net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  73
  74         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  77
  78         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80
  81         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  82         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  83                                     .len = WLAN_MAX_KEY_LEN },
  84         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  85         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  86         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  87         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  88
  89         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  90         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  91         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  92                                        .len = IEEE80211_MAX_DATA_LEN },
  93         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  94                                        .len = IEEE80211_MAX_DATA_LEN },
  95         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  96         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  97         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  98         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  99                                                .len = NL80211_MAX_SUPP_RATES },
 100         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 101         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 102         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 103         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 104                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 105         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 106
 107         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 108         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 114                                            .len = NL80211_MAX_SUPP_RATES },
 115
 116         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 117
 118         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 119                                          .len = NL80211_HT_CAPABILITY_LEN },
 120
 121         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 122         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 123                               .len = IEEE80211_MAX_DATA_LEN },
 124         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 125         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 126
 127         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 128                                 .len = IEEE80211_MAX_SSID_LEN },
 129         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 130         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 131         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 134         [NL80211_ATTR_STA_FLAGS2] = {
 135                 .len = sizeof(struct nl80211_sta_flag_update),
 136         },
 137         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 140         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 141         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 142         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 143         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 144                                  .len = WLAN_PMKID_LEN },
 145         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 146         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 147         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 148         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 149                                  .len = IEEE80211_MAX_DATA_LEN },
 150         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 151         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 152 };
 153
 154 /* policy for the attributes */
 155 static struct nla_policy
 156 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 157         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 158         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 159         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 160         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 161         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 162         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 163 };
 164
 165 /* ifidx get helper */
 166 static int nl80211_get_ifidx(struct netlink_callback *cb)
 167 {
 168         int res;
 169
 170         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 171                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 172                           nl80211_policy);
 173         if (res)
 174                 return res;
 175
 176         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 177                 return -EINVAL;
 178
 179         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 180         if (!res)
 181                 return -EINVAL;
 182         return res;
 183 }
 184
 185 /* IE validation */
 186 static bool is_valid_ie_attr(const struct nlattr *attr)
 187 {
 188         const u8 *pos;
 189         int len;
 190
 191         if (!attr)
 192                 return true;
 193
 194         pos = nla_data(attr);
 195         len = nla_len(attr);
 196
 197         while (len) {
 198                 u8 elemlen;
 199
 200                 if (len < 2)
 201                         return false;
 202                 len -= 2;
 203
 204                 elemlen = pos[1];
 205                 if (elemlen > len)
 206                         return false;
 207
 208                 len -= elemlen;
 209                 pos += 2 + elemlen;
 210         }
 211
 212         return true;
 213 }
 214
 215 /* message building helper */
 216 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 217                                    int flags, u8 cmd)
 218 {
 219         /* since there is no private header just add the generic one */
 220         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 221 }
 222
 223 static int nl80211_msg_put_channel(struct sk_buff *msg,
 224                                    struct ieee80211_channel *chan)
 225 {
 226         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 227                     chan->center_freq);
 228
 229         if (chan->flags & IEEE80211_CHAN_DISABLED)
 230                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 231         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 232                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 233         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 234                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 235         if (chan->flags & IEEE80211_CHAN_RADAR)
 236                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 237
 238         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 239                     DBM_TO_MBM(chan->max_power));
 240
 241         return 0;
 242
 243  nla_put_failure:
 244         return -ENOBUFS;
 245 }
 246
 247 /* netlink command implementations */
 248
 249 struct key_parse {
 250         struct key_params p;
 251         int idx;
 252         bool def, defmgmt;
 253 };
 254
 255 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 256 {
 257         struct nlattr *tb[NL80211_KEY_MAX + 1];
 258         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 259                                    nl80211_key_policy);
 260         if (err)
 261                 return err;
 262
 263         k->def = !!tb[NL80211_KEY_DEFAULT];
 264         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 265
 266         if (tb[NL80211_KEY_IDX])
 267                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 268
 269         if (tb[NL80211_KEY_DATA]) {
 270                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 271                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 272         }
 273
 274         if (tb[NL80211_KEY_SEQ]) {
 275                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 276                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 277         }
 278
 279         if (tb[NL80211_KEY_CIPHER])
 280                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 281
 282         return 0;
 283 }
 284
 285 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 286 {
 287         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 288                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 289                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 290         }
 291
 292         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 293                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 294                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 295         }
 296
 297         if (info->attrs[NL80211_ATTR_KEY_IDX])
 298                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 299
 300         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 301                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 302
 303         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 304         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 305
 306         return 0;
 307 }
 308
 309 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 310 {
 311         int err;
 312
 313         memset(k, 0, sizeof(*k));
 314         k->idx = -1;
 315
 316         if (info->attrs[NL80211_ATTR_KEY])
 317                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 318         else
 319                 err = nl80211_parse_key_old(info, k);
 320
 321         if (err)
 322                 return err;
 323
 324         if (k->def && k->defmgmt)
 325                 return -EINVAL;
 326
 327         if (k->idx != -1) {
 328                 if (k->defmgmt) {
 329                         if (k->idx < 4 || k->idx > 5)
 330                                 return -EINVAL;
 331                 } else if (k->def) {
 332                         if (k->idx < 0 || k->idx > 3)
 333                                 return -EINVAL;
 334                 } else {
 335                         if (k->idx < 0 || k->idx > 5)
 336                                 return -EINVAL;
 337                 }
 338         }
 339
 340         return 0;
 341 }
 342
 343 static struct cfg80211_cached_keys *
 344 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 345                        struct nlattr *keys)
 346 {
 347         struct key_parse parse;
 348         struct nlattr *key;
 349         struct cfg80211_cached_keys *result;
 350         int rem, err, def = 0;
 351
 352         result = kzalloc(sizeof(*result), GFP_KERNEL);
 353         if (!result)
 354                 return ERR_PTR(-ENOMEM);
 355
 356         result->def = -1;
 357         result->defmgmt = -1;
 358
 359         nla_for_each_nested(key, keys, rem) {
 360                 memset(&parse, 0, sizeof(parse));
 361                 parse.idx = -1;
 362
 363                 err = nl80211_parse_key_new(key, &parse);
 364                 if (err)
 365                         goto error;
 366                 err = -EINVAL;
 367                 if (!parse.p.key)
 368                         goto error;
 369                 if (parse.idx < 0 || parse.idx > 4)
 370                         goto error;
 371                 if (parse.def) {
 372                         if (def)
 373                                 goto error;
 374                         def = 1;
 375                         result->def = parse.idx;
 376                 } else if (parse.defmgmt)
 377                         goto error;
 378                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 379                                                      parse.idx, NULL);
 380                 if (err)
 381                         goto error;
 382                 result->params[parse.idx].cipher = parse.p.cipher;
 383                 result->params[parse.idx].key_len = parse.p.key_len;
 384                 result->params[parse.idx].key = result->data[parse.idx];
 385                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 386         }
 387
 388         return result;
 389  error:
 390         kfree(result);
 391         return ERR_PTR(err);
 392 }
 393
 394 static int nl80211_key_allowed(struct wireless_dev *wdev)
 395 {
 396         ASSERT_WDEV_LOCK(wdev);
 397
 398         if (!netif_running(wdev->netdev))
 399                 return -ENETDOWN;
 400
 401         switch (wdev->iftype) {
 402         case NL80211_IFTYPE_AP:
 403         case NL80211_IFTYPE_AP_VLAN:
 404                 break;
 405         case NL80211_IFTYPE_ADHOC:
 406                 if (!wdev->current_bss)
 407                         return -ENOLINK;
 408                 break;
 409         case NL80211_IFTYPE_STATION:
 410                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 411                         return -ENOLINK;
 412                 break;
 413         default:
 414                 return -EINVAL;
 415         }
 416
 417         return 0;
 418 }
 419
 420 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 421                               struct cfg80211_registered_device *dev)
 422 {
 423         void *hdr;
 424         struct nlattr *nl_bands, *nl_band;
 425         struct nlattr *nl_freqs, *nl_freq;
 426         struct nlattr *nl_rates, *nl_rate;
 427         struct nlattr *nl_modes;
 428         struct nlattr *nl_cmds;
 429         enum ieee80211_band band;
 430         struct ieee80211_channel *chan;
 431         struct ieee80211_rate *rate;
 432         int i;
 433         u16 ifmodes = dev->wiphy.interface_modes;
 434
 435         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 436         if (!hdr)
 437                 return -1;
 438
 439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 440         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 441
 442         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 443                     cfg80211_rdev_list_generation);
 444
 445         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 446                    dev->wiphy.retry_short);
 447         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 448                    dev->wiphy.retry_long);
 449         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 450                     dev->wiphy.frag_threshold);
 451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 452                     dev->wiphy.rts_threshold);
 453         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 454                     dev->wiphy.coverage_class);
 455
 456         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 457                    dev->wiphy.max_scan_ssids);
 458         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 459                     dev->wiphy.max_scan_ie_len);
 460
 461         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 462                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 463                 dev->wiphy.cipher_suites);
 464
 465         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 466                    dev->wiphy.max_num_pmkids);
 467
 468         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 469         if (!nl_modes)
 470                 goto nla_put_failure;
 471
 472         i = 0;
 473         while (ifmodes) {
 474                 if (ifmodes & 1)
 475                         NLA_PUT_FLAG(msg, i);
 476                 ifmodes >>= 1;
 477                 i++;
 478         }
 479
 480         nla_nest_end(msg, nl_modes);
 481
 482         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 483         if (!nl_bands)
 484                 goto nla_put_failure;
 485
 486         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 487                 if (!dev->wiphy.bands[band])
 488                         continue;
 489
 490                 nl_band = nla_nest_start(msg, band);
 491                 if (!nl_band)
 492                         goto nla_put_failure;
 493
 494                 /* add HT info */
 495                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 496                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 497                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 498                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 499                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 500                                 dev->wiphy.bands[band]->ht_cap.cap);
 501                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 502                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 503                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 504                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 505                 }
 506
 507                 /* add frequencies */
 508                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 509                 if (!nl_freqs)
 510                         goto nla_put_failure;
 511
 512                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 513                         nl_freq = nla_nest_start(msg, i);
 514                         if (!nl_freq)
 515                                 goto nla_put_failure;
 516
 517                         chan = &dev->wiphy.bands[band]->channels[i];
 518
 519                         if (nl80211_msg_put_channel(msg, chan))
 520                                 goto nla_put_failure;
 521
 522                         nla_nest_end(msg, nl_freq);
 523                 }
 524
 525                 nla_nest_end(msg, nl_freqs);
 526
 527                 /* add bitrates */
 528                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 529                 if (!nl_rates)
 530                         goto nla_put_failure;
 531
 532                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 533                         nl_rate = nla_nest_start(msg, i);
 534                         if (!nl_rate)
 535                                 goto nla_put_failure;
 536
 537                         rate = &dev->wiphy.bands[band]->bitrates[i];
 538                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 539                                     rate->bitrate);
 540                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 541                                 NLA_PUT_FLAG(msg,
 542                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 543
 544                         nla_nest_end(msg, nl_rate);
 545                 }
 546
 547                 nla_nest_end(msg, nl_rates);
 548
 549                 nla_nest_end(msg, nl_band);
 550         }
 551         nla_nest_end(msg, nl_bands);
 552
 553         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 554         if (!nl_cmds)
