net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  27                             struct genl_info *info);
  28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  29                               struct genl_info *info);
  30
  31 /* the netlink family */
  32 static struct genl_family nl80211_fam = {
  33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  34         .name = "nl80211",      /* have users key off the name instead */
  35         .hdrsize = 0,           /* no private header */
  36         .version = 1,           /* no particular meaning now */
  37         .maxattr = NL80211_ATTR_MAX,
  38         .netnsok = true,
  39         .pre_doit = nl80211_pre_doit,
  40         .post_doit = nl80211_post_doit,
  41 };
  42
  43 /* internal helper: get rdev and dev */
  44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  45                                        struct cfg80211_registered_device **rdev,
  46                                        struct net_device **dev)
  47 {
  48         struct nlattr **attrs = info->attrs;
  49         int ifindex;
  50
  51         if (!attrs[NL80211_ATTR_IFINDEX])
  52                 return -EINVAL;
  53
  54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  56         if (!*dev)
  57                 return -ENODEV;
  58
  59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  60         if (IS_ERR(*rdev)) {
  61                 dev_put(*dev);
  62                 return PTR_ERR(*rdev);
  63         }
  64
  65         return 0;
  66 }
  67
  68 /* policy for the attributes */
  69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  72                                       .len = 20-1 },
  73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  81
  82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  85
  86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  88
  89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  91                                     .len = WLAN_MAX_KEY_LEN },
  92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  96
  97         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  98         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  99         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 100                                        .len = IEEE80211_MAX_DATA_LEN },
 101         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 102                                        .len = IEEE80211_MAX_DATA_LEN },
 103         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 104         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 105         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 106         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 107                                                .len = NL80211_MAX_SUPP_RATES },
 108         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 109         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 110         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 111         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 112                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 113         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 114
 115         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 116         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 117
 118         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 119         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 120         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 121         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 122                                            .len = NL80211_MAX_SUPP_RATES },
 123
 124         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 127                                          .len = NL80211_HT_CAPABILITY_LEN },
 128
 129         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 130         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 131                               .len = IEEE80211_MAX_DATA_LEN },
 132         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 133         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 134
 135         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 136                                 .len = IEEE80211_MAX_SSID_LEN },
 137         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 138         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 139         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 140         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 141         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 142         [NL80211_ATTR_STA_FLAGS2] = {
 143                 .len = sizeof(struct nl80211_sta_flag_update),
 144         },
 145         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 146         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 147         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 148         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 149         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 150         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 151         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 152         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 153         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 154                                  .len = WLAN_PMKID_LEN },
 155         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 156         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 157         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 158         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 159                                  .len = IEEE80211_MAX_DATA_LEN },
 160         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 161         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 162         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 163         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 164         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 165
 166         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 167         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 168         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 169 };
 170
 171 /* policy for the attributes */
 172 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 173         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 174         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 175         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 176         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 177         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 178         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 179 };
 180
 181 /* ifidx get helper */
 182 static int nl80211_get_ifidx(struct netlink_callback *cb)
 183 {
 184         int res;
 185
 186         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 187                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 188                           nl80211_policy);
 189         if (res)
 190                 return res;
 191
 192         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 193                 return -EINVAL;
 194
 195         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 196         if (!res)
 197                 return -EINVAL;
 198         return res;
 199 }
 200
 201 /* IE validation */
 202 static bool is_valid_ie_attr(const struct nlattr *attr)
 203 {
 204         const u8 *pos;
 205         int len;
 206
 207         if (!attr)
 208                 return true;
 209
 210         pos = nla_data(attr);
 211         len = nla_len(attr);
 212
 213         while (len) {
 214                 u8 elemlen;
 215
 216                 if (len < 2)
 217                         return false;
 218                 len -= 2;
 219
 220                 elemlen = pos[1];
 221                 if (elemlen > len)
 222                         return false;
 223
 224                 len -= elemlen;
 225                 pos += 2 + elemlen;
 226         }
 227
 228         return true;
 229 }
 230
 231 /* message building helper */
 232 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 233                                    int flags, u8 cmd)
 234 {
 235         /* since there is no private header just add the generic one */
 236         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 237 }
 238
 239 static int nl80211_msg_put_channel(struct sk_buff *msg,
 240                                    struct ieee80211_channel *chan)
 241 {
 242         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 243                     chan->center_freq);
 244
 245         if (chan->flags & IEEE80211_CHAN_DISABLED)
 246                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 247         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 248                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 249         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 250                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 251         if (chan->flags & IEEE80211_CHAN_RADAR)
 252                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 253
 254         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 255                     DBM_TO_MBM(chan->max_power));
 256
 257         return 0;
 258
 259  nla_put_failure:
 260         return -ENOBUFS;
 261 }
 262
 263 /* netlink command implementations */
 264
 265 struct key_parse {
 266         struct key_params p;
 267         int idx;
 268         bool def, defmgmt;
 269 };
 270
 271 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 272 {
 273         struct nlattr *tb[NL80211_KEY_MAX + 1];
 274         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 275                                    nl80211_key_policy);
 276         if (err)
 277                 return err;
 278
 279         k->def = !!tb[NL80211_KEY_DEFAULT];
 280         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 281
 282         if (tb[NL80211_KEY_IDX])
 283                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 284
 285         if (tb[NL80211_KEY_DATA]) {
 286                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 287                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 288         }
 289
 290         if (tb[NL80211_KEY_SEQ]) {
 291                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 292                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 293         }
 294
 295         if (tb[NL80211_KEY_CIPHER])
 296                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 297
 298         return 0;
 299 }
 300
 301 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 302 {
 303         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 304                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 305                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 306         }
 307
 308         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 309                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 310                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 311         }
 312
 313         if (info->attrs[NL80211_ATTR_KEY_IDX])
 314                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 315
 316         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 317                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 318
 319         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 320         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 321
 322         return 0;
 323 }
 324
 325 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 326 {
 327         int err;
 328
 329         memset(k, 0, sizeof(*k));
 330         k->idx = -1;
 331
 332         if (info->attrs[NL80211_ATTR_KEY])
 333                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 334         else
 335                 err = nl80211_parse_key_old(info, k);
 336
 337         if (err)
 338                 return err;
 339
 340         if (k->def && k->defmgmt)
 341                 return -EINVAL;
 342
 343         if (k->idx != -1) {
 344                 if (k->defmgmt) {
 345                         if (k->idx < 4 || k->idx > 5)
 346                                 return -EINVAL;
 347                 } else if (k->def) {
 348                         if (k->idx < 0 || k->idx > 3)
 349                                 return -EINVAL;
 350                 } else {
 351                         if (k->idx < 0 || k->idx > 5)
 352                                 return -EINVAL;
 353                 }
 354         }
 355
 356         return 0;
 357 }
 358
 359 static struct cfg80211_cached_keys *
 360 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 361                        struct nlattr *keys)
 362 {
 363         struct key_parse parse;
 364         struct nlattr *key;
 365         struct cfg80211_cached_keys *result;
 366         int rem, err, def = 0;
 367
 368         result = kzalloc(sizeof(*result), GFP_KERNEL);
 369         if (!result)
 370                 return ERR_PTR(-ENOMEM);
 371
 372         result->def = -1;
 373         result->defmgmt = -1;
 374
 375         nla_for_each_nested(key, keys, rem) {
 376                 memset(&parse, 0, sizeof(parse));
 377                 parse.idx = -1;
 378
 379                 err = nl80211_parse_key_new(key, &parse);
 380                 if (err)
 381                         goto error;
 382                 err = -EINVAL;
 383                 if (!parse.p.key)
 384                         goto error;
 385                 if (parse.idx < 0 || parse.idx > 4)
 386                         goto error;
 387                 if (parse.def) {
 388                         if (def)
 389                                 goto error;
 390                         def = 1;
 391                         result->def = parse.idx;
 392                 } else if (parse.defmgmt)
 393                         goto error;
 394                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 395                                                      parse.idx, NULL);
 396                 if (err)
 397                         goto error;
 398                 result->params[parse.idx].cipher = parse.p.cipher;
 399                 result->params[parse.idx].key_len = parse.p.key_len;
 400                 result->params[parse.idx].key = result->data[parse.idx];
 401                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 402         }
 403
 404         return result;
 405  error:
 406         kfree(result);
 407         return ERR_PTR(err);
 408 }
 409
 410 static int nl80211_key_allowed(struct wireless_dev *wdev)
 411 {
 412         ASSERT_WDEV_LOCK(wdev);
 413
 414         if (!netif_running(wdev->netdev))
 415                 return -ENETDOWN;
 416
 417         switch (wdev->iftype) {
 418         case NL80211_IFTYPE_AP:
 419         case NL80211_IFTYPE_AP_VLAN:
 420         case NL80211_IFTYPE_P2P_GO:
 421                 break;
 422         case NL80211_IFTYPE_ADHOC:
 423                 if (!wdev->current_bss)
 424                         return -ENOLINK;
 425                 break;
 426         case NL80211_IFTYPE_STATION:
 427         case NL80211_IFTYPE_P2P_CLIENT:
 428                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 429                         return -ENOLINK;
 430                 break;
 431         default:
 432                 return -EINVAL;
 433         }
 434
 435         return 0;
 436 }
 437
 438 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 439                               struct cfg80211_registered_device *dev)
 440 {
 441         void *hdr;
 442         struct nlattr *nl_bands, *nl_band;
 443         struct nlattr *nl_freqs, *nl_freq;
 444         struct nlattr *nl_rates, *nl_rate;
 445         struct nlattr *nl_modes;
 446         struct nlattr *nl_cmds;
 447         enum ieee80211_band band;
 448         struct ieee80211_channel *chan;
 449         struct ieee80211_rate *rate;
 450         int i;
 451         u16 ifmodes = dev->wiphy.interface_modes;
 452         const struct ieee80211_txrx_stypes *mgmt_stypes =
 453                                 dev->wiphy.mgmt_stypes;
 454
 455         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 456         if (!hdr)
 457                 return -1;
 458
 459         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 460         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 461
 462         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 463                     cfg80211_rdev_list_generation);
 464
 465         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 466                    dev->wiphy.retry_short);
 467         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 468                    dev->wiphy.retry_long);
 469         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 470                     dev->wiphy.frag_threshold);
 471         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 472                     dev->wiphy.rts_threshold);
 473         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 474                     dev->wiphy.coverage_class);
 475
 476         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 477                    dev->wiphy.max_scan_ssids);
 478         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 479                     dev->wiphy.max_scan_ie_len);
 480
 481         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 482                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 483                 dev->wiphy.cipher_suites);
 484
 485         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 486                    dev->wiphy.max_num_pmkids);
 487
 488         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 489                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 490
 491         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 492         if (!nl_modes)
 493                 goto nla_put_failure;
 494
 495         i = 0;
 496         while (ifmodes) {
 497                 if (ifmodes & 1)
 498                         NLA_PUT_FLAG(msg, i);
 499                 ifmodes >>= 1;
 500                 i++;
 501         }
 502
 503         nla_nest_end(msg, nl_modes);
 504
 505         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 506         if (!nl_bands)
 507                 goto nla_put_failure;
 508
 509         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 510                 if (!dev->wiphy.bands[band])
 511                         continue;
 512
 513                 nl_band = nla_nest_start(msg, band);
 514                 if (!nl_band)
 515                         goto nla_put_failure;
 516
 517                 /* add HT info */
 518                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 519                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 520                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 521                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 522                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 523                                 dev->wiphy.bands[band]->ht_cap.cap);
 524                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 525                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 526                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 527                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 528                 }
 529
 530                 /* add frequencies */
 531                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 532                 if (!nl_freqs)
 533                         goto nla_put_failure;
 534
 535                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 536                         nl_freq = nla_nest_start(msg, i);
 537                         if (!nl_freq)
 538                                 goto nla_put_failure;
 539
 540                         chan = &dev->wiphy.bands[band]->channels[i];
 541
 542                         if (nl80211_msg_put_channel(msg, chan))
 543                                 goto nla_put_failure;
 544
 545                         nla_nest_end(msg, nl_freq);
 546                 }
 547
 548                 nla_nest_end(msg, nl_freqs);
 549
 550                 /* add bitrates */
 551                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 552                 if (!nl_rates)
 553                         goto nla_put_failure;
 554
 555                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 556                         nl_rate = nla_nest_start(msg, i);
 557                         if (!nl_rate)
 558                                 goto nla_put_failure;
 559
 560                         rate = &dev->wiphy.bands[band]->bitrates[i];
 561                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 562                                     rate->bitrate);
 563                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 564                                 NLA_PUT_FLAG(msg,
 565                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 566
 567                         nla_nest_end(msg, nl_rate);
 568                 }
 569
 570                 nla_nest_end(msg, nl_rates);
 571
 572                 nla_nest_end(msg, nl_band);
 573         }
 574         nla_nest_end(msg, nl_bands);
 575
 576         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 577         if (!nl_cmds)
 578                 goto nla_put_failure;
 579
 580         i = 0;
 581 #define CMD(op, n)                                              \
 582          do {                                                   \
 583                 if (dev->ops->op) {                             \
 584                         i++;                                    \
 585                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 586                 }                                               \
 587         } while (0)
 588
 589         CMD(add_virtual_intf, NEW_INTERFACE);
 590         CMD(change_virtual_intf, SET_INTERFACE);
 591         CMD(add_key, NEW_KEY);
 592         CMD(add_beacon, NEW_BEACON);
 593         CMD(add_station, NEW_STATION);
 594         CMD(add_mpath, NEW_MPATH);
 595         CMD(set_mesh_params, SET_MESH_PARAMS);
 596         CMD(change_bss, SET_BSS);
 597         CMD(auth, AUTHENTICATE);
 598         CMD(assoc, ASSOCIATE);
 599         CMD(deauth, DEAUTHENTICATE);
 600         CMD(disassoc, DISASSOCIATE);
 601         CMD(join_ibss, JOIN_IBSS);
 602         CMD(set_pmksa, SET_PMKSA);
 603         CMD(del_pmksa, DEL_PMKSA);
 604         CMD(flush_pmksa, FLUSH_PMKSA);
 605         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 606         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 607         CMD(mgmt_tx, FRAME);
 608         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 609                 i++;
 610                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 611         }
 612         CMD(set_channel, SET_CHANNEL);
 613         CMD(set_wds_peer, SET_WDS_PEER);
 614
 615 #undef CMD
 616
 617         if (dev->ops->connect || dev->ops->auth) {
 618                 i++;
 619                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 620         }
 621
 622         if (dev->ops->disconnect || dev->ops->deauth) {
 623                 i++;
 624                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 625         }
 626
 627         nla_nest_end(msg, nl_cmds);
 628
 629         if (mgmt_stypes) {
 630                 u16 stypes;
 631                 struct nlattr *nl_ftypes, *nl_ifs;
 632                 enum nl80211_iftype ift;
 633
 634                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 635                 if (!nl_ifs)
 636                         goto nla_put_failure;
 637
 638                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 639                         nl_ftypes = nla_nest_start(msg, ift);
 640                         if (!nl_ftypes)
 641                                 goto nla_put_failure;
 642                         i = 0;
 643                         stypes = mgmt_stypes[ift].tx;
 644                         while (stypes) {
 645                                 if (stypes & 1)
 646                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 647                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 648                                 stypes >>= 1;
 649                                 i++;
 650                         }
 651                         nla_nest_end(msg, nl_ftypes);
 652                 }
 653
 654                 nla_nest_end(msg, nl_ifs);
 655
 656                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 657                 if (!nl_ifs)
 658                         goto nla_put_failure;
 659
 660                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 661                         nl_ftypes = nla_nest_start(msg, ift);
 662                         if (!nl_ftypes)
 663                                 goto nla_put_failure;
 664                         i = 0;
 665                         stypes = mgmt_stypes[ift].rx;
 666                         while (stypes) {
 667                                 if (stypes & 1)
 668                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 669                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 670                                 stypes >>= 1;
 671                                 i++;
 672                         }
 673                         nla_nest_end(msg, nl_ftypes);
 674                 }
 675                 nla_nest_end(msg, nl_ifs);
 676         }
 677
 678         return genlmsg_end(msg, hdr);
 679
 680  nla_put_failure:
 681         genlmsg_cancel(msg, hdr);
 682         return -EMSGSIZE;
 683 }
 684
 685 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 686 {
 687         int idx = 0;
 688         int start = cb->args[0];
 689         struct cfg80211_registered_device *dev;
 690
 691         mutex_lock(&cfg80211_mutex);
 692         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 693                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 694                         continue;
 695                 if (++idx <= start)
 696                         continue;
 697                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 698                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 699                                        dev) < 0) {
 700                         idx--;
 701                         break;
 702                 }
 703         }
 704         mutex_unlock(&cfg80211_mutex);
 705
 706         cb->args[0] = idx;
 707
 708         return skb->len;
 709 }
 710
 711 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 712 {
 713         struct sk_buff *msg;
 714         struct cfg80211_registered_device *dev = info->user_ptr[0];
 715
 716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 717         if (!msg)
 718                 return -ENOMEM;
 719
 720         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
 721                 nlmsg_free(msg);
 722                 return -ENOBUFS;
 723         }
 724
 725         return genlmsg_reply(msg, info);
 726 }
 727
 728 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 729         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 730         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 731         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 732         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 733         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 734 };
 735
 736 static int parse_txq_params(struct nlattr *tb[],
 737                             struct ieee80211_txq_params *txq_params)
 738 {
 739         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 740             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 741             !tb[NL80211_TXQ_ATTR_AIFS])
 742                 return -EINVAL;
 743
 744         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 745         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 746         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 747         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 748         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 749
 750         return 0;
 751 }
 752
 753 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 754 {
 755         /*
 756          * You can only set the channel explicitly for AP, mesh
 757          * and WDS type interfaces; all others have their channel
 758          * managed via their respective "establish a connection"
 759          * command (connect, join, ...)
 760          *
 761          * Monitors are special as they are normally slaved to
 762          * whatever else is going on, so they behave as though
 763          * you tried setting the wiphy channel itself.
