                 return err;
2846
2847         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2848         if (!msg)
2849                 return -ENOMEM;
2850
2851         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2852                                  rdev, dev, mac_addr, &sinfo) < 0) {
2853                 nlmsg_free(msg);
2854                 return -ENOBUFS;
2855         }
2856
2857         return genlmsg_reply(msg, info);
2858 }
2859
2860 /*
2861  * Get vlan interface making sure it is running and on the right wiphy.
2862  */
2863 static struct net_device *get_vlan(struct genl_info *info,
2864                                    struct cfg80211_registered_device *rdev)
2865 {
2866         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2867         struct net_device *v;
2868         int ret;
2869
2870         if (!vlanattr)
2871                 return NULL;
2872
2873         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
2874         if (!v)
2875                 return ERR_PTR(-ENODEV);
2876
2877         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
2878                 ret = -EINVAL;
2879                 goto error;
2880         }
2881
2882         if (!netif_running(v)) {
2883                 ret = -ENETDOWN;
2884                 goto error;
2885         }
2886
2887         return v;
2888  error:
2889         dev_put(v);
2890         return ERR_PTR(ret);
2891 }
2892
2893 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2894 {
2895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2896         int err;
2897         struct net_device *dev = info->user_ptr[1];
2898         struct station_parameters params;
2899         u8 *mac_addr = NULL;
2900
2901         memset(&params, 0, sizeof(params));
2902
2903         params.listen_interval = -1;
2904         params.plink_state = -1;
2905
2906         if (info->attrs[NL80211_ATTR_STA_AID])
2907                 return -EINVAL;
2908
2909         if (!info->attrs[NL80211_ATTR_MAC])
2910                 return -EINVAL;
2911
2912         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2913
2914         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2915                 params.supported_rates =
2916                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2917                 params.supported_rates_len =
2918                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2919         }
2920
2921         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2922                 params.listen_interval =
2923                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2924
2925         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2926                 params.ht_capa =
2927                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2928
2929         if (!rdev->ops->change_station)
2930                 return -EOPNOTSUPP;
2931
2932         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
2933                 return -EINVAL;
2934
2935         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2936                 params.plink_action =
2937                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2938
2939         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
2940                 params.plink_state =
2941                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
2942
2943         switch (dev->ieee80211_ptr->iftype) {
2944         case NL80211_IFTYPE_AP:
2945         case NL80211_IFTYPE_AP_VLAN:
2946         case NL80211_IFTYPE_P2P_GO:
2947                 /* disallow mesh-specific things */
2948                 if (params.plink_action)
2949                         return -EINVAL;
2950
2951                 /* TDLS can't be set, ... */
2952                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
2953                         return -EINVAL;
2954                 /*
2955                  * ... but don't bother the driver with it. This works around
2956                  * a hostapd/wpa_supplicant issue -- it always includes the
2957                  * TLDS_PEER flag in the mask even for AP mode.
2958                  */
2959                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2960
2961                 /* accept only the listed bits */
2962                 if (params.sta_flags_mask &
2963                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
2964                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2965                                   BIT(NL80211_STA_FLAG_WME) |
2966                                   BIT(NL80211_STA_FLAG_MFP)))
2967                         return -EINVAL;
2968
2969                 /* must be last in here for error handling */
2970                 params.vlan = get_vlan(info, rdev);
2971                 if (IS_ERR(params.vlan))
2972                         return PTR_ERR(params.vlan);
2973                 break;
2974         case NL80211_IFTYPE_P2P_CLIENT:
2975         case NL80211_IFTYPE_STATION:
2976                 /*
2977                  * Don't allow userspace to change the TDLS_PEER flag,
2978                  * but silently ignore attempts to change it since we
2979                  * don't have state here to verify that it doesn't try
2980                  * to change the flag.
2981                  */
2982                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2983                 /* fall through */
2984         case NL80211_IFTYPE_ADHOC:
2985                 /* disallow things sta doesn't support */
2986                 if (params.plink_action)
2987                         return -EINVAL;
2988                 if (params.ht_capa)
2989                         return -EINVAL;
2990                 if (params.listen_interval >= 0)
2991                         return -EINVAL;
2992                 /* reject any changes other than AUTHORIZED */
2993                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2994                         return -EINVAL;
2995                 break;
2996         case NL80211_IFTYPE_MESH_POINT:
2997                 /* disallow things mesh doesn't support */
2998                 if (params.vlan)
2999                         return -EINVAL;
3000                 if (params.ht_capa)
3001                         return -EINVAL;
3002                 if (params.listen_interval >= 0)
3003                         return -EINVAL;
3004                 /*
3005                  * No special handling for TDLS here -- the userspace
3006                  * mesh code doesn't have this bug.
3007                  */
3008                 if (params.sta_flags_mask &
3009                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3010                                   BIT(NL80211_STA_FLAG_MFP) |
3011                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3012                         return -EINVAL;
3013                 break;
3014         default:
3015                 return -EOPNOTSUPP;
3016         }
3017
3018         /* be aware of params.vlan when changing code here */
3019
3020         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
3021
3022         if (params.vlan)
3023                 dev_put(params.vlan);
3024
3025         return err;
3026 }
3027
3028 static struct nla_policy
3029 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3030         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3031         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3032 };
3033
3034 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3035 {
3036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3037         int err;
3038         struct net_device *dev = info->user_ptr[1];
3039         struct station_parameters params;
3040         u8 *mac_addr = NULL;
3041
3042         memset(&params, 0, sizeof(params));
3043
3044         if (!info->attrs[NL80211_ATTR_MAC])
3045                 return -EINVAL;
3046
3047         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3048                 return -EINVAL;
3049
3050         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3051                 return -EINVAL;
3052
3053         if (!info->attrs[NL80211_ATTR_STA_AID])
3054                 return -EINVAL;
3055
3056         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3057         params.supported_rates =
3058                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3059         params.supported_rates_len =
3060                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3061         params.listen_interval =
3062                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3063
3064         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3065         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3066                 return -EINVAL;
3067
3068         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3069                 params.ht_capa =
3070                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3071
3072         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3073                 params.plink_action =
3074                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3075
3076         if (!rdev->ops->add_station)
3077                 return -EOPNOTSUPP;
3078
3079         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3080                 return -EINVAL;
3081
3082         switch (dev->ieee80211_ptr->iftype) {
3083         case NL80211_IFTYPE_AP:
3084         case NL80211_IFTYPE_AP_VLAN:
3085         case NL80211_IFTYPE_P2P_GO:
3086                 /* parse WME attributes if sta is WME capable */
3087                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3088                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3089                     info->attrs[NL80211_ATTR_STA_WME]) {
3090                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3091                         struct nlattr *nla;
3092
3093                         nla = info->attrs[NL80211_ATTR_STA_WME];
3094                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3095                                                nl80211_sta_wme_policy);
3096                         if (err)
3097                                 return err;
3098
3099                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3100                                 params.uapsd_queues =
3101                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3102                         if (params.uapsd_queues &
3103                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3104                                 return -EINVAL;
3105
3106                         if (tb[NL80211_STA_WME_MAX_SP])
3107                                 params.max_sp =
3108                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3109
3110                         if (params.max_sp &
3111                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3112                                 return -EINVAL;
3113
3114                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3115                 }
3116                 /* TDLS peers cannot be added */
3117                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3118                         return -EINVAL;
3119                 /* but don't bother the driver with it */
3120                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3121
3122                 /* must be last in here for error handling */
3123                 params.vlan = get_vlan(info, rdev);
3124                 if (IS_ERR(params.vlan))
3125                         return PTR_ERR(params.vlan);
3126                 break;
3127         case NL80211_IFTYPE_MESH_POINT:
3128                 /* TDLS peers cannot be added */
3129                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3130                         return -EINVAL;
3131                 break;
3132         case NL80211_IFTYPE_STATION:
3133                 /* Only TDLS peers can be added */
3134                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3135                         return -EINVAL;
3136                 /* Can only add if TDLS ... */
3137                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3138                         return -EOPNOTSUPP;
3139                 /* ... with external setup is supported */
3140                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3141                         return -EOPNOTSUPP;
3142                 break;
3143         default:
3144                 return -EOPNOTSUPP;
3145         }
3146
3147         /* be aware of params.vlan when changing code here */
3148
3149         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
3150
3151         if (params.vlan)
3152                 dev_put(params.vlan);
3153         return err;
3154 }
3155
3156 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3157 {
3158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3159         struct net_device *dev = info->user_ptr[1];
3160         u8 *mac_addr = NULL;
3161
3162         if (info->attrs[NL80211_ATTR_MAC])
3163                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3164
3165         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3166             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3167             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3168             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3169                 return -EINVAL;
3170
3171         if (!rdev->ops->del_station)
3172                 return -EOPNOTSUPP;
3173
3174         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
3175 }
3176
3177 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
3178                                 int flags, struct net_device *dev,
3179                                 u8 *dst, u8 *next_hop,
3180                                 struct mpath_info *pinfo)
3181 {
3182         void *hdr;
3183         struct nlattr *pinfoattr;
3184
3185         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
3186         if (!hdr)
3187                 return -1;
3188
3189         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3190             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3191             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3192             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3193                 goto nla_put_failure;
3194
3195         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3196         if (!pinfoattr)
3197                 goto nla_put_failure;
3198         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3199             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3200                         pinfo->frame_qlen))
3201                 goto nla_put_failure;
3202         if (((pinfo->filled & MPATH_INFO_SN) &&
3203              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3204             ((pinfo->filled & MPATH_INFO_METRIC) &&
3205              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3206                          pinfo->metric)) ||
3207             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3208              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3209                          pinfo->exptime)) ||
3210             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3211              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3212                         pinfo->flags)) ||
3213             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3214              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3215                          pinfo->discovery_timeout)) ||
3216             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3217              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3218                         pinfo->discovery_retries)))
3219                 goto nla_put_failure;
3220
3221         nla_nest_end(msg, pinfoattr);
3222
3223         return genlmsg_end(msg, hdr);
3224
3225  nla_put_failure:
3226         genlmsg_cancel(msg, hdr);
3227         return -EMSGSIZE;