 555                 goto nla_put_failure;
 556
 557         i = 0;
 558 #define CMD(op, n)                                              \
 559          do {                                                   \
 560                 if (dev->ops->op) {                             \
 561                         i++;                                    \
 562                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 563                 }                                               \
 564         } while (0)
 565
 566         CMD(add_virtual_intf, NEW_INTERFACE);
 567         CMD(change_virtual_intf, SET_INTERFACE);
 568         CMD(add_key, NEW_KEY);
 569         CMD(add_beacon, NEW_BEACON);
 570         CMD(add_station, NEW_STATION);
 571         CMD(add_mpath, NEW_MPATH);
 572         CMD(set_mesh_params, SET_MESH_PARAMS);
 573         CMD(change_bss, SET_BSS);
 574         CMD(auth, AUTHENTICATE);
 575         CMD(assoc, ASSOCIATE);
 576         CMD(deauth, DEAUTHENTICATE);
 577         CMD(disassoc, DISASSOCIATE);
 578         CMD(join_ibss, JOIN_IBSS);
 579         CMD(set_pmksa, SET_PMKSA);
 580         CMD(del_pmksa, DEL_PMKSA);
 581         CMD(flush_pmksa, FLUSH_PMKSA);
 582         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 583         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 584         CMD(action, ACTION);
 585         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 586                 i++;
 587                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 588         }
 589
 590 #undef CMD
 591
 592         if (dev->ops->connect || dev->ops->auth) {
 593                 i++;
 594                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 595         }
 596
 597         if (dev->ops->disconnect || dev->ops->deauth) {
 598                 i++;
 599                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 600         }
 601
 602         nla_nest_end(msg, nl_cmds);
 603
 604         return genlmsg_end(msg, hdr);
 605
 606  nla_put_failure:
 607         genlmsg_cancel(msg, hdr);
 608         return -EMSGSIZE;
 609 }
 610
 611 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 612 {
 613         int idx = 0;
 614         int start = cb->args[0];
 615         struct cfg80211_registered_device *dev;
 616
 617         mutex_lock(&cfg80211_mutex);
 618         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 619                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 620                         continue;
 621                 if (++idx <= start)
 622                         continue;
 623                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 624                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 625                                        dev) < 0) {
 626                         idx--;
 627                         break;
 628                 }
 629         }
 630         mutex_unlock(&cfg80211_mutex);
 631
 632         cb->args[0] = idx;
 633
 634         return skb->len;
 635 }
 636
 637 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 638 {
 639         struct sk_buff *msg;
 640         struct cfg80211_registered_device *dev;
 641
 642         dev = cfg80211_get_dev_from_info(info);
 643         if (IS_ERR(dev))
 644                 return PTR_ERR(dev);
 645
 646         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 647         if (!msg)
 648                 goto out_err;
 649
 650         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 651                 goto out_free;
 652
 653         cfg80211_unlock_rdev(dev);
 654
 655         return genlmsg_reply(msg, info);
 656
 657  out_free:
 658         nlmsg_free(msg);
 659  out_err:
 660         cfg80211_unlock_rdev(dev);
 661         return -ENOBUFS;
 662 }
 663
 664 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 665         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 666         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 667         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 668         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 669         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 670 };
 671
 672 static int parse_txq_params(struct nlattr *tb[],
 673                             struct ieee80211_txq_params *txq_params)
 674 {
 675         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 676             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 677             !tb[NL80211_TXQ_ATTR_AIFS])
 678                 return -EINVAL;
 679
 680         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 681         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 682         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 683         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 684         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 685
 686         return 0;
 687 }
 688
 689 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 690 {
 691         struct cfg80211_registered_device *rdev;
 692         int result = 0, rem_txq_params = 0;
 693         struct nlattr *nl_txq_params;
 694         u32 changed;
 695         u8 retry_short = 0, retry_long = 0;
 696         u32 frag_threshold = 0, rts_threshold = 0;
 697         u8 coverage_class = 0;
 698
 699         rtnl_lock();
 700
 701         mutex_lock(&cfg80211_mutex);
 702
 703         rdev = __cfg80211_rdev_from_info(info);
 704         if (IS_ERR(rdev)) {
 705                 mutex_unlock(&cfg80211_mutex);
 706                 result = PTR_ERR(rdev);
 707                 goto unlock;
 708         }
 709
 710         mutex_lock(&rdev->mtx);
 711
 712         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 713                 result = cfg80211_dev_rename(
 714                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 715
 716         mutex_unlock(&cfg80211_mutex);
 717
 718         if (result)
 719                 goto bad_res;
 720
 721         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 722                 struct ieee80211_txq_params txq_params;
 723                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 724
 725                 if (!rdev->ops->set_txq_params) {
 726                         result = -EOPNOTSUPP;
 727                         goto bad_res;
 728                 }
 729
 730                 nla_for_each_nested(nl_txq_params,
 731                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 732                                     rem_txq_params) {
 733                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 734                                   nla_data(nl_txq_params),
 735                                   nla_len(nl_txq_params),
 736                                   txq_params_policy);
 737                         result = parse_txq_params(tb, &txq_params);
 738                         if (result)
 739                                 goto bad_res;
 740
 741                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 742                                                            &txq_params);
 743                         if (result)
 744                                 goto bad_res;
 745                 }
 746         }
 747
 748         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 749                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 750                 u32 freq;
 751
 752                 result = -EINVAL;
 753
 754                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 755                         channel_type = nla_get_u32(info->attrs[
 756                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 757                         if (channel_type != NL80211_CHAN_NO_HT &&
 758                             channel_type != NL80211_CHAN_HT20 &&
 759                             channel_type != NL80211_CHAN_HT40PLUS &&
 760                             channel_type != NL80211_CHAN_HT40MINUS)
 761                                 goto bad_res;
 762                 }
 763
 764                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 765
 766                 mutex_lock(&rdev->devlist_mtx);
 767                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 768                 mutex_unlock(&rdev->devlist_mtx);
 769                 if (result)
 770                         goto bad_res;
 771         }
 772
 773         changed = 0;
 774
 775         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 776                 retry_short = nla_get_u8(
 777                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 778                 if (retry_short == 0) {
 779                         result = -EINVAL;
 780                         goto bad_res;
 781                 }
 782                 changed |= WIPHY_PARAM_RETRY_SHORT;
 783         }
 784
 785         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 786                 retry_long = nla_get_u8(
 787                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 788                 if (retry_long == 0) {
 789                         result = -EINVAL;
 790                         goto bad_res;
 791                 }
 792                 changed |= WIPHY_PARAM_RETRY_LONG;
 793         }
 794
 795         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 796                 frag_threshold = nla_get_u32(
 797                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 798                 if (frag_threshold < 256) {
 799                         result = -EINVAL;
 800                         goto bad_res;
 801                 }
 802                 if (frag_threshold != (u32) -1) {
 803                         /*
 804                          * Fragments (apart from the last one) are required to
 805                          * have even length. Make the fragmentation code
 806                          * simpler by stripping LSB should someone try to use
 807                          * odd threshold value.
 808                          */
 809                         frag_threshold &= ~0x1;
 810                 }
 811                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 812         }
 813
 814         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 815                 rts_threshold = nla_get_u32(
 816                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 817                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 818         }
 819
 820         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 821                 coverage_class = nla_get_u8(
 822                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 823                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 824         }
 825
 826         if (changed) {
 827                 u8 old_retry_short, old_retry_long;
 828                 u32 old_frag_threshold, old_rts_threshold;
 829                 u8 old_coverage_class;
 830
 831                 if (!rdev->ops->set_wiphy_params) {
 832                         result = -EOPNOTSUPP;
 833                         goto bad_res;
 834                 }
 835
 836                 old_retry_short = rdev->wiphy.retry_short;
 837                 old_retry_long = rdev->wiphy.retry_long;
 838                 old_frag_threshold = rdev->wiphy.frag_threshold;
 839                 old_rts_threshold = rdev->wiphy.rts_threshold;
 840                 old_coverage_class = rdev->wiphy.coverage_class;
 841
 842                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 843                         rdev->wiphy.retry_short = retry_short;
 844                 if (changed & WIPHY_PARAM_RETRY_LONG)
 845                         rdev->wiphy.retry_long = retry_long;
 846                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 847                         rdev->wiphy.frag_threshold = frag_threshold;
 848                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 849                         rdev->wiphy.rts_threshold = rts_threshold;
 850                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 851                         rdev->wiphy.coverage_class = coverage_class;
 852
 853                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 854                 if (result) {
 855                         rdev->wiphy.retry_short = old_retry_short;
 856                         rdev->wiphy.retry_long = old_retry_long;
 857                         rdev->wiphy.frag_threshold = old_frag_threshold;
 858                         rdev->wiphy.rts_threshold = old_rts_threshold;
 859                         rdev->wiphy.coverage_class = old_coverage_class;
 860                 }
 861         }
 862
 863  bad_res:
 864         mutex_unlock(&rdev->mtx);
 865  unlock:
 866         rtnl_unlock();
 867         return result;
 868 }
 869
 870
 871 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 872                               struct cfg80211_registered_device *rdev,
 873                               struct net_device *dev)
 874 {
 875         void *hdr;
 876
 877         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 878         if (!hdr)
 879                 return -1;
 880
 881         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 882         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 883         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 884         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 885
 886         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 887                     rdev->devlist_generation ^
 888                         (cfg80211_rdev_list_generation << 2));
 889
 890         return genlmsg_end(msg, hdr);
 891
 892  nla_put_failure:
 893         genlmsg_cancel(msg, hdr);
 894         return -EMSGSIZE;
 895 }
 896
 897 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 898 {
 899         int wp_idx = 0;
 900         int if_idx = 0;
 901         int wp_start = cb->args[0];
 902         int if_start = cb->args[1];
 903         struct cfg80211_registered_device *rdev;
 904         struct wireless_dev *wdev;
 905
 906         mutex_lock(&cfg80211_mutex);
 907         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 908                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 909                         continue;
 910                 if (wp_idx < wp_start) {
 911                         wp_idx++;
 912                         continue;
 913                 }
 914                 if_idx = 0;
 915
 916                 mutex_lock(&rdev->devlist_mtx);
 917                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 918                         if (if_idx < if_start) {
 919                                 if_idx++;
 920                                 continue;
 921                         }
 922                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 923                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 924                                                rdev, wdev->netdev) < 0) {
 925                                 mutex_unlock(&rdev->devlist_mtx);
 926                                 goto out;
 927                         }
 928                         if_idx++;
 929                 }
 930                 mutex_unlock(&rdev->devlist_mtx);
 931
 932                 wp_idx++;
 933         }
 934  out:
 935         mutex_unlock(&cfg80211_mutex);
 936
 937         cb->args[0] = wp_idx;
 938         cb->args[1] = if_idx;
 939
 940         return skb->len;
 941 }
 942
 943 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 944 {
 945         struct sk_buff *msg;
 946         struct cfg80211_registered_device *dev;
 947         struct net_device *netdev;
 948         int err;
 949
 950         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 951         if (err)
 952                 return err;
 953
 954         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 955         if (!msg)
 956                 goto out_err;
 957
 958         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 959                                dev, netdev) < 0)
 960                 goto out_free;
 961
 962         dev_put(netdev);
 963         cfg80211_unlock_rdev(dev);
 964
 965         return genlmsg_reply(msg, info);
 966
 967  out_free:
 968         nlmsg_free(msg);
 969  out_err:
 970         dev_put(netdev);
 971         cfg80211_unlock_rdev(dev);
 972         return -ENOBUFS;
 973 }
 974
 975 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 976         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 977         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 978         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 979         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 980         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 981 };
 982
 983 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 984 {
 985         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 986         int flag;
 987
 988         *mntrflags = 0;
 989
 990         if (!nla)
 991                 return -EINVAL;
 992
 993         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 994                              nla, mntr_flags_policy))
 995                 return -EINVAL;
 996
 997         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 998                 if (flags[flag])
 999                         *mntrflags |= (1<<flag);
1000
1001         return 0;
1002 }
1003
1004 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1005                                struct net_device *netdev, u8 use_4addr,
1006                                enum nl80211_iftype iftype)
1007 {
1008         if (!use_4addr) {
1009                 if (netdev && netdev->br_port)
1010                         return -EBUSY;
1011                 return 0;
1012         }
1013
1014         switch (iftype) {
1015         case NL80211_IFTYPE_AP_VLAN:
1016                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1017                         return 0;
1018                 break;
1019         case NL80211_IFTYPE_STATION:
1020                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1021                         return 0;
1022                 break;
1023         default:
1024                 break;
1025         }
1026
1027         return -EOPNOTSUPP;
1028 }
1029
1030 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1031 {
1032         struct cfg80211_registered_device *rdev;
1033         struct vif_params params;
1034         int err;
1035         enum nl80211_iftype otype, ntype;
1036         struct net_device *dev;
1037         u32 _flags, *flags = NULL;
1038         bool change = false;
1039
1040         memset(&params, 0, sizeof(params));
1041
1042         rtnl_lock();
1043
1044         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1045         if (err)