 764          */
 765         return !wdev ||
 766                 wdev->iftype == NL80211_IFTYPE_AP ||
 767                 wdev->iftype == NL80211_IFTYPE_WDS ||
 768                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 769                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
 770                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
 771 }
 772
 773 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 774                                  struct wireless_dev *wdev,
 775                                  struct genl_info *info)
 776 {
 777         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 778         u32 freq;
 779         int result;
 780
 781         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
 782                 return -EINVAL;
 783
 784         if (!nl80211_can_set_dev_channel(wdev))
 785                 return -EOPNOTSUPP;
 786
 787         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 788                 channel_type = nla_get_u32(info->attrs[
 789                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 790                 if (channel_type != NL80211_CHAN_NO_HT &&
 791                     channel_type != NL80211_CHAN_HT20 &&
 792                     channel_type != NL80211_CHAN_HT40PLUS &&
 793                     channel_type != NL80211_CHAN_HT40MINUS)
 794                         return -EINVAL;
 795         }
 796
 797         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 798
 799         mutex_lock(&rdev->devlist_mtx);
 800         if (wdev) {
 801                 wdev_lock(wdev);
 802                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
 803                 wdev_unlock(wdev);
 804         } else {
 805                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
 806         }
 807         mutex_unlock(&rdev->devlist_mtx);
 808
 809         return result;
 810 }
 811
 812 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 813 {
 814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 815         struct net_device *netdev = info->user_ptr[1];
 816
 817         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 818 }
 819
 820 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
 821 {
 822         struct cfg80211_registered_device *rdev;
 823         struct wireless_dev *wdev;
 824         struct net_device *dev;
 825         u8 *bssid;
 826         int err;
 827
 828         if (!info->attrs[NL80211_ATTR_MAC])
 829                 return -EINVAL;
 830
 831         rtnl_lock();
 832
 833         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
 834         if (err)
 835                 goto unlock_rtnl;
 836
 837         wdev = dev->ieee80211_ptr;
 838
 839         if (netif_running(dev)) {
 840                 err = -EBUSY;
 841                 goto out;
 842         }
 843
 844         if (!rdev->ops->set_wds_peer) {
 845                 err = -EOPNOTSUPP;
 846                 goto out;
 847         }
 848
 849         if (wdev->iftype != NL80211_IFTYPE_WDS) {
 850                 err = -EOPNOTSUPP;
 851                 goto out;
 852         }
 853
 854         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 855         err = rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
 856
 857 out:
 858         cfg80211_unlock_rdev(rdev);
 859         dev_put(dev);
 860 unlock_rtnl:
 861         rtnl_unlock();
 862
 863         return err;
 864 }
 865
 866
 867 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 868 {
 869         struct cfg80211_registered_device *rdev;
 870         struct net_device *netdev = NULL;
 871         struct wireless_dev *wdev;
 872         int result = 0, rem_txq_params = 0;
 873         struct nlattr *nl_txq_params;
 874         u32 changed;
 875         u8 retry_short = 0, retry_long = 0;
 876         u32 frag_threshold = 0, rts_threshold = 0;
 877         u8 coverage_class = 0;
 878
 879         /*
 880          * Try to find the wiphy and netdev. Normally this
 881          * function shouldn't need the netdev, but this is
 882          * done for backward compatibility -- previously
 883          * setting the channel was done per wiphy, but now
 884          * it is per netdev. Previous userland like hostapd
 885          * also passed a netdev to set_wiphy, so that it is
 886          * possible to let that go to the right netdev!
 887          */
 888         mutex_lock(&cfg80211_mutex);
 889
 890         if (info->attrs[NL80211_ATTR_IFINDEX]) {
 891                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 892
 893                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
 894                 if (netdev && netdev->ieee80211_ptr) {
 895                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
 896                         mutex_lock(&rdev->mtx);
 897                 } else
 898                         netdev = NULL;
 899         }
 900
 901         if (!netdev) {
 902                 rdev = __cfg80211_rdev_from_info(info);
 903                 if (IS_ERR(rdev)) {
 904                         mutex_unlock(&cfg80211_mutex);
 905                         return PTR_ERR(rdev);
 906                 }
 907                 wdev = NULL;
 908                 netdev = NULL;
 909                 result = 0;
 910
 911                 mutex_lock(&rdev->mtx);
 912         } else if (netif_running(netdev) &&
 913                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
 914                 wdev = netdev->ieee80211_ptr;
 915         else
 916                 wdev = NULL;
 917
 918         /*
 919          * end workaround code, by now the rdev is available
 920          * and locked, and wdev may or may not be NULL.
 921          */
 922
 923         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 924                 result = cfg80211_dev_rename(
 925                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 926
 927         mutex_unlock(&cfg80211_mutex);
 928
 929         if (result)
 930                 goto bad_res;
 931
 932         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 933                 struct ieee80211_txq_params txq_params;
 934                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 935
 936                 if (!rdev->ops->set_txq_params) {
 937                         result = -EOPNOTSUPP;
 938                         goto bad_res;
 939                 }
 940
 941                 nla_for_each_nested(nl_txq_params,
 942                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 943                                     rem_txq_params) {
 944                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 945                                   nla_data(nl_txq_params),
 946                                   nla_len(nl_txq_params),
 947                                   txq_params_policy);
 948                         result = parse_txq_params(tb, &txq_params);
 949                         if (result)
 950                                 goto bad_res;
 951
 952                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 953                                                            &txq_params);
 954                         if (result)
 955                                 goto bad_res;
 956                 }
 957         }
 958
 959         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 960                 result = __nl80211_set_channel(rdev, wdev, info);
 961                 if (result)
 962                         goto bad_res;
 963         }
 964
 965         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
 966                 enum nl80211_tx_power_setting type;
 967                 int idx, mbm = 0;
 968
 969                 if (!rdev->ops->set_tx_power) {
 970                         result = -EOPNOTSUPP;
 971                         goto bad_res;
 972                 }
 973
 974                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
 975                 type = nla_get_u32(info->attrs[idx]);
 976
 977                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
 978                     (type != NL80211_TX_POWER_AUTOMATIC)) {
 979                         result = -EINVAL;
 980                         goto bad_res;
 981                 }
 982
 983                 if (type != NL80211_TX_POWER_AUTOMATIC) {
 984                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
 985                         mbm = nla_get_u32(info->attrs[idx]);
 986                 }
 987
 988                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
 989                 if (result)
 990                         goto bad_res;
 991         }
 992
 993         changed = 0;
 994
 995         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 996                 retry_short = nla_get_u8(
 997                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 998                 if (retry_short == 0) {
 999                         result = -EINVAL;
1000                         goto bad_res;
1001                 }
1002                 changed |= WIPHY_PARAM_RETRY_SHORT;
1003         }
1004
1005         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1006                 retry_long = nla_get_u8(
1007                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1008                 if (retry_long == 0) {
1009                         result = -EINVAL;
1010                         goto bad_res;
1011                 }
1012                 changed |= WIPHY_PARAM_RETRY_LONG;
1013         }
1014
1015         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1016                 frag_threshold = nla_get_u32(
1017                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1018                 if (frag_threshold < 256) {
1019                         result = -EINVAL;
1020                         goto bad_res;
1021                 }
1022                 if (frag_threshold != (u32) -1) {
1023                         /*
1024                          * Fragments (apart from the last one) are required to
1025                          * have even length. Make the fragmentation code
1026                          * simpler by stripping LSB should someone try to use
1027                          * odd threshold value.
1028                          */
1029                         frag_threshold &= ~0x1;
1030                 }
1031                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1032         }
1033
1034         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1035                 rts_threshold = nla_get_u32(
1036                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1037                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1038         }
1039
1040         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1041                 coverage_class = nla_get_u8(
1042                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1043                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1044         }
1045
1046         if (changed) {
1047                 u8 old_retry_short, old_retry_long;
1048                 u32 old_frag_threshold, old_rts_threshold;
1049                 u8 old_coverage_class;
1050
1051                 if (!rdev->ops->set_wiphy_params) {
1052                         result = -EOPNOTSUPP;
1053                         goto bad_res;
1054                 }
1055
1056                 old_retry_short = rdev->wiphy.retry_short;
1057                 old_retry_long = rdev->wiphy.retry_long;
1058                 old_frag_threshold = rdev->wiphy.frag_threshold;
1059                 old_rts_threshold = rdev->wiphy.rts_threshold;
1060                 old_coverage_class = rdev->wiphy.coverage_class;
1061
1062                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1063                         rdev->wiphy.retry_short = retry_short;
1064                 if (changed & WIPHY_PARAM_RETRY_LONG)
1065                         rdev->wiphy.retry_long = retry_long;
1066                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1067                         rdev->wiphy.frag_threshold = frag_threshold;
1068                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1069                         rdev->wiphy.rts_threshold = rts_threshold;
1070                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1071                         rdev->wiphy.coverage_class = coverage_class;
1072
1073                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1074                 if (result) {
1075                         rdev->wiphy.retry_short = old_retry_short;
1076                         rdev->wiphy.retry_long = old_retry_long;
1077                         rdev->wiphy.frag_threshold = old_frag_threshold;
1078                         rdev->wiphy.rts_threshold = old_rts_threshold;
1079                         rdev->wiphy.coverage_class = old_coverage_class;
1080                 }
1081         }
1082
1083  bad_res:
1084         mutex_unlock(&rdev->mtx);
1085         if (netdev)
1086                 dev_put(netdev);
1087         return result;
1088 }
1089
1090
1091 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1092                               struct cfg80211_registered_device *rdev,
1093                               struct net_device *dev)
1094 {
1095         void *hdr;
1096
1097         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1098         if (!hdr)
1099                 return -1;
1100
1101         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1102         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1103         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1104         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1105
1106         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1107                     rdev->devlist_generation ^
1108                         (cfg80211_rdev_list_generation << 2));
1109
1110         return genlmsg_end(msg, hdr);
1111
1112  nla_put_failure:
1113         genlmsg_cancel(msg, hdr);
1114         return -EMSGSIZE;
1115 }
1116
1117 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1118 {
1119         int wp_idx = 0;
1120         int if_idx = 0;
1121         int wp_start = cb->args[0];
1122         int if_start = cb->args[1];
1123         struct cfg80211_registered_device *rdev;
1124         struct wireless_dev *wdev;
1125
1126         mutex_lock(&cfg80211_mutex);
1127         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1128                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1129                         continue;
1130                 if (wp_idx < wp_start) {
1131                         wp_idx++;
1132                         continue;
1133                 }
1134                 if_idx = 0;
1135
1136                 mutex_lock(&rdev->devlist_mtx);
1137                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1138                         if (if_idx < if_start) {
1139                                 if_idx++;
1140                                 continue;
1141                         }
1142                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1143                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1144                                                rdev, wdev->netdev) < 0) {
1145                                 mutex_unlock(&rdev->devlist_mtx);
1146                                 goto out;
1147                         }
1148                         if_idx++;
1149                 }
1150                 mutex_unlock(&rdev->devlist_mtx);
1151
1152                 wp_idx++;
1153         }
1154  out:
1155         mutex_unlock(&cfg80211_mutex);
1156
1157         cb->args[0] = wp_idx;
1158         cb->args[1] = if_idx;
1159
1160         return skb->len;
1161 }
1162
1163 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1164 {
1165         struct sk_buff *msg;
1166         struct cfg80211_registered_device *dev = info->user_ptr[0];
1167         struct net_device *netdev = info->user_ptr[1];
1168
1169         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1170         if (!msg)
1171                 return -ENOMEM;
1172
1173         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1174                                dev, netdev) < 0) {
1175                 nlmsg_free(msg);
1176                 return -ENOBUFS;
1177         }
1178
1179         return genlmsg_reply(msg, info);
1180 }
1181
1182 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1183         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1184         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1185         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1186         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1187         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1188 };
1189
1190 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1191 {
1192         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1193         int flag;
1194
1195         *mntrflags = 0;
1196
1197         if (!nla)
1198                 return -EINVAL;
1199
1200         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1201                              nla, mntr_flags_policy))
1202                 return -EINVAL;
1203
1204         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1205                 if (flags[flag])
1206                         *mntrflags |= (1<<flag);
1207
1208         return 0;
1209 }
1210
1211 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1212                                struct net_device *netdev, u8 use_4addr,
1213                                enum nl80211_iftype iftype)
1214 {
1215         if (!use_4addr) {
1216                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1217                         return -EBUSY;
1218                 return 0;
1219         }
1220
1221         switch (iftype) {
1222         case NL80211_IFTYPE_AP_VLAN:
1223                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1224                         return 0;
1225                 break;
1226         case NL80211_IFTYPE_STATION:
1227                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1228                         return 0;
1229                 break;
1230         default:
1231                 break;
1232         }
1233
1234         return -EOPNOTSUPP;
1235 }
1236
1237 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1238 {
1239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1240         struct vif_params params;
1241         int err;
1242         enum nl80211_iftype otype, ntype;
1243         struct net_device *dev = info->user_ptr[1];
1244         u32 _flags, *flags = NULL;
1245         bool change = false;
1246
1247         memset(&params, 0, sizeof(params));
1248
1249         otype = ntype = dev->ieee80211_ptr->iftype;
1250
1251         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1252                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1253                 if (otype != ntype)
1254                         change = true;
1255                 if (ntype > NL80211_IFTYPE_MAX)
1256                         return -EINVAL;
1257         }
1258
1259         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1260                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1261                         return -EINVAL;
1262                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1263                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1264                 change = true;
1265         }
1266
1267         if (info->attrs[NL80211_ATTR_4ADDR]) {
1268                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1269                 change = true;
1270                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1271                 if (err)
1272                         return err;
1273         } else {
1274                 params.use_4addr = -1;
1275         }
1276
1277         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1278                 if (ntype != NL80211_IFTYPE_MONITOR)
1279                         return -EINVAL;
1280                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1281                                           &_flags);
1282                 if (err)
1283                         return err;
1284
1285                 flags = &_flags;
1286                 change = true;
1287         }
1288
1289         if (change)
1290                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1291         else
1292                 err = 0;
1293
1294         if (!err && params.use_4addr != -1)
1295                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1296
1297         return err;
1298 }
1299
1300 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1301 {
1302         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1303         struct vif_params params;
1304         int err;
1305         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1306         u32 flags;
1307
1308         memset(&params, 0, sizeof(params));
1309
1310         if (!info->attrs[NL80211_ATTR_IFNAME])
1311                 return -EINVAL;
1312
1313         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1314                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1315                 if (type > NL80211_IFTYPE_MAX)
1316                         return -EINVAL;
1317         }
1318
1319         if (!rdev->ops->add_virtual_intf ||
1320             !(rdev->wiphy.interface_modes & (1 << type)))
1321                 return -EOPNOTSUPP;
1322
1323         if (type == NL80211_IFTYPE_MESH_POINT &&
1324             info->attrs[NL80211_ATTR_MESH_ID]) {
1325                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1326                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1327         }
1328
1329         if (info->attrs[NL80211_ATTR_4ADDR]) {
1330                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1331                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1332                 if (err)
1333                         return err;
1334         }
1335
1336         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1337                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1338                                   &flags);
1339         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1340                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1341                 type, err ? NULL : &flags, &params);
1342
1343         return err;
1344 }
1345
1346 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1347 {
1348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1349         struct net_device *dev = info->user_ptr[1];
1350
1351         if (!rdev->ops->del_virtual_intf)
1352                 return -EOPNOTSUPP;
1353
1354         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1355 }
1356
1357 struct get_key_cookie {
1358         struct sk_buff *msg;
1359         int error;
1360         int idx;
1361 };
1362
1363 static void get_key_callback(void *c, struct key_params *params)
1364 {
1365         struct nlattr *key;
1366         struct get_key_cookie *cookie = c;
1367
1368         if (params->key)
1369                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1370                         params->key_len, params->key);
1371
1372         if (params->seq)
1373                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1374                         params->seq_len, params->seq);
1375
1376         if (params->cipher)
1377                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1378                             params->cipher);
1379
1380         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1381         if (!key)
1382                 goto nla_put_failure;
1383
1384         if (params->key)
1385                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1386                         params->key_len, params->key);
1387
1388         if (params->seq)
1389                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1390                         params->seq_len, params->seq);
1391
1392         if (params->cipher)
1393                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1394                             params->cipher);
1395
1396         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1397
1398         nla_nest_end(cookie->msg, key);
1399
1400         return;
1401  nla_put_failure:
1402         cookie->error = 1;
1403 }
1404
1405 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1406 {
1407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1408         int err;
1409         struct net_device *dev = info->user_ptr[1];
1410         u8 key_idx = 0;
1411         u8 *mac_addr = NULL;
1412         struct get_key_cookie cookie = {
1413                 .error = 0,
1414         };
1415         void *hdr;
1416         struct sk_buff *msg;
1417
1418         if (info->attrs[NL80211_ATTR_KEY_IDX])
1419                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1420
1421         if (key_idx > 5)
1422                 return -EINVAL;
1423
1424         if (info->attrs[NL80211_ATTR_MAC])
1425                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1426
1427         if (!rdev->ops->get_key)
1428                 return -EOPNOTSUPP;
1429
1430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1431         if (!msg)
1432                 return -ENOMEM;
1433
1434         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1435                              NL80211_CMD_NEW_KEY);
1436         if (IS_ERR(hdr))
1437                 return PTR_ERR(hdr);
1438
1439         cookie.msg = msg;
1440         cookie.idx = key_idx;
1441
1442         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1443         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1444         if (mac_addr)
1445                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1446
1447         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1448                                 &cookie, get_key_callback);
1449
1450         if (err)
1451                 goto free_msg;
1452
1453         if (cookie.error)
1454                 goto nla_put_failure;
1455
1456         genlmsg_end(msg, hdr);
1457         return genlmsg_reply(msg, info);
1458
1459  nla_put_failure:
1460         err = -ENOBUFS;
1461  free_msg:
1462         nlmsg_free(msg);
1463         return err;
1464 }
1465
1466 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1467 {
1468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1469         struct key_parse key;
1470         int err;
1471         struct net_device *dev = info->user_ptr[1];
1472         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1473                     u8 key_index);
1474
1475         err = nl80211_parse_key(info, &key);
1476         if (err)
1477                 return err;
1478
1479         if (key.idx < 0)
1480                 return -EINVAL;
1481
1482         /* only support setting default key */
1483         if (!key.def && !key.defmgmt)
1484                 return -EINVAL;
1485
1486         if (key.def)
1487                 func = rdev->ops->set_default_key;
1488         else
1489                 func = rdev->ops->set_default_mgmt_key;
1490
1491         if (!func)
1492                 return -EOPNOTSUPP;
1493
1494         wdev_lock(dev->ieee80211_ptr);
1495         err = nl80211_key_allowed(dev->ieee80211_ptr);
1496         if (!err)
1497                 err = func(&rdev->wiphy, dev, key.idx);
1498
1499 #ifdef CONFIG_CFG80211_WEXT
1500         if (!err) {
1501                 if (func == rdev->ops->set_default_key)
1502                         dev->ieee80211_ptr->wext.default_key = key.idx;
1503                 else
1504                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1505         }
1506 #endif
1507         wdev_unlock(dev->ieee80211_ptr);
1508
1509         return err;
1510 }
1511
1512 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1513 {
1514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1515         int err;
1516         struct net_device *dev = info->user_ptr[1];
1517         struct key_parse key;
1518         u8 *mac_addr = NULL;
1519
1520         err = nl80211_parse_key(info, &key);
1521         if (err)
1522                 return err;
1523
1524         if (!key.p.key)
1525                 return -EINVAL;
1526
1527         if (info->attrs[NL80211_ATTR_MAC])
1528                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1529
1530         if (!rdev->ops->add_key)
1531                 return -EOPNOTSUPP;
1532
1533         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr))
1534                 return -EINVAL;
1535
1536         wdev_lock(dev->ieee80211_ptr);
1537         err = nl80211_key_allowed(dev->ieee80211_ptr);
1538         if (!err)
1539                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1540                                          mac_addr, &key.p);
1541         wdev_unlock(dev->ieee80211_ptr);
1542
1543         return err;
1544 }
1545
1546 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1547 {
1548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1549         int err;
1550         struct net_device *dev = info->user_ptr[1];
1551         u8 *mac_addr = NULL;
1552         struct key_parse key;
1553
1554         err = nl80211_parse_key(info, &key);
1555         if (err)
1556                 return err;
1557
1558         if (info->attrs[NL80211_ATTR_MAC])
1559                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1560
1561         if (!rdev->ops->del_key)
1562                 return -EOPNOTSUPP;
1563
1564         wdev_lock(dev->ieee80211_ptr);
1565         err = nl80211_key_allowed(dev->ieee80211_ptr);
1566         if (!err)
1567                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1568
1569 #ifdef CONFIG_CFG80211_WEXT
1570         if (!err) {
1571                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1572                         dev->ieee80211_ptr->wext.default_key = -1;
1573                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1574                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1575         }
1576 #endif
1577         wdev_unlock(dev->ieee80211_ptr);
1578
1579         return err;
1580 }
1581
1582 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1583 {
1584         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1585                     struct beacon_parameters *info);
1586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1587         struct net_device *dev = info->user_ptr[1];
1588         struct beacon_parameters params;
1589         int haveinfo = 0;
1590
1591         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1592                 return -EINVAL;
1593
1594         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1595             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1596                 return -EOPNOTSUPP;
1597
1598         switch (info->genlhdr->cmd) {
1599         case NL80211_CMD_NEW_BEACON:
1600                 /* these are required for NEW_BEACON */
1601                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1602                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1603                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1604                         return -EINVAL;
1605
1606                 call = rdev->ops->add_beacon;
1607                 break;
1608         case NL80211_CMD_SET_BEACON:
1609                 call = rdev->ops->set_beacon;
1610                 break;
1611         default:
1612                 WARN_ON(1);
1613                 return -EOPNOTSUPP;
1614         }
1615
1616         if (!call)
1617                 return -EOPNOTSUPP;
1618
1619         memset(&params, 0, sizeof(params));
1620
1621         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1622                 params.interval =
1623                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1624                 haveinfo = 1;
1625         }
1626
1627         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1628                 params.dtim_period =
1629                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1630                 haveinfo = 1;
1631         }
1632
1633         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1634                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1635                 params.head_len =
1636                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1637                 haveinfo = 1;
1638         }
1639
1640         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1641                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1642                 params.tail_len =
1643                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1644                 haveinfo = 1;
1645         }
1646
1647         if (!haveinfo)
1648                 return -EINVAL;
1649
1650         return call(&rdev->wiphy, dev, &params);
1651 }
1652
1653 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1654 {
1655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1656         struct net_device *dev = info->user_ptr[1];
1657
1658         if (!rdev->ops->del_beacon)
1659                 return -EOPNOTSUPP;
1660
1661         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1662             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1663                 return -EOPNOTSUPP;
1664
1665         return rdev->ops->del_beacon(&rdev->wiphy, dev);
1666 }
1667
1668 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1669         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1670         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1671         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1672         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1673 };
1674
1675 static int parse_station_flags(struct genl_info *info,
1676                                struct station_parameters *params)
1677 {
1678         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1679         struct nlattr *nla;
1680         int flag;
1681
1682         /*
1683          * Try parsing the new attribute first so userspace
1684          * can specify both for older kernels.