3228 }
3229
3230 static int nl80211_dump_mpath(struct sk_buff *skb,
3231                               struct netlink_callback *cb)
3232 {
3233         struct mpath_info pinfo;
3234         struct cfg80211_registered_device *dev;
3235         struct net_device *netdev;
3236         u8 dst[ETH_ALEN];
3237         u8 next_hop[ETH_ALEN];
3238         int path_idx = cb->args[1];
3239         int err;
3240
3241         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3242         if (err)
3243                 return err;
3244
3245         if (!dev->ops->dump_mpath) {
3246                 err = -EOPNOTSUPP;
3247                 goto out_err;
3248         }
3249
3250         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3251                 err = -EOPNOTSUPP;
3252                 goto out_err;
3253         }
3254
3255         while (1) {
3256                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
3257                                            dst, next_hop, &pinfo);
3258                 if (err == -ENOENT)
3259                         break;
3260                 if (err)
3261                         goto out_err;
3262
3263                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
3264                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3265                                        netdev, dst, next_hop,
3266                                        &pinfo) < 0)
3267                         goto out;
3268
3269                 path_idx++;
3270         }
3271
3272
3273  out:
3274         cb->args[1] = path_idx;
3275         err = skb->len;
3276  out_err:
3277         nl80211_finish_netdev_dump(dev);
3278         return err;
3279 }
3280
3281 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3282 {
3283         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3284         int err;
3285         struct net_device *dev = info->user_ptr[1];
3286         struct mpath_info pinfo;
3287         struct sk_buff *msg;
3288         u8 *dst = NULL;
3289         u8 next_hop[ETH_ALEN];
3290
3291         memset(&pinfo, 0, sizeof(pinfo));
3292
3293         if (!info->attrs[NL80211_ATTR_MAC])
3294                 return -EINVAL;
3295
3296         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3297
3298         if (!rdev->ops->get_mpath)
3299                 return -EOPNOTSUPP;
3300
3301         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3302                 return -EOPNOTSUPP;
3303
3304         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
3305         if (err)
3306                 return err;
3307
3308         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3309         if (!msg)
3310                 return -ENOMEM;
3311
3312         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
3313                                  dev, dst, next_hop, &pinfo) < 0) {
3314                 nlmsg_free(msg);
3315                 return -ENOBUFS;
3316         }
3317
3318         return genlmsg_reply(msg, info);
3319 }
3320
3321 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3322 {
3323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3324         struct net_device *dev = info->user_ptr[1];
3325         u8 *dst = NULL;
3326         u8 *next_hop = NULL;
3327
3328         if (!info->attrs[NL80211_ATTR_MAC])
3329                 return -EINVAL;
3330
3331         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3332                 return -EINVAL;
3333
3334         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3335         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3336
3337         if (!rdev->ops->change_mpath)
3338                 return -EOPNOTSUPP;
3339
3340         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3341                 return -EOPNOTSUPP;
3342
3343         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
3344 }
3345
3346 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3347 {
3348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3349         struct net_device *dev = info->user_ptr[1];
3350         u8 *dst = NULL;
3351         u8 *next_hop = NULL;
3352
3353         if (!info->attrs[NL80211_ATTR_MAC])
3354                 return -EINVAL;
3355
3356         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3357                 return -EINVAL;
3358
3359         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3360         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3361
3362         if (!rdev->ops->add_mpath)
3363                 return -EOPNOTSUPP;
3364
3365         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3366                 return -EOPNOTSUPP;
3367
3368         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3369 }
3370
3371 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3372 {
3373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3374         struct net_device *dev = info->user_ptr[1];
3375         u8 *dst = NULL;
3376
3377         if (info->attrs[NL80211_ATTR_MAC])
3378                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3379
3380         if (!rdev->ops->del_mpath)
3381                 return -EOPNOTSUPP;
3382
3383         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3384 }
3385
3386 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3387 {
3388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3389         struct net_device *dev = info->user_ptr[1];
3390         struct bss_parameters params;
3391
3392         memset(&params, 0, sizeof(params));
3393         /* default to not changing parameters */
3394         params.use_cts_prot = -1;
3395         params.use_short_preamble = -1;
3396         params.use_short_slot_time = -1;
3397         params.ap_isolate = -1;
3398         params.ht_opmode = -1;
3399
3400         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3401                 params.use_cts_prot =
3402                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3403         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3404                 params.use_short_preamble =
3405                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3406         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3407                 params.use_short_slot_time =
3408                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3409         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3410                 params.basic_rates =
3411                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3412                 params.basic_rates_len =
3413                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3414         }
3415         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3416                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3417         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3418                 params.ht_opmode =
3419                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3420
3421         if (!rdev->ops->change_bss)
3422                 return -EOPNOTSUPP;
3423
3424         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3425             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3426                 return -EOPNOTSUPP;
3427
3428         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3429 }
3430
3431 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3432         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3433         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3434         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3435         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3436         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3437         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3438 };
3439
3440 static int parse_reg_rule(struct nlattr *tb[],
3441         struct ieee80211_reg_rule *reg_rule)
3442 {
3443         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3444         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3445
3446         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3447                 return -EINVAL;
3448         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3449                 return -EINVAL;
3450         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3451                 return -EINVAL;
3452         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3453                 return -EINVAL;
3454         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3455                 return -EINVAL;
3456
3457         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3458
3459         freq_range->start_freq_khz =
3460                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3461         freq_range->end_freq_khz =
3462                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3463         freq_range->max_bandwidth_khz =
3464                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3465
3466         power_rule->max_eirp =
3467                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3468
3469         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3470                 power_rule->max_antenna_gain =
3471                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3472
3473         return 0;
3474 }
3475
3476 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3477 {
3478         int r;
3479         char *data = NULL;
3480
3481         /*
3482          * You should only get this when cfg80211 hasn't yet initialized
3483          * completely when built-in to the kernel right between the time
3484          * window between nl80211_init() and regulatory_init(), if that is
3485          * even possible.
3486          */
3487         mutex_lock(&cfg80211_mutex);
3488         if (unlikely(!cfg80211_regdomain)) {
3489                 mutex_unlock(&cfg80211_mutex);
3490                 return -EINPROGRESS;
3491         }
3492         mutex_unlock(&cfg80211_mutex);
3493
3494         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3495                 return -EINVAL;
3496
3497         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3498
3499         r = regulatory_hint_user(data);
3500
3501         return r;
3502 }
3503
3504 static int nl80211_get_mesh_config(struct sk_buff *skb,
3505                                    struct genl_info *info)
3506 {
3507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3508         struct net_device *dev = info->user_ptr[1];
3509         struct wireless_dev *wdev = dev->ieee80211_ptr;
3510         struct mesh_config cur_params;
3511         int err = 0;
3512         void *hdr;
3513         struct nlattr *pinfoattr;
3514         struct sk_buff *msg;
3515
3516         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3517                 return -EOPNOTSUPP;
3518
3519         if (!rdev->ops->get_mesh_config)
3520                 return -EOPNOTSUPP;
3521
3522         wdev_lock(wdev);
3523         /* If not connected, get default parameters */
3524         if (!wdev->mesh_id_len)
3525                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3526         else
3527                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3528                                                  &cur_params);
3529         wdev_unlock(wdev);
3530
3531         if (err)
3532                 return err;
3533
3534         /* Draw up a netlink message to send back */
3535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3536         if (!msg)
3537                 return -ENOMEM;
3538         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3539                              NL80211_CMD_GET_MESH_CONFIG);
3540         if (!hdr)
3541                 goto out;
3542         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3543         if (!pinfoattr)
3544                 goto nla_put_failure;
3545         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3546             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3547                         cur_params.dot11MeshRetryTimeout) ||
3548             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3549                         cur_params.dot11MeshConfirmTimeout) ||
3550             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3551                         cur_params.dot11MeshHoldingTimeout) ||
3552             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3553                         cur_params.dot11MeshMaxPeerLinks) ||
3554             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3555                        cur_params.dot11MeshMaxRetries) ||
3556             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3557                        cur_params.dot11MeshTTL) ||
3558             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3559                        cur_params.element_ttl) ||
3560             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3561                        cur_params.auto_open_plinks) ||
3562             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3563                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3564             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3565                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3566             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3567                         cur_params.path_refresh_time) ||
3568             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3569                         cur_params.min_discovery_timeout) ||
3570             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3571                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3572             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3573                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3574             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3575                         cur_params.dot11MeshHWMPperrMinInterval) ||
3576             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3577                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3578             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3579                        cur_params.dot11MeshHWMPRootMode) ||
3580             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3581                         cur_params.dot11MeshHWMPRannInterval) ||
3582             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3583                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3584             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3585                        cur_params.dot11MeshForwarding) ||
3586             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3587                         cur_params.rssi_threshold) ||
3588             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3589                         cur_params.ht_opmode) ||
3590             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3591                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3592             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3593                         cur_params.dot11MeshHWMProotInterval) ||
3594             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3595                         cur_params.dot11MeshHWMPconfirmationInterval))
3596                 goto nla_put_failure;
3597         nla_nest_end(msg, pinfoattr);
3598         genlmsg_end(msg, hdr);
3599         return genlmsg_reply(msg, info);
3600
3601  nla_put_failure:
3602         genlmsg_cancel(msg, hdr);
3603  out:
3604         nlmsg_free(msg);
3605         return -ENOBUFS;
3606 }
3607