1046                 goto unlock_rtnl;
1047
1048         otype = ntype = dev->ieee80211_ptr->iftype;
1049
1050         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1051                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1052                 if (otype != ntype)
1053                         change = true;
1054                 if (ntype > NL80211_IFTYPE_MAX) {
1055                         err = -EINVAL;
1056                         goto unlock;
1057                 }
1058         }
1059
1060         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1061                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1062                         err = -EINVAL;
1063                         goto unlock;
1064                 }
1065                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1066                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1067                 change = true;
1068         }
1069
1070         if (info->attrs[NL80211_ATTR_4ADDR]) {
1071                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1072                 change = true;
1073                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1074                 if (err)
1075                         goto unlock;
1076         } else {
1077                 params.use_4addr = -1;
1078         }
1079
1080         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1081                 if (ntype != NL80211_IFTYPE_MONITOR) {
1082                         err = -EINVAL;
1083                         goto unlock;
1084                 }
1085                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1086                                           &_flags);
1087                 if (err)
1088                         goto unlock;
1089
1090                 flags = &_flags;
1091                 change = true;
1092         }
1093
1094         if (change)
1095                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1096         else
1097                 err = 0;
1098
1099         if (!err && params.use_4addr != -1)
1100                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1101
1102  unlock:
1103         dev_put(dev);
1104         cfg80211_unlock_rdev(rdev);
1105  unlock_rtnl:
1106         rtnl_unlock();
1107         return err;
1108 }
1109
1110 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1111 {
1112         struct cfg80211_registered_device *rdev;
1113         struct vif_params params;
1114         int err;
1115         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1116         u32 flags;
1117
1118         memset(&params, 0, sizeof(params));
1119
1120         if (!info->attrs[NL80211_ATTR_IFNAME])
1121                 return -EINVAL;
1122
1123         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1124                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1125                 if (type > NL80211_IFTYPE_MAX)
1126                         return -EINVAL;
1127         }
1128
1129         rtnl_lock();
1130
1131         rdev = cfg80211_get_dev_from_info(info);
1132         if (IS_ERR(rdev)) {
1133                 err = PTR_ERR(rdev);
1134                 goto unlock_rtnl;
1135         }
1136
1137         if (!rdev->ops->add_virtual_intf ||
1138             !(rdev->wiphy.interface_modes & (1 << type))) {
1139                 err = -EOPNOTSUPP;
1140                 goto unlock;
1141         }
1142
1143         if (type == NL80211_IFTYPE_MESH_POINT &&
1144             info->attrs[NL80211_ATTR_MESH_ID]) {
1145                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1146                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1147         }
1148
1149         if (info->attrs[NL80211_ATTR_4ADDR]) {
1150                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1151                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1152                 if (err)
1153                         goto unlock;
1154         }
1155
1156         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1157                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1158                                   &flags);
1159         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1160                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1161                 type, err ? NULL : &flags, &params);
1162
1163  unlock:
1164         cfg80211_unlock_rdev(rdev);
1165  unlock_rtnl:
1166         rtnl_unlock();
1167         return err;
1168 }
1169
1170 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1171 {
1172         struct cfg80211_registered_device *rdev;
1173         int err;
1174         struct net_device *dev;
1175
1176         rtnl_lock();
1177
1178         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1179         if (err)
1180                 goto unlock_rtnl;
1181
1182         if (!rdev->ops->del_virtual_intf) {
1183                 err = -EOPNOTSUPP;
1184                 goto out;
1185         }
1186
1187         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1188
1189  out:
1190         cfg80211_unlock_rdev(rdev);
1191         dev_put(dev);
1192  unlock_rtnl:
1193         rtnl_unlock();
1194         return err;
1195 }
1196
1197 struct get_key_cookie {
1198         struct sk_buff *msg;
1199         int error;
1200         int idx;
1201 };
1202
1203 static void get_key_callback(void *c, struct key_params *params)
1204 {
1205         struct nlattr *key;
1206         struct get_key_cookie *cookie = c;
1207
1208         if (params->key)
1209                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1210                         params->key_len, params->key);
1211
1212         if (params->seq)
1213                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1214                         params->seq_len, params->seq);
1215
1216         if (params->cipher)
1217                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1218                             params->cipher);
1219
1220         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1221         if (!key)
1222                 goto nla_put_failure;
1223
1224         if (params->key)
1225                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1226                         params->key_len, params->key);
1227
1228         if (params->seq)
1229                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1230                         params->seq_len, params->seq);
1231
1232         if (params->cipher)
1233                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1234                             params->cipher);
1235
1236         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1237
1238         nla_nest_end(cookie->msg, key);
1239
1240         return;
1241  nla_put_failure:
1242         cookie->error = 1;
1243 }
1244
1245 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1246 {
1247         struct cfg80211_registered_device *rdev;
1248         int err;
1249         struct net_device *dev;
1250         u8 key_idx = 0;
1251         u8 *mac_addr = NULL;
1252         struct get_key_cookie cookie = {
1253                 .error = 0,
1254         };
1255         void *hdr;
1256         struct sk_buff *msg;
1257
1258         if (info->attrs[NL80211_ATTR_KEY_IDX])
1259                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1260
1261         if (key_idx > 5)
1262                 return -EINVAL;
1263
1264         if (info->attrs[NL80211_ATTR_MAC])
1265                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1266
1267         rtnl_lock();
1268
1269         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1270         if (err)
1271                 goto unlock_rtnl;
1272
1273         if (!rdev->ops->get_key) {
1274                 err = -EOPNOTSUPP;
1275                 goto out;
1276         }
1277
1278         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1279         if (!msg) {
1280                 err = -ENOMEM;
1281                 goto out;
1282         }
1283
1284         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1285                              NL80211_CMD_NEW_KEY);
1286
1287         if (IS_ERR(hdr)) {
1288                 err = PTR_ERR(hdr);
1289                 goto free_msg;
1290         }
1291
1292         cookie.msg = msg;
1293         cookie.idx = key_idx;
1294
1295         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1296         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1297         if (mac_addr)
1298                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1299
1300         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1301                                 &cookie, get_key_callback);
1302
1303         if (err)
1304                 goto free_msg;
1305
1306         if (cookie.error)
1307                 goto nla_put_failure;
1308
1309         genlmsg_end(msg, hdr);
1310         err = genlmsg_reply(msg, info);
1311         goto out;
1312
1313  nla_put_failure:
1314         err = -ENOBUFS;
1315  free_msg:
1316         nlmsg_free(msg);
1317  out:
1318         cfg80211_unlock_rdev(rdev);
1319         dev_put(dev);
1320  unlock_rtnl:
1321         rtnl_unlock();
1322
1323         return err;
1324 }
1325
1326 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1327 {
1328         struct cfg80211_registered_device *rdev;
1329         struct key_parse key;
1330         int err;
1331         struct net_device *dev;
1332         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1333                     u8 key_index);
1334
1335         err = nl80211_parse_key(info, &key);
1336         if (err)
1337                 return err;
1338
1339         if (key.idx < 0)
1340                 return -EINVAL;
1341
1342         /* only support setting default key */
1343         if (!key.def && !key.defmgmt)
1344                 return -EINVAL;
1345
1346         rtnl_lock();
1347
1348         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1349         if (err)
1350                 goto unlock_rtnl;
1351
1352         if (key.def)
1353                 func = rdev->ops->set_default_key;
1354         else
1355                 func = rdev->ops->set_default_mgmt_key;
1356
1357         if (!func) {
1358                 err = -EOPNOTSUPP;
1359                 goto out;
1360         }
1361
1362         wdev_lock(dev->ieee80211_ptr);
1363         err = nl80211_key_allowed(dev->ieee80211_ptr);
1364         if (!err)
1365                 err = func(&rdev->wiphy, dev, key.idx);
1366
1367 #ifdef CONFIG_CFG80211_WEXT
1368         if (!err) {
1369                 if (func == rdev->ops->set_default_key)
1370                         dev->ieee80211_ptr->wext.default_key = key.idx;
1371                 else
1372                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1373         }
1374 #endif
1375         wdev_unlock(dev->ieee80211_ptr);
1376
1377  out:
1378         cfg80211_unlock_rdev(rdev);
1379         dev_put(dev);
1380
1381  unlock_rtnl:
1382         rtnl_unlock();
1383
1384         return err;
1385 }
1386
1387 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1388 {
1389         struct cfg80211_registered_device *rdev;
1390         int err;
1391         struct net_device *dev;
1392         struct key_parse key;
1393         u8 *mac_addr = NULL;
1394
1395         err = nl80211_parse_key(info, &key);
1396         if (err)
1397                 return err;
1398
1399         if (!key.p.key)
1400                 return -EINVAL;
1401
1402         if (info->attrs[NL80211_ATTR_MAC])
1403                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1404
1405         rtnl_lock();
1406
1407         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1408         if (err)
1409                 goto unlock_rtnl;
1410
1411         if (!rdev->ops->add_key) {
1412                 err = -EOPNOTSUPP;
1413                 goto out;
1414         }
1415
1416         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1417                 err = -EINVAL;
1418                 goto out;
1419         }
1420
1421         wdev_lock(dev->ieee80211_ptr);
1422         err = nl80211_key_allowed(dev->ieee80211_ptr);
1423         if (!err)
1424                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1425                                          mac_addr, &key.p);
1426         wdev_unlock(dev->ieee80211_ptr);
1427
1428  out:
1429         cfg80211_unlock_rdev(rdev);
1430         dev_put(dev);
1431  unlock_rtnl:
1432         rtnl_unlock();
1433
1434         return err;
1435 }
1436
1437 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1438 {
1439         struct cfg80211_registered_device *rdev;
1440         int err;
1441         struct net_device *dev;
1442         u8 *mac_addr = NULL;
1443         struct key_parse key;
1444
1445         err = nl80211_parse_key(info, &key);
1446         if (err)
1447                 return err;
1448
1449         if (info->attrs[NL80211_ATTR_MAC])
1450                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1451
1452         rtnl_lock();
1453
1454         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1455         if (err)
1456                 goto unlock_rtnl;
1457
1458         if (!rdev->ops->del_key) {
1459                 err = -EOPNOTSUPP;
1460                 goto out;
1461         }
1462
1463         wdev_lock(dev->ieee80211_ptr);
1464         err = nl80211_key_allowed(dev->ieee80211_ptr);
1465         if (!err)
1466                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1467
1468 #ifdef CONFIG_CFG80211_WEXT
1469         if (!err) {
1470                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1471                         dev->ieee80211_ptr->wext.default_key = -1;
1472                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1473                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1474         }
1475 #endif
1476         wdev_unlock(dev->ieee80211_ptr);
1477
1478  out:
1479         cfg80211_unlock_rdev(rdev);
1480         dev_put(dev);
1481
1482  unlock_rtnl:
1483         rtnl_unlock();
1484
1485         return err;
1486 }
1487
1488 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1489 {
1490         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1491                     struct beacon_parameters *info);
1492         struct cfg80211_registered_device *rdev;
1493         int err;
1494         struct net_device *dev;
1495         struct beacon_parameters params;
1496         int haveinfo = 0;
1497
1498         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1499                 return -EINVAL;
1500
1501         rtnl_lock();
1502
1503         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1504         if (err)
1505                 goto unlock_rtnl;
1506
1507         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1508                 err = -EOPNOTSUPP;
1509                 goto out;
1510         }
1511
1512         switch (info->genlhdr->cmd) {
1513         case NL80211_CMD_NEW_BEACON:
1514                 /* these are required for NEW_BEACON */
1515                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1516                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1517                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1518                         err = -EINVAL;
1519                         goto out;
1520                 }
1521
1522                 call = rdev->ops->add_beacon;
1523                 break;
1524         case NL80211_CMD_SET_BEACON:
1525                 call = rdev->ops->set_beacon;
1526                 break;
1527         default:
1528                 WARN_ON(1);
1529                 err = -EOPNOTSUPP;
1530                 goto out;
1531         }
1532
1533         if (!call) {
1534                 err = -EOPNOTSUPP;
1535                 goto out;
1536         }
1537
1538         memset(&params, 0, sizeof(params));
1539
1540         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1541                 params.interval =
1542                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1543                 haveinfo = 1;
1544         }
1545
1546         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1547                 params.dtim_period =
1548                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1549                 haveinfo = 1;
1550         }
1551
1552         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1553                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1554                 params.head_len =
1555                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1556                 haveinfo = 1;
1557         }
1558
1559         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1560                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1561                 params.tail_len =
1562                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1563                 haveinfo = 1;
1564         }
1565
1566         if (!haveinfo) {
1567                 err = -EINVAL;
1568                 goto out;
1569         }
1570
1571         err = call(&rdev->wiphy, dev, &params);
1572
1573  out:
1574         cfg80211_unlock_rdev(rdev);
1575         dev_put(dev);
1576  unlock_rtnl:
1577         rtnl_unlock();
1578
1579         return err;
1580 }
1581
1582 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1583 {
1584         struct cfg80211_registered_device *rdev;
1585         int err;
1586         struct net_device *dev;
1587
1588         rtnl_lock();
1589
1590         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1591         if (err)
1592                 goto unlock_rtnl;
1593
1594         if (!rdev->ops->del_beacon) {
1595                 err = -EOPNOTSUPP;
1596                 goto out;
1597         }
1598
1599         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1600                 err = -EOPNOTSUPP;
1601                 goto out;
1602         }
1603         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1604
1605  out:
1606         cfg80211_unlock_rdev(rdev);
1607         dev_put(dev);
1608  unlock_rtnl:
1609         rtnl_unlock();
1610
1611         return err;
1612 }
1613
1614 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1615         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1616         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1617         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1618         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1619 };
1620
1621 static int parse_station_flags(struct genl_info *info,
1622                                struct station_parameters *params)
1623 {
1624         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1625         struct nlattr *nla;
1626         int flag;
1627
1628         /*
1629          * Try parsing the new attribute first so userspace
1630          * can specify both for older kernels.