1685          */
1686         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1687         if (nla) {
1688                 struct nl80211_sta_flag_update *sta_flags;
1689
1690                 sta_flags = nla_data(nla);
1691                 params->sta_flags_mask = sta_flags->mask;
1692                 params->sta_flags_set = sta_flags->set;
1693                 if ((params->sta_flags_mask |
1694                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1695                         return -EINVAL;
1696                 return 0;
1697         }
1698
1699         /* if present, parse the old attribute */
1700
1701         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1702         if (!nla)
1703                 return 0;
1704
1705         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1706                              nla, sta_flags_policy))
1707                 return -EINVAL;
1708
1709         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1710         params->sta_flags_mask &= ~1;
1711
1712         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1713                 if (flags[flag])
1714                         params->sta_flags_set |= (1<<flag);
1715
1716         return 0;
1717 }
1718
1719 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1720                                 int flags, struct net_device *dev,
1721                                 const u8 *mac_addr, struct station_info *sinfo)
1722 {
1723         void *hdr;
1724         struct nlattr *sinfoattr, *txrate;
1725         u16 bitrate;
1726
1727         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1728         if (!hdr)
1729                 return -1;
1730
1731         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1732         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1733
1734         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1735
1736         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1737         if (!sinfoattr)
1738                 goto nla_put_failure;
1739         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1740                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1741                             sinfo->inactive_time);
1742         if (sinfo->filled & STATION_INFO_RX_BYTES)
1743                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1744                             sinfo->rx_bytes);
1745         if (sinfo->filled & STATION_INFO_TX_BYTES)
1746                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1747                             sinfo->tx_bytes);
1748         if (sinfo->filled & STATION_INFO_LLID)
1749                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1750                             sinfo->llid);
1751         if (sinfo->filled & STATION_INFO_PLID)
1752                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1753                             sinfo->plid);
1754         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1755                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1756                             sinfo->plink_state);
1757         if (sinfo->filled & STATION_INFO_SIGNAL)
1758                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1759                            sinfo->signal);
1760         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1761                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1762                 if (!txrate)
1763                         goto nla_put_failure;
1764
1765                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1766                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1767                 if (bitrate > 0)
1768                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1769
1770                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1771                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1772                                     sinfo->txrate.mcs);
1773                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1774                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1775                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1776                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1777
1778                 nla_nest_end(msg, txrate);
1779         }
1780         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1781                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1782                             sinfo->rx_packets);
1783         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1784                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1785                             sinfo->tx_packets);
1786         nla_nest_end(msg, sinfoattr);
1787
1788         return genlmsg_end(msg, hdr);
1789
1790  nla_put_failure:
1791         genlmsg_cancel(msg, hdr);
1792         return -EMSGSIZE;
1793 }
1794
1795 static int nl80211_dump_station(struct sk_buff *skb,
1796                                 struct netlink_callback *cb)
1797 {
1798         struct station_info sinfo;
1799         struct cfg80211_registered_device *dev;
1800         struct net_device *netdev;
1801         u8 mac_addr[ETH_ALEN];
1802         int ifidx = cb->args[0];
1803         int sta_idx = cb->args[1];
1804         int err;
1805
1806         if (!ifidx)
1807                 ifidx = nl80211_get_ifidx(cb);
1808         if (ifidx < 0)
1809                 return ifidx;
1810
1811         rtnl_lock();
1812
1813         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1814         if (!netdev) {
1815                 err = -ENODEV;
1816                 goto out_rtnl;
1817         }
1818
1819         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1820         if (IS_ERR(dev)) {
1821                 err = PTR_ERR(dev);
1822                 goto out_rtnl;
1823         }
1824
1825         if (!dev->ops->dump_station) {
1826                 err = -EOPNOTSUPP;
1827                 goto out_err;
1828         }
1829
1830         while (1) {
1831                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1832                                              mac_addr, &sinfo);
1833                 if (err == -ENOENT)
1834                         break;
1835                 if (err)
1836                         goto out_err;
1837
1838                 if (nl80211_send_station(skb,
1839                                 NETLINK_CB(cb->skb).pid,
1840                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1841                                 netdev, mac_addr,
1842                                 &sinfo) < 0)
1843                         goto out;
1844
1845                 sta_idx++;
1846         }
1847
1848
1849  out:
1850         cb->args[1] = sta_idx;
1851         err = skb->len;
1852  out_err:
1853         cfg80211_unlock_rdev(dev);
1854  out_rtnl:
1855         rtnl_unlock();
1856
1857         return err;
1858 }
1859
1860 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1861 {
1862         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1863         struct net_device *dev = info->user_ptr[1];
1864         struct station_info sinfo;
1865         struct sk_buff *msg;
1866         u8 *mac_addr = NULL;
1867         int err;
1868
1869         memset(&sinfo, 0, sizeof(sinfo));
1870
1871         if (!info->attrs[NL80211_ATTR_MAC])
1872                 return -EINVAL;
1873
1874         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1875
1876         if (!rdev->ops->get_station)
1877                 return -EOPNOTSUPP;
1878
1879         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1880         if (err)
1881                 return err;
1882
1883         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1884         if (!msg)
1885                 return -ENOMEM;
1886
1887         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1888                                  dev, mac_addr, &sinfo) < 0) {
1889                 nlmsg_free(msg);
1890                 return -ENOBUFS;
1891         }
1892
1893         return genlmsg_reply(msg, info);
1894 }
1895
1896 /*
1897  * Get vlan interface making sure it is running and on the right wiphy.
1898  */
1899 static int get_vlan(struct genl_info *info,
1900                     struct cfg80211_registered_device *rdev,
1901                     struct net_device **vlan)
1902 {
1903         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1904         *vlan = NULL;
1905
1906         if (vlanattr) {
1907                 *vlan = dev_get_by_index(genl_info_net(info),
1908                                          nla_get_u32(vlanattr));
1909                 if (!*vlan)
1910                         return -ENODEV;
1911                 if (!(*vlan)->ieee80211_ptr)
1912                         return -EINVAL;
1913                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1914                         return -EINVAL;
1915                 if (!netif_running(*vlan))
1916                         return -ENETDOWN;
1917         }
1918         return 0;
1919 }
1920
1921 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1922 {
1923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1924         int err;
1925         struct net_device *dev = info->user_ptr[1];
1926         struct station_parameters params;
1927         u8 *mac_addr = NULL;
1928
1929         memset(&params, 0, sizeof(params));
1930
1931         params.listen_interval = -1;
1932
1933         if (info->attrs[NL80211_ATTR_STA_AID])
1934                 return -EINVAL;
1935
1936         if (!info->attrs[NL80211_ATTR_MAC])
1937                 return -EINVAL;
1938
1939         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1940
1941         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1942                 params.supported_rates =
1943                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1944                 params.supported_rates_len =
1945                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1946         }
1947
1948         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1949                 params.listen_interval =
1950                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1951
1952         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1953                 params.ht_capa =
1954                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1955
1956         if (parse_station_flags(info, &params))
1957                 return -EINVAL;
1958
1959         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1960                 params.plink_action =
1961                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1962
1963         err = get_vlan(info, rdev, &params.vlan);
1964         if (err)
1965                 goto out;
1966
1967         /* validate settings */
1968         err = 0;
1969
1970         switch (dev->ieee80211_ptr->iftype) {
1971         case NL80211_IFTYPE_AP:
1972         case NL80211_IFTYPE_AP_VLAN:
1973         case NL80211_IFTYPE_P2P_GO:
1974                 /* disallow mesh-specific things */
1975                 if (params.plink_action)
1976                         err = -EINVAL;
1977                 break;
1978         case NL80211_IFTYPE_P2P_CLIENT:
1979         case NL80211_IFTYPE_STATION:
1980                 /* disallow everything but AUTHORIZED flag */
1981                 if (params.plink_action)
1982                         err = -EINVAL;
1983                 if (params.vlan)
1984                         err = -EINVAL;
1985                 if (params.supported_rates)
1986                         err = -EINVAL;
1987                 if (params.ht_capa)
1988                         err = -EINVAL;
1989                 if (params.listen_interval >= 0)
1990                         err = -EINVAL;
1991                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1992                         err = -EINVAL;
1993                 break;
1994         case NL80211_IFTYPE_MESH_POINT:
1995                 /* disallow things mesh doesn't support */
1996                 if (params.vlan)
1997                         err = -EINVAL;
1998                 if (params.ht_capa)
1999                         err = -EINVAL;
2000                 if (params.listen_interval >= 0)
2001                         err = -EINVAL;
2002                 if (params.supported_rates)
2003                         err = -EINVAL;
2004                 if (params.sta_flags_mask)
2005                         err = -EINVAL;
2006                 break;
2007         default:
2008                 err = -EINVAL;
2009         }
2010
2011         if (err)
2012                 goto out;
2013
2014         if (!rdev->ops->change_station) {
2015                 err = -EOPNOTSUPP;
2016                 goto out;
2017         }
2018
2019         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2020
2021  out:
2022         if (params.vlan)
2023                 dev_put(params.vlan);
2024
2025         return err;
2026 }
2027
2028 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2029 {
2030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2031         int err;
2032         struct net_device *dev = info->user_ptr[1];
2033         struct station_parameters params;
2034         u8 *mac_addr = NULL;
2035
2036         memset(&params, 0, sizeof(params));
2037
2038         if (!info->attrs[NL80211_ATTR_MAC])
2039                 return -EINVAL;
2040
2041         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2042                 return -EINVAL;
2043
2044         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2045                 return -EINVAL;
2046
2047         if (!info->attrs[NL80211_ATTR_STA_AID])
2048                 return -EINVAL;
2049
2050         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2051         params.supported_rates =
2052                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2053         params.supported_rates_len =
2054                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2055         params.listen_interval =
2056                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2057
2058         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2059         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2060                 return -EINVAL;
2061
2062         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2063                 params.ht_capa =
2064                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2065
2066         if (parse_station_flags(info, &params))
2067                 return -EINVAL;
2068
2069         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2070             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2071             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2072                 return -EINVAL;
2073
2074         err = get_vlan(info, rdev, &params.vlan);
2075         if (err)
2076                 goto out;
2077
2078         /* validate settings */
2079         err = 0;
2080
2081         if (!rdev->ops->add_station) {
2082                 err = -EOPNOTSUPP;
2083                 goto out;
2084         }
2085
2086         if (!netif_running(dev)) {
2087                 err = -ENETDOWN;
2088                 goto out;
2089         }
2090
2091         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2092
2093  out:
2094         if (params.vlan)
2095                 dev_put(params.vlan);
2096         return err;
2097 }
2098
2099 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2100 {
2101         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2102         struct net_device *dev = info->user_ptr[1];
2103         u8 *mac_addr = NULL;
2104
2105         if (info->attrs[NL80211_ATTR_MAC])
2106                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2107
2108         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2109             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2110             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2111             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2112                 return -EINVAL;
2113
2114         if (!rdev->ops->del_station)
2115                 return -EOPNOTSUPP;
2116
2117         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2118 }
2119
2120 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2121                                 int flags, struct net_device *dev,
2122                                 u8 *dst, u8 *next_hop,
2123                                 struct mpath_info *pinfo)
2124 {
2125         void *hdr;
2126         struct nlattr *pinfoattr;
2127
2128         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2129         if (!hdr)
2130                 return -1;
2131
2132         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2133         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2134         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2135
2136         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2137
2138         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2139         if (!pinfoattr)
2140                 goto nla_put_failure;
2141         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2142                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2143                             pinfo->frame_qlen);
2144         if (pinfo->filled & MPATH_INFO_SN)
2145                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2146                             pinfo->sn);
2147         if (pinfo->filled & MPATH_INFO_METRIC)
2148                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2149                             pinfo->metric);
2150         if (pinfo->filled & MPATH_INFO_EXPTIME)
2151                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2152                             pinfo->exptime);
2153         if (pinfo->filled & MPATH_INFO_FLAGS)
2154                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2155                             pinfo->flags);
2156         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2157                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2158                             pinfo->discovery_timeout);
2159         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2160                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2161                             pinfo->discovery_retries);
2162
2163         nla_nest_end(msg, pinfoattr);
2164
2165         return genlmsg_end(msg, hdr);
2166
2167  nla_put_failure:
2168         genlmsg_cancel(msg, hdr);
2169         return -EMSGSIZE;
2170 }
2171
2172 static int nl80211_dump_mpath(struct sk_buff *skb,
2173                               struct netlink_callback *cb)
2174 {
2175         struct mpath_info pinfo;
2176         struct cfg80211_registered_device *dev;
2177         struct net_device *netdev;
2178         u8 dst[ETH_ALEN];
2179         u8 next_hop[ETH_ALEN];
2180         int ifidx = cb->args[0];
2181         int path_idx = cb->args[1];
2182         int err;
2183
2184         if (!ifidx)
2185                 ifidx = nl80211_get_ifidx(cb);
2186         if (ifidx < 0)
2187                 return ifidx;
2188
2189         rtnl_lock();
2190
2191         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2192         if (!netdev) {
2193                 err = -ENODEV;
2194                 goto out_rtnl;
2195         }
2196
2197         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2198         if (IS_ERR(dev)) {
2199                 err = PTR_ERR(dev);
2200                 goto out_rtnl;
2201         }
2202
2203         if (!dev->ops->dump_mpath) {
2204                 err = -EOPNOTSUPP;
2205                 goto out_err;
2206         }
2207
2208         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2209                 err = -EOPNOTSUPP;
2210                 goto out_err;
2211         }
2212
2213         while (1) {
2214                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2215                                            dst, next_hop, &pinfo);
2216                 if (err == -ENOENT)
2217                         break;
2218                 if (err)
2219                         goto out_err;
2220
2221                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2222                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2223                                        netdev, dst, next_hop,
2224                                        &pinfo) < 0)
2225                         goto out;
2226
2227                 path_idx++;
2228         }
2229
2230
2231  out:
2232         cb->args[1] = path_idx;
2233         err = skb->len;
2234  out_err:
2235         cfg80211_unlock_rdev(dev);
2236  out_rtnl:
2237         rtnl_unlock();
2238
2239         return err;
2240 }
2241
2242 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2243 {
2244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2245         int err;
2246         struct net_device *dev = info->user_ptr[1];
2247         struct mpath_info pinfo;
2248         struct sk_buff *msg;
2249         u8 *dst = NULL;
2250         u8 next_hop[ETH_ALEN];
2251
2252         memset(&pinfo, 0, sizeof(pinfo));
2253
2254         if (!info->attrs[NL80211_ATTR_MAC])
2255                 return -EINVAL;
2256
2257         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2258
2259         if (!rdev->ops->get_mpath)
2260                 return -EOPNOTSUPP;
2261
2262         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2263                 return -EOPNOTSUPP;
2264
2265         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2266         if (err)
2267                 return err;
2268
2269         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2270         if (!msg)
2271                 return -ENOMEM;
2272
2273         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2274                                  dev, dst, next_hop, &pinfo) < 0) {
2275                 nlmsg_free(msg);
2276                 return -ENOBUFS;
2277         }
2278
2279         return genlmsg_reply(msg, info);
2280 }
2281
2282 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2283 {
2284         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2285         struct net_device *dev = info->user_ptr[1];
2286         u8 *dst = NULL;
2287         u8 *next_hop = NULL;
2288
2289         if (!info->attrs[NL80211_ATTR_MAC])
2290                 return -EINVAL;
2291
2292         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2293                 return -EINVAL;
2294
2295         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2296         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2297
2298         if (!rdev->ops->change_mpath)
2299                 return -EOPNOTSUPP;
2300
2301         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2302                 return -EOPNOTSUPP;
2303
2304         if (!netif_running(dev))
2305                 return -ENETDOWN;
2306
2307         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2308 }
2309
2310 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2311 {
2312         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2313         struct net_device *dev = info->user_ptr[1];
2314         u8 *dst = NULL;
2315         u8 *next_hop = NULL;
2316
2317         if (!info->attrs[NL80211_ATTR_MAC])
2318                 return -EINVAL;
2319
2320         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2321                 return -EINVAL;
2322
2323         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2324         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2325
2326         if (!rdev->ops->add_mpath)
2327                 return -EOPNOTSUPP;
2328
2329         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2330                 return -EOPNOTSUPP;
2331
2332         if (!netif_running(dev))
2333                 return -ENETDOWN;
2334
2335         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2336 }
2337
2338 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2339 {
2340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2341         struct net_device *dev = info->user_ptr[1];
2342         u8 *dst = NULL;
2343
2344         if (info->attrs[NL80211_ATTR_MAC])
2345                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2346
2347         if (!rdev->ops->del_mpath)
2348                 return -EOPNOTSUPP;
2349
2350         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2351 }
2352
2353 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2354 {
2355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2356         struct net_device *dev = info->user_ptr[1];
2357         struct bss_parameters params;
2358
2359         memset(&params, 0, sizeof(params));
2360         /* default to not changing parameters */
2361         params.use_cts_prot = -1;
2362         params.use_short_preamble = -1;
2363         params.use_short_slot_time = -1;
2364         params.ap_isolate = -1;
2365
2366         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2367                 params.use_cts_prot =
2368                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2369         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2370                 params.use_short_preamble =
2371                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2372         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2373                 params.use_short_slot_time =
2374                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2375         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2376                 params.basic_rates =
2377                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2378                 params.basic_rates_len =
2379                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2380         }
2381         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2382                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2383
2384         if (!rdev->ops->change_bss)
2385                 return -EOPNOTSUPP;
2386
2387         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2388             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2389                 return -EOPNOTSUPP;
2390
2391         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2392 }
2393
2394 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2395         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2396         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2397         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2398         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2399         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2400         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2401 };
2402
2403 static int parse_reg_rule(struct nlattr *tb[],
2404         struct ieee80211_reg_rule *reg_rule)
2405 {
2406         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2407         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2408
2409         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2410                 return -EINVAL;
2411         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2412                 return -EINVAL;
2413         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2414                 return -EINVAL;
2415         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2416                 return -EINVAL;
2417         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2418                 return -EINVAL;
2419
2420         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2421
2422         freq_range->start_freq_khz =
2423                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2424         freq_range->end_freq_khz =
2425                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2426         freq_range->max_bandwidth_khz =
2427                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2428
2429         power_rule->max_eirp =
2430                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2431
2432         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2433                 power_rule->max_antenna_gain =
2434                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2435
2436         return 0;
2437 }
2438
2439 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2440 {
2441         int r;
2442         char *data = NULL;
2443
2444         /*
2445          * You should only get this when cfg80211 hasn't yet initialized
2446          * completely when built-in to the kernel right between the time
2447          * window between nl80211_init() and regulatory_init(), if that is
2448          * even possible.