3608 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3609         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3610         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3611         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3612         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3613         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3614         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3615         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3616         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3617         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3618         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3619         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3620         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3621         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3622         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3623         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3624         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3625         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3626         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3627         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3628         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3629         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3630         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3631         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3632         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3633         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3634 };
3635
3636 static const struct nla_policy
3637         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3638         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3639         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3640         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3641         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3642         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3643                                     .len = IEEE80211_MAX_DATA_LEN },
3644         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3645 };
3646
3647 static int nl80211_parse_mesh_config(struct genl_info *info,
3648                                      struct mesh_config *cfg,
3649                                      u32 *mask_out)
3650 {
3651         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3652         u32 mask = 0;
3653
3654 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3655 do {\
3656         if (table[attr_num]) {\
3657                 cfg->param = nla_fn(table[attr_num]); \
3658                 mask |= (1 << (attr_num - 1)); \
3659         } \
3660 } while (0);\
3661
3662
3663         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3664                 return -EINVAL;
3665         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3666                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3667                              nl80211_meshconf_params_policy))
3668                 return -EINVAL;
3669
3670         /* This makes sure that there aren't more than 32 mesh config
3671          * parameters (otherwise our bitfield scheme would not work.) */
3672         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3673
3674         /* Fill in the params struct */
3675         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3676                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3677                                   nla_get_u16);
3678         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3679                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3680                                   nla_get_u16);
3681         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3682                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3683                                   nla_get_u16);
3684         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3685                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3686                                   nla_get_u16);
3687         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3688                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3689                                   nla_get_u8);
3690         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3691                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3692         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3693                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3694                                   nla_get_u8);
3695         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3696                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3697                                   nla_get_u8);
3698         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3699                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3700                                   nla_get_u32);
3701         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3702                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3703                                   nla_get_u8);
3704         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3705                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3706                                   nla_get_u32);
3707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3708                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3709                                   nla_get_u16);
3710         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3711                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3712                                   nla_get_u32);
3713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3714                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3715                                   nla_get_u16);
3716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3717                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3718                                   nla_get_u16);
3719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3720                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3721                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3722                                   nla_get_u16);
3723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3724                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3726                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3727                                   nla_get_u16);
3728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3729                                   dot11MeshGateAnnouncementProtocol, mask,
3730                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3731                                   nla_get_u8);
3732         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3733                                   mask, NL80211_MESHCONF_FORWARDING,
3734                                   nla_get_u8);
3735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3736                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3737                                   nla_get_u32);
3738         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3739                                   mask, NL80211_MESHCONF_HT_OPMODE,
3740                                   nla_get_u16);
3741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3742                                   mask,
3743                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3744                                   nla_get_u32);
3745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3746                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3747                                   nla_get_u16);
3748         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3749                                   dot11MeshHWMPconfirmationInterval, mask,
3750                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3751                                   nla_get_u16);
3752         if (mask_out)
3753                 *mask_out = mask;
3754
3755         return 0;
3756
3757 #undef FILL_IN_MESH_PARAM_IF_SET
3758 }
3759
3760 static int nl80211_parse_mesh_setup(struct genl_info *info,
3761                                      struct mesh_setup *setup)
3762 {
3763         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3764
3765         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3766                 return -EINVAL;
3767         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3768                              info->attrs[NL80211_ATTR_MESH_SETUP],
3769                              nl80211_mesh_setup_params_policy))
3770                 return -EINVAL;
3771
3772         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3773                 setup->sync_method =
3774                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3775                  IEEE80211_SYNC_METHOD_VENDOR :
3776                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3777
3778         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3779                 setup->path_sel_proto =
3780                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3781                  IEEE80211_PATH_PROTOCOL_VENDOR :
3782                  IEEE80211_PATH_PROTOCOL_HWMP;
3783
3784         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3785                 setup->path_metric =
3786                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3787                  IEEE80211_PATH_METRIC_VENDOR :
3788                  IEEE80211_PATH_METRIC_AIRTIME;
3789
3790
3791         if (tb[NL80211_MESH_SETUP_IE]) {
3792                 struct nlattr *ieattr =
3793                         tb[NL80211_MESH_SETUP_IE];
3794                 if (!is_valid_ie_attr(ieattr))
3795                         return -EINVAL;
3796                 setup->ie = nla_data(ieattr);
3797                 setup->ie_len = nla_len(ieattr);
3798         }
3799         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3800         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3801
3802         return 0;
3803 }
3804
3805 static int nl80211_update_mesh_config(struct sk_buff *skb,
3806                                       struct genl_info *info)
3807 {
3808         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3809         struct net_device *dev = info->user_ptr[1];
3810         struct wireless_dev *wdev = dev->ieee80211_ptr;
3811         struct mesh_config cfg;
3812         u32 mask;
3813         int err;
3814
3815         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3816                 return -EOPNOTSUPP;
3817
3818         if (!rdev->ops->update_mesh_config)
3819                 return -EOPNOTSUPP;
3820
3821         err = nl80211_parse_mesh_config(info, &cfg, &mask);
3822         if (err)
3823                 return err;
3824
3825         wdev_lock(wdev);
3826         if (!wdev->mesh_id_len)
3827                 err = -ENOLINK;
3828
3829         if (!err)
3830                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3831                                                     mask, &cfg);
3832
3833         wdev_unlock(wdev);
3834
3835         return err;
3836 }
3837
3838 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3839 {
3840         struct sk_buff *msg;
3841         void *hdr = NULL;
3842         struct nlattr *nl_reg_rules;
3843         unsigned int i;
3844         int err = -EINVAL;
3845
3846         mutex_lock(&cfg80211_mutex);
3847
3848         if (!cfg80211_regdomain)
3849                 goto out;
3850
3851         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3852         if (!msg) {
3853                 err = -ENOBUFS;
3854                 goto out;
3855         }
3856
3857         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
3858                              NL80211_CMD_GET_REG);
3859         if (!hdr)
3860                 goto put_failure;
3861
3862         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
3863                            cfg80211_regdomain->alpha2) ||
3864             (cfg80211_regdomain->dfs_region &&
3865              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
3866                         cfg80211_regdomain->dfs_region)))
3867                 goto nla_put_failure;
3868
3869         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3870         if (!nl_reg_rules)
3871                 goto nla_put_failure;
3872
3873         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3874                 struct nlattr *nl_reg_rule;
3875                 const struct ieee80211_reg_rule *reg_rule;
3876                 const struct ieee80211_freq_range *freq_range;
3877                 const struct ieee80211_power_rule *power_rule;
3878
3879                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3880                 freq_range = &reg_rule->freq_range;
3881                 power_rule = &reg_rule->power_rule;
3882
3883                 nl_reg_rule = nla_nest_start(msg, i);
3884                 if (!nl_reg_rule)
3885                         goto nla_put_failure;
3886
3887                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3888                                 reg_rule->flags) ||
3889                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
3890                                 freq_range->start_freq_khz) ||
3891                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
3892                                 freq_range->end_freq_khz) ||
3893                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3894                                 freq_range->max_bandwidth_khz) ||
3895                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3896                                 power_rule->max_antenna_gain) ||
3897                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3898                                 power_rule->max_eirp))
3899                         goto nla_put_failure;
3900
3901                 nla_nest_end(msg, nl_reg_rule);
3902         }
3903
3904         nla_nest_end(msg, nl_reg_rules);
3905
3906         genlmsg_end(msg, hdr);
3907         err = genlmsg_reply(msg, info);
3908         goto out;
3909
3910 nla_put_failure:
3911         genlmsg_cancel(msg, hdr);
3912 put_failure:
3913         nlmsg_free(msg);
3914         err = -EMSGSIZE;
3915 out:
3916         mutex_unlock(&cfg80211_mutex);
3917         return err;
3918 }
3919
3920 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3921 {
3922         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3923         struct nlattr *nl_reg_rule;
3924         char *alpha2 = NULL;
3925         int rem_reg_rules = 0, r = 0;
3926         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3927         u8 dfs_region = 0;
3928         struct ieee80211_regdomain *rd = NULL;
3929
3930         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3931                 return -EINVAL;
3932
3933         if (!info->attrs[NL80211_ATTR_REG_RULES])
3934                 return -EINVAL;
3935
3936         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3937
3938         if (info->attrs[NL80211_ATTR_DFS_REGION])
3939                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
3940
3941         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3942                         rem_reg_rules) {
3943                 num_rules++;
3944                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3945                         return -EINVAL;
3946         }
3947
3948         mutex_lock(&cfg80211_mutex);
3949
3950         if (!reg_is_valid_request(alpha2)) {
3951                 r = -EINVAL;
3952                 goto bad_reg;
3953         }
3954
3955         size_of_regd = sizeof(struct ieee80211_regdomain) +
3956                 (num_rules * sizeof(struct ieee80211_reg_rule));
3957
3958         rd = kzalloc(size_of_regd, GFP_KERNEL);
3959         if (!rd) {
3960                 r = -ENOMEM;
3961                 goto bad_reg;
3962         }
3963
3964         rd->n_reg_rules = num_rules;
3965         rd->alpha2[0] = alpha2[0];
3966         rd->alpha2[1] = alpha2[1];
3967
3968         /*
3969          * Disable DFS master mode if the DFS region was
3970          * not supported or known on this kernel.