1631          */
1632         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1633         if (nla) {
1634                 struct nl80211_sta_flag_update *sta_flags;
1635
1636                 sta_flags = nla_data(nla);
1637                 params->sta_flags_mask = sta_flags->mask;
1638                 params->sta_flags_set = sta_flags->set;
1639                 if ((params->sta_flags_mask |
1640                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1641                         return -EINVAL;
1642                 return 0;
1643         }
1644
1645         /* if present, parse the old attribute */
1646
1647         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1648         if (!nla)
1649                 return 0;
1650
1651         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1652                              nla, sta_flags_policy))
1653                 return -EINVAL;
1654
1655         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1656         params->sta_flags_mask &= ~1;
1657
1658         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1659                 if (flags[flag])
1660                         params->sta_flags_set |= (1<<flag);
1661
1662         return 0;
1663 }
1664
1665 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1666                                 int flags, struct net_device *dev,
1667                                 const u8 *mac_addr, struct station_info *sinfo)
1668 {
1669         void *hdr;
1670         struct nlattr *sinfoattr, *txrate;
1671         u16 bitrate;
1672
1673         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1674         if (!hdr)
1675                 return -1;
1676
1677         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1678         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1679
1680         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1681
1682         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1683         if (!sinfoattr)
1684                 goto nla_put_failure;
1685         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1686                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1687                             sinfo->inactive_time);
1688         if (sinfo->filled & STATION_INFO_RX_BYTES)
1689                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1690                             sinfo->rx_bytes);
1691         if (sinfo->filled & STATION_INFO_TX_BYTES)
1692                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1693                             sinfo->tx_bytes);
1694         if (sinfo->filled & STATION_INFO_LLID)
1695                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1696                             sinfo->llid);
1697         if (sinfo->filled & STATION_INFO_PLID)
1698                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1699                             sinfo->plid);
1700         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1701                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1702                             sinfo->plink_state);
1703         if (sinfo->filled & STATION_INFO_SIGNAL)
1704                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1705                            sinfo->signal);
1706         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1707                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1708                 if (!txrate)
1709                         goto nla_put_failure;
1710
1711                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1712                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1713                 if (bitrate > 0)
1714                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1715
1716                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1717                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1718                                     sinfo->txrate.mcs);
1719                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1720                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1721                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1722                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1723
1724                 nla_nest_end(msg, txrate);
1725         }
1726         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1727                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1728                             sinfo->rx_packets);
1729         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1730                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1731                             sinfo->tx_packets);
1732         nla_nest_end(msg, sinfoattr);
1733
1734         return genlmsg_end(msg, hdr);
1735
1736  nla_put_failure:
1737         genlmsg_cancel(msg, hdr);
1738         return -EMSGSIZE;
1739 }
1740
1741 static int nl80211_dump_station(struct sk_buff *skb,
1742                                 struct netlink_callback *cb)
1743 {
1744         struct station_info sinfo;
1745         struct cfg80211_registered_device *dev;
1746         struct net_device *netdev;
1747         u8 mac_addr[ETH_ALEN];
1748         int ifidx = cb->args[0];
1749         int sta_idx = cb->args[1];
1750         int err;
1751
1752         if (!ifidx)
1753                 ifidx = nl80211_get_ifidx(cb);
1754         if (ifidx < 0)
1755                 return ifidx;
1756
1757         rtnl_lock();
1758
1759         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1760         if (!netdev) {
1761                 err = -ENODEV;
1762                 goto out_rtnl;
1763         }
1764
1765         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1766         if (IS_ERR(dev)) {
1767                 err = PTR_ERR(dev);
1768                 goto out_rtnl;
1769         }
1770
1771         if (!dev->ops->dump_station) {
1772                 err = -EOPNOTSUPP;
1773                 goto out_err;
1774         }
1775
1776         while (1) {
1777                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1778                                              mac_addr, &sinfo);
1779                 if (err == -ENOENT)
1780                         break;
1781                 if (err)
1782                         goto out_err;
1783
1784                 if (nl80211_send_station(skb,
1785                                 NETLINK_CB(cb->skb).pid,
1786                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1787                                 netdev, mac_addr,
1788                                 &sinfo) < 0)
1789                         goto out;
1790
1791                 sta_idx++;
1792         }
1793
1794
1795  out:
1796         cb->args[1] = sta_idx;
1797         err = skb->len;
1798  out_err:
1799         cfg80211_unlock_rdev(dev);
1800  out_rtnl:
1801         rtnl_unlock();
1802
1803         return err;
1804 }
1805
1806 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1807 {
1808         struct cfg80211_registered_device *rdev;
1809         int err;
1810         struct net_device *dev;
1811         struct station_info sinfo;
1812         struct sk_buff *msg;
1813         u8 *mac_addr = NULL;
1814
1815         memset(&sinfo, 0, sizeof(sinfo));
1816
1817         if (!info->attrs[NL80211_ATTR_MAC])
1818                 return -EINVAL;
1819
1820         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1821
1822         rtnl_lock();
1823
1824         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1825         if (err)
1826                 goto out_rtnl;
1827
1828         if (!rdev->ops->get_station) {
1829                 err = -EOPNOTSUPP;
1830                 goto out;
1831         }
1832
1833         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1834         if (err)
1835                 goto out;
1836
1837         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1838         if (!msg)
1839                 goto out;
1840
1841         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1842                                  dev, mac_addr, &sinfo) < 0)
1843                 goto out_free;
1844
1845         err = genlmsg_reply(msg, info);
1846         goto out;
1847
1848  out_free:
1849         nlmsg_free(msg);
1850  out:
1851         cfg80211_unlock_rdev(rdev);
1852         dev_put(dev);
1853  out_rtnl:
1854         rtnl_unlock();
1855
1856         return err;
1857 }
1858
1859 /*
1860  * Get vlan interface making sure it is running and on the right wiphy.
1861  */
1862 static int get_vlan(struct genl_info *info,
1863                     struct cfg80211_registered_device *rdev,
1864                     struct net_device **vlan)
1865 {
1866         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1867         *vlan = NULL;
1868
1869         if (vlanattr) {
1870                 *vlan = dev_get_by_index(genl_info_net(info),
1871                                          nla_get_u32(vlanattr));
1872                 if (!*vlan)
1873                         return -ENODEV;
1874                 if (!(*vlan)->ieee80211_ptr)
1875                         return -EINVAL;
1876                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1877                         return -EINVAL;
1878                 if (!netif_running(*vlan))
1879                         return -ENETDOWN;
1880         }
1881         return 0;
1882 }
1883
1884 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1885 {
1886         struct cfg80211_registered_device *rdev;
1887         int err;
1888         struct net_device *dev;
1889         struct station_parameters params;
1890         u8 *mac_addr = NULL;
1891
1892         memset(&params, 0, sizeof(params));
1893
1894         params.listen_interval = -1;
1895
1896         if (info->attrs[NL80211_ATTR_STA_AID])
1897                 return -EINVAL;
1898
1899         if (!info->attrs[NL80211_ATTR_MAC])
1900                 return -EINVAL;
1901
1902         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1903
1904         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1905                 params.supported_rates =
1906                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1907                 params.supported_rates_len =
1908                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1909         }
1910
1911         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1912                 params.listen_interval =
1913                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1914
1915         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1916                 params.ht_capa =
1917                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1918
1919         if (parse_station_flags(info, &params))
1920                 return -EINVAL;
1921
1922         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1923                 params.plink_action =
1924                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1925
1926         rtnl_lock();
1927
1928         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1929         if (err)
1930                 goto out_rtnl;
1931
1932         err = get_vlan(info, rdev, &params.vlan);
1933         if (err)
1934                 goto out;
1935
1936         /* validate settings */
1937         err = 0;
1938
1939         switch (dev->ieee80211_ptr->iftype) {
1940         case NL80211_IFTYPE_AP:
1941         case NL80211_IFTYPE_AP_VLAN:
1942                 /* disallow mesh-specific things */
1943                 if (params.plink_action)
1944                         err = -EINVAL;
1945                 break;
1946         case NL80211_IFTYPE_STATION:
1947                 /* disallow everything but AUTHORIZED flag */
1948                 if (params.plink_action)
1949                         err = -EINVAL;
1950                 if (params.vlan)
1951                         err = -EINVAL;
1952                 if (params.supported_rates)
1953                         err = -EINVAL;
1954                 if (params.ht_capa)
1955                         err = -EINVAL;
1956                 if (params.listen_interval >= 0)
1957                         err = -EINVAL;
1958                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1959                         err = -EINVAL;
1960                 break;
1961         case NL80211_IFTYPE_MESH_POINT:
1962                 /* disallow things mesh doesn't support */
1963                 if (params.vlan)
1964                         err = -EINVAL;
1965                 if (params.ht_capa)
1966                         err = -EINVAL;
1967                 if (params.listen_interval >= 0)
1968                         err = -EINVAL;
1969                 if (params.supported_rates)
1970                         err = -EINVAL;
1971                 if (params.sta_flags_mask)
1972                         err = -EINVAL;
1973                 break;
1974         default:
1975                 err = -EINVAL;
1976         }
1977
1978         if (err)
1979                 goto out;
1980
1981         if (!rdev->ops->change_station) {
1982                 err = -EOPNOTSUPP;
1983                 goto out;
1984         }
1985
1986         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1987
1988  out:
1989         if (params.vlan)
1990                 dev_put(params.vlan);
1991         cfg80211_unlock_rdev(rdev);
1992         dev_put(dev);
1993  out_rtnl:
1994         rtnl_unlock();
1995
1996         return err;
1997 }
1998
1999 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2000 {
2001         struct cfg80211_registered_device *rdev;
2002         int err;
2003         struct net_device *dev;
2004         struct station_parameters params;
2005         u8 *mac_addr = NULL;
2006
2007         memset(&params, 0, sizeof(params));
2008
2009         if (!info->attrs[NL80211_ATTR_MAC])
2010                 return -EINVAL;
2011
2012         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2013                 return -EINVAL;
2014
2015         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2016                 return -EINVAL;
2017
2018         if (!info->attrs[NL80211_ATTR_STA_AID])
2019                 return -EINVAL;
2020
2021         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2022         params.supported_rates =
2023                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2024         params.supported_rates_len =
2025                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2026         params.listen_interval =
2027                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2028
2029         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2030         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2031                 return -EINVAL;
2032
2033         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2034                 params.ht_capa =
2035                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2036
2037         if (parse_station_flags(info, &params))
2038                 return -EINVAL;
2039
2040         rtnl_lock();
2041
2042         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2043         if (err)
2044                 goto out_rtnl;
2045
2046         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2047             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2048                 err = -EINVAL;
2049                 goto out;
2050         }
2051
2052         err = get_vlan(info, rdev, &params.vlan);
2053         if (err)
2054                 goto out;
2055
2056         /* validate settings */
2057         err = 0;
2058
2059         if (!rdev->ops->add_station) {
2060                 err = -EOPNOTSUPP;
2061                 goto out;
2062         }
2063
2064         if (!netif_running(dev)) {