2449          */
2450         mutex_lock(&cfg80211_mutex);
2451         if (unlikely(!cfg80211_regdomain)) {
2452                 mutex_unlock(&cfg80211_mutex);
2453                 return -EINPROGRESS;
2454         }
2455         mutex_unlock(&cfg80211_mutex);
2456
2457         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2458                 return -EINVAL;
2459
2460         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2461
2462         r = regulatory_hint_user(data);
2463
2464         return r;
2465 }
2466
2467 static int nl80211_get_mesh_params(struct sk_buff *skb,
2468         struct genl_info *info)
2469 {
2470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2471         struct mesh_config cur_params;
2472         int err;
2473         struct net_device *dev = info->user_ptr[1];
2474         void *hdr;
2475         struct nlattr *pinfoattr;
2476         struct sk_buff *msg;
2477
2478         if (!rdev->ops->get_mesh_params)
2479                 return -EOPNOTSUPP;
2480
2481         /* Get the mesh params */
2482         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2483         if (err)
2484                 return err;
2485
2486         /* Draw up a netlink message to send back */
2487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2488         if (!msg)
2489                 return -ENOMEM;
2490         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2491                              NL80211_CMD_GET_MESH_PARAMS);
2492         if (!hdr)
2493                 goto nla_put_failure;
2494         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2495         if (!pinfoattr)
2496                 goto nla_put_failure;
2497         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2498         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2499                         cur_params.dot11MeshRetryTimeout);
2500         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2501                         cur_params.dot11MeshConfirmTimeout);
2502         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2503                         cur_params.dot11MeshHoldingTimeout);
2504         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2505                         cur_params.dot11MeshMaxPeerLinks);
2506         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2507                         cur_params.dot11MeshMaxRetries);
2508         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2509                         cur_params.dot11MeshTTL);
2510         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2511                         cur_params.auto_open_plinks);
2512         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2513                         cur_params.dot11MeshHWMPmaxPREQretries);
2514         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2515                         cur_params.path_refresh_time);
2516         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2517                         cur_params.min_discovery_timeout);
2518         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2519                         cur_params.dot11MeshHWMPactivePathTimeout);
2520         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2521                         cur_params.dot11MeshHWMPpreqMinInterval);
2522         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2523                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2524         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2525                         cur_params.dot11MeshHWMPRootMode);
2526         nla_nest_end(msg, pinfoattr);
2527         genlmsg_end(msg, hdr);
2528         return genlmsg_reply(msg, info);
2529
2530  nla_put_failure:
2531         genlmsg_cancel(msg, hdr);
2532         nlmsg_free(msg);
2533         return -ENOBUFS;
2534 }
2535
2536 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2537 do {\
2538         if (table[attr_num]) {\
2539                 cfg.param = nla_fn(table[attr_num]); \
2540                 mask |= (1 << (attr_num - 1)); \
2541         } \
2542 } while (0);\
2543
2544 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2545         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2546         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2547         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2548         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2549         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2550         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2551         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2552
2553         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2554         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2555         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2556         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2557         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2558         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2559 };
2560
2561 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2562 {
2563         u32 mask;
2564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2565         struct net_device *dev = info->user_ptr[1];
2566         struct mesh_config cfg;
2567         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2568         struct nlattr *parent_attr;
2569
2570         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2571         if (!parent_attr)
2572                 return -EINVAL;
2573         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2574                         parent_attr, nl80211_meshconf_params_policy))
2575                 return -EINVAL;
2576
2577         if (!rdev->ops->set_mesh_params)
2578                 return -EOPNOTSUPP;
2579
2580         /* This makes sure that there aren't more than 32 mesh config
2581          * parameters (otherwise our bitfield scheme would not work.) */
2582         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2583
2584         /* Fill in the params struct */
2585         mask = 0;
2586         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2587                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2588         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2589                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2590         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2591                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2592         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2593                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2594         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2595                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2596         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2597                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2598         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2599                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2600         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2601                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2602                         nla_get_u8);
2603         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2604                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2605         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2606                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2607                         nla_get_u16);
2608         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2609                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2610                         nla_get_u32);
2611         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2612                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2613                         nla_get_u16);
2614         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2615                         dot11MeshHWMPnetDiameterTraversalTime,
2616                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2617                         nla_get_u16);
2618         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2619                         dot11MeshHWMPRootMode, mask,
2620                         NL80211_MESHCONF_HWMP_ROOTMODE,
2621                         nla_get_u8);
2622
2623         /* Apply changes */
2624         return rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2625 }
2626
2627 #undef FILL_IN_MESH_PARAM_IF_SET
2628
2629 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2630 {
2631         struct sk_buff *msg;
2632         void *hdr = NULL;
2633         struct nlattr *nl_reg_rules;
2634         unsigned int i;
2635         int err = -EINVAL;
2636
2637         mutex_lock(&cfg80211_mutex);
2638
2639         if (!cfg80211_regdomain)
2640                 goto out;
2641
2642         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2643         if (!msg) {
2644                 err = -ENOBUFS;
2645                 goto out;
2646         }
2647
2648         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2649                              NL80211_CMD_GET_REG);
2650         if (!hdr)
2651                 goto nla_put_failure;
2652
2653         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2654                 cfg80211_regdomain->alpha2);
2655
2656         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2657         if (!nl_reg_rules)
2658                 goto nla_put_failure;
2659
2660         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2661                 struct nlattr *nl_reg_rule;
2662                 const struct ieee80211_reg_rule *reg_rule;
2663                 const struct ieee80211_freq_range *freq_range;
2664                 const struct ieee80211_power_rule *power_rule;
2665
2666                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2667                 freq_range = &reg_rule->freq_range;
2668                 power_rule = &reg_rule->power_rule;
2669
2670                 nl_reg_rule = nla_nest_start(msg, i);
2671                 if (!nl_reg_rule)
2672                         goto nla_put_failure;
2673
2674                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2675                         reg_rule->flags);
2676                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2677                         freq_range->start_freq_khz);
2678                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2679                         freq_range->end_freq_khz);
2680                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2681                         freq_range->max_bandwidth_khz);
2682                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2683                         power_rule->max_antenna_gain);
2684                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2685                         power_rule->max_eirp);
2686
2687                 nla_nest_end(msg, nl_reg_rule);
2688         }
2689
2690         nla_nest_end(msg, nl_reg_rules);
2691
2692         genlmsg_end(msg, hdr);
2693         err = genlmsg_reply(msg, info);
2694         goto out;
2695
2696 nla_put_failure:
2697         genlmsg_cancel(msg, hdr);
2698         nlmsg_free(msg);
2699         err = -EMSGSIZE;
2700 out:
2701         mutex_unlock(&cfg80211_mutex);
2702         return err;
2703 }
2704
2705 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2706 {
2707         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2708         struct nlattr *nl_reg_rule;
2709         char *alpha2 = NULL;
2710         int rem_reg_rules = 0, r = 0;
2711         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2712         struct ieee80211_regdomain *rd = NULL;
2713
2714         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2715                 return -EINVAL;
2716
2717         if (!info->attrs[NL80211_ATTR_REG_RULES])
2718                 return -EINVAL;
2719
2720         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2721
2722         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2723                         rem_reg_rules) {
2724                 num_rules++;
2725                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2726                         return -EINVAL;
2727         }
2728
2729         mutex_lock(&cfg80211_mutex);
2730
2731         if (!reg_is_valid_request(alpha2)) {
2732                 r = -EINVAL;
2733                 goto bad_reg;
2734         }
2735
2736         size_of_regd = sizeof(struct ieee80211_regdomain) +
2737                 (num_rules * sizeof(struct ieee80211_reg_rule));
2738
2739         rd = kzalloc(size_of_regd, GFP_KERNEL);
2740         if (!rd) {
2741                 r = -ENOMEM;
2742                 goto bad_reg;
2743         }
2744
2745         rd->n_reg_rules = num_rules;
2746         rd->alpha2[0] = alpha2[0];
2747         rd->alpha2[1] = alpha2[1];
2748
2749         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2750                         rem_reg_rules) {
2751                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2752                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2753                         reg_rule_policy);
2754                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2755                 if (r)
2756                         goto bad_reg;
2757
2758                 rule_idx++;
2759
2760                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2761                         r = -EINVAL;
2762                         goto bad_reg;
2763                 }
2764         }
2765
2766         BUG_ON(rule_idx != num_rules);
2767
2768         r = set_regdom(rd);
2769
2770         mutex_unlock(&cfg80211_mutex);
2771
2772         return r;
2773
2774  bad_reg:
2775         mutex_unlock(&cfg80211_mutex);
2776         kfree(rd);
2777         return r;
2778 }
2779
2780 static int validate_scan_freqs(struct nlattr *freqs)
2781 {
2782         struct nlattr *attr1, *attr2;
2783         int n_channels = 0, tmp1, tmp2;
2784
2785         nla_for_each_nested(attr1, freqs, tmp1) {
2786                 n_channels++;
2787                 /*
2788                  * Some hardware has a limited channel list for
2789                  * scanning, and it is pretty much nonsensical
2790                  * to scan for a channel twice, so disallow that
2791                  * and don't require drivers to check that the
2792                  * channel list they get isn't longer than what
2793                  * they can scan, as long as they can scan all
2794                  * the channels they registered at once.