3971          */
3972         if (reg_supported_dfs_region(dfs_region))
3973                 rd->dfs_region = dfs_region;
3974
3975         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3976                         rem_reg_rules) {
3977                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3978                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3979                         reg_rule_policy);
3980                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3981                 if (r)
3982                         goto bad_reg;
3983
3984                 rule_idx++;
3985
3986                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3987                         r = -EINVAL;
3988                         goto bad_reg;
3989                 }
3990         }
3991
3992         BUG_ON(rule_idx != num_rules);
3993
3994         r = set_regdom(rd);
3995
3996         mutex_unlock(&cfg80211_mutex);
3997
3998         return r;
3999
4000  bad_reg:
4001         mutex_unlock(&cfg80211_mutex);
4002         kfree(rd);
4003         return r;
4004 }
4005
4006 static int validate_scan_freqs(struct nlattr *freqs)
4007 {
4008         struct nlattr *attr1, *attr2;
4009         int n_channels = 0, tmp1, tmp2;
4010
4011         nla_for_each_nested(attr1, freqs, tmp1) {
4012                 n_channels++;
4013                 /*
4014                  * Some hardware has a limited channel list for
4015                  * scanning, and it is pretty much nonsensical
4016                  * to scan for a channel twice, so disallow that
4017                  * and don't require drivers to check that the
4018                  * channel list they get isn't longer than what
4019                  * they can scan, as long as they can scan all
4020                  * the channels they registered at once.
4021                  */
4022                 nla_for_each_nested(attr2, freqs, tmp2)
4023                         if (attr1 != attr2 &&
4024                             nla_get_u32(attr1) == nla_get_u32(attr2))
4025                                 return 0;
4026         }
4027
4028         return n_channels;
4029 }
4030
4031 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4032 {
4033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4034         struct net_device *dev = info->user_ptr[1];
4035         struct cfg80211_scan_request *request;
4036         struct nlattr *attr;
4037         struct wiphy *wiphy;
4038         int err, tmp, n_ssids = 0, n_channels, i;
4039         size_t ie_len;
4040
4041         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4042                 return -EINVAL;
4043
4044         wiphy = &rdev->wiphy;
4045
4046         if (!rdev->ops->scan)
4047                 return -EOPNOTSUPP;
4048
4049         if (rdev->scan_req)
4050                 return -EBUSY;
4051
4052         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4053                 n_channels = validate_scan_freqs(
4054                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4055                 if (!n_channels)
4056                         return -EINVAL;
4057         } else {
4058                 enum ieee80211_band band;
4059                 n_channels = 0;
4060
4061                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4062                         if (wiphy->bands[band])
4063                                 n_channels += wiphy->bands[band]->n_channels;
4064         }
4065
4066         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4067                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4068                         n_ssids++;
4069
4070         if (n_ssids > wiphy->max_scan_ssids)
4071                 return -EINVAL;
4072
4073         if (info->attrs[NL80211_ATTR_IE])
4074                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4075         else
4076                 ie_len = 0;
4077
4078         if (ie_len > wiphy->max_scan_ie_len)
4079                 return -EINVAL;
4080
4081         request = kzalloc(sizeof(*request)
4082                         + sizeof(*request->ssids) * n_ssids
4083                         + sizeof(*request->channels) * n_channels
4084                         + ie_len, GFP_KERNEL);
4085         if (!request)
4086                 return -ENOMEM;
4087
4088         if (n_ssids)
4089                 request->ssids = (void *)&request->channels[n_channels];
4090         request->n_ssids = n_ssids;
4091         if (ie_len) {
4092                 if (request->ssids)
4093                         request->ie = (void *)(request->ssids + n_ssids);
4094                 else
4095                         request->ie = (void *)(request->channels + n_channels);
4096         }
4097
4098         i = 0;
4099         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4100                 /* user specified, bail out if channel not found */
4101                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4102                         struct ieee80211_channel *chan;
4103
4104                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4105
4106                         if (!chan) {
4107                                 err = -EINVAL;
4108                                 goto out_free;
4109                         }
4110
4111                         /* ignore disabled channels */
4112                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4113                                 continue;
4114
4115                         request->channels[i] = chan;
4116                         i++;
4117                 }
4118         } else {
4119                 enum ieee80211_band band;
4120
4121                 /* all channels */
4122                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4123                         int j;
4124                         if (!wiphy->bands[band])
4125                                 continue;
4126                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4127                                 struct ieee80211_channel *chan;
4128
4129                                 chan = &wiphy->bands[band]->channels[j];
4130
4131                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4132                                         continue;
4133
4134                                 request->channels[i] = chan;
4135                                 i++;
4136                         }
4137                 }
4138         }
4139
4140         if (!i) {
4141                 err = -EINVAL;
4142                 goto out_free;
4143         }
4144
4145         request->n_channels = i;
4146
4147         i = 0;
4148         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4149                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4150                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4151                                 err = -EINVAL;
4152                                 goto out_free;
4153                         }
4154                         request->ssids[i].ssid_len = nla_len(attr);
4155                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4156                         i++;
4157                 }
4158         }
4159
4160         if (info->attrs[NL80211_ATTR_IE]) {
4161                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4162                 memcpy((void *)request->ie,
4163                        nla_data(info->attrs[NL80211_ATTR_IE]),
4164                        request->ie_len);
4165         }
4166
4167         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4168                 if (wiphy->bands[i])
4169                         request->rates[i] =
4170                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4171
4172         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4173                 nla_for_each_nested(attr,
4174                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4175                                     tmp) {
4176                         enum ieee80211_band band = nla_type(attr);
4177
4178                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4179                                 err = -EINVAL;
4180                                 goto out_free;
4181                         }
4182                         err = ieee80211_get_ratemask(wiphy->bands[band],
4183                                                      nla_data(attr),
4184                                                      nla_len(attr),
4185                                                      &request->rates[band]);
4186                         if (err)
4187                                 goto out_free;
4188                 }
4189         }
4190
4191         request->no_cck =
4192                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4193
4194         request->dev = dev;
4195         request->wiphy = &rdev->wiphy;
4196
4197         rdev->scan_req = request;
4198         err = rdev->ops->scan(&rdev->wiphy, dev, request);
4199
4200         if (!err) {
4201                 nl80211_send_scan_start(rdev, dev);
4202                 dev_hold(dev);
4203         } else {
4204  out_free:
4205                 rdev->scan_req = NULL;
4206                 kfree(request);
4207         }
4208
4209         return err;
4210 }
4211
4212 static int nl80211_start_sched_scan(struct sk_buff *skb,
4213                                     struct genl_info *info)
4214 {
4215         struct cfg80211_sched_scan_request *request;
4216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4217         struct net_device *dev = info->user_ptr[1];
4218         struct nlattr *attr;
4219         struct wiphy *wiphy;
4220         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4221         u32 interval;
4222         enum ieee80211_band band;
4223         size_t ie_len;
4224         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4225
4226         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4227             !rdev->ops->sched_scan_start)
4228                 return -EOPNOTSUPP;
4229
4230         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4231                 return -EINVAL;
4232
4233         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4234                 return -EINVAL;
4235
4236         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4237         if (interval == 0)
4238                 return -EINVAL;
4239
4240         wiphy = &rdev->wiphy;
4241
4242         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4243                 n_channels = validate_scan_freqs(
4244                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4245                 if (!n_channels)
4246                         return -EINVAL;
4247         } else {
4248                 n_channels = 0;
4249
4250                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4251                         if (wiphy->bands[band])
4252                                 n_channels += wiphy->bands[band]->n_channels;
4253         }
4254
4255         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4256                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4257                                     tmp)
4258                         n_ssids++;
4259
4260         if (n_ssids > wiphy->max_sched_scan_ssids)
4261                 return -EINVAL;
4262
4263         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4264                 nla_for_each_nested(attr,
4265                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4266                                     tmp)
4267                         n_match_sets++;
4268
4269         if (n_match_sets > wiphy->max_match_sets)
4270                 return -EINVAL;
4271
4272         if (info->attrs[NL80211_ATTR_IE])
4273                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4274         else
4275                 ie_len = 0;
4276
4277         if (ie_len > wiphy->max_sched_scan_ie_len)
4278                 return -EINVAL;
4279
4280         mutex_lock(&rdev->sched_scan_mtx);
4281
4282         if (rdev->sched_scan_req) {
4283                 err = -EINPROGRESS;
4284                 goto out;
4285         }
4286
4287         request = kzalloc(sizeof(*request)
4288                         + sizeof(*request->ssids) * n_ssids
4289                         + sizeof(*request->match_sets) * n_match_sets
4290                         + sizeof(*request->channels) * n_channels
4291                         + ie_len, GFP_KERNEL);
4292         if (!request) {
4293                 err = -ENOMEM;
4294                 goto out;
4295         }
4296
4297         if (n_ssids)
4298                 request->ssids = (void *)&request->channels[n_channels];
4299         request->n_ssids = n_ssids;
4300         if (ie_len) {
4301                 if (request->ssids)
4302                         request->ie = (void *)(request->ssids + n_ssids);
4303                 else
4304                         request->ie = (void *)(request->channels + n_channels);
4305         }
4306
4307         if (n_match_sets) {
4308                 if (request->ie)
4309                         request->match_sets = (void *)(request->ie + ie_len);
4310                 else if (request->ssids)
4311                         request->match_sets =
4312                                 (void *)(request->ssids + n_ssids);
4313                 else
4314                         request->match_sets =
4315                                 (void *)(request->channels + n_channels);
4316         }
4317         request->n_match_sets = n_match_sets;
4318
4319         i = 0;
4320         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4321                 /* user specified, bail out if channel not found */
4322                 nla_for_each_nested(attr,
4323                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4324                                     tmp) {
4325                         struct ieee80211_channel *chan;
4326
4327                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4328
4329                         if (!chan) {
4330                                 err = -EINVAL;
4331                                 goto out_free;
4332                         }
4333
4334                         /* ignore disabled channels */
4335                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4336                                 continue;
4337
4338                         request->channels[i] = chan;
4339                         i++;
4340                 }
4341         } else {
4342                 /* all channels */
4343                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4344                         int j;
4345                         if (!wiphy->bands[band])
4346                                 continue;
4347                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4348                                 struct ieee80211_channel *chan;
4349
4350                                 chan = &wiphy->bands[band]->channels[j];
4351
4352                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4353                                         continue;
4354
4355                                 request->channels[i] = chan;
4356                                 i++;
4357                         }
4358                 }
4359         }
4360
4361         if (!i) {
4362                 err = -EINVAL;
4363                 goto out_free;
4364         }
4365
4366         request->n_channels = i;
4367
4368         i = 0;
4369         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4370                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4371                                     tmp) {
4372                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4373                                 err = -EINVAL;
4374                                 goto out_free;
4375                         }
4376                         request->ssids[i].ssid_len = nla_len(attr);
4377                         memcpy(request->ssids[i].ssid, nla_data(attr),
4378                                nla_len(attr));
4379                         i++;
4380                 }
4381         }
4382
4383         i = 0;
4384         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4385                 nla_for_each_nested(attr,
4386                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4387                                     tmp) {
4388                         struct nlattr *ssid, *rssi;
4389