2065                 err = -ENETDOWN;
2066                 goto out;
2067         }
2068
2069         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2070
2071  out:
2072         if (params.vlan)
2073                 dev_put(params.vlan);
2074         cfg80211_unlock_rdev(rdev);
2075         dev_put(dev);
2076  out_rtnl:
2077         rtnl_unlock();
2078
2079         return err;
2080 }
2081
2082 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2083 {
2084         struct cfg80211_registered_device *rdev;
2085         int err;
2086         struct net_device *dev;
2087         u8 *mac_addr = NULL;
2088
2089         if (info->attrs[NL80211_ATTR_MAC])
2090                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2091
2092         rtnl_lock();
2093
2094         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2095         if (err)
2096                 goto out_rtnl;
2097
2098         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2099             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2100                 err = -EINVAL;
2101                 goto out;
2102         }
2103
2104         if (!rdev->ops->del_station) {
2105                 err = -EOPNOTSUPP;
2106                 goto out;
2107         }
2108
2109         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2110
2111  out:
2112         cfg80211_unlock_rdev(rdev);
2113         dev_put(dev);
2114  out_rtnl:
2115         rtnl_unlock();
2116
2117         return err;
2118 }
2119
2120 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2121                                 int flags, struct net_device *dev,
2122                                 u8 *dst, u8 *next_hop,
2123                                 struct mpath_info *pinfo)
2124 {
2125         void *hdr;
2126         struct nlattr *pinfoattr;
2127
2128         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2129         if (!hdr)
2130                 return -1;
2131
2132         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2133         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2134         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2135
2136         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2137
2138         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2139         if (!pinfoattr)
2140                 goto nla_put_failure;
2141         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2142                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2143                             pinfo->frame_qlen);
2144         if (pinfo->filled & MPATH_INFO_SN)
2145                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2146                             pinfo->sn);
2147         if (pinfo->filled & MPATH_INFO_METRIC)
2148                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2149                             pinfo->metric);
2150         if (pinfo->filled & MPATH_INFO_EXPTIME)
2151                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2152                             pinfo->exptime);
2153         if (pinfo->filled & MPATH_INFO_FLAGS)
2154                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2155                             pinfo->flags);
2156         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2157                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2158                             pinfo->discovery_timeout);
2159         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2160                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2161                             pinfo->discovery_retries);
2162
2163         nla_nest_end(msg, pinfoattr);
2164
2165         return genlmsg_end(msg, hdr);
2166
2167  nla_put_failure:
2168         genlmsg_cancel(msg, hdr);
2169         return -EMSGSIZE;
2170 }
2171
2172 static int nl80211_dump_mpath(struct sk_buff *skb,
2173                               struct netlink_callback *cb)
2174 {
2175         struct mpath_info pinfo;
2176         struct cfg80211_registered_device *dev;
2177         struct net_device *netdev;
2178         u8 dst[ETH_ALEN];
2179         u8 next_hop[ETH_ALEN];
2180         int ifidx = cb->args[0];
2181         int path_idx = cb->args[1];
2182         int err;
2183
2184         if (!ifidx)
2185                 ifidx = nl80211_get_ifidx(cb);
2186         if (ifidx < 0)
2187                 return ifidx;
2188
2189         rtnl_lock();
2190
2191         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2192         if (!netdev) {
2193                 err = -ENODEV;
2194                 goto out_rtnl;
2195         }
2196
2197         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2198         if (IS_ERR(dev)) {
2199                 err = PTR_ERR(dev);
2200                 goto out_rtnl;
2201         }
2202
2203         if (!dev->ops->dump_mpath) {
2204                 err = -EOPNOTSUPP;
2205                 goto out_err;
2206         }
2207
2208         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2209                 err = -EOPNOTSUPP;
2210                 goto out_err;
2211         }
2212
2213         while (1) {
2214                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2215                                            dst, next_hop, &pinfo);
2216                 if (err == -ENOENT)
2217                         break;
2218                 if (err)
2219                         goto out_err;
2220
2221                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2222                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2223                                        netdev, dst, next_hop,
2224                                        &pinfo) < 0)
2225                         goto out;
2226
2227                 path_idx++;
2228         }
2229
2230
2231  out:
2232         cb->args[1] = path_idx;
2233         err = skb->len;
2234  out_err:
2235         cfg80211_unlock_rdev(dev);
2236  out_rtnl:
2237         rtnl_unlock();
2238
2239         return err;
2240 }
2241
2242 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2243 {
2244         struct cfg80211_registered_device *rdev;
2245         int err;
2246         struct net_device *dev;
2247         struct mpath_info pinfo;
2248         struct sk_buff *msg;
2249         u8 *dst = NULL;
2250         u8 next_hop[ETH_ALEN];
2251
2252         memset(&pinfo, 0, sizeof(pinfo));
2253
2254         if (!info->attrs[NL80211_ATTR_MAC])
2255                 return -EINVAL;
2256
2257         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2258
2259         rtnl_lock();
2260
2261         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2262         if (err)
2263                 goto out_rtnl;
2264
2265         if (!rdev->ops->get_mpath) {
2266                 err = -EOPNOTSUPP;
2267                 goto out;
2268         }
2269
2270         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2271                 err = -EOPNOTSUPP;
2272                 goto out;
2273         }
2274
2275         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2276         if (err)
2277                 goto out;
2278
2279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2280         if (!msg)
2281                 goto out;
2282
2283         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2284                                  dev, dst, next_hop, &pinfo) < 0)
2285                 goto out_free;
2286
2287         err = genlmsg_reply(msg, info);
2288         goto out;
2289
2290  out_free:
2291         nlmsg_free(msg);
2292  out:
2293         cfg80211_unlock_rdev(rdev);
2294         dev_put(dev);
2295  out_rtnl:
2296         rtnl_unlock();
2297
2298         return err;
2299 }
2300
2301 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2302 {
2303         struct cfg80211_registered_device *rdev;
2304         int err;
2305         struct net_device *dev;
2306         u8 *dst = NULL;
2307         u8 *next_hop = NULL;
2308
2309         if (!info->attrs[NL80211_ATTR_MAC])
2310                 return -EINVAL;
2311
2312         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2313                 return -EINVAL;
2314
2315         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2316         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2317
2318         rtnl_lock();
2319
2320         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2321         if (err)
2322                 goto out_rtnl;
2323
2324         if (!rdev->ops->change_mpath) {
2325                 err = -EOPNOTSUPP;
2326                 goto out;
2327         }
2328
2329         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2330                 err = -EOPNOTSUPP;
2331                 goto out;
2332         }
2333
2334         if (!netif_running(dev)) {
2335                 err = -ENETDOWN;
2336                 goto out;
2337         }
2338
2339         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2340
2341  out:
2342         cfg80211_unlock_rdev(rdev);
2343         dev_put(dev);
2344  out_rtnl:
2345         rtnl_unlock();
2346
2347         return err;
2348 }
2349 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2350 {
2351         struct cfg80211_registered_device *rdev;
2352         int err;
2353         struct net_device *dev;
2354         u8 *dst = NULL;
2355         u8 *next_hop = NULL;
2356
2357         if (!info->attrs[NL80211_ATTR_MAC])
2358                 return -EINVAL;
2359
2360         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2361                 return -EINVAL;
2362
2363         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2364         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2365
2366         rtnl_lock();
2367
2368         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2369         if (err)
2370                 goto out_rtnl;
2371
2372         if (!rdev->ops->add_mpath) {
2373                 err = -EOPNOTSUPP;
2374                 goto out;
2375         }
2376
2377         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2378                 err = -EOPNOTSUPP;
2379                 goto out;
2380         }
2381
2382         if (!netif_running(dev)) {
2383                 err = -ENETDOWN;
2384                 goto out;
2385         }
2386
2387         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2388
2389  out:
2390         cfg80211_unlock_rdev(rdev);
2391         dev_put(dev);
2392  out_rtnl:
2393         rtnl_unlock();
2394
2395         return err;
2396 }
2397
2398 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2399 {
2400         struct cfg80211_registered_device *rdev;
2401         int err;
2402         struct net_device *dev;
2403         u8 *dst = NULL;
2404
2405         if (info->attrs[NL80211_ATTR_MAC])
2406                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2407
2408         rtnl_lock();
2409
2410         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2411         if (err)
2412                 goto out_rtnl;
2413
2414         if (!rdev->ops->del_mpath) {
2415                 err = -EOPNOTSUPP;
2416                 goto out;
2417         }
2418
2419         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2420
2421  out:
2422         cfg80211_unlock_rdev(rdev);
2423         dev_put(dev);
2424  out_rtnl:
2425         rtnl_unlock();
2426
2427         return err;
2428 }
2429
2430 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2431 {
2432         struct cfg80211_registered_device *rdev;
2433         int err;
2434         struct net_device *dev;
2435         struct bss_parameters params;
2436
2437         memset(&params, 0, sizeof(params));
2438         /* default to not changing parameters */
2439         params.use_cts_prot = -1;
2440         params.use_short_preamble = -1;
2441         params.use_short_slot_time = -1;
2442
2443         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2444                 params.use_cts_prot =
2445                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2446         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2447                 params.use_short_preamble =
2448                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2449         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2450                 params.use_short_slot_time =
2451                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2452         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2453                 params.basic_rates =
2454                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2455                 params.basic_rates_len =
2456                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2457         }
2458
2459         rtnl_lock();
2460
2461         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2462         if (err)
2463                 goto out_rtnl;
2464
2465         if (!rdev->ops->change_bss) {
2466                 err = -EOPNOTSUPP;
2467                 goto out;
2468         }
2469
2470         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2471                 err = -EOPNOTSUPP;
2472                 goto out;
2473         }
2474
2475         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2476
2477  out:
2478         cfg80211_unlock_rdev(rdev);
2479         dev_put(dev);
2480  out_rtnl:
2481         rtnl_unlock();
2482
2483         return err;
2484 }
2485
2486 static const struct nla_policy
2487         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2488         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2489         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2490         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2491         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2492         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2493         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2494 };
2495
2496 static int parse_reg_rule(struct nlattr *tb[],
2497         struct ieee80211_reg_rule *reg_rule)
2498 {
2499         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2500         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2501
2502         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2503                 return -EINVAL;
2504         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2505                 return -EINVAL;
2506         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2507                 return -EINVAL;
2508         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2509                 return -EINVAL;
2510         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2511                 return -EINVAL;
2512
2513         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2514
2515         freq_range->start_freq_khz =
2516                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2517         freq_range->end_freq_khz =
2518                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2519         freq_range->max_bandwidth_khz =
2520                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2521
2522         power_rule->max_eirp =
2523                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2524
2525         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2526                 power_rule->max_antenna_gain =
2527                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2528
2529         return 0;
2530 }
2531
2532 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2533 {
2534         int r;
2535         char *data = NULL;
2536
2537         /*
2538          * You should only get this when cfg80211 hasn't yet initialized
2539          * completely when built-in to the kernel right between the time
2540          * window between nl80211_init() and regulatory_init(), if that is
2541          * even possible.