2795                  */
2796                 nla_for_each_nested(attr2, freqs, tmp2)
2797                         if (attr1 != attr2 &&
2798                             nla_get_u32(attr1) == nla_get_u32(attr2))
2799                                 return 0;
2800         }
2801
2802         return n_channels;
2803 }
2804
2805 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2806 {
2807         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2808         struct net_device *dev = info->user_ptr[1];
2809         struct cfg80211_scan_request *request;
2810         struct cfg80211_ssid *ssid;
2811         struct ieee80211_channel *channel;
2812         struct nlattr *attr;
2813         struct wiphy *wiphy;
2814         int err, tmp, n_ssids = 0, n_channels, i;
2815         enum ieee80211_band band;
2816         size_t ie_len;
2817
2818         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2819                 return -EINVAL;
2820
2821         wiphy = &rdev->wiphy;
2822
2823         if (!rdev->ops->scan)
2824                 return -EOPNOTSUPP;
2825
2826         if (!netif_running(dev))
2827                 return -ENETDOWN;
2828
2829         if (rdev->scan_req)
2830                 return -EBUSY;
2831
2832         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2833                 n_channels = validate_scan_freqs(
2834                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2835                 if (!n_channels)
2836                         return -EINVAL;
2837         } else {
2838                 n_channels = 0;
2839
2840                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2841                         if (wiphy->bands[band])
2842                                 n_channels += wiphy->bands[band]->n_channels;
2843         }
2844
2845         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2846                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2847                         n_ssids++;
2848
2849         if (n_ssids > wiphy->max_scan_ssids)
2850                 return -EINVAL;
2851
2852         if (info->attrs[NL80211_ATTR_IE])
2853                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2854         else
2855                 ie_len = 0;
2856
2857         if (ie_len > wiphy->max_scan_ie_len)
2858                 return -EINVAL;
2859
2860         request = kzalloc(sizeof(*request)
2861                         + sizeof(*ssid) * n_ssids
2862                         + sizeof(channel) * n_channels
2863                         + ie_len, GFP_KERNEL);
2864         if (!request)
2865                 return -ENOMEM;
2866
2867         if (n_ssids)
2868                 request->ssids = (void *)&request->channels[n_channels];
2869         request->n_ssids = n_ssids;
2870         if (ie_len) {
2871                 if (request->ssids)
2872                         request->ie = (void *)(request->ssids + n_ssids);
2873                 else
2874                         request->ie = (void *)(request->channels + n_channels);
2875         }
2876
2877         i = 0;
2878         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2879                 /* user specified, bail out if channel not found */
2880                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2881                         struct ieee80211_channel *chan;
2882
2883                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2884
2885                         if (!chan) {
2886                                 err = -EINVAL;
2887                                 goto out_free;
2888                         }
2889
2890                         /* ignore disabled channels */
2891                         if (chan->flags & IEEE80211_CHAN_DISABLED)
2892                                 continue;
2893
2894                         request->channels[i] = chan;
2895                         i++;
2896                 }
2897         } else {
2898                 /* all channels */
2899                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2900                         int j;
2901                         if (!wiphy->bands[band])
2902                                 continue;
2903                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2904                                 struct ieee80211_channel *chan;
2905
2906                                 chan = &wiphy->bands[band]->channels[j];
2907
2908                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
2909                                         continue;
2910
2911                                 request->channels[i] = chan;
2912                                 i++;
2913                         }
2914                 }
2915         }
2916
2917         if (!i) {
2918                 err = -EINVAL;
2919                 goto out_free;
2920         }
2921
2922         request->n_channels = i;
2923
2924         i = 0;
2925         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2926                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2927                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2928                                 err = -EINVAL;
2929                                 goto out_free;
2930                         }
2931                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2932                         request->ssids[i].ssid_len = nla_len(attr);
2933                         i++;
2934                 }
2935         }
2936
2937         if (info->attrs[NL80211_ATTR_IE]) {
2938                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2939                 memcpy((void *)request->ie,
2940                        nla_data(info->attrs[NL80211_ATTR_IE]),
2941                        request->ie_len);
2942         }
2943
2944         request->dev = dev;
2945         request->wiphy = &rdev->wiphy;
2946
2947         rdev->scan_req = request;
2948         err = rdev->ops->scan(&rdev->wiphy, dev, request);
2949
2950         if (!err) {
2951                 nl80211_send_scan_start(rdev, dev);
2952                 dev_hold(dev);
2953         } else {
2954  out_free:
2955                 rdev->scan_req = NULL;
2956                 kfree(request);
2957         }
2958
2959         return err;
2960 }
2961
2962 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2963                             struct cfg80211_registered_device *rdev,
2964                             struct wireless_dev *wdev,
2965                             struct cfg80211_internal_bss *intbss)
2966 {
2967         struct cfg80211_bss *res = &intbss->pub;
2968         void *hdr;
2969         struct nlattr *bss;
2970         int i;
2971
2972         ASSERT_WDEV_LOCK(wdev);
2973
2974         hdr = nl80211hdr_put(msg, pid, seq, flags,
2975                              NL80211_CMD_NEW_SCAN_RESULTS);
2976         if (!hdr)
2977                 return -1;
2978
2979         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
2980         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
2981
2982         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2983         if (!bss)
2984                 goto nla_put_failure;
2985         if (!is_zero_ether_addr(res->bssid))
2986                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2987         if (res->information_elements && res->len_information_elements)
2988                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2989                         res->len_information_elements,
2990                         res->information_elements);
2991         if (res->beacon_ies && res->len_beacon_ies &&
2992             res->beacon_ies != res->information_elements)
2993                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
2994                         res->len_beacon_ies, res->beacon_ies);
2995         if (res->tsf)
2996                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2997         if (res->beacon_interval)
2998                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2999         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3000         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3001         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3002                 jiffies_to_msecs(jiffies - intbss->ts));
3003
3004         switch (rdev->wiphy.signal_type) {
3005         case CFG80211_SIGNAL_TYPE_MBM:
3006                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3007                 break;
3008         case CFG80211_SIGNAL_TYPE_UNSPEC:
3009                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3010                 break;
3011         default:
3012                 break;
3013         }
3014
3015         switch (wdev->iftype) {
3016         case NL80211_IFTYPE_P2P_CLIENT:
3017         case NL80211_IFTYPE_STATION:
3018                 if (intbss == wdev->current_bss)
3019                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3020                                     NL80211_BSS_STATUS_ASSOCIATED);
3021                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3022                         if (intbss != wdev->auth_bsses[i])
3023                                 continue;
3024                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3025                                     NL80211_BSS_STATUS_AUTHENTICATED);
3026                         break;
3027                 }
3028                 break;
3029         case NL80211_IFTYPE_ADHOC:
3030                 if (intbss == wdev->current_bss)
3031                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3032                                     NL80211_BSS_STATUS_IBSS_JOINED);
3033                 break;
3034         default:
3035                 break;
3036         }
3037
3038         nla_nest_end(msg, bss);
3039
3040         return genlmsg_end(msg, hdr);
3041
3042  nla_put_failure:
3043         genlmsg_cancel(msg, hdr);
3044         return -EMSGSIZE;
3045 }
3046
3047 static int nl80211_dump_scan(struct sk_buff *skb,
3048                              struct netlink_callback *cb)
3049 {
3050         struct cfg80211_registered_device *rdev;
3051         struct net_device *dev;
3052         struct cfg80211_internal_bss *scan;
3053         struct wireless_dev *wdev;
3054         int ifidx = cb->args[0];
3055         int start = cb->args[1], idx = 0;
3056         int err;
3057
3058         if (!ifidx)
3059                 ifidx = nl80211_get_ifidx(cb);
3060         if (ifidx < 0)
3061                 return ifidx;
3062         cb->args[0] = ifidx;
3063
3064         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3065         if (!dev)
3066                 return -ENODEV;
3067
3068         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3069         if (IS_ERR(rdev)) {
3070                 err = PTR_ERR(rdev);
3071                 goto out_put_netdev;
3072         }
3073
3074         wdev = dev->ieee80211_ptr;
3075
3076         wdev_lock(wdev);
3077         spin_lock_bh(&rdev->bss_lock);
3078         cfg80211_bss_expire(rdev);
3079
3080         list_for_each_entry(scan, &rdev->bss_list, list) {
3081                 if (++idx <= start)
3082                         continue;
3083                 if (nl80211_send_bss(skb,
3084                                 NETLINK_CB(cb->skb).pid,
3085                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3086                                 rdev, wdev, scan) < 0) {
3087                         idx--;
3088                         goto out;
3089                 }
3090         }
3091
3092  out:
3093         spin_unlock_bh(&rdev->bss_lock);
3094         wdev_unlock(wdev);
3095
3096         cb->args[1] = idx;
3097         err = skb->len;
3098         cfg80211_unlock_rdev(rdev);
3099  out_put_netdev:
3100         dev_put(dev);
3101
3102         return err;
3103 }
3104
3105 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3106                                 int flags, struct net_device *dev,
3107                                 struct survey_info *survey)
3108 {
3109         void *hdr;
3110         struct nlattr *infoattr;
3111
3112         /* Survey without a channel doesn't make sense */
3113         if (!survey->channel)
3114                 return -EINVAL;
3115
3116         hdr = nl80211hdr_put(msg, pid, seq, flags,
3117                              NL80211_CMD_NEW_SURVEY_RESULTS);
3118         if (!hdr)
3119                 return -ENOMEM;
3120
3121         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3122
3123         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3124         if (!infoattr)
3125                 goto nla_put_failure;
3126
3127         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3128                     survey->channel->center_freq);
3129         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3130                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3131                             survey->noise);
3132         if (survey->filled & SURVEY_INFO_IN_USE)
3133                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3134
3135         nla_nest_end(msg, infoattr);
3136
3137         return genlmsg_end(msg, hdr);
3138
3139  nla_put_failure:
3140         genlmsg_cancel(msg, hdr);
3141         return -EMSGSIZE;
3142 }
3143
3144 static int nl80211_dump_survey(struct sk_buff *skb,
3145                         struct netlink_callback *cb)
3146 {
3147         struct survey_info survey;
3148         struct cfg80211_registered_device *dev;
3149         struct net_device *netdev;
3150         int ifidx = cb->args[0];
3151         int survey_idx = cb->args[1];
3152         int res;
3153
3154         if (!ifidx)
3155                 ifidx = nl80211_get_ifidx(cb);
3156         if (ifidx < 0)
3157                 return ifidx;
3158         cb->args[0] = ifidx;
3159
3160         rtnl_lock();
3161
3162         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3163         if (!netdev) {
3164                 res = -ENODEV;
3165                 goto out_rtnl;
3166         }
3167
3168         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3169         if (IS_ERR(dev)) {
3170                 res = PTR_ERR(dev);
3171                 goto out_rtnl;
3172         }
3173
3174         if (!dev->ops->dump_survey) {
3175                 res = -EOPNOTSUPP;
3176                 goto out_err;
3177         }
3178
3179         while (1) {
3180                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3181                                             &survey);
3182                 if (res == -ENOENT)
3183                         break;
3184                 if (res)
3185                         goto out_err;
3186
3187                 if (nl80211_send_survey(skb,
3188                                 NETLINK_CB(cb->skb).pid,
3189                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3190                                 netdev,
3191                                 &survey) < 0)
3192                         goto out;
3193                 survey_idx++;
3194         }
3195
3196  out:
3197         cb->args[1] = survey_idx;
3198         res = skb->len;
3199  out_err:
3200         cfg80211_unlock_rdev(dev);
3201  out_rtnl:
3202         rtnl_unlock();
3203
3204         return res;
3205 }
3206
3207 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3208 {
3209         return auth_type <= NL80211_AUTHTYPE_MAX;
3210 }
3211
3212 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3213 {
3214         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3215                                   NL80211_WPA_VERSION_2));
3216 }
3217
3218 static bool nl80211_valid_akm_suite(u32 akm)
3219 {
3220         return akm == WLAN_AKM_SUITE_8021X ||
3221                 akm == WLAN_AKM_SUITE_PSK;
3222 }
3223
3224 static bool nl80211_valid_cipher_suite(u32 cipher)
3225 {
3226         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3227                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3228                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3229                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3230                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3231 }
3232
3233
3234 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3235 {
3236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3237         struct net_device *dev = info->user_ptr[1];
3238         struct ieee80211_channel *chan;
3239         const u8 *bssid, *ssid, *ie = NULL;
3240         int err, ssid_len, ie_len = 0;
3241         enum nl80211_auth_type auth_type;
3242         struct key_parse key;
3243         bool local_state_change;
3244
3245         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3246                 return -EINVAL;
3247
3248         if (!info->attrs[NL80211_ATTR_MAC])
3249                 return -EINVAL;
3250
3251         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3252                 return -EINVAL;
3253
3254         if (!info->attrs[NL80211_ATTR_SSID])
3255                 return -EINVAL;
3256
3257         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3258                 return -EINVAL;
3259
3260         err = nl80211_parse_key(info, &key);
3261         if (err)
3262                 return err;
3263
3264         if (key.idx >= 0) {
3265                 if (!key.p.key || !key.p.key_len)
3266                         return -EINVAL;
3267                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3268                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3269                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3270                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3271                         return -EINVAL;
3272                 if (key.idx > 4)
3273                         return -EINVAL;
3274         } else {
3275                 key.p.key_len = 0;
3276                 key.p.key = NULL;
3277         }
3278
3279         if (key.idx >= 0) {
3280                 int i;
3281                 bool ok = false;
3282                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3283                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3284                                 ok = true;
3285                                 break;
3286                         }
3287                 }
3288                 if (!ok)
3289                         return -EINVAL;
3290         }
3291
3292         if (!rdev->ops->auth)
3293                 return -EOPNOTSUPP;
3294
3295         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3296             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3297                 return -EOPNOTSUPP;
3298
3299         if (!netif_running(dev))
3300                 return -ENETDOWN;
3301
3302         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3303         chan = ieee80211_get_channel(&rdev->wiphy,
3304                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3305         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3306                 return -EINVAL;
3307
3308         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3309         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3310
3311         if (info->attrs[NL80211_ATTR_IE]) {
3312                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3313                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3314         }
3315
3316         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3317         if (!nl80211_valid_auth_type(auth_type))
3318                 return -EINVAL;
3319
3320         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3321
3322         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3323                                   ssid, ssid_len, ie, ie_len,
3324                                   key.p.key, key.p.key_len, key.idx,
3325                                   local_state_change);
3326 }
3327
3328 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
3329                                    struct genl_info *info,
3330                                    struct cfg80211_crypto_settings *settings,
3331                                    int cipher_limit)
3332 {
3333         memset(settings, 0, sizeof(*settings));
3334
3335         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3336
3337         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
3338                 u16 proto;
3339                 proto = nla_get_u16(
3340                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3341                 settings->control_port_ethertype = cpu_to_be16(proto);
3342                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
3343                     proto != ETH_P_PAE)
3344                         return -EINVAL;
3345                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
3346                         settings->control_port_no_encrypt = true;
3347         } else
3348                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
3349
3350         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3351                 void *data;
3352                 int len, i;
3353
3354                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3355                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3356                 settings->n_ciphers_pairwise = len / sizeof(u32);
3357
3358                 if (len % sizeof(u32))
3359                         return -EINVAL;
3360
3361                 if (settings->n_ciphers_pairwise > cipher_limit)
3362                         return -EINVAL;
3363
3364                 memcpy(settings->ciphers_pairwise, data, len);
3365
3366                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3367                         if (!nl80211_valid_cipher_suite(
3368                                         settings->ciphers_pairwise[i]))
3369                                 return -EINVAL;
3370         }
3371
3372         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3373                 settings->cipher_group =
3374                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3375                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3376                         return -EINVAL;
3377         }
3378
3379         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3380                 settings->wpa_versions =
3381                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3382                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3383                         return -EINVAL;
3384         }
3385
3386         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3387                 void *data;
3388                 int len, i;
3389
3390                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3391                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3392                 settings->n_akm_suites = len / sizeof(u32);
3393
3394                 if (len % sizeof(u32))
3395                         return -EINVAL;
3396
3397                 memcpy(settings->akm_suites, data, len);
3398
3399                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3400                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3401                                 return -EINVAL;
3402         }
3403
3404         return 0;
3405 }
3406
3407 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3408 {
3409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3410         struct net_device *dev = info->user_ptr[1];
3411         struct cfg80211_crypto_settings crypto;
3412         struct ieee80211_channel *chan;
3413         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3414         int err, ssid_len, ie_len = 0;
3415         bool use_mfp = false;
3416
3417         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3418                 return -EINVAL;
3419
3420         if (!info->attrs[NL80211_ATTR_MAC] ||
3421             !info->attrs[NL80211_ATTR_SSID] ||
3422             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3423                 return -EINVAL;
3424
3425         if (!rdev->ops->assoc)
3426                 return -EOPNOTSUPP;
3427
3428         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3429             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3430                 return -EOPNOTSUPP;
3431
3432         if (!netif_running(dev))
3433                 return -ENETDOWN;
3434
3435         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3436
3437         chan = ieee80211_get_channel(&rdev->wiphy,
3438                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3439         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3440                 return -EINVAL;
3441
3442         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3443         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3444
3445         if (info->attrs[NL80211_ATTR_IE]) {
3446                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3447                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3448         }
3449
3450         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3451                 enum nl80211_mfp mfp =
3452                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3453                 if (mfp == NL80211_MFP_REQUIRED)
3454                         use_mfp = true;
3455                 else if (mfp != NL80211_MFP_NO)
3456                         return -EINVAL;
3457         }
3458
3459         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3460                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3461
3462         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
3463         if (!err)
3464                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3465                                           ssid, ssid_len, ie, ie_len, use_mfp,
3466                                           &crypto);
3467
3468         return err;
3469 }
3470
3471 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3472 {
3473         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3474         struct net_device *dev = info->user_ptr[1];
3475         const u8 *ie = NULL, *bssid;
3476         int ie_len = 0;
3477         u16 reason_code;
3478         bool local_state_change;
3479
3480         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3481                 return -EINVAL;
3482
3483         if (!info->attrs[NL80211_ATTR_MAC])
3484                 return -EINVAL;
3485
3486         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3487                 return -EINVAL;
3488
3489         if (!rdev->ops->deauth)
3490                 return -EOPNOTSUPP;
3491
3492         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3493             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3494                 return -EOPNOTSUPP;
3495
3496         if (!netif_running(dev))
3497                 return -ENETDOWN;
3498
3499         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3500
3501         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3502         if (reason_code == 0) {
3503                 /* Reason Code 0 is reserved */
3504                 return -EINVAL;
3505         }
3506
3507         if (info->attrs[NL80211_ATTR_IE]) {
3508                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3509                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3510         }
3511
3512         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3513
3514         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3515                                     local_state_change);
3516 }
3517
3518 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3519 {
3520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3521         struct net_device *dev = info->user_ptr[1];
3522         const u8 *ie = NULL, *bssid;
3523         int ie_len = 0;
3524         u16 reason_code;
3525         bool local_state_change;
3526
3527         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3528                 return -EINVAL;
3529
3530         if (!info->attrs[NL80211_ATTR_MAC])
3531                 return -EINVAL;
3532
3533         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3534                 return -EINVAL;
3535
3536         if (!rdev->ops->disassoc)
3537                 return -EOPNOTSUPP;
3538
3539         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3540             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3541                 return -EOPNOTSUPP;
3542