4390                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4391                                   nla_data(attr), nla_len(attr),
4392                                   nl80211_match_policy);
4393                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4394                         if (ssid) {
4395                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4396                                         err = -EINVAL;
4397                                         goto out_free;
4398                                 }
4399                                 memcpy(request->match_sets[i].ssid.ssid,
4400                                        nla_data(ssid), nla_len(ssid));
4401                                 request->match_sets[i].ssid.ssid_len =
4402                                         nla_len(ssid);
4403                         }
4404                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4405                         if (rssi)
4406                                 request->rssi_thold = nla_get_u32(rssi);
4407                         else
4408                                 request->rssi_thold =
4409                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4410                         i++;
4411                 }
4412         }
4413
4414         if (info->attrs[NL80211_ATTR_IE]) {
4415                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4416                 memcpy((void *)request->ie,
4417                        nla_data(info->attrs[NL80211_ATTR_IE]),
4418                        request->ie_len);
4419         }
4420
4421         request->dev = dev;
4422         request->wiphy = &rdev->wiphy;
4423         request->interval = interval;
4424
4425         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4426         if (!err) {
4427                 rdev->sched_scan_req = request;
4428                 nl80211_send_sched_scan(rdev, dev,
4429                                         NL80211_CMD_START_SCHED_SCAN);
4430                 goto out;
4431         }
4432
4433 out_free:
4434         kfree(request);
4435 out:
4436         mutex_unlock(&rdev->sched_scan_mtx);
4437         return err;
4438 }
4439
4440 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4441                                    struct genl_info *info)
4442 {
4443         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4444         int err;
4445
4446         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4447             !rdev->ops->sched_scan_stop)
4448                 return -EOPNOTSUPP;
4449
4450         mutex_lock(&rdev->sched_scan_mtx);
4451         err = __cfg80211_stop_sched_scan(rdev, false);
4452         mutex_unlock(&rdev->sched_scan_mtx);
4453
4454         return err;
4455 }
4456
4457 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4458                             u32 seq, int flags,
4459                             struct cfg80211_registered_device *rdev,
4460                             struct wireless_dev *wdev,
4461                             struct cfg80211_internal_bss *intbss)
4462 {
4463         struct cfg80211_bss *res = &intbss->pub;
4464         void *hdr;
4465         struct nlattr *bss;
4466
4467         ASSERT_WDEV_LOCK(wdev);
4468
4469         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
4470                              NL80211_CMD_NEW_SCAN_RESULTS);
4471         if (!hdr)
4472                 return -1;
4473
4474         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4475
4476         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4477             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4478                 goto nla_put_failure;
4479
4480         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4481         if (!bss)
4482                 goto nla_put_failure;
4483         if ((!is_zero_ether_addr(res->bssid) &&
4484              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4485             (res->information_elements && res->len_information_elements &&
4486              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4487                      res->len_information_elements,
4488                      res->information_elements)) ||
4489             (res->beacon_ies && res->len_beacon_ies &&
4490              res->beacon_ies != res->information_elements &&
4491              nla_put(msg, NL80211_BSS_BEACON_IES,
4492                      res->len_beacon_ies, res->beacon_ies)))
4493                 goto nla_put_failure;
4494         if (res->tsf &&
4495             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4496                 goto nla_put_failure;
4497         if (res->beacon_interval &&
4498             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4499                 goto nla_put_failure;
4500         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4501             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4502             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4503                         jiffies_to_msecs(jiffies - intbss->ts)))
4504                 goto nla_put_failure;
4505
4506         switch (rdev->wiphy.signal_type) {
4507         case CFG80211_SIGNAL_TYPE_MBM:
4508                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4509                         goto nla_put_failure;
4510                 break;
4511         case CFG80211_SIGNAL_TYPE_UNSPEC:
4512                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4513                         goto nla_put_failure;
4514                 break;
4515         default:
4516                 break;
4517         }
4518
4519         switch (wdev->iftype) {
4520         case NL80211_IFTYPE_P2P_CLIENT:
4521         case NL80211_IFTYPE_STATION:
4522                 if (intbss == wdev->current_bss &&
4523                     nla_put_u32(msg, NL80211_BSS_STATUS,
4524                                 NL80211_BSS_STATUS_ASSOCIATED))
4525                         goto nla_put_failure;
4526                 break;
4527         case NL80211_IFTYPE_ADHOC:
4528                 if (intbss == wdev->current_bss &&
4529                     nla_put_u32(msg, NL80211_BSS_STATUS,
4530                                 NL80211_BSS_STATUS_IBSS_JOINED))
4531                         goto nla_put_failure;
4532                 break;
4533         default:
4534                 break;
4535         }
4536
4537         nla_nest_end(msg, bss);
4538
4539         return genlmsg_end(msg, hdr);
4540
4541  nla_put_failure:
4542         genlmsg_cancel(msg, hdr);
4543         return -EMSGSIZE;
4544 }
4545
4546 static int nl80211_dump_scan(struct sk_buff *skb,
4547                              struct netlink_callback *cb)
4548 {
4549         struct cfg80211_registered_device *rdev;
4550         struct net_device *dev;
4551         struct cfg80211_internal_bss *scan;
4552         struct wireless_dev *wdev;
4553         int start = cb->args[1], idx = 0;
4554         int err;
4555
4556         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4557         if (err)
4558                 return err;
4559
4560         wdev = dev->ieee80211_ptr;
4561
4562         wdev_lock(wdev);
4563         spin_lock_bh(&rdev->bss_lock);
4564         cfg80211_bss_expire(rdev);
4565
4566         cb->seq = rdev->bss_generation;
4567
4568         list_for_each_entry(scan, &rdev->bss_list, list) {
4569                 if (++idx <= start)
4570                         continue;
4571                 if (nl80211_send_bss(skb, cb,
4572                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4573                                 rdev, wdev, scan) < 0) {
4574                         idx--;
4575                         break;
4576                 }
4577         }
4578
4579         spin_unlock_bh(&rdev->bss_lock);
4580         wdev_unlock(wdev);
4581
4582         cb->args[1] = idx;
4583         nl80211_finish_netdev_dump(rdev);
4584
4585         return skb->len;
4586 }
4587
4588 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
4589                                 int flags, struct net_device *dev,
4590                                 struct survey_info *survey)
4591 {
4592         void *hdr;
4593         struct nlattr *infoattr;
4594
4595         hdr = nl80211hdr_put(msg, pid, seq, flags,
4596                              NL80211_CMD_NEW_SURVEY_RESULTS);
4597         if (!hdr)
4598                 return -ENOMEM;
4599
4600         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4601                 goto nla_put_failure;
4602
4603         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4604         if (!infoattr)
4605                 goto nla_put_failure;
4606
4607         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4608                         survey->channel->center_freq))
4609                 goto nla_put_failure;
4610
4611         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4612             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4613                 goto nla_put_failure;
4614         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4615             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4616                 goto nla_put_failure;
4617         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4618             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4619                         survey->channel_time))
4620                 goto nla_put_failure;
4621         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4622             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4623                         survey->channel_time_busy))
4624                 goto nla_put_failure;
4625         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4626             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4627                         survey->channel_time_ext_busy))
4628                 goto nla_put_failure;
4629         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4630             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4631                         survey->channel_time_rx))
4632                 goto nla_put_failure;
4633         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4634             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4635                         survey->channel_time_tx))
4636                 goto nla_put_failure;
4637
4638         nla_nest_end(msg, infoattr);
4639
4640         return genlmsg_end(msg, hdr);
4641
4642  nla_put_failure:
4643         genlmsg_cancel(msg, hdr);
4644         return -EMSGSIZE;
4645 }
4646
4647 static int nl80211_dump_survey(struct sk_buff *skb,
4648                         struct netlink_callback *cb)
4649 {
4650         struct survey_info survey;
4651         struct cfg80211_registered_device *dev;
4652         struct net_device *netdev;
4653         int survey_idx = cb->args[1];
4654         int res;
4655
4656         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4657         if (res)
4658                 return res;
4659
4660         if (!dev->ops->dump_survey) {
4661                 res = -EOPNOTSUPP;
4662                 goto out_err;
4663         }
4664
4665         while (1) {
4666                 struct ieee80211_channel *chan;
4667
4668                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4669                                             &survey);
4670                 if (res == -ENOENT)
4671                         break;
4672                 if (res)
4673                         goto out_err;
4674
4675                 /* Survey without a channel doesn't make sense */
4676                 if (!survey.channel) {
4677                         res = -EINVAL;
4678                         goto out;
4679                 }
4680
4681                 chan = ieee80211_get_channel(&dev->wiphy,
4682                                              survey.channel->center_freq);
4683                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4684                         survey_idx++;
4685                         continue;
4686                 }
4687
4688                 if (nl80211_send_survey(skb,
4689                                 NETLINK_CB(cb->skb).pid,
4690                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4691                                 netdev,
4692                                 &survey) < 0)
4693                         goto out;
4694                 survey_idx++;
4695         }
4696
4697  out:
4698         cb->args[1] = survey_idx;
4699         res = skb->len;
4700  out_err:
4701         nl80211_finish_netdev_dump(dev);
4702         return res;
4703 }
4704
4705 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4706 {
4707         return auth_type <= NL80211_AUTHTYPE_MAX;
4708 }
4709
4710 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4711 {
4712         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4713                                   NL80211_WPA_VERSION_2));
4714 }
4715
4716 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4717 {
4718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4719         struct net_device *dev = info->user_ptr[1];
4720         struct ieee80211_channel *chan;
4721         const u8 *bssid, *ssid, *ie = NULL;
4722         int err, ssid_len, ie_len = 0;
4723         enum nl80211_auth_type auth_type;
4724         struct key_parse key;
4725         bool local_state_change;
4726
4727         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4728                 return -EINVAL;
4729
4730         if (!info->attrs[NL80211_ATTR_MAC])
4731                 return -EINVAL;
4732
4733         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4734                 return -EINVAL;
4735
4736         if (!info->attrs[NL80211_ATTR_SSID])
4737                 return -EINVAL;
4738
4739         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4740                 return -EINVAL;
4741
4742         err = nl80211_parse_key(info, &key);
4743         if (err)
4744                 return err;
4745
4746         if (key.idx >= 0) {
4747                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4748                         return -EINVAL;
4749                 if (!key.p.key || !key.p.key_len)
4750                         return -EINVAL;
4751                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4752                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4753                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4754                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4755                         return -EINVAL;
4756                 if (key.idx > 4)
4757                         return -EINVAL;
4758         } else {
4759                 key.p.key_len = 0;
4760                 key.p.key = NULL;
4761         }
4762
4763         if (key.idx >= 0) {
4764                 int i;
4765                 bool ok = false;
4766                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4767                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4768                                 ok = true;
4769                                 break;
4770                         }
4771                 }
4772                 if (!ok)
4773                         return -EINVAL;
4774         }
4775
4776         if (!rdev->ops->auth)
4777                 return -EOPNOTSUPP;
4778
4779         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4780             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4781                 return -EOPNOTSUPP;
4782
4783         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4784         chan = ieee80211_get_channel(&rdev->wiphy,
4785                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4786         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4787                 return -EINVAL;
4788
4789         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4790         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4791
4792         if (info->attrs[NL80211_ATTR_IE]) {
4793                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4794                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4795         }
4796
4797         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4798         if (!nl80211_valid_auth_type(auth_type))
4799                 return -EINVAL;
4800
4801         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4802
4803         /*
4804          * Since we no longer track auth state, ignore
4805          * requests to only change local state.