2542          */
2543         mutex_lock(&cfg80211_mutex);
2544         if (unlikely(!cfg80211_regdomain)) {
2545                 mutex_unlock(&cfg80211_mutex);
2546                 return -EINPROGRESS;
2547         }
2548         mutex_unlock(&cfg80211_mutex);
2549
2550         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2551                 return -EINVAL;
2552
2553         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2554
2555         r = regulatory_hint_user(data);
2556
2557         return r;
2558 }
2559
2560 static int nl80211_get_mesh_params(struct sk_buff *skb,
2561         struct genl_info *info)
2562 {
2563         struct cfg80211_registered_device *rdev;
2564         struct mesh_config cur_params;
2565         int err;
2566         struct net_device *dev;
2567         void *hdr;
2568         struct nlattr *pinfoattr;
2569         struct sk_buff *msg;
2570
2571         rtnl_lock();
2572
2573         /* Look up our device */
2574         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2575         if (err)
2576                 goto out_rtnl;
2577
2578         if (!rdev->ops->get_mesh_params) {
2579                 err = -EOPNOTSUPP;
2580                 goto out;
2581         }
2582
2583         /* Get the mesh params */
2584         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2585         if (err)
2586                 goto out;
2587
2588         /* Draw up a netlink message to send back */
2589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2590         if (!msg) {
2591                 err = -ENOBUFS;
2592                 goto out;
2593         }
2594         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2595                              NL80211_CMD_GET_MESH_PARAMS);
2596         if (!hdr)
2597                 goto nla_put_failure;
2598         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2599         if (!pinfoattr)
2600                 goto nla_put_failure;
2601         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2602         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2603                         cur_params.dot11MeshRetryTimeout);
2604         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2605                         cur_params.dot11MeshConfirmTimeout);
2606         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2607                         cur_params.dot11MeshHoldingTimeout);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2609                         cur_params.dot11MeshMaxPeerLinks);
2610         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2611                         cur_params.dot11MeshMaxRetries);
2612         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2613                         cur_params.dot11MeshTTL);
2614         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2615                         cur_params.auto_open_plinks);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2617                         cur_params.dot11MeshHWMPmaxPREQretries);
2618         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2619                         cur_params.path_refresh_time);
2620         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2621                         cur_params.min_discovery_timeout);
2622         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2623                         cur_params.dot11MeshHWMPactivePathTimeout);
2624         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2625                         cur_params.dot11MeshHWMPpreqMinInterval);
2626         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2627                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2628         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2629                         cur_params.dot11MeshHWMPRootMode);
2630         nla_nest_end(msg, pinfoattr);
2631         genlmsg_end(msg, hdr);
2632         err = genlmsg_reply(msg, info);
2633         goto out;
2634
2635  nla_put_failure:
2636         genlmsg_cancel(msg, hdr);
2637         err = -EMSGSIZE;
2638  out:
2639         /* Cleanup */
2640         cfg80211_unlock_rdev(rdev);
2641         dev_put(dev);
2642  out_rtnl:
2643         rtnl_unlock();
2644
2645         return err;
2646 }
2647
2648 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2649 do {\
2650         if (table[attr_num]) {\
2651                 cfg.param = nla_fn(table[attr_num]); \
2652                 mask |= (1 << (attr_num - 1)); \
2653         } \
2654 } while (0);\
2655
2656 static struct nla_policy
2657 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2658         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2659         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2661         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2663         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2664         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2665
2666         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2667         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2668         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2669         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2670         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2671         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2672 };
2673
2674 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2675 {
2676         int err;
2677         u32 mask;
2678         struct cfg80211_registered_device *rdev;
2679         struct net_device *dev;
2680         struct mesh_config cfg;
2681         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2682         struct nlattr *parent_attr;
2683
2684         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2685         if (!parent_attr)
2686                 return -EINVAL;
2687         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2688                         parent_attr, nl80211_meshconf_params_policy))
2689                 return -EINVAL;
2690
2691         rtnl_lock();
2692
2693         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2694         if (err)
2695                 goto out_rtnl;
2696
2697         if (!rdev->ops->set_mesh_params) {
2698                 err = -EOPNOTSUPP;
2699                 goto out;
2700         }
2701
2702         /* This makes sure that there aren't more than 32 mesh config
2703          * parameters (otherwise our bitfield scheme would not work.) */
2704         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2705
2706         /* Fill in the params struct */
2707         mask = 0;
2708         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2709                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2710         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2711                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2712         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2713                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2714         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2715                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2717                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2719                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2721                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2722         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2723                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2724                         nla_get_u8);
2725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2726                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2728                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2729                         nla_get_u16);
2730         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2731                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2732                         nla_get_u32);
2733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2734                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2735                         nla_get_u16);
2736         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2737                         dot11MeshHWMPnetDiameterTraversalTime,
2738                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2739                         nla_get_u16);
2740         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2741                         dot11MeshHWMPRootMode, mask,
2742                         NL80211_MESHCONF_HWMP_ROOTMODE,
2743                         nla_get_u8);
2744
2745         /* Apply changes */
2746         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2747
2748  out:
2749         /* cleanup */
2750         cfg80211_unlock_rdev(rdev);
2751         dev_put(dev);
2752  out_rtnl:
2753         rtnl_unlock();
2754
2755         return err;
2756 }
2757
2758 #undef FILL_IN_MESH_PARAM_IF_SET
2759
2760 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2761 {
2762         struct sk_buff *msg;
2763         void *hdr = NULL;
2764         struct nlattr *nl_reg_rules;
2765         unsigned int i;
2766         int err = -EINVAL;
2767
2768         mutex_lock(&cfg80211_mutex);
2769
2770         if (!cfg80211_regdomain)
2771                 goto out;
2772
2773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2774         if (!msg) {
2775                 err = -ENOBUFS;
2776                 goto out;
2777         }
2778
2779         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2780                              NL80211_CMD_GET_REG);
2781         if (!hdr)
2782                 goto nla_put_failure;
2783
2784         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2785                 cfg80211_regdomain->alpha2);
2786
2787         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2788         if (!nl_reg_rules)
2789                 goto nla_put_failure;
2790
2791         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2792                 struct nlattr *nl_reg_rule;
2793                 const struct ieee80211_reg_rule *reg_rule;
2794                 const struct ieee80211_freq_range *freq_range;
2795                 const struct ieee80211_power_rule *power_rule;
2796
2797                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2798                 freq_range = &reg_rule->freq_range;
2799                 power_rule = &reg_rule->power_rule;
2800
2801                 nl_reg_rule = nla_nest_start(msg, i);
2802                 if (!nl_reg_rule)
2803                         goto nla_put_failure;
2804
2805                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2806                         reg_rule->flags);
2807                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2808                         freq_range->start_freq_khz);
2809                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2810                         freq_range->end_freq_khz);
2811                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2812                         freq_range->max_bandwidth_khz);
2813                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2814                         power_rule->max_antenna_gain);
2815                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2816                         power_rule->max_eirp);
2817
2818                 nla_nest_end(msg, nl_reg_rule);
2819         }
2820
2821         nla_nest_end(msg, nl_reg_rules);
2822
2823         genlmsg_end(msg, hdr);
2824         err = genlmsg_reply(msg, info);
2825         goto out;
2826
2827 nla_put_failure:
2828         genlmsg_cancel(msg, hdr);
2829         err = -EMSGSIZE;
2830 out:
2831         mutex_unlock(&cfg80211_mutex);
2832         return err;
2833 }
2834
2835 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2836 {
2837         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2838         struct nlattr *nl_reg_rule;
2839         char *alpha2 = NULL;
2840         int rem_reg_rules = 0, r = 0;
2841         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2842         struct ieee80211_regdomain *rd = NULL;
2843
2844         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2845                 return -EINVAL;
2846
2847         if (!info->attrs[NL80211_ATTR_REG_RULES])
2848                 return -EINVAL;
2849
2850         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2851
2852         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2853                         rem_reg_rules) {
2854                 num_rules++;
2855                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2856                         return -EINVAL;
2857         }
2858
2859         mutex_lock(&cfg80211_mutex);
2860
2861         if (!reg_is_valid_request(alpha2)) {
2862                 r = -EINVAL;
2863                 goto bad_reg;
2864         }
2865
2866         size_of_regd = sizeof(struct ieee80211_regdomain) +
2867                 (num_rules * sizeof(struct ieee80211_reg_rule));
2868
2869         rd = kzalloc(size_of_regd, GFP_KERNEL);
2870         if (!rd) {
2871                 r = -ENOMEM;
2872                 goto bad_reg;
2873         }
2874
2875         rd->n_reg_rules = num_rules;
2876         rd->alpha2[0] = alpha2[0];
2877         rd->alpha2[1] = alpha2[1];
2878
2879         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2880                         rem_reg_rules) {
2881                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2882                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2883                         reg_rule_policy);
2884                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2885                 if (r)
2886                         goto bad_reg;
2887
2888                 rule_idx++;
2889
2890                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2891                         r = -EINVAL;
2892                         goto bad_reg;
2893                 }
2894         }
2895
2896         BUG_ON(rule_idx != num_rules);
2897
2898         r = set_regdom(rd);
2899
2900         mutex_unlock(&cfg80211_mutex);
2901
2902         return r;
2903
2904  bad_reg:
2905         mutex_unlock(&cfg80211_mutex);
2906         kfree(rd);
2907         return r;
2908 }
2909
2910 static int validate_scan_freqs(struct nlattr *freqs)
2911 {
2912         struct nlattr *attr1, *attr2;
2913         int n_channels = 0, tmp1, tmp2;
2914
2915         nla_for_each_nested(attr1, freqs, tmp1) {
2916                 n_channels++;
2917                 /*
2918                  * Some hardware has a limited channel list for
2919                  * scanning, and it is pretty much nonsensical
2920                  * to scan for a channel twice, so disallow that
2921                  * and don't require drivers to check that the
2922                  * channel list they get isn't longer than what
2923                  * they can scan, as long as they can scan all
2924                  * the channels they registered at once.