3543         if (!netif_running(dev))
3544                 return -ENETDOWN;
3545
3546         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3547
3548         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3549         if (reason_code == 0) {
3550                 /* Reason Code 0 is reserved */
3551                 return -EINVAL;
3552         }
3553
3554         if (info->attrs[NL80211_ATTR_IE]) {
3555                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3556                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3557         }
3558
3559         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3560
3561         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3562                                       local_state_change);
3563 }
3564
3565 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3566 {
3567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3568         struct net_device *dev = info->user_ptr[1];
3569         struct cfg80211_ibss_params ibss;
3570         struct wiphy *wiphy;
3571         struct cfg80211_cached_keys *connkeys = NULL;
3572         int err;
3573
3574         memset(&ibss, 0, sizeof(ibss));
3575
3576         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3577                 return -EINVAL;
3578
3579         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3580             !info->attrs[NL80211_ATTR_SSID] ||
3581             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3582                 return -EINVAL;
3583
3584         ibss.beacon_interval = 100;
3585
3586         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3587                 ibss.beacon_interval =
3588                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3589                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3590                         return -EINVAL;
3591         }
3592
3593         if (!rdev->ops->join_ibss)
3594                 return -EOPNOTSUPP;
3595
3596         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3597                 return -EOPNOTSUPP;
3598
3599         if (!netif_running(dev))
3600                 return -ENETDOWN;
3601
3602         wiphy = &rdev->wiphy;
3603
3604         if (info->attrs[NL80211_ATTR_MAC])
3605                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3606         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3607         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3608
3609         if (info->attrs[NL80211_ATTR_IE]) {
3610                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3611                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3612         }
3613
3614         ibss.channel = ieee80211_get_channel(wiphy,
3615                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3616         if (!ibss.channel ||
3617             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3618             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
3619                 return -EINVAL;
3620
3621         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3622         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3623
3624         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3625                 u8 *rates =
3626                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3627                 int n_rates =
3628                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3629                 struct ieee80211_supported_band *sband =
3630                         wiphy->bands[ibss.channel->band];
3631                 int i, j;
3632
3633                 if (n_rates == 0)
3634                         return -EINVAL;
3635
3636                 for (i = 0; i < n_rates; i++) {
3637                         int rate = (rates[i] & 0x7f) * 5;
3638                         bool found = false;
3639
3640                         for (j = 0; j < sband->n_bitrates; j++) {
3641                                 if (sband->bitrates[j].bitrate == rate) {
3642                                         found = true;
3643                                         ibss.basic_rates |= BIT(j);
3644                                         break;
3645                                 }
3646                         }
3647                         if (!found)
3648                                 return -EINVAL;
3649                 }
3650         }
3651
3652         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3653                 connkeys = nl80211_parse_connkeys(rdev,
3654                                         info->attrs[NL80211_ATTR_KEYS]);
3655                 if (IS_ERR(connkeys))
3656                         return PTR_ERR(connkeys);
3657         }
3658
3659         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3660         if (err)
3661                 kfree(connkeys);
3662         return err;
3663 }
3664
3665 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3666 {
3667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3668         struct net_device *dev = info->user_ptr[1];
3669
3670         if (!rdev->ops->leave_ibss)
3671                 return -EOPNOTSUPP;
3672
3673         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3674                 return -EOPNOTSUPP;
3675
3676         if (!netif_running(dev))
3677                 return -ENETDOWN;
3678
3679         return cfg80211_leave_ibss(rdev, dev, false);
3680 }
3681
3682 #ifdef CONFIG_NL80211_TESTMODE
3683 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3684         .name = "testmode",
3685 };
3686
3687 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3688 {
3689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3690         int err;
3691
3692         if (!info->attrs[NL80211_ATTR_TESTDATA])
3693                 return -EINVAL;
3694
3695         err = -EOPNOTSUPP;
3696         if (rdev->ops->testmode_cmd) {
3697                 rdev->testmode_info = info;
3698                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3699                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3700                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3701                 rdev->testmode_info = NULL;
3702         }
3703
3704         return err;
3705 }
3706
3707 static struct sk_buff *
3708 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3709                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3710 {
3711         struct sk_buff *skb;
3712         void *hdr;
3713         struct nlattr *data;
3714
3715         skb = nlmsg_new(approxlen + 100, gfp);
3716         if (!skb)
3717                 return NULL;
3718
3719         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3720         if (!hdr) {
3721                 kfree_skb(skb);
3722                 return NULL;
3723         }
3724
3725         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3726         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3727
3728         ((void **)skb->cb)[0] = rdev;
3729         ((void **)skb->cb)[1] = hdr;
3730         ((void **)skb->cb)[2] = data;
3731
3732         return skb;
3733
3734  nla_put_failure:
3735         kfree_skb(skb);
3736         return NULL;
3737 }
3738
3739 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3740                                                   int approxlen)
3741 {
3742         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3743
3744         if (WARN_ON(!rdev->testmode_info))
3745                 return NULL;
3746
3747         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3748                                 rdev->testmode_info->snd_pid,
3749                                 rdev->testmode_info->snd_seq,
3750                                 GFP_KERNEL);
3751 }
3752 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3753
3754 int cfg80211_testmode_reply(struct sk_buff *skb)
3755 {
3756         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3757         void *hdr = ((void **)skb->cb)[1];
3758         struct nlattr *data = ((void **)skb->cb)[2];
3759
3760         if (WARN_ON(!rdev->testmode_info)) {
3761                 kfree_skb(skb);
3762                 return -EINVAL;
3763         }
3764
3765         nla_nest_end(skb, data);
3766         genlmsg_end(skb, hdr);
3767         return genlmsg_reply(skb, rdev->testmode_info);
3768 }
3769 EXPORT_SYMBOL(cfg80211_testmode_reply);
3770
3771 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3772                                                   int approxlen, gfp_t gfp)
3773 {
3774         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3775
3776         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3777 }
3778 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3779
3780 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3781 {
3782         void *hdr = ((void **)skb->cb)[1];
3783         struct nlattr *data = ((void **)skb->cb)[2];
3784
3785         nla_nest_end(skb, data);
3786         genlmsg_end(skb, hdr);
3787         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3788 }
3789 EXPORT_SYMBOL(cfg80211_testmode_event);
3790 #endif
3791
3792 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3793 {
3794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3795         struct net_device *dev = info->user_ptr[1];
3796         struct cfg80211_connect_params connect;
3797         struct wiphy *wiphy;
3798         struct cfg80211_cached_keys *connkeys = NULL;
3799         int err;
3800
3801         memset(&connect, 0, sizeof(connect));
3802
3803         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3804                 return -EINVAL;
3805
3806         if (!info->attrs[NL80211_ATTR_SSID] ||
3807             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3808                 return -EINVAL;
3809
3810         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3811                 connect.auth_type =
3812                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3813                 if (!nl80211_valid_auth_type(connect.auth_type))
3814                         return -EINVAL;
3815         } else
3816                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3817
3818         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3819
3820         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
3821                                       NL80211_MAX_NR_CIPHER_SUITES);
3822         if (err)
3823                 return err;
3824
3825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3826             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3827                 return -EOPNOTSUPP;
3828
3829         if (!netif_running(dev))
3830                 return -ENETDOWN;
3831
3832         wiphy = &rdev->wiphy;
3833
3834         if (info->attrs[NL80211_ATTR_MAC])
3835                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3836         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3837         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3838
3839         if (info->attrs[NL80211_ATTR_IE]) {
3840                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3841                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3842         }
3843
3844         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3845                 connect.channel =
3846                         ieee80211_get_channel(wiphy,
3847                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3848                 if (!connect.channel ||
3849                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
3850                         return -EINVAL;
3851         }
3852
3853         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3854                 connkeys = nl80211_parse_connkeys(rdev,
3855                                         info->attrs[NL80211_ATTR_KEYS]);
3856                 if (IS_ERR(connkeys))
3857                         return PTR_ERR(connkeys);
3858         }
3859
3860         err = cfg80211_connect(rdev, dev, &connect, connkeys);
3861         if (err)
3862                 kfree(connkeys);
3863         return err;
3864 }
3865
3866 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3867 {
3868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3869         struct net_device *dev = info->user_ptr[1];
3870         u16 reason;
3871
3872         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3873                 reason = WLAN_REASON_DEAUTH_LEAVING;
3874         else
3875                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3876
3877         if (reason == 0)
3878                 return -EINVAL;
3879
3880         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3881             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3882                 return -EOPNOTSUPP;
3883
3884         if (!netif_running(dev))
3885                 return -ENETDOWN;
3886
3887         return cfg80211_disconnect(rdev, dev, reason, true);
3888 }
3889
3890 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
3891 {
3892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3893         struct net *net;
3894         int err;
3895         u32 pid;
3896
3897         if (!info->attrs[NL80211_ATTR_PID])
3898                 return -EINVAL;
3899
3900         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
3901
3902         net = get_net_ns_by_pid(pid);
3903         if (IS_ERR(net))
3904                 return PTR_ERR(net);
3905
3906         err = 0;
3907
3908         /* check if anything to do */
3909         if (!net_eq(wiphy_net(&rdev->wiphy), net))
3910                 err = cfg80211_switch_netns(rdev, net);
3911
3912         put_net(net);
3913         return err;
3914 }
3915
3916 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
3917 {
3918         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3919         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
3920                         struct cfg80211_pmksa *pmksa) = NULL;
3921         struct net_device *dev = info->user_ptr[1];
3922         struct cfg80211_pmksa pmksa;
3923
3924         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
3925
3926         if (!info->attrs[NL80211_ATTR_MAC])
3927                 return -EINVAL;
3928
3929         if (!info->attrs[NL80211_ATTR_PMKID])
3930                 return -EINVAL;
3931
3932         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
3933         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3934
3935         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3936             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3937                 return -EOPNOTSUPP;
3938
3939         switch (info->genlhdr->cmd) {
3940         case NL80211_CMD_SET_PMKSA:
3941                 rdev_ops = rdev->ops->set_pmksa;
3942                 break;
3943         case NL80211_CMD_DEL_PMKSA:
3944                 rdev_ops = rdev->ops->del_pmksa;
3945                 break;
3946         default:
3947                 WARN_ON(1);
3948                 break;
3949         }
3950
3951         if (!rdev_ops)
3952                 return -EOPNOTSUPP;
3953
3954         return rdev_ops(&rdev->wiphy, dev, &pmksa);
3955 }
3956
3957 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
3958 {
3959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3960         struct net_device *dev = info->user_ptr[1];
3961
3962         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3963             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3964                 return -EOPNOTSUPP;
3965
3966         if (!rdev->ops->flush_pmksa)
3967                 return -EOPNOTSUPP;
3968
3969         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
3970 }
3971
3972 static int nl80211_remain_on_channel(struct sk_buff *skb,
3973                                      struct genl_info *info)
3974 {
3975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3976         struct net_device *dev = info->user_ptr[1];
3977         struct ieee80211_channel *chan;
3978         struct sk_buff *msg;
3979         void *hdr;
3980         u64 cookie;
3981         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
3982         u32 freq, duration;
3983         int err;
3984
3985         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3986             !info->attrs[NL80211_ATTR_DURATION])
3987                 return -EINVAL;
3988
3989         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
3990
3991         /*
3992          * We should be on that channel for at least one jiffie,
3993          * and more than 5 seconds seems excessive.
3994          */
3995         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
3996                 return -EINVAL;
3997
3998         if (!rdev->ops->remain_on_channel)
3999                 return -EOPNOTSUPP;
4000
4001         if (!netif_running(dev))
4002                 return -ENETDOWN;
4003
4004         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4005                 channel_type = nla_get_u32(
4006                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4007                 if (channel_type != NL80211_CHAN_NO_HT &&
4008                     channel_type != NL80211_CHAN_HT20 &&
4009                     channel_type != NL80211_CHAN_HT40PLUS &&
4010                     channel_type != NL80211_CHAN_HT40MINUS)
4011                         return -EINVAL;
4012         }
4013
4014         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4015         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4016         if (chan == NULL)
4017                 return -EINVAL;
4018
4019         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4020         if (!msg)
4021                 return -ENOMEM;
4022
4023         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4024                              NL80211_CMD_REMAIN_ON_CHANNEL);
4025
4026         if (IS_ERR(hdr)) {
4027                 err = PTR_ERR(hdr);
4028                 goto free_msg;
4029         }
4030
4031         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4032                                            channel_type, duration, &cookie);
4033
4034         if (err)
4035                 goto free_msg;
4036
4037         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4038
4039         genlmsg_end(msg, hdr);
4040
4041         return genlmsg_reply(msg, info);
4042
4043  nla_put_failure:
4044         err = -ENOBUFS;
4045  free_msg:
4046         nlmsg_free(msg);
4047         return err;
4048 }
4049
4050 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4051                                             struct genl_info *info)
4052 {
4053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4054         struct net_device *dev = info->user_ptr[1];
4055         u64 cookie;
4056
4057         if (!info->attrs[NL80211_ATTR_COOKIE])
4058                 return -EINVAL;
4059
4060         if (!rdev->ops->cancel_remain_on_channel)
4061                 return -EOPNOTSUPP;
4062
4063         if (!netif_running(dev))
4064                 return -ENETDOWN;
4065
4066         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4067
4068         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4069 }
4070
4071 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4072                            u8 *rates, u8 rates_len)
4073 {
4074         u8 i;
4075         u32 mask = 0;
4076
4077         for (i = 0; i < rates_len; i++) {
4078                 int rate = (rates[i] & 0x7f) * 5;
4079                 int ridx;
4080                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4081                         struct ieee80211_rate *srate =
4082                                 &sband->bitrates[ridx];
4083                         if (rate == srate->bitrate) {
4084                                 mask |= 1 << ridx;
4085                                 break;
4086                         }
4087                 }
4088                 if (ridx == sband->n_bitrates)
4089                         return 0; /* rate not found */
4090         }
4091
4092         return mask;
4093 }
4094
4095 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4096         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4097                                     .len = NL80211_MAX_SUPP_RATES },
4098 };
4099
4100 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4101                                        struct genl_info *info)
4102 {
4103         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4105         struct cfg80211_bitrate_mask mask;
4106         int rem, i;
4107         struct net_device *dev = info->user_ptr[1];
4108         struct nlattr *tx_rates;
4109         struct ieee80211_supported_band *sband;
4110
4111         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4112                 return -EINVAL;
4113
4114         if (!rdev->ops->set_bitrate_mask)
4115                 return -EOPNOTSUPP;
4116
4117         memset(&mask, 0, sizeof(mask));
4118         /* Default to all rates enabled */
4119         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4120                 sband = rdev->wiphy.bands[i];
4121                 mask.control[i].legacy =
4122                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4123         }
4124
4125         /*
4126          * The nested attribute uses enum nl80211_band as the index. This maps
4127          * directly to the enum ieee80211_band values used in cfg80211.
4128          */
4129         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4130         {
4131                 enum ieee80211_band band = nla_type(tx_rates);
4132                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4133                         return -EINVAL;
4134                 sband = rdev->wiphy.bands[band];
4135                 if (sband == NULL)
4136                         return -EINVAL;
4137                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4138                           nla_len(tx_rates), nl80211_txattr_policy);
4139                 if (tb[NL80211_TXRATE_LEGACY]) {
4140                         mask.control[band].legacy = rateset_to_mask(
4141                                 sband,
4142                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4143                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4144                         if (mask.control[band].legacy == 0)
4145                                 return -EINVAL;
4146                 }
4147         }
4148
4149         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4150 }
4151
4152 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4153 {
4154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4155         struct net_device *dev = info->user_ptr[1];
4156         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4157
4158         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4159                 return -EINVAL;
4160
4161         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4162                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4163
4164         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4165             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4166             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4167             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4168             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4169             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4170                 return -EOPNOTSUPP;
4171
4172         /* not much point in registering if we can't reply */
4173         if (!rdev->ops->mgmt_tx)
4174                 return -EOPNOTSUPP;
4175
4176         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4177                         frame_type,
4178                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4179                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4180 }
4181
4182 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4183 {
4184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4185         struct net_device *dev = info->user_ptr[1];
4186         struct ieee80211_channel *chan;
4187         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4188         bool channel_type_valid = false;
4189         u32 freq;
4190         int err;
4191         void *hdr;
4192         u64 cookie;
4193         struct sk_buff *msg;
4194
4195         if (!info->attrs[NL80211_ATTR_FRAME] ||
4196             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4197                 return -EINVAL;
4198
4199         if (!rdev->ops->mgmt_tx)
4200                 return -EOPNOTSUPP;
4201
4202         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4203             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4204             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4205             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4206             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4207             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4208                 return -EOPNOTSUPP;
4209
4210         if (!netif_running(dev))
4211                 return -ENETDOWN;
4212
4213         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4214                 channel_type = nla_get_u32(
4215                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4216                 if (channel_type != NL80211_CHAN_NO_HT &&
4217                     channel_type != NL80211_CHAN_HT20 &&
4218                     channel_type != NL80211_CHAN_HT40PLUS &&
4219                     channel_type != NL80211_CHAN_HT40MINUS)
4220                         return -EINVAL;
4221                 channel_type_valid = true;
4222         }
4223
4224         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4225         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4226         if (chan == NULL)
4227                 return -EINVAL;
4228
4229         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4230         if (!msg)
4231                 return -ENOMEM;
4232
4233         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4234                              NL80211_CMD_FRAME);
4235
4236         if (IS_ERR(hdr)) {
4237                 err = PTR_ERR(hdr);
4238                 goto free_msg;
4239         }
4240         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, channel_type,
4241                                     channel_type_valid,
4242                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
4243                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
4244                                     &cookie);
4245         if (err)
4246                 goto free_msg;
4247
4248         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4249
4250         genlmsg_end(msg, hdr);
4251         return genlmsg_reply(msg, info);
4252
4253  nla_put_failure:
4254         err = -ENOBUFS;
4255  free_msg:
4256         nlmsg_free(msg);
4257         return err;
4258 }
4259
4260 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4261 {
4262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4263         struct wireless_dev *wdev;
4264         struct net_device *dev = info->user_ptr[1];
4265         u8 ps_state;
4266         bool state;
4267         int err;
4268
4269         if (!info->attrs[NL80211_ATTR_PS_STATE])
4270                 return -EINVAL;
4271
4272         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4273
4274         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
4275                 return -EINVAL;
4276
4277         wdev = dev->ieee80211_ptr;
4278
4279         if (!rdev->ops->set_power_mgmt)
4280                 return -EOPNOTSUPP;
4281
4282         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4283
4284         if (state == wdev->ps)
4285                 return 0;
4286
4287         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
4288                                         wdev->ps_timeout);
4289         if (!err)
4290                 wdev->ps = state;
4291         return err;
4292 }
4293
4294 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4295 {
4296         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4297         enum nl80211_ps_state ps_state;
4298         struct wireless_dev *wdev;
4299         struct net_device *dev = info->user_ptr[1];
4300         struct sk_buff *msg;
4301         void *hdr;
4302         int err;
4303
4304         wdev = dev->ieee80211_ptr;
4305
4306         if (!rdev->ops->set_power_mgmt)
4307                 return -EOPNOTSUPP;
4308