4806          */
4807         if (local_state_change)
4808                 return 0;
4809
4810         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4811                                   ssid, ssid_len, ie, ie_len,
4812                                   key.p.key, key.p.key_len, key.idx);
4813 }
4814
4815 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4816                                    struct genl_info *info,
4817                                    struct cfg80211_crypto_settings *settings,
4818                                    int cipher_limit)
4819 {
4820         memset(settings, 0, sizeof(*settings));
4821
4822         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4823
4824         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4825                 u16 proto;
4826                 proto = nla_get_u16(
4827                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4828                 settings->control_port_ethertype = cpu_to_be16(proto);
4829                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4830                     proto != ETH_P_PAE)
4831                         return -EINVAL;
4832                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4833                         settings->control_port_no_encrypt = true;
4834         } else
4835                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4836
4837         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4838                 void *data;
4839                 int len, i;
4840
4841                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4842                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4843                 settings->n_ciphers_pairwise = len / sizeof(u32);
4844
4845                 if (len % sizeof(u32))
4846                         return -EINVAL;
4847
4848                 if (settings->n_ciphers_pairwise > cipher_limit)
4849                         return -EINVAL;
4850
4851                 memcpy(settings->ciphers_pairwise, data, len);
4852
4853                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
4854                         if (!cfg80211_supported_cipher_suite(
4855                                         &rdev->wiphy,
4856                                         settings->ciphers_pairwise[i]))
4857                                 return -EINVAL;
4858         }
4859
4860         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
4861                 settings->cipher_group =
4862                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
4863                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
4864                                                      settings->cipher_group))
4865                         return -EINVAL;
4866         }
4867
4868         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
4869                 settings->wpa_versions =
4870                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
4871                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
4872                         return -EINVAL;
4873         }
4874
4875         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
4876                 void *data;
4877                 int len;
4878
4879                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
4880                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
4881                 settings->n_akm_suites = len / sizeof(u32);
4882
4883                 if (len % sizeof(u32))
4884                         return -EINVAL;
4885
4886                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
4887                         return -EINVAL;
4888
4889                 memcpy(settings->akm_suites, data, len);
4890         }
4891
4892         return 0;
4893 }
4894
4895 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
4896 {
4897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4898         struct net_device *dev = info->user_ptr[1];
4899         struct cfg80211_crypto_settings crypto;
4900         struct ieee80211_channel *chan;
4901         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
4902         int err, ssid_len, ie_len = 0;
4903         bool use_mfp = false;
4904         u32 flags = 0;
4905         struct ieee80211_ht_cap *ht_capa = NULL;
4906         struct ieee80211_ht_cap *ht_capa_mask = NULL;
4907
4908         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4909                 return -EINVAL;
4910
4911         if (!info->attrs[NL80211_ATTR_MAC] ||
4912             !info->attrs[NL80211_ATTR_SSID] ||
4913             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4914                 return -EINVAL;
4915
4916         if (!rdev->ops->assoc)
4917                 return -EOPNOTSUPP;
4918
4919         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4920             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4921                 return -EOPNOTSUPP;
4922
4923         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4924
4925         chan = ieee80211_get_channel(&rdev->wiphy,
4926                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4927         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4928                 return -EINVAL;
4929
4930         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4931         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4932
4933         if (info->attrs[NL80211_ATTR_IE]) {
4934                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4935                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4936         }
4937
4938         if (info->attrs[NL80211_ATTR_USE_MFP]) {
4939                 enum nl80211_mfp mfp =
4940                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
4941                 if (mfp == NL80211_MFP_REQUIRED)
4942                         use_mfp = true;
4943                 else if (mfp != NL80211_MFP_NO)
4944                         return -EINVAL;
4945         }
4946
4947         if (info->attrs[NL80211_ATTR_PREV_BSSID])
4948                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
4949
4950         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
4951                 flags |= ASSOC_REQ_DISABLE_HT;
4952
4953         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
4954                 ht_capa_mask =
4955                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
4956
4957         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
4958                 if (!ht_capa_mask)
4959                         return -EINVAL;
4960                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4961         }
4962
4963         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
4964         if (!err)
4965                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
4966                                           ssid, ssid_len, ie, ie_len, use_mfp,
4967                                           &crypto, flags, ht_capa,
4968                                           ht_capa_mask);
4969
4970         return err;
4971 }
4972
4973 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
4974 {
4975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4976         struct net_device *dev = info->user_ptr[1];
4977         const u8 *ie = NULL, *bssid;
4978         int ie_len = 0;
4979         u16 reason_code;
4980         bool local_state_change;
4981
4982         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4983                 return -EINVAL;
4984
4985         if (!info->attrs[NL80211_ATTR_MAC])
4986                 return -EINVAL;
4987
4988         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4989                 return -EINVAL;
4990
4991         if (!rdev->ops->deauth)
4992                 return -EOPNOTSUPP;
4993
4994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4996                 return -EOPNOTSUPP;
4997
4998         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4999
5000         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5001         if (reason_code == 0) {
5002                 /* Reason Code 0 is reserved */
5003                 return -EINVAL;
5004         }
5005
5006         if (info->attrs[NL80211_ATTR_IE]) {
5007                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5008                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5009         }
5010
5011         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5012
5013         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5014                                     local_state_change);
5015 }
5016
5017 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5018 {
5019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5020         struct net_device *dev = info->user_ptr[1];
5021         const u8 *ie = NULL, *bssid;
5022         int ie_len = 0;
5023         u16 reason_code;
5024         bool local_state_change;
5025
5026         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5027                 return -EINVAL;
5028
5029         if (!info->attrs[NL80211_ATTR_MAC])
5030                 return -EINVAL;
5031
5032         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5033                 return -EINVAL;
5034
5035         if (!rdev->ops->disassoc)
5036                 return -EOPNOTSUPP;
5037
5038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5040                 return -EOPNOTSUPP;
5041
5042         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5043
5044         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5045         if (reason_code == 0) {
5046                 /* Reason Code 0 is reserved */
5047                 return -EINVAL;
5048         }
5049
5050         if (info->attrs[NL80211_ATTR_IE]) {
5051                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5052                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5053         }
5054
5055         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5056
5057         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5058                                       local_state_change);
5059 }
5060
5061 static bool
5062 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5063                          int mcast_rate[IEEE80211_NUM_BANDS],
5064                          int rateval)
5065 {
5066         struct wiphy *wiphy = &rdev->wiphy;
5067         bool found = false;
5068         int band, i;
5069
5070         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5071                 struct ieee80211_supported_band *sband;
5072
5073                 sband = wiphy->bands[band];
5074                 if (!sband)
5075                         continue;
5076
5077                 for (i = 0; i < sband->n_bitrates; i++) {
5078                         if (sband->bitrates[i].bitrate == rateval) {
5079                                 mcast_rate[band] = i + 1;
5080                                 found = true;
5081                                 break;
5082                         }
5083                 }
5084         }
5085
5086         return found;
5087 }
5088
5089 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5090 {
5091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5092         struct net_device *dev = info->user_ptr[1];
5093         struct cfg80211_ibss_params ibss;
5094         struct wiphy *wiphy;
5095         struct cfg80211_cached_keys *connkeys = NULL;
5096         int err;
5097
5098         memset(&ibss, 0, sizeof(ibss));
5099
5100         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5101                 return -EINVAL;
5102
5103         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5104             !info->attrs[NL80211_ATTR_SSID] ||
5105             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5106                 return -EINVAL;
5107
5108         ibss.beacon_interval = 100;
5109
5110         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5111                 ibss.beacon_interval =
5112                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5113                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5114                         return -EINVAL;
5115         }
5116
5117         if (!rdev->ops->join_ibss)
5118                 return -EOPNOTSUPP;
5119
5120         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5121                 return -EOPNOTSUPP;
5122
5123         wiphy = &rdev->wiphy;
5124
5125         if (info->attrs[NL80211_ATTR_MAC]) {
5126                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5127
5128                 if (!is_valid_ether_addr(ibss.bssid))
5129                         return -EINVAL;
5130         }
5131         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5132         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5133
5134         if (info->attrs[NL80211_ATTR_IE]) {
5135                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5136                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5137         }
5138
5139         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5140                 enum nl80211_channel_type channel_type;
5141
5142                 if (!nl80211_valid_channel_type(info, &channel_type))
5143                         return -EINVAL;
5144
5145                 if (channel_type != NL80211_CHAN_NO_HT &&
5146                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5147                         return -EINVAL;