2925                  */
2926                 nla_for_each_nested(attr2, freqs, tmp2)
2927                         if (attr1 != attr2 &&
2928                             nla_get_u32(attr1) == nla_get_u32(attr2))
2929                                 return 0;
2930         }
2931
2932         return n_channels;
2933 }
2934
2935 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2936 {
2937         struct cfg80211_registered_device *rdev;
2938         struct net_device *dev;
2939         struct cfg80211_scan_request *request;
2940         struct cfg80211_ssid *ssid;
2941         struct ieee80211_channel *channel;
2942         struct nlattr *attr;
2943         struct wiphy *wiphy;
2944         int err, tmp, n_ssids = 0, n_channels, i;
2945         enum ieee80211_band band;
2946         size_t ie_len;
2947
2948         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2949                 return -EINVAL;
2950
2951         rtnl_lock();
2952
2953         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2954         if (err)
2955                 goto out_rtnl;
2956
2957         wiphy = &rdev->wiphy;
2958
2959         if (!rdev->ops->scan) {
2960                 err = -EOPNOTSUPP;
2961                 goto out;
2962         }
2963
2964         if (!netif_running(dev)) {
2965                 err = -ENETDOWN;
2966                 goto out;
2967         }
2968
2969         if (rdev->scan_req) {
2970                 err = -EBUSY;
2971                 goto out;
2972         }
2973
2974         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2975                 n_channels = validate_scan_freqs(
2976                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2977                 if (!n_channels) {
2978                         err = -EINVAL;
2979                         goto out;
2980                 }
2981         } else {
2982                 n_channels = 0;
2983
2984                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2985                         if (wiphy->bands[band])
2986                                 n_channels += wiphy->bands[band]->n_channels;
2987         }
2988
2989         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2990                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2991                         n_ssids++;
2992
2993         if (n_ssids > wiphy->max_scan_ssids) {
2994                 err = -EINVAL;
2995                 goto out;
2996         }
2997
2998         if (info->attrs[NL80211_ATTR_IE])
2999                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3000         else
3001                 ie_len = 0;
3002
3003         if (ie_len > wiphy->max_scan_ie_len) {
3004                 err = -EINVAL;
3005                 goto out;
3006         }
3007
3008         request = kzalloc(sizeof(*request)
3009                         + sizeof(*ssid) * n_ssids
3010                         + sizeof(channel) * n_channels
3011                         + ie_len, GFP_KERNEL);
3012         if (!request) {
3013                 err = -ENOMEM;
3014                 goto out;
3015         }
3016
3017         if (n_ssids)
3018                 request->ssids = (void *)&request->channels[n_channels];
3019         request->n_ssids = n_ssids;
3020         if (ie_len) {
3021                 if (request->ssids)
3022                         request->ie = (void *)(request->ssids + n_ssids);
3023                 else
3024                         request->ie = (void *)(request->channels + n_channels);
3025         }
3026
3027         i = 0;
3028         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3029                 /* user specified, bail out if channel not found */
3030                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3031                         struct ieee80211_channel *chan;
3032
3033                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3034
3035                         if (!chan) {
3036                                 err = -EINVAL;
3037                                 goto out_free;
3038                         }
3039
3040                         /* ignore disabled channels */
3041                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3042                                 continue;
3043
3044                         request->channels[i] = chan;
3045                         i++;
3046                 }
3047         } else {
3048                 /* all channels */
3049                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3050                         int j;
3051                         if (!wiphy->bands[band])
3052                                 continue;
3053                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3054                                 struct ieee80211_channel *chan;
3055
3056                                 chan = &wiphy->bands[band]->channels[j];
3057
3058                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3059                                         continue;
3060
3061                                 request->channels[i] = chan;
3062                                 i++;
3063                         }
3064                 }
3065         }
3066
3067         if (!i) {
3068                 err = -EINVAL;
3069                 goto out_free;
3070         }
3071
3072         request->n_channels = i;
3073
3074         i = 0;
3075         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3076                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3077                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3078                                 err = -EINVAL;
3079                                 goto out_free;
3080                         }
3081                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3082                         request->ssids[i].ssid_len = nla_len(attr);
3083                         i++;
3084                 }
3085         }
3086
3087         if (info->attrs[NL80211_ATTR_IE]) {
3088                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3089                 memcpy((void *)request->ie,
3090                        nla_data(info->attrs[NL80211_ATTR_IE]),
3091                        request->ie_len);
3092         }
3093
3094         request->dev = dev;
3095         request->wiphy = &rdev->wiphy;
3096
3097         rdev->scan_req = request;
3098         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3099
3100         if (!err) {
3101                 nl80211_send_scan_start(rdev, dev);
3102                 dev_hold(dev);
3103         }
3104
3105  out_free:
3106         if (err) {
3107                 rdev->scan_req = NULL;
3108                 kfree(request);
3109         }
3110  out:
3111         cfg80211_unlock_rdev(rdev);
3112         dev_put(dev);
3113  out_rtnl:
3114         rtnl_unlock();
3115
3116         return err;
3117 }
3118
3119 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3120                             struct cfg80211_registered_device *rdev,
3121                             struct wireless_dev *wdev,
3122                             struct cfg80211_internal_bss *intbss)
3123 {
3124         struct cfg80211_bss *res = &intbss->pub;
3125         void *hdr;
3126         struct nlattr *bss;
3127         int i;
3128
3129         ASSERT_WDEV_LOCK(wdev);
3130
3131         hdr = nl80211hdr_put(msg, pid, seq, flags,
3132                              NL80211_CMD_NEW_SCAN_RESULTS);
3133         if (!hdr)
3134                 return -1;
3135
3136         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3137         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3138
3139         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3140         if (!bss)
3141                 goto nla_put_failure;
3142         if (!is_zero_ether_addr(res->bssid))
3143                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3144         if (res->information_elements && res->len_information_elements)
3145                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3146                         res->len_information_elements,
3147                         res->information_elements);
3148         if (res->beacon_ies && res->len_beacon_ies &&
3149             res->beacon_ies != res->information_elements)
3150                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3151                         res->len_beacon_ies, res->beacon_ies);
3152         if (res->tsf)
3153                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3154         if (res->beacon_interval)
3155                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3156         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3157         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3158         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3159                 jiffies_to_msecs(jiffies - intbss->ts));
3160
3161         switch (rdev->wiphy.signal_type) {
3162         case CFG80211_SIGNAL_TYPE_MBM:
3163                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3164                 break;
3165         case CFG80211_SIGNAL_TYPE_UNSPEC:
3166                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3167                 break;
3168         default:
3169                 break;
3170         }
3171
3172         switch (wdev->iftype) {
3173         case NL80211_IFTYPE_STATION:
3174                 if (intbss == wdev->current_bss)
3175                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3176                                     NL80211_BSS_STATUS_ASSOCIATED);
3177                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3178                         if (intbss != wdev->auth_bsses[i])
3179                                 continue;
3180                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3181                                     NL80211_BSS_STATUS_AUTHENTICATED);
3182                         break;
3183                 }
3184                 break;
3185         case NL80211_IFTYPE_ADHOC:
3186                 if (intbss == wdev->current_bss)
3187                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3188                                     NL80211_BSS_STATUS_IBSS_JOINED);
3189                 break;
3190         default:
3191                 break;
3192         }
3193
3194         nla_nest_end(msg, bss);
3195
3196         return genlmsg_end(msg, hdr);
3197
3198  nla_put_failure:
3199         genlmsg_cancel(msg, hdr);
3200         return -EMSGSIZE;
3201 }
3202
3203 static int nl80211_dump_scan(struct sk_buff *skb,
3204                              struct netlink_callback *cb)
3205 {
3206         struct cfg80211_registered_device *rdev;
3207         struct net_device *dev;
3208         struct cfg80211_internal_bss *scan;
3209         struct wireless_dev *wdev;
3210         int ifidx = cb->args[0];
3211         int start = cb->args[1], idx = 0;
3212         int err;
3213
3214         if (!ifidx)
3215                 ifidx = nl80211_get_ifidx(cb);
3216         if (ifidx < 0)
3217                 return ifidx;
3218         cb->args[0] = ifidx;
3219
3220         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3221         if (!dev)
3222                 return -ENODEV;
3223
3224         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3225         if (IS_ERR(rdev)) {
3226                 err = PTR_ERR(rdev);
3227                 goto out_put_netdev;
3228         }
3229
3230         wdev = dev->ieee80211_ptr;
3231
3232         wdev_lock(wdev);
3233         spin_lock_bh(&rdev->bss_lock);
3234         cfg80211_bss_expire(rdev);
3235
3236         list_for_each_entry(scan, &rdev->bss_list, list) {
3237                 if (++idx <= start)
3238                         continue;
3239                 if (nl80211_send_bss(skb,
3240                                 NETLINK_CB(cb->skb).pid,
3241                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3242                                 rdev, wdev, scan) < 0) {
3243                         idx--;
3244                         goto out;
3245                 }
3246         }
3247
3248  out:
3249         spin_unlock_bh(&rdev->bss_lock);
3250         wdev_unlock(wdev);
3251
3252         cb->args[1] = idx;
3253         err = skb->len;
3254         cfg80211_unlock_rdev(rdev);
3255  out_put_netdev:
3256         dev_put(dev);
3257
3258         return err;
3259 }
3260
3261 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3262                                 int flags, struct net_device *dev,
3263                                 struct survey_info *survey)
3264 {
3265         void *hdr;
3266         struct nlattr *infoattr;
3267
3268         /* Survey without a channel doesn't make sense */
3269         if (!survey->channel)
3270                 return -EINVAL;
3271
3272         hdr = nl80211hdr_put(msg, pid, seq, flags,
3273                              NL80211_CMD_NEW_SURVEY_RESULTS);
3274         if (!hdr)
3275                 return -ENOMEM;
3276
3277         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3278
3279         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3280         if (!infoattr)
3281                 goto nla_put_failure;
3282
3283         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3284                     survey->channel->center_freq);
3285         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3286                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3287                             survey->noise);
3288
3289         nla_nest_end(msg, infoattr);
3290
3291         return genlmsg_end(msg, hdr);
3292
3293  nla_put_failure:
3294         genlmsg_cancel(msg, hdr);
3295         return -EMSGSIZE;
3296 }
3297
3298 static int nl80211_dump_survey(struct sk_buff *skb,
3299                         struct netlink_callback *cb)
3300 {
3301         struct survey_info survey;
3302         struct cfg80211_registered_device *dev;
3303         struct net_device *netdev;
3304         int ifidx = cb->args[0];
3305         int survey_idx = cb->args[1];
3306         int res;
3307
3308         if (!ifidx)
3309                 ifidx = nl80211_get_ifidx(cb);
3310         if (ifidx < 0)
3311                 return ifidx;
3312         cb->args[0] = ifidx;
3313
3314         rtnl_lock();
3315
3316         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3317         if (!netdev) {
3318                 res = -ENODEV;
3319                 goto out_rtnl;
3320         }
3321
3322         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3323         if (IS_ERR(dev)) {
3324                 res = PTR_ERR(dev);
3325                 goto out_rtnl;
3326         }
3327
3328         if (!dev->ops->dump_survey) {
3329                 res = -EOPNOTSUPP;
3330                 goto out_err;
3331         }
3332
3333         while (1) {
3334                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3335                                             &survey);
3336                 if (res == -ENOENT)
3337                         break;
3338                 if (res)
3339                         goto out_err;
3340
3341                 if (nl80211_send_survey(skb,
3342                                 NETLINK_CB(cb->skb).pid,
3343                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3344                                 netdev,
3345                                 &survey) < 0)
3346                         goto out;
3347                 survey_idx++;
3348         }
3349
3350  out:
3351         cb->args[1] = survey_idx;
3352         res = skb->len;
3353  out_err:
3354         cfg80211_unlock_rdev(dev);
3355  out_rtnl:
3356         rtnl_unlock();
3357
3358         return res;
3359 }
3360
3361 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3362 {
3363         return auth_type <= NL80211_AUTHTYPE_MAX;
3364 }
3365
3366 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3367 {
3368         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3369                                   NL80211_WPA_VERSION_2));
3370 }
3371
3372 static bool nl80211_valid_akm_suite(u32 akm)
3373 {
3374         return akm == WLAN_AKM_SUITE_8021X ||
3375                 akm == WLAN_AKM_SUITE_PSK;
3376 }
3377
3378 static bool nl80211_valid_cipher_suite(u32 cipher)
3379 {
3380         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3381                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3382                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3383                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3384                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3385 }
3386
3387
3388 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3389 {
3390         struct cfg80211_registered_device *rdev;
3391         struct net_device *dev;
3392         struct ieee80211_channel *chan;
3393         const u8 *bssid, *ssid, *ie = NULL;
3394         int err, ssid_len, ie_len = 0;
3395         enum nl80211_auth_type auth_type;
3396         struct key_parse key;
3397
3398         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3399                 return -EINVAL;
3400
3401         if (!info->attrs[NL80211_ATTR_MAC])
3402                 return -EINVAL;
3403
3404         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3405                 return -EINVAL;
3406
3407         if (!info->attrs[NL80211_ATTR_SSID])
3408                 return -EINVAL;
3409
3410         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3411                 return -EINVAL;
3412
3413         err = nl80211_parse_key(info, &key);
3414         if (err)
3415                 return err;
3416
3417         if (key.idx >= 0) {
3418                 if (!key.p.key || !key.p.key_len)
3419                         return -EINVAL;
3420                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3421                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3422                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3423                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3424                         return -EINVAL;