4309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4310         if (!msg)
4311                 return -ENOMEM;
4312
4313         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4314                              NL80211_CMD_GET_POWER_SAVE);
4315         if (!hdr) {
4316                 err = -ENOBUFS;
4317                 goto free_msg;
4318         }
4319
4320         if (wdev->ps)
4321                 ps_state = NL80211_PS_ENABLED;
4322         else
4323                 ps_state = NL80211_PS_DISABLED;
4324
4325         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4326
4327         genlmsg_end(msg, hdr);
4328         return genlmsg_reply(msg, info);
4329
4330  nla_put_failure:
4331         err = -ENOBUFS;
4332  free_msg:
4333         nlmsg_free(msg);
4334         return err;
4335 }
4336
4337 static struct nla_policy
4338 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4339         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4340         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4341         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4342 };
4343
4344 static int nl80211_set_cqm_rssi(struct genl_info *info,
4345                                 s32 threshold, u32 hysteresis)
4346 {
4347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4348         struct wireless_dev *wdev;
4349         struct net_device *dev = info->user_ptr[1];
4350
4351         if (threshold > 0)
4352                 return -EINVAL;
4353
4354         wdev = dev->ieee80211_ptr;
4355
4356         if (!rdev->ops->set_cqm_rssi_config)
4357                 return -EOPNOTSUPP;
4358
4359         if (wdev->iftype != NL80211_IFTYPE_STATION &&
4360             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
4361                 return -EOPNOTSUPP;
4362
4363         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4364                                               threshold, hysteresis);
4365 }
4366
4367 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4368 {
4369         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4370         struct nlattr *cqm;
4371         int err;
4372
4373         cqm = info->attrs[NL80211_ATTR_CQM];
4374         if (!cqm) {
4375                 err = -EINVAL;
4376                 goto out;
4377         }
4378
4379         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4380                                nl80211_attr_cqm_policy);
4381         if (err)
4382                 goto out;
4383
4384         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4385             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4386                 s32 threshold;
4387                 u32 hysteresis;
4388                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4389                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4390                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4391         } else
4392                 err = -EINVAL;
4393
4394 out:
4395         return err;
4396 }
4397
4398 #define NL80211_FLAG_NEED_WIPHY         0x01
4399 #define NL80211_FLAG_NEED_NETDEV        0x02
4400 #define NL80211_FLAG_NEED_RTNL          0x04
4401
4402 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
4403                             struct genl_info *info)
4404 {
4405         struct cfg80211_registered_device *rdev;
4406         struct net_device *dev;
4407         int err;
4408         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
4409
4410         if (rtnl)
4411                 rtnl_lock();
4412
4413         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
4414                 rdev = cfg80211_get_dev_from_info(info);
4415                 if (IS_ERR(rdev)) {
4416                         if (rtnl)
4417                                 rtnl_unlock();
4418                         return PTR_ERR(rdev);
4419                 }
4420                 info->user_ptr[0] = rdev;
4421         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
4422                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4423                 if (err) {
4424                         if (rtnl)
4425                                 rtnl_unlock();
4426                         return err;
4427                 }
4428                 info->user_ptr[0] = rdev;
4429                 info->user_ptr[1] = dev;
4430         }
4431
4432         return 0;
4433 }
4434
4435 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
4436                               struct genl_info *info)
4437 {
4438         if (info->user_ptr[0])
4439                 cfg80211_unlock_rdev(info->user_ptr[0]);
4440         if (info->user_ptr[1])
4441                 dev_put(info->user_ptr[1]);
4442         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
4443                 rtnl_unlock();
4444 }
4445
4446 static struct genl_ops nl80211_ops[] = {
4447         {
4448                 .cmd = NL80211_CMD_GET_WIPHY,
4449                 .doit = nl80211_get_wiphy,
4450                 .dumpit = nl80211_dump_wiphy,
4451                 .policy = nl80211_policy,
4452                 /* can be retrieved by unprivileged users */
4453                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
4454         },
4455         {
4456                 .cmd = NL80211_CMD_SET_WIPHY,
4457                 .doit = nl80211_set_wiphy,
4458                 .policy = nl80211_policy,
4459                 .flags = GENL_ADMIN_PERM,
4460                 .internal_flags = NL80211_FLAG_NEED_RTNL,
4461         },
4462         {
4463                 .cmd = NL80211_CMD_GET_INTERFACE,
4464                 .doit = nl80211_get_interface,
4465                 .dumpit = nl80211_dump_interface,
4466                 .policy = nl80211_policy,
4467                 /* can be retrieved by unprivileged users */
4468                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
4469         },
4470         {
4471                 .cmd = NL80211_CMD_SET_INTERFACE,
4472                 .doit = nl80211_set_interface,
4473                 .policy = nl80211_policy,
4474                 .flags = GENL_ADMIN_PERM,
4475                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4476                                   NL80211_FLAG_NEED_RTNL,
4477         },
4478         {
4479                 .cmd = NL80211_CMD_NEW_INTERFACE,
4480                 .doit = nl80211_new_interface,
4481                 .policy = nl80211_policy,
4482                 .flags = GENL_ADMIN_PERM,
4483                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4484                                   NL80211_FLAG_NEED_RTNL,
4485         },
4486         {
4487                 .cmd = NL80211_CMD_DEL_INTERFACE,
4488                 .doit = nl80211_del_interface,
4489                 .policy = nl80211_policy,
4490                 .flags = GENL_ADMIN_PERM,
4491                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4492                                   NL80211_FLAG_NEED_RTNL,
4493         },
4494         {
4495                 .cmd = NL80211_CMD_GET_KEY,
4496                 .doit = nl80211_get_key,
4497                 .policy = nl80211_policy,
4498                 .flags = GENL_ADMIN_PERM,
4499                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4500                                   NL80211_FLAG_NEED_RTNL,
4501         },
4502         {
4503                 .cmd = NL80211_CMD_SET_KEY,
4504                 .doit = nl80211_set_key,
4505                 .policy = nl80211_policy,
4506                 .flags = GENL_ADMIN_PERM,
4507                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4508                                   NL80211_FLAG_NEED_RTNL,
4509         },
4510         {
4511                 .cmd = NL80211_CMD_NEW_KEY,
4512                 .doit = nl80211_new_key,
4513                 .policy = nl80211_policy,
4514                 .flags = GENL_ADMIN_PERM,
4515                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4516                                   NL80211_FLAG_NEED_RTNL,
4517         },
4518         {
4519                 .cmd = NL80211_CMD_DEL_KEY,
4520                 .doit = nl80211_del_key,
4521                 .policy = nl80211_policy,
4522                 .flags = GENL_ADMIN_PERM,
4523                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4524                                   NL80211_FLAG_NEED_RTNL,
4525         },
4526         {
4527                 .cmd = NL80211_CMD_SET_BEACON,
4528                 .policy = nl80211_policy,
4529                 .flags = GENL_ADMIN_PERM,
4530                 .doit = nl80211_addset_beacon,
4531                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4532                                   NL80211_FLAG_NEED_RTNL,
4533         },
4534         {
4535                 .cmd = NL80211_CMD_NEW_BEACON,
4536                 .policy = nl80211_policy,
4537                 .flags = GENL_ADMIN_PERM,
4538                 .doit = nl80211_addset_beacon,
4539                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4540                                   NL80211_FLAG_NEED_RTNL,
4541         },
4542         {
4543                 .cmd = NL80211_CMD_DEL_BEACON,
4544                 .policy = nl80211_policy,
4545                 .flags = GENL_ADMIN_PERM,
4546                 .doit = nl80211_del_beacon,
4547                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4548                                   NL80211_FLAG_NEED_RTNL,
4549         },
4550         {
4551                 .cmd = NL80211_CMD_GET_STATION,
4552                 .doit = nl80211_get_station,
4553                 .dumpit = nl80211_dump_station,
4554                 .policy = nl80211_policy,
4555                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4556                                   NL80211_FLAG_NEED_RTNL,
4557         },
4558         {
4559                 .cmd = NL80211_CMD_SET_STATION,
4560                 .doit = nl80211_set_station,
4561                 .policy = nl80211_policy,
4562                 .flags = GENL_ADMIN_PERM,
4563                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4564                                   NL80211_FLAG_NEED_RTNL,
4565         },
4566         {
4567                 .cmd = NL80211_CMD_NEW_STATION,
4568                 .doit = nl80211_new_station,
4569                 .policy = nl80211_policy,
4570                 .flags = GENL_ADMIN_PERM,
4571                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4572                                   NL80211_FLAG_NEED_RTNL,
4573         },
4574         {
4575                 .cmd = NL80211_CMD_DEL_STATION,
4576                 .doit = nl80211_del_station,
4577                 .policy = nl80211_policy,
4578                 .flags = GENL_ADMIN_PERM,
4579                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4580                                   NL80211_FLAG_NEED_RTNL,
4581         },
4582         {
4583                 .cmd = NL80211_CMD_GET_MPATH,
4584                 .doit = nl80211_get_mpath,
4585                 .dumpit = nl80211_dump_mpath,
4586                 .policy = nl80211_policy,
4587                 .flags = GENL_ADMIN_PERM,
4588                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4589                                   NL80211_FLAG_NEED_RTNL,
4590         },
4591         {
4592                 .cmd = NL80211_CMD_SET_MPATH,
4593                 .doit = nl80211_set_mpath,
4594                 .policy = nl80211_policy,
4595                 .flags = GENL_ADMIN_PERM,
4596                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4597                                   NL80211_FLAG_NEED_RTNL,
4598         },
4599         {
4600                 .cmd = NL80211_CMD_NEW_MPATH,
4601                 .doit = nl80211_new_mpath,
4602                 .policy = nl80211_policy,
4603                 .flags = GENL_ADMIN_PERM,
4604                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4605                                   NL80211_FLAG_NEED_RTNL,
4606         },
4607         {
4608                 .cmd = NL80211_CMD_DEL_MPATH,
4609                 .doit = nl80211_del_mpath,
4610                 .policy = nl80211_policy,
4611                 .flags = GENL_ADMIN_PERM,
4612                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4613                                   NL80211_FLAG_NEED_RTNL,
4614         },
4615         {
4616                 .cmd = NL80211_CMD_SET_BSS,
4617                 .doit = nl80211_set_bss,
4618                 .policy = nl80211_policy,
4619                 .flags = GENL_ADMIN_PERM,
4620                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4621                                   NL80211_FLAG_NEED_RTNL,
4622         },
4623         {
4624                 .cmd = NL80211_CMD_GET_REG,
4625                 .doit = nl80211_get_reg,
4626                 .policy = nl80211_policy,
4627                 /* can be retrieved by unprivileged users */
4628         },
4629         {
4630                 .cmd = NL80211_CMD_SET_REG,
4631                 .doit = nl80211_set_reg,
4632                 .policy = nl80211_policy,
4633                 .flags = GENL_ADMIN_PERM,
4634         },
4635         {
4636                 .cmd = NL80211_CMD_REQ_SET_REG,
4637                 .doit = nl80211_req_set_reg,
4638                 .policy = nl80211_policy,
4639                 .flags = GENL_ADMIN_PERM,
4640         },
4641         {
4642                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4643                 .doit = nl80211_get_mesh_params,
4644                 .policy = nl80211_policy,
4645                 /* can be retrieved by unprivileged users */
4646                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4647                                   NL80211_FLAG_NEED_RTNL,
4648         },
4649         {
4650                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4651                 .doit = nl80211_set_mesh_params,
4652                 .policy = nl80211_policy,
4653                 .flags = GENL_ADMIN_PERM,
4654                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4655                                   NL80211_FLAG_NEED_RTNL,
4656         },
4657         {
4658                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4659                 .doit = nl80211_trigger_scan,
4660                 .policy = nl80211_policy,
4661                 .flags = GENL_ADMIN_PERM,
4662                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4663                                   NL80211_FLAG_NEED_RTNL,
4664         },
4665         {
4666                 .cmd = NL80211_CMD_GET_SCAN,
4667                 .policy = nl80211_policy,
4668                 .dumpit = nl80211_dump_scan,
4669         },
4670         {
4671                 .cmd = NL80211_CMD_AUTHENTICATE,
4672                 .doit = nl80211_authenticate,
4673                 .policy = nl80211_policy,
4674                 .flags = GENL_ADMIN_PERM,
4675                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4676                                   NL80211_FLAG_NEED_RTNL,
4677         },
4678         {
4679                 .cmd = NL80211_CMD_ASSOCIATE,
4680                 .doit = nl80211_associate,
4681                 .policy = nl80211_policy,
4682                 .flags = GENL_ADMIN_PERM,
4683                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4684                                   NL80211_FLAG_NEED_RTNL,
4685         },
4686         {
4687                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4688                 .doit = nl80211_deauthenticate,
4689                 .policy = nl80211_policy,
4690                 .flags = GENL_ADMIN_PERM,
4691                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4692                                   NL80211_FLAG_NEED_RTNL,
4693         },
4694         {
4695                 .cmd = NL80211_CMD_DISASSOCIATE,
4696                 .doit = nl80211_disassociate,
4697                 .policy = nl80211_policy,
4698                 .flags = GENL_ADMIN_PERM,
4699                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4700                                   NL80211_FLAG_NEED_RTNL,
4701         },
4702         {
4703                 .cmd = NL80211_CMD_JOIN_IBSS,
4704                 .doit = nl80211_join_ibss,
4705                 .policy = nl80211_policy,
4706                 .flags = GENL_ADMIN_PERM,
4707                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4708                                   NL80211_FLAG_NEED_RTNL,
4709         },
4710         {
4711                 .cmd = NL80211_CMD_LEAVE_IBSS,
4712                 .doit = nl80211_leave_ibss,
4713                 .policy = nl80211_policy,
4714                 .flags = GENL_ADMIN_PERM,
4715                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4716                                   NL80211_FLAG_NEED_RTNL,
4717         },
4718 #ifdef CONFIG_NL80211_TESTMODE
4719         {
4720                 .cmd = NL80211_CMD_TESTMODE,
4721                 .doit = nl80211_testmode_do,
4722                 .policy = nl80211_policy,
4723                 .flags = GENL_ADMIN_PERM,
4724                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4725                                   NL80211_FLAG_NEED_RTNL,
4726         },
4727 #endif
4728         {
4729                 .cmd = NL80211_CMD_CONNECT,
4730                 .doit = nl80211_connect,
4731                 .policy = nl80211_policy,
4732                 .flags = GENL_ADMIN_PERM,
4733                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4734                                   NL80211_FLAG_NEED_RTNL,
4735         },
4736         {
4737                 .cmd = NL80211_CMD_DISCONNECT,
4738                 .doit = nl80211_disconnect,
4739                 .policy = nl80211_policy,
4740                 .flags = GENL_ADMIN_PERM,
4741                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4742                                   NL80211_FLAG_NEED_RTNL,
4743         },
4744         {
4745                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4746                 .doit = nl80211_wiphy_netns,
4747                 .policy = nl80211_policy,
4748                 .flags = GENL_ADMIN_PERM,
4749                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4750                                   NL80211_FLAG_NEED_RTNL,
4751         },
4752         {
4753                 .cmd = NL80211_CMD_GET_SURVEY,
4754                 .policy = nl80211_policy,
4755                 .dumpit = nl80211_dump_survey,
4756         },
4757         {
4758                 .cmd = NL80211_CMD_SET_PMKSA,
4759                 .doit = nl80211_setdel_pmksa,
4760                 .policy = nl80211_policy,
4761                 .flags = GENL_ADMIN_PERM,
4762                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4763                                   NL80211_FLAG_NEED_RTNL,
4764         },
4765         {
4766                 .cmd = NL80211_CMD_DEL_PMKSA,
4767                 .doit = nl80211_setdel_pmksa,
4768                 .policy = nl80211_policy,
4769                 .flags = GENL_ADMIN_PERM,
4770                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4771                                   NL80211_FLAG_NEED_RTNL,
4772         },
4773         {
4774                 .cmd = NL80211_CMD_FLUSH_PMKSA,
4775                 .doit = nl80211_flush_pmksa,
4776                 .policy = nl80211_policy,
4777                 .flags = GENL_ADMIN_PERM,
4778                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4779                                   NL80211_FLAG_NEED_RTNL,
4780         },
4781         {
4782                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
4783                 .doit = nl80211_remain_on_channel,
4784                 .policy = nl80211_policy,
4785                 .flags = GENL_ADMIN_PERM,
4786                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4787                                   NL80211_FLAG_NEED_RTNL,
4788         },
4789         {
4790                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
4791                 .doit = nl80211_cancel_remain_on_channel,
4792                 .policy = nl80211_policy,
4793                 .flags = GENL_ADMIN_PERM,
4794                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4795                                   NL80211_FLAG_NEED_RTNL,
4796         },
4797         {
4798                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
4799                 .doit = nl80211_set_tx_bitrate_mask,
4800                 .policy = nl80211_policy,
4801                 .flags = GENL_ADMIN_PERM,
4802                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4803                                   NL80211_FLAG_NEED_RTNL,
4804         },
4805         {
4806                 .cmd = NL80211_CMD_REGISTER_FRAME,
4807                 .doit = nl80211_register_mgmt,
4808                 .policy = nl80211_policy,
4809                 .flags = GENL_ADMIN_PERM,
4810                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4811                                   NL80211_FLAG_NEED_RTNL,
4812         },
4813         {
4814                 .cmd = NL80211_CMD_FRAME,
4815                 .doit = nl80211_tx_mgmt,
4816                 .policy = nl80211_policy,
4817                 .flags = GENL_ADMIN_PERM,
4818                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4819                                   NL80211_FLAG_NEED_RTNL,
4820         },
4821         {
4822                 .cmd = NL80211_CMD_SET_POWER_SAVE,
4823                 .doit = nl80211_set_power_save,
4824                 .policy = nl80211_policy,
4825                 .flags = GENL_ADMIN_PERM,
4826                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4827                                   NL80211_FLAG_NEED_RTNL,
4828         },
4829         {
4830                 .cmd = NL80211_CMD_GET_POWER_SAVE,
4831                 .doit = nl80211_get_power_save,
4832                 .policy = nl80211_policy,
4833                 /* can be retrieved by unprivileged users */
4834                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4835                                   NL80211_FLAG_NEED_RTNL,
4836         },
4837         {
4838                 .cmd = NL80211_CMD_SET_CQM,
4839                 .doit = nl80211_set_cqm,
4840                 .policy = nl80211_policy,
4841                 .flags = GENL_ADMIN_PERM,
4842                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4843                                   NL80211_FLAG_NEED_RTNL,
4844         },
4845         {
4846                 .cmd = NL80211_CMD_SET_CHANNEL,
4847                 .doit = nl80211_set_channel,
4848                 .policy = nl80211_policy,
4849                 .flags = GENL_ADMIN_PERM,
4850                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4851                                   NL80211_FLAG_NEED_RTNL,
4852         },
4853         {
4854                 .cmd = NL80211_CMD_SET_WDS_PEER,
4855                 .doit = nl80211_set_wds_peer,
4856                 .policy = nl80211_policy,
4857                 .flags = GENL_ADMIN_PERM,
4858         },
4859 };
4860
4861 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4862         .name = "mlme",
4863 };
4864
4865 /* multicast groups */
4866 static struct genl_multicast_group nl80211_config_mcgrp = {
4867         .name = "config",
4868 };
4869 static struct genl_multicast_group nl80211_scan_mcgrp = {
4870         .name = "scan",
4871 };
4872 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4873         .name = "regulatory",
4874 };
4875
4876 /* notification functions */
4877
4878 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4879 {
4880         struct sk_buff *msg;
4881
4882         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4883         if (!msg)
4884                 return;
4885
4886         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4887                 nlmsg_free(msg);
4888                 return;
4889         }
4890
4891         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4892                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4893 }
4894
4895 static int nl80211_add_scan_req(struct sk_buff *msg,
4896                                 struct cfg80211_registered_device *rdev)
4897 {
4898         struct cfg80211_scan_request *req = rdev->scan_req;
4899         struct nlattr *nest;
4900         int i;
4901
4902         ASSERT_RDEV_LOCK(rdev);
4903
4904         if (WARN_ON(!req))
4905                 return 0;
4906
4907         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4908         if (!nest)
4909                 goto nla_put_failure;
4910         for (i = 0; i < req->n_ssids; i++)
4911                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4912         nla_nest_end(msg, nest);
4913
4914         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4915         if (!nest)
4916                 goto nla_put_failure;
4917         for (i = 0; i < req->n_channels; i++)
4918                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4919         nla_nest_end(msg, nest);
4920
4921         if (req->ie)
4922                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4923
4924         return 0;
4925  nla_put_failure:
4926         return -ENOBUFS;
4927 }
4928
4929 static int nl80211_send_scan_msg(struct sk_buff *msg,
4930                                  struct cfg80211_registered_device *rdev,
4931                                  struct net_device *netdev,
4932                                  u32 pid, u32 seq, int flags,
4933                                  u32 cmd)
4934 {
4935         void *hdr;
4936
4937         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4938         if (!hdr)
4939                 return -1;
4940
4941         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4942         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4943
4944         /* ignore errors and send incomplete event anyway */
4945         nl80211_add_scan_req(msg, rdev);
4946
4947         return genlmsg_end(msg, hdr);
4948
4949  nla_put_failure:
4950         genlmsg_cancel(msg, hdr);
4951         return -EMSGSIZE;
4952 }
4953
4954 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4955                              struct net_device *netdev)
4956 {
4957         struct sk_buff *msg;
4958
4959         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4960         if (!msg)
4961                 return;
4962
4963         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4964                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4965                 nlmsg_free(msg);
4966                 return;
4967         }
4968
4969         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4970                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4971 }
4972
4973 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4974                             struct net_device *netdev)
4975 {
4976         struct sk_buff *msg;
4977
4978         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4979         if (!msg)
4980                 return;
4981
4982         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4983                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4984                 nlmsg_free(msg);
4985                 return;
4986         }
4987
4988         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4989                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4990 }
4991
4992 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4993                                struct net_device *netdev)
4994 {
4995         struct sk_buff *msg;
4996
4997         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4998         if (!msg)
4999                 return;
5000
5001         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5002                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5003                 nlmsg_free(msg);
5004                 return;
5005         }
5006
5007         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5008                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5009 }
5010
5011 /*
5012  * This can happen on global regulatory changes or device specific settings
5013  * based on custom world regulatory domains.