5148
5149                 ibss.channel_type = channel_type;
5150         } else {
5151                 ibss.channel_type = NL80211_CHAN_NO_HT;
5152         }
5153
5154         ibss.channel = rdev_freq_to_chan(rdev,
5155                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5156                 ibss.channel_type);
5157         if (!ibss.channel ||
5158             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5159             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5160                 return -EINVAL;
5161
5162         /* Both channels should be able to initiate communication */
5163         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5164              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5165             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5166                                           ibss.channel_type))
5167                 return -EINVAL;
5168
5169         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5170         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5171
5172         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5173                 u8 *rates =
5174                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5175                 int n_rates =
5176                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5177                 struct ieee80211_supported_band *sband =
5178                         wiphy->bands[ibss.channel->band];
5179
5180                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5181                                              &ibss.basic_rates);
5182                 if (err)
5183                         return err;
5184         }
5185
5186         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5187             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5188                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5189                 return -EINVAL;
5190
5191         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5192                 connkeys = nl80211_parse_connkeys(rdev,
5193                                         info->attrs[NL80211_ATTR_KEYS]);
5194                 if (IS_ERR(connkeys))
5195                         return PTR_ERR(connkeys);
5196         }
5197
5198         ibss.control_port =
5199                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5200
5201         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5202         if (err)
5203                 kfree(connkeys);
5204         return err;
5205 }
5206
5207 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5208 {
5209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5210         struct net_device *dev = info->user_ptr[1];
5211
5212         if (!rdev->ops->leave_ibss)
5213                 return -EOPNOTSUPP;
5214
5215         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5216                 return -EOPNOTSUPP;
5217
5218         return cfg80211_leave_ibss(rdev, dev, false);
5219 }
5220
5221 #ifdef CONFIG_NL80211_TESTMODE
5222 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5223         .name = "testmode",
5224 };
5225
5226 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5227 {
5228         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5229         int err;
5230
5231         if (!info->attrs[NL80211_ATTR_TESTDATA])
5232                 return -EINVAL;
5233
5234         err = -EOPNOTSUPP;
5235         if (rdev->ops->testmode_cmd) {
5236                 rdev->testmode_info = info;
5237                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
5238                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5239                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5240                 rdev->testmode_info = NULL;
5241         }
5242
5243         return err;
5244 }
5245
5246 static int nl80211_testmode_dump(struct sk_buff *skb,
5247                                  struct netlink_callback *cb)
5248 {
5249         struct cfg80211_registered_device *rdev;
5250         int err;
5251         long phy_idx;
5252         void *data = NULL;
5253         int data_len = 0;
5254
5255         if (cb->args[0]) {
5256                 /*
5257                  * 0 is a valid index, but not valid for args[0],
5258                  * so we need to offset by 1.
5259                  */
5260                 phy_idx = cb->args[0] - 1;
5261         } else {
5262                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5263                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5264                                   nl80211_policy);
5265                 if (err)
5266                         return err;
5267
5268                 mutex_lock(&cfg80211_mutex);
5269                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5270                                                   nl80211_fam.attrbuf);
5271                 if (IS_ERR(rdev)) {
5272                         mutex_unlock(&cfg80211_mutex);
5273                         return PTR_ERR(rdev);
5274                 }
5275                 phy_idx = rdev->wiphy_idx;
5276                 rdev = NULL;
5277                 mutex_unlock(&cfg80211_mutex);
5278
5279                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5280                         cb->args[1] =
5281                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5282         }
5283
5284         if (cb->args[1]) {
5285                 data = nla_data((void *)cb->args[1]);
5286                 data_len = nla_len((void *)cb->args[1]);
5287         }
5288
5289         mutex_lock(&cfg80211_mutex);
5290         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5291         if (!rdev) {
5292                 mutex_unlock(&cfg80211_mutex);
5293                 return -ENOENT;
5294         }
5295         cfg80211_lock_rdev(rdev);
5296         mutex_unlock(&cfg80211_mutex);
5297
5298         if (!rdev->ops->testmode_dump) {
5299                 err = -EOPNOTSUPP;
5300                 goto out_err;
5301         }
5302
5303         while (1) {
5304                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
5305                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5306                                            NL80211_CMD_TESTMODE);
5307                 struct nlattr *tmdata;
5308
5309                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5310                         genlmsg_cancel(skb, hdr);
5311                         break;
5312                 }
5313
5314                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5315                 if (!tmdata) {
5316                         genlmsg_cancel(skb, hdr);
5317                         break;
5318                 }
5319                 err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
5320                                                data, data_len);
5321                 nla_nest_end(skb, tmdata);
5322
5323                 if (err == -ENOBUFS || err == -ENOENT) {
5324                         genlmsg_cancel(skb, hdr);
5325                         break;
5326                 } else if (err) {
5327                         genlmsg_cancel(skb, hdr);
5328                         goto out_err;
5329                 }
5330
5331                 genlmsg_end(skb, hdr);
5332         }
5333
5334         err = skb->len;
5335         /* see above */
5336         cb->args[0] = phy_idx + 1;
5337  out_err:
5338         cfg80211_unlock_rdev(rdev);
5339         return err;
5340 }
5341
5342 static struct sk_buff *
5343 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5344                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
5345 {
5346         struct sk_buff *skb;
5347         void *hdr;
5348         struct nlattr *data;
5349
5350         skb = nlmsg_new(approxlen + 100, gfp);
5351         if (!skb)
5352                 return NULL;
5353
5354         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
5355         if (!hdr) {
5356                 kfree_skb(skb);
5357                 return NULL;
5358         }
5359
5360         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5361                 goto nla_put_failure;
5362         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5363
5364         ((void **)skb->cb)[0] = rdev;
5365         ((void **)skb->cb)[1] = hdr;
5366         ((void **)skb->cb)[2] = data;
5367
5368         return skb;
5369
5370  nla_put_failure:
5371         kfree_skb(skb);
5372         return NULL;
5373 }
5374
5375 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5376                                                   int approxlen)
5377 {
5378         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5379
5380         if (WARN_ON(!rdev->testmode_info))
5381                 return NULL;
5382
5383         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5384                                 rdev->testmode_info->snd_pid,
5385                                 rdev->testmode_info->snd_seq,
5386                                 GFP_KERNEL);
5387 }
5388 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5389
5390 int cfg80211_testmode_reply(struct sk_buff *skb)
5391 {
5392         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5393         void *hdr = ((void **)skb->cb)[1];
5394         struct nlattr *data = ((void **)skb->cb)[2];
5395
5396         if (WARN_ON(!rdev->testmode_info)) {
5397                 kfree_skb(skb);
5398                 return -EINVAL;
5399         }
5400
5401         nla_nest_end(skb, data);
5402         genlmsg_end(skb, hdr);
5403         return genlmsg_reply(skb, rdev->testmode_info);
5404 }
5405 EXPORT_SYMBOL(cfg80211_testmode_reply);
5406
5407 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5408                                                   int approxlen, gfp_t gfp)
5409 {
5410         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5411
5412         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5413 }
5414 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5415
5416 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5417 {
5418         void *hdr = ((void **)skb->cb)[1];
5419         struct nlattr *data = ((void **)skb->cb)[2];
5420
5421         nla_nest_end(skb, data);
5422         genlmsg_end(skb, hdr);
5423         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5424 }
5425 EXPORT_SYMBOL(cfg80211_testmode_event);
5426 #endif
5427
5428 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5429 {
5430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5431         struct net_device *dev = info->user_ptr[1];
5432         struct cfg80211_connect_params connect;
5433         struct wiphy *wiphy;
5434         struct cfg80211_cached_keys *connkeys = NULL;
5435         int err;
5436
5437         memset(&connect, 0, sizeof(connect));
5438
5439         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5440                 return -EINVAL;
5441
5442         if (!info->attrs[NL80211_ATTR_SSID] ||
5443             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5444                 return -EINVAL;
5445
5446         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5447                 connect.auth_type =
5448                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5449                 if (!nl80211_valid_auth_type(connect.auth_type))
5450                         return -EINVAL;
5451         } else
5452                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5453
5454         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5455
5456         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5457                                       NL80211_MAX_NR_CIPHER_SUITES);
5458         if (err)
5459                 return err;
5460
5461         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5462             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5463                 return -EOPNOTSUPP;
5464
5465         wiphy = &rdev->wiphy;
5466
5467         connect.bg_scan_period = -1;
5468         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5469                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5470                 connect.bg_scan_period =
5471                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5472         }
5473
5474         if (info->attrs[NL80211_ATTR_MAC])
5475                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5476         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5477         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5478
5479         if (info->attrs[NL80211_ATTR_IE]) {
5480                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5481                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5482         }
5483
5484         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5485                 connect.channel =
5486                         ieee80211_get_channel(wiphy,
5487                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5488                 if (!connect.channel ||
5489                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5490                         return -EINVAL;
5491         }
5492
5493         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5494                 connkeys = nl80211_parse_connkeys(rdev,
5495                                         info->attrs[NL80211_ATTR_KEYS]);
5496                 if (IS_ERR(connkeys))