5014  */
5015 void nl80211_send_reg_change_event(struct regulatory_request *request)
5016 {
5017         struct sk_buff *msg;
5018         void *hdr;
5019
5020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5021         if (!msg)
5022                 return;
5023
5024         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5025         if (!hdr) {
5026                 nlmsg_free(msg);
5027                 return;
5028         }
5029
5030         /* Userspace can always count this one always being set */
5031         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5032
5033         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5034                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5035                            NL80211_REGDOM_TYPE_WORLD);
5036         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5037                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5038                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5039         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5040                  request->intersect)
5041                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5042                            NL80211_REGDOM_TYPE_INTERSECTION);
5043         else {
5044                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5045                            NL80211_REGDOM_TYPE_COUNTRY);
5046                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5047         }
5048
5049         if (wiphy_idx_valid(request->wiphy_idx))
5050                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5051
5052         if (genlmsg_end(msg, hdr) < 0) {
5053                 nlmsg_free(msg);
5054                 return;
5055         }
5056
5057         rcu_read_lock();
5058         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5059                                 GFP_ATOMIC);
5060         rcu_read_unlock();
5061
5062         return;
5063
5064 nla_put_failure:
5065         genlmsg_cancel(msg, hdr);
5066         nlmsg_free(msg);
5067 }
5068
5069 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5070                                     struct net_device *netdev,
5071                                     const u8 *buf, size_t len,
5072                                     enum nl80211_commands cmd, gfp_t gfp)
5073 {
5074         struct sk_buff *msg;
5075         void *hdr;
5076
5077         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5078         if (!msg)
5079                 return;
5080
5081         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5082         if (!hdr) {
5083                 nlmsg_free(msg);
5084                 return;
5085         }
5086
5087         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5088         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5089         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5090
5091         if (genlmsg_end(msg, hdr) < 0) {
5092                 nlmsg_free(msg);
5093                 return;
5094         }
5095
5096         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5097                                 nl80211_mlme_mcgrp.id, gfp);
5098         return;
5099
5100  nla_put_failure:
5101         genlmsg_cancel(msg, hdr);
5102         nlmsg_free(msg);
5103 }
5104
5105 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5106                           struct net_device *netdev, const u8 *buf,
5107                           size_t len, gfp_t gfp)
5108 {
5109         nl80211_send_mlme_event(rdev, netdev, buf, len,
5110                                 NL80211_CMD_AUTHENTICATE, gfp);
5111 }
5112
5113 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5114                            struct net_device *netdev, const u8 *buf,
5115                            size_t len, gfp_t gfp)
5116 {
5117         nl80211_send_mlme_event(rdev, netdev, buf, len,
5118                                 NL80211_CMD_ASSOCIATE, gfp);
5119 }
5120
5121 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5122                          struct net_device *netdev, const u8 *buf,
5123                          size_t len, gfp_t gfp)
5124 {
5125         nl80211_send_mlme_event(rdev, netdev, buf, len,
5126                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5127 }
5128
5129 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5130                            struct net_device *netdev, const u8 *buf,
5131                            size_t len, gfp_t gfp)
5132 {
5133         nl80211_send_mlme_event(rdev, netdev, buf, len,
5134                                 NL80211_CMD_DISASSOCIATE, gfp);
5135 }
5136
5137 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5138                                       struct net_device *netdev, int cmd,
5139                                       const u8 *addr, gfp_t gfp)
5140 {
5141         struct sk_buff *msg;
5142         void *hdr;
5143
5144         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5145         if (!msg)
5146                 return;
5147
5148         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5149         if (!hdr) {
5150                 nlmsg_free(msg);
5151                 return;
5152         }
5153
5154         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5155         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5156         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5157         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5158
5159         if (genlmsg_end(msg, hdr) < 0) {
5160                 nlmsg_free(msg);
5161                 return;
5162         }
5163
5164         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5165                                 nl80211_mlme_mcgrp.id, gfp);
5166         return;
5167
5168  nla_put_failure:
5169         genlmsg_cancel(msg, hdr);
5170         nlmsg_free(msg);
5171 }
5172
5173 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5174                                struct net_device *netdev, const u8 *addr,
5175                                gfp_t gfp)
5176 {
5177         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5178                                   addr, gfp);
5179 }
5180
5181 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5182                                 struct net_device *netdev, const u8 *addr,
5183                                 gfp_t gfp)
5184 {
5185         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5186                                   addr, gfp);
5187 }
5188
5189 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5190                                  struct net_device *netdev, const u8 *bssid,
5191                                  const u8 *req_ie, size_t req_ie_len,
5192                                  const u8 *resp_ie, size_t resp_ie_len,
5193                                  u16 status, gfp_t gfp)
5194 {
5195         struct sk_buff *msg;
5196         void *hdr;
5197
5198         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5199         if (!msg)
5200                 return;
5201
5202         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5203         if (!hdr) {
5204                 nlmsg_free(msg);
5205                 return;
5206         }
5207
5208         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5209         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5210         if (bssid)
5211                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5212         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5213         if (req_ie)
5214                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5215         if (resp_ie)
5216                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5217
5218         if (genlmsg_end(msg, hdr) < 0) {
5219                 nlmsg_free(msg);
5220                 return;
5221         }
5222
5223         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5224                                 nl80211_mlme_mcgrp.id, gfp);
5225         return;
5226
5227  nla_put_failure:
5228         genlmsg_cancel(msg, hdr);
5229         nlmsg_free(msg);
5230
5231 }
5232
5233 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5234                          struct net_device *netdev, const u8 *bssid,
5235                          const u8 *req_ie, size_t req_ie_len,
5236                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5237 {
5238         struct sk_buff *msg;
5239         void *hdr;
5240
5241         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5242         if (!msg)
5243                 return;
5244
5245         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5246         if (!hdr) {
5247                 nlmsg_free(msg);
5248                 return;
5249         }
5250
5251         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5252         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5253         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5254         if (req_ie)
5255                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5256         if (resp_ie)
5257                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5258
5259         if (genlmsg_end(msg, hdr) < 0) {
5260                 nlmsg_free(msg);
5261                 return;
5262         }
5263
5264         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5265                                 nl80211_mlme_mcgrp.id, gfp);
5266         return;
5267
5268  nla_put_failure:
5269         genlmsg_cancel(msg, hdr);
5270         nlmsg_free(msg);
5271
5272 }
5273
5274 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5275                                struct net_device *netdev, u16 reason,
5276                                const u8 *ie, size_t ie_len, bool from_ap)
5277 {
5278         struct sk_buff *msg;
5279         void *hdr;
5280
5281         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5282         if (!msg)
5283                 return;
5284
5285         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5286         if (!hdr) {
5287                 nlmsg_free(msg);
5288                 return;
5289         }
5290
5291         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5292         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5293         if (from_ap && reason)
5294                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5295         if (from_ap)
5296                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5297         if (ie)
5298                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5299
5300         if (genlmsg_end(msg, hdr) < 0) {
5301                 nlmsg_free(msg);
5302                 return;
5303         }
5304
5305         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5306                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5307         return;
5308
5309  nla_put_failure:
5310         genlmsg_cancel(msg, hdr);
5311         nlmsg_free(msg);
5312
5313 }
5314
5315 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5316                              struct net_device *netdev, const u8 *bssid,
5317                              gfp_t gfp)
5318 {
5319         struct sk_buff *msg;
5320         void *hdr;
5321
5322         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5323         if (!msg)
5324                 return;
5325
5326         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5327         if (!hdr) {
5328                 nlmsg_free(msg);
5329                 return;
5330         }
5331
5332         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5333         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5334         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5335
5336         if (genlmsg_end(msg, hdr) < 0) {
5337                 nlmsg_free(msg);
5338                 return;
5339         }
5340
5341         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5342                                 nl80211_mlme_mcgrp.id, gfp);
5343         return;
5344
5345  nla_put_failure:
5346         genlmsg_cancel(msg, hdr);
5347         nlmsg_free(msg);
5348 }
5349
5350 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5351                                  struct net_device *netdev, const u8 *addr,
5352                                  enum nl80211_key_type key_type, int key_id,
5353                                  const u8 *tsc, gfp_t gfp)
5354 {
5355         struct sk_buff *msg;
5356         void *hdr;
5357
5358         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5359         if (!msg)
5360                 return;
5361
5362         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5363         if (!hdr) {
5364                 nlmsg_free(msg);
5365                 return;
5366         }
5367
5368         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5369         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5370         if (addr)
5371                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5372         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5373         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5374         if (tsc)
5375                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5376
5377         if (genlmsg_end(msg, hdr) < 0) {
5378                 nlmsg_free(msg);
5379                 return;
5380         }
5381
5382         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5383                                 nl80211_mlme_mcgrp.id, gfp);
5384         return;
5385
5386  nla_put_failure:
5387         genlmsg_cancel(msg, hdr);
5388         nlmsg_free(msg);
5389 }
5390
5391 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5392                                     struct ieee80211_channel *channel_before,
5393                                     struct ieee80211_channel *channel_after)
5394 {
5395         struct sk_buff *msg;
5396         void *hdr;
5397         struct nlattr *nl_freq;
5398
5399         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5400         if (!msg)
5401                 return;
5402
5403         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5404         if (!hdr) {
5405                 nlmsg_free(msg);
5406                 return;
5407         }
5408
5409         /*
5410          * Since we are applying the beacon hint to a wiphy we know its
5411          * wiphy_idx is valid
5412          */
5413         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5414
5415         /* Before */
5416         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5417         if (!nl_freq)
5418                 goto nla_put_failure;
5419         if (nl80211_msg_put_channel(msg, channel_before))
5420                 goto nla_put_failure;
5421         nla_nest_end(msg, nl_freq);
5422
5423         /* After */
5424         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5425         if (!nl_freq)
5426                 goto nla_put_failure;
5427         if (nl80211_msg_put_channel(msg, channel_after))
5428                 goto nla_put_failure;
5429         nla_nest_end(msg, nl_freq);
5430
5431         if (genlmsg_end(msg, hdr) < 0) {
5432                 nlmsg_free(msg);
5433                 return;
5434         }
5435
5436         rcu_read_lock();
5437         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5438                                 GFP_ATOMIC);
5439         rcu_read_unlock();
5440
5441         return;
5442
5443 nla_put_failure:
5444         genlmsg_cancel(msg, hdr);
5445         nlmsg_free(msg);
5446 }
5447
5448 static void nl80211_send_remain_on_chan_event(
5449         int cmd, struct cfg80211_registered_device *rdev,
5450         struct net_device *netdev, u64 cookie,
5451         struct ieee80211_channel *chan,
5452         enum nl80211_channel_type channel_type,
5453         unsigned int duration, gfp_t gfp)
5454 {
5455         struct sk_buff *msg;
5456         void *hdr;
5457
5458         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5459         if (!msg)
5460                 return;
5461
5462         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5463         if (!hdr) {
5464                 nlmsg_free(msg);
5465                 return;
5466         }
5467
5468         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5469         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5470         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5471         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5472         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5473
5474         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5475                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5476
5477         if (genlmsg_end(msg, hdr) < 0) {
5478                 nlmsg_free(msg);
5479                 return;
5480         }
5481
5482         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5483                                 nl80211_mlme_mcgrp.id, gfp);
5484         return;
5485
5486  nla_put_failure:
5487         genlmsg_cancel(msg, hdr);
5488         nlmsg_free(msg);
5489 }
5490
5491 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5492                                     struct net_device *netdev, u64 cookie,
5493                                     struct ieee80211_channel *chan,
5494                                     enum nl80211_channel_type channel_type,
5495                                     unsigned int duration, gfp_t gfp)
5496 {
5497         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5498                                           rdev, netdev, cookie, chan,
5499                                           channel_type, duration, gfp);
5500 }
5501
5502 void nl80211_send_remain_on_channel_cancel(
5503         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5504         u64 cookie, struct ieee80211_channel *chan,
5505         enum nl80211_channel_type channel_type, gfp_t gfp)
5506 {
5507         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5508                                           rdev, netdev, cookie, chan,
5509                                           channel_type, 0, gfp);
5510 }
5511
5512 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5513                             struct net_device *dev, const u8 *mac_addr,
5514                             struct station_info *sinfo, gfp_t gfp)
5515 {
5516         struct sk_buff *msg;
5517
5518         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5519         if (!msg)
5520                 return;
5521
5522         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5523                 nlmsg_free(msg);
5524                 return;
5525         }
5526
5527         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5528                                 nl80211_mlme_mcgrp.id, gfp);
5529 }
5530
5531 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
5532                       struct net_device *netdev, u32 nlpid,
5533                       int freq, const u8 *buf, size_t len, gfp_t gfp)
5534 {
5535         struct sk_buff *msg;
5536         void *hdr;
5537         int err;
5538
5539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5540         if (!msg)
5541                 return -ENOMEM;
5542
5543         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
5544         if (!hdr) {
5545                 nlmsg_free(msg);
5546                 return -ENOMEM;
5547         }
5548
5549         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5550         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5551         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5552         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5553
5554         err = genlmsg_end(msg, hdr);
5555         if (err < 0) {
5556                 nlmsg_free(msg);
5557                 return err;
5558         }
5559
5560         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5561         if (err < 0)
5562                 return err;
5563         return 0;
5564
5565  nla_put_failure:
5566         genlmsg_cancel(msg, hdr);
5567         nlmsg_free(msg);
5568         return -ENOBUFS;
5569 }
5570
5571 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
5572                                  struct net_device *netdev, u64 cookie,
5573                                  const u8 *buf, size_t len, bool ack,
5574                                  gfp_t gfp)
5575 {
5576         struct sk_buff *msg;
5577         void *hdr;
5578
5579         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5580         if (!msg)
5581                 return;
5582
5583         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
5584         if (!hdr) {
5585                 nlmsg_free(msg);
5586                 return;
5587         }
5588
5589         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5590         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5591         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5592         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5593         if (ack)
5594                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5595
5596         if (genlmsg_end(msg, hdr) < 0) {
5597                 nlmsg_free(msg);
5598                 return;
5599         }
5600
5601         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5602         return;
5603
5604  nla_put_failure:
5605         genlmsg_cancel(msg, hdr);
5606         nlmsg_free(msg);
5607 }
5608
5609 void
5610 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
5611                              struct net_device *netdev,
5612                              enum nl80211_cqm_rssi_threshold_event rssi_event,
5613                              gfp_t gfp)
5614 {
5615         struct sk_buff *msg;
5616         struct nlattr *pinfoattr;
5617         void *hdr;
5618
5619         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5620         if (!msg)
5621                 return;
5622
5623         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5624         if (!hdr) {
5625                 nlmsg_free(msg);
5626                 return;
5627         }
5628
5629         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5630         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5631
5632         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5633         if (!pinfoattr)
5634                 goto nla_put_failure;
5635
5636         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
5637                     rssi_event);
5638
5639         nla_nest_end(msg, pinfoattr);
5640
5641         if (genlmsg_end(msg, hdr) < 0) {
5642                 nlmsg_free(msg);
5643                 return;
5644         }
5645
5646         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5647                                 nl80211_mlme_mcgrp.id, gfp);
5648         return;
5649
5650  nla_put_failure:
5651         genlmsg_cancel(msg, hdr);
5652         nlmsg_free(msg);
5653 }
5654
5655 static int nl80211_netlink_notify(struct notifier_block * nb,
5656                                   unsigned long state,
5657                                   void *_notify)
5658 {
5659         struct netlink_notify *notify = _notify;
5660         struct cfg80211_registered_device *rdev;
5661         struct wireless_dev *wdev;
5662
5663         if (state != NETLINK_URELEASE)
5664                 return NOTIFY_DONE;
5665
5666         rcu_read_lock();
5667
5668         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5669                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5670                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
5671
5672         rcu_read_unlock();
5673
5674         return NOTIFY_DONE;
5675 }
5676
5677 static struct notifier_block nl80211_netlink_notifier = {
5678         .notifier_call = nl80211_netlink_notify,
5679 };
5680
5681 /* initialisation/exit functions */
5682
5683 int nl80211_init(void)
5684 {
5685         int err;
5686
5687         err = genl_register_family_with_ops(&nl80211_fam,
5688                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5689         if (err)
5690                 return err;
5691
5692         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5693         if (err)
5694                 goto err_out;
5695
5696         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5697         if (err)
5698                 goto err_out;
5699
5700         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5701         if (err)
5702                 goto err_out;
5703
5704         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5705         if (err)
5706                 goto err_out;
5707
5708 #ifdef CONFIG_NL80211_TESTMODE
5709         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5710         if (err)
5711                 goto err_out;
5712 #endif
5713
5714         err = netlink_register_notifier(&nl80211_netlink_notifier);
5715         if (err)
5716                 goto err_out;
5717
5718         return 0;
5719  err_out:
5720         genl_unregister_family(&nl80211_fam);
5721         return err;
5722 }
5723
5724 void nl80211_exit(void)
5725 {
5726         netlink_unregister_notifier(&nl80211_netlink_notifier);
5727         genl_unregister_family(&nl80211_fam);
5728 }