5497                         return PTR_ERR(connkeys);
5498         }
5499
5500         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5501                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5502
5503         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5504                 memcpy(&connect.ht_capa_mask,
5505                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5506                        sizeof(connect.ht_capa_mask));
5507
5508         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5509                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5510                         return -EINVAL;
5511                 memcpy(&connect.ht_capa,
5512                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5513                        sizeof(connect.ht_capa));
5514         }
5515
5516         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5517         if (err)
5518                 kfree(connkeys);
5519         return err;
5520 }
5521
5522 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5523 {
5524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5525         struct net_device *dev = info->user_ptr[1];
5526         u16 reason;
5527
5528         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5529                 reason = WLAN_REASON_DEAUTH_LEAVING;
5530         else
5531                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5532
5533         if (reason == 0)
5534                 return -EINVAL;
5535
5536         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5537             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5538                 return -EOPNOTSUPP;
5539
5540         return cfg80211_disconnect(rdev, dev, reason, true);
5541 }
5542
5543 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5544 {
5545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5546         struct net *net;
5547         int err;
5548         u32 pid;
5549
5550         if (!info->attrs[NL80211_ATTR_PID])
5551                 return -EINVAL;
5552
5553         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5554
5555         net = get_net_ns_by_pid(pid);
5556         if (IS_ERR(net))
5557                 return PTR_ERR(net);
5558
5559         err = 0;
5560
5561         /* check if anything to do */
5562         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5563                 err = cfg80211_switch_netns(rdev, net);
5564
5565         put_net(net);
5566         return err;
5567 }
5568
5569 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5570 {
5571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5572         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5573                         struct cfg80211_pmksa *pmksa) = NULL;
5574         struct net_device *dev = info->user_ptr[1];
5575         struct cfg80211_pmksa pmksa;
5576
5577         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5578
5579         if (!info->attrs[NL80211_ATTR_MAC])
5580                 return -EINVAL;
5581
5582         if (!info->attrs[NL80211_ATTR_PMKID])
5583                 return -EINVAL;
5584
5585         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5586         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5587
5588         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5589             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5590                 return -EOPNOTSUPP;
5591
5592         switch (info->genlhdr->cmd) {
5593         case NL80211_CMD_SET_PMKSA:
5594                 rdev_ops = rdev->ops->set_pmksa;
5595                 break;
5596         case NL80211_CMD_DEL_PMKSA:
5597                 rdev_ops = rdev->ops->del_pmksa;
5598                 break;
5599         default:
5600                 WARN_ON(1);
5601                 break;
5602         }
5603
5604         if (!rdev_ops)
5605                 return -EOPNOTSUPP;
5606
5607         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5608 }
5609
5610 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5611 {
5612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5613         struct net_device *dev = info->user_ptr[1];
5614
5615         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5616             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5617                 return -EOPNOTSUPP;
5618
5619         if (!rdev->ops->flush_pmksa)
5620                 return -EOPNOTSUPP;
5621
5622         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5623 }
5624
5625 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5626 {
5627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5628         struct net_device *dev = info->user_ptr[1];
5629         u8 action_code, dialog_token;
5630         u16 status_code;
5631         u8 *peer;
5632
5633         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5634             !rdev->ops->tdls_mgmt)
5635                 return -EOPNOTSUPP;
5636
5637         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5638             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5639             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5640             !info->attrs[NL80211_ATTR_IE] ||
5641             !info->attrs[NL80211_ATTR_MAC])
5642                 return -EINVAL;
5643
5644         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5645         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5646         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5647         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5648
5649         return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5650                                     dialog_token, status_code,
5651                                     nla_data(info->attrs[NL80211_ATTR_IE]),
5652                                     nla_len(info->attrs[NL80211_ATTR_IE]));
5653 }
5654
5655 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5656 {
5657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5658         struct net_device *dev = info->user_ptr[1];
5659         enum nl80211_tdls_operation operation;
5660         u8 *peer;
5661
5662         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5663             !rdev->ops->tdls_oper)
5664                 return -EOPNOTSUPP;
5665
5666         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5667             !info->attrs[NL80211_ATTR_MAC])
5668                 return -EINVAL;
5669
5670         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5671         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5672
5673         return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5674 }
5675
5676 static int nl80211_remain_on_channel(struct sk_buff *skb,
5677                                      struct genl_info *info)
5678 {
5679         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5680         struct net_device *dev = info->user_ptr[1];
5681         struct ieee80211_channel *chan;
5682         struct sk_buff *msg;
5683         void *hdr;
5684         u64 cookie;
5685         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5686         u32 freq, duration;
5687         int err;
5688
5689         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5690             !info->attrs[NL80211_ATTR_DURATION])
5691                 return -EINVAL;
5692
5693         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5694
5695         if (!rdev->ops->remain_on_channel ||
5696             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5697                 return -EOPNOTSUPP;
5698
5699         /*
5700          * We should be on that channel for at least a minimum amount of
5701          * time (10ms) but no longer than the driver supports.
5702          */
5703         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5704             duration > rdev->wiphy.max_remain_on_channel_duration)
5705                 return -EINVAL;
5706
5707         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5708             !nl80211_valid_channel_type(info, &channel_type))
5709                 return -EINVAL;
5710
5711         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5712         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5713         if (chan == NULL)
5714                 return -EINVAL;
5715
5716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5717         if (!msg)
5718                 return -ENOMEM;
5719
5720         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
5721                              NL80211_CMD_REMAIN_ON_CHANNEL);
5722
5723         if (IS_ERR(hdr)) {
5724                 err = PTR_ERR(hdr);
5725                 goto free_msg;
5726         }
5727
5728         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
5729                                            channel_type, duration, &cookie);
5730
5731         if (err)
5732                 goto free_msg;
5733
5734         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
5735                 goto nla_put_failure;
5736
5737         genlmsg_end(msg, hdr);
5738
5739         return genlmsg_reply(msg, info);
5740
5741  nla_put_failure:
5742         err = -ENOBUFS;
5743  free_msg:
5744         nlmsg_free(msg);
5745         return err;
5746 }
5747
5748 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5749                                             struct genl_info *info)
5750 {
5751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5752         struct net_device *dev = info->user_ptr[1];
5753         u64 cookie;
5754
5755         if (!info->attrs[NL80211_ATTR_COOKIE])
5756                 return -EINVAL;
5757
5758         if (!rdev->ops->cancel_remain_on_channel)
5759                 return -EOPNOTSUPP;
5760
5761         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5762
5763         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
5764 }
5765
5766 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5767                            u8 *rates, u8 rates_len)
5768 {
5769         u8 i;
5770         u32 mask = 0;
5771
5772         for (i = 0; i < rates_len; i++) {
5773                 int rate = (rates[i] & 0x7f) * 5;
5774                 int ridx;
5775                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5776                         struct ieee80211_rate *srate =
5777                                 &sband->bitrates[ridx];
5778                         if (rate == srate->bitrate) {
5779                                 mask |= 1 << ridx;
5780                                 break;
5781                         }
5782                 }
5783                 if (ridx == sband->n_bitrates)
5784                         return 0; /* rate not found */
5785         }
5786
5787         return mask;
5788 }
5789
5790 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5791                                u8 *rates, u8 rates_len,
5792                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5793 {
5794         u8 i;
5795
5796         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5797
5798         for (i = 0; i < rates_len; i++) {
5799                 int ridx, rbit;
5800
5801                 ridx = rates[i] / 8;
5802                 rbit = BIT(rates[i] % 8);
5803
5804                 /* check validity */
5805                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5806                         return false;
5807
5808                 /* check availability */
5809                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5810                         mcs[ridx] |= rbit;
5811                 else
5812                         return false;
5813         }
5814
5815         return true;
5816 }
5817
5818 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5819         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5820                                     .len = NL80211_MAX_SUPP_RATES },
5821         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
5822                                  .len = NL80211_MAX_SUPP_HT_RATES },
5823 };
5824
5825 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5826                                        struct genl_info *info)
5827 {
5828         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5830         struct cfg80211_bitrate_mask mask;
5831         int rem, i;
5832         struct net_device *dev = info->user_ptr[1];
5833         struct nlattr *tx_rates;
5834         struct ieee80211_supported_band *sband;
5835
5836         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5837                 return -EINVAL;
5838
5839         if (!rdev->ops->set_bitrate_mask)
5840                 return -EOPNOTSUPP;
5841
5842         memset(&mask, 0, sizeof(mask));
5843         /* Default to all rates enabled */
5844         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5845                 sband = rdev->wiphy.bands[i];
5846                 mask.control[i].legacy =
5847                         sband ? (1 << sband->n_bitrates) - 1 : 0;
5848                 if (sband)
5849                         memcpy(mask.control[i].mcs,
5850                                sband->ht_cap.mcs.rx_mask,
5851                                sizeof(mask.control[i].mcs));
5852                 else
5853                         memset(mask.control[i].mcs, 0,
5854                                sizeof(mask.control[i].mcs));
5855         }
5856
5857         /*
5858          * The nested attribute uses enum nl80211_band as the index. This maps</