3425                 if (key.idx > 4)
3426                         return -EINVAL;
3427         } else {
3428                 key.p.key_len = 0;
3429                 key.p.key = NULL;
3430         }
3431
3432         rtnl_lock();
3433
3434         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3435         if (err)
3436                 goto unlock_rtnl;
3437
3438         if (!rdev->ops->auth) {
3439                 err = -EOPNOTSUPP;
3440                 goto out;
3441         }
3442
3443         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3444                 err = -EOPNOTSUPP;
3445                 goto out;
3446         }
3447
3448         if (!netif_running(dev)) {
3449                 err = -ENETDOWN;
3450                 goto out;
3451         }
3452
3453         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3454         chan = ieee80211_get_channel(&rdev->wiphy,
3455                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3456         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3457                 err = -EINVAL;
3458                 goto out;
3459         }
3460
3461         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3462         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3463
3464         if (info->attrs[NL80211_ATTR_IE]) {
3465                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3466                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3467         }
3468
3469         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3470         if (!nl80211_valid_auth_type(auth_type)) {
3471                 err = -EINVAL;
3472                 goto out;
3473         }
3474
3475         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3476                                  ssid, ssid_len, ie, ie_len,
3477                                  key.p.key, key.p.key_len, key.idx);
3478
3479 out:
3480         cfg80211_unlock_rdev(rdev);
3481         dev_put(dev);
3482 unlock_rtnl:
3483         rtnl_unlock();
3484         return err;
3485 }
3486
3487 static int nl80211_crypto_settings(struct genl_info *info,
3488                                    struct cfg80211_crypto_settings *settings,
3489                                    int cipher_limit)
3490 {
3491         memset(settings, 0, sizeof(*settings));
3492
3493         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3494
3495         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3496                 void *data;
3497                 int len, i;
3498
3499                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3500                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3501                 settings->n_ciphers_pairwise = len / sizeof(u32);
3502
3503                 if (len % sizeof(u32))
3504                         return -EINVAL;
3505
3506                 if (settings->n_ciphers_pairwise > cipher_limit)
3507                         return -EINVAL;
3508
3509                 memcpy(settings->ciphers_pairwise, data, len);
3510
3511                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3512                         if (!nl80211_valid_cipher_suite(
3513                                         settings->ciphers_pairwise[i]))
3514                                 return -EINVAL;
3515         }
3516
3517         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3518                 settings->cipher_group =
3519                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3520                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3521                         return -EINVAL;
3522         }
3523
3524         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3525                 settings->wpa_versions =
3526                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3527                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3528                         return -EINVAL;
3529         }
3530
3531         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3532                 void *data;
3533                 int len, i;
3534
3535                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3536                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3537                 settings->n_akm_suites = len / sizeof(u32);
3538
3539                 if (len % sizeof(u32))
3540                         return -EINVAL;
3541
3542                 memcpy(settings->akm_suites, data, len);
3543
3544                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3545                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3546                                 return -EINVAL;
3547         }
3548
3549         return 0;
3550 }
3551
3552 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3553 {
3554         struct cfg80211_registered_device *rdev;
3555         struct net_device *dev;
3556         struct wireless_dev *wdev;
3557         struct cfg80211_crypto_settings crypto;
3558         struct ieee80211_channel *chan, *fixedchan;
3559         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3560         int err, ssid_len, ie_len = 0;
3561         bool use_mfp = false;
3562
3563         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3564                 return -EINVAL;
3565
3566         if (!info->attrs[NL80211_ATTR_MAC] ||
3567             !info->attrs[NL80211_ATTR_SSID] ||
3568             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3569                 return -EINVAL;
3570
3571         rtnl_lock();
3572
3573         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3574         if (err)
3575                 goto unlock_rtnl;
3576
3577         if (!rdev->ops->assoc) {
3578                 err = -EOPNOTSUPP;
3579                 goto out;
3580         }
3581
3582         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3583                 err = -EOPNOTSUPP;
3584                 goto out;
3585         }
3586
3587         if (!netif_running(dev)) {
3588                 err = -ENETDOWN;
3589                 goto out;
3590         }
3591
3592         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3593
3594         chan = ieee80211_get_channel(&rdev->wiphy,
3595                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3596         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3597                 err = -EINVAL;
3598                 goto out;
3599         }
3600
3601         mutex_lock(&rdev->devlist_mtx);
3602         wdev = dev->ieee80211_ptr;
3603         fixedchan = rdev_fixed_channel(rdev, wdev);
3604         if (fixedchan && chan != fixedchan) {
3605                 err = -EBUSY;
3606                 mutex_unlock(&rdev->devlist_mtx);
3607                 goto out;
3608         }
3609         mutex_unlock(&rdev->devlist_mtx);
3610
3611         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3612         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3613
3614         if (info->attrs[NL80211_ATTR_IE]) {
3615                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3616                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3617         }
3618
3619         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3620                 enum nl80211_mfp mfp =
3621                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3622                 if (mfp == NL80211_MFP_REQUIRED)
3623                         use_mfp = true;
3624                 else if (mfp != NL80211_MFP_NO) {
3625                         err = -EINVAL;
3626                         goto out;
3627                 }
3628         }
3629
3630         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3631                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3632
3633         err = nl80211_crypto_settings(info, &crypto, 1);
3634         if (!err)
3635                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3636                                           ssid, ssid_len, ie, ie_len, use_mfp,
3637                                           &crypto);
3638
3639 out:
3640         cfg80211_unlock_rdev(rdev);
3641         dev_put(dev);
3642 unlock_rtnl:
3643         rtnl_unlock();
3644         return err;
3645 }
3646
3647 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3648 {
3649         struct cfg80211_registered_device *rdev;
3650         struct net_device *dev;
3651         const u8 *ie = NULL, *bssid;
3652         int err, ie_len = 0;
3653         u16 reason_code;
3654
3655         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3656                 return -EINVAL;
3657
3658         if (!info->attrs[NL80211_ATTR_MAC])
3659                 return -EINVAL;
3660
3661         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3662                 return -EINVAL;
3663
3664         rtnl_lock();
3665
3666         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3667         if (err)
3668                 goto unlock_rtnl;
3669
3670         if (!rdev->ops->deauth) {
3671                 err = -EOPNOTSUPP;
3672                 goto out;
3673         }
3674
3675         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3676                 err = -EOPNOTSUPP;
3677                 goto out;
3678         }
3679
3680         if (!netif_running(dev)) {
3681                 err = -ENETDOWN;
3682                 goto out;
3683         }
3684
3685         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3686
3687         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3688         if (reason_code == 0) {
3689                 /* Reason Code 0 is reserved */
3690                 err = -EINVAL;
3691                 goto out;
3692         }
3693
3694         if (info->attrs[NL80211_ATTR_IE]) {
3695                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3696                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3697         }
3698
3699         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3700
3701 out:
3702         cfg80211_unlock_rdev(rdev);
3703         dev_put(dev);
3704 unlock_rtnl:
3705         rtnl_unlock();
3706         return err;
3707 }
3708
3709 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3710 {
3711         struct cfg80211_registered_device *rdev;
3712         struct net_device *dev;
3713         const u8 *ie = NULL, *bssid;
3714         int err, ie_len = 0;
3715         u16 reason_code;
3716
3717         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3718                 return -EINVAL;
3719
3720         if (!info->attrs[NL80211_ATTR_MAC])
3721                 return -EINVAL;
3722
3723         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3724                 return -EINVAL;
3725
3726         rtnl_lock();
3727
3728         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3729         if (err)
3730                 goto unlock_rtnl;
3731
3732         if (!rdev->ops->disassoc) {
3733                 err = -EOPNOTSUPP;
3734                 goto out;
3735         }
3736
3737         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3738                 err = -EOPNOTSUPP;
3739                 goto out;
3740         }
3741
3742         if (!netif_running(dev)) {
3743                 err = -ENETDOWN;
3744                 goto out;
3745         }
3746
3747         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3748
3749         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3750         if (reason_code == 0) {
3751                 /* Reason Code 0 is reserved */
3752                 err = -EINVAL;
3753                 goto out;
3754         }
3755
3756         if (info->attrs[NL80211_ATTR_IE]) {
3757                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3758                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3759         }
3760
3761         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3762
3763 out:
3764         cfg80211_unlock_rdev(rdev);
3765         dev_put(dev);
3766 unlock_rtnl:
3767         rtnl_unlock();
3768         return err;
3769 }
3770
3771 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3772 {
3773         struct cfg80211_registered_device *rdev;
3774         struct net_device *dev;
3775         struct cfg80211_ibss_params ibss;
3776         struct wiphy *wiphy;
3777         struct cfg80211_cached_keys *connkeys = NULL;
3778         int err;
3779
3780         memset(&ibss, 0, sizeof(ibss));
3781
3782         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3783                 return -EINVAL;
3784
3785         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3786             !info->attrs[NL80211_ATTR_SSID] ||
3787             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3788                 return -EINVAL;
3789
3790         ibss.beacon_interval = 100;
3791
3792         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3793                 ibss.beacon_interval =
3794                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3795                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3796                         return -EINVAL;
3797         }
3798
3799         rtnl_lock();
3800
3801         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3802         if (err)
3803                 goto unlock_rtnl;
3804
3805         if (!rdev->ops->join_ibss) {
3806                 err = -EOPNOTSUPP;
3807                 goto out;
3808         }
3809
3810         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3811                 err = -EOPNOTSUPP;
3812                 goto out;
3813         }
3814
3815         if (!netif_running(dev)) {
3816                 err = -ENETDOWN;
3817                 goto out;
3818         }
3819
3820         wiphy = &rdev->wiphy;
3821
3822         if (info->attrs[NL80211_ATTR_MAC])
3823                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3824         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3825         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3826
3827         if (info->attrs[NL80211_ATTR_IE]) {
3828                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3829                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3830         }
3831
3832         ibss.channel = ieee80211_get_channel(wiphy,
3833                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3834         if (!ibss.channel ||
3835             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3836             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3837                 err = -EINVAL;
3838                 goto out;
3839         }
3840
3841         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3842         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3843
3844         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3845                 connkeys = nl80211_parse_connkeys(rdev,
3846                                         info->attrs[NL80211_ATTR_KEYS]);
3847                 if (IS_ERR(connkeys)) {
3848                         err = PTR_ERR(connkeys);
3849                         connkeys = NULL;
3850                         goto out;
3851                 }
3852         }
3853
3854         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3855
3856 out:
3857         cfg80211_unlock_rdev(rdev);
3858         dev_put(dev);
3859 unlock_rtnl:
3860         if (err)
3861                 kfree(connkeys);
3862         rtnl_unlock();
3863         return err;
3864 }
3865
3866 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3867 {
3868         struct cfg80211_registered_device *rdev;
3869         struct net_device *dev;
3870         int err;
3871
3872         rtnl_lock();
3873
3874         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3875         if (err)
3876                 goto unlock_rtnl;
3877
3878         if (!rdev->ops->leave_ibss) {
3879                 err = -EOPNOTSUPP;
3880                 goto out;
3881         }
3882
3883         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3884                 err = -EOPNOTSUPP;
3885                 goto out;
3886         }
3887
3888         if (!netif_running(dev)) {
3889                 err = -ENETDOWN;
3890                 goto out;
3891         }
3892
3893         err = cfg80211_leave_ibss(rdev, dev, false);
3894
3895 out:
3896         cfg80211_unlock_rdev(rdev);
3897         dev_put(dev);
3898 unlock_rtnl:
3899         rtnl_unlock();
3900         return err;
3901 }
3902
3903 #ifdef CONFIG_NL80211_TESTMODE
3904 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3905         .name = "testmode",
3906 };
3907
3908 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3909 {
3910         struct cfg80211_registered_device *rdev;
3911         int err;
3912
3913         if (!info->attrs[NL80211_ATTR_TESTDATA])
3914                 return -EINVAL;
3915
3916         rtnl_lock();
3917
3918         rdev = cfg80211_get_dev_from_info(info);
3919         if (IS_ERR(rdev)) {
3920                 err = PTR_ERR(rdev);
3921                 goto unlock_rtnl;
3922         }
3923
3924         err = -EOPNOTSUPP;
3925         if (rdev->ops->testmode_cmd) {
3926                 rdev->testmode_info = info;
3927                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3928                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3929                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3930                 rdev->testmode_info = NULL;
3931         }
3932
3933         cfg80211_unlock_rdev(rdev);
3934
3935  unlock_rtnl:
3936         rtnl_unlock();
3937         return err;
3938 }
3939
3940 static struct sk_buff *
3941 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3942                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3943 {
3944         struct sk_buff *skb;
3945         void *hdr;
3946         struct nlattr *data;
3947
3948         skb = nlmsg_new(approxlen + 100, gfp);
3949         if (!skb)
3950                 return NULL;
3951
3952         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3953         if (!hdr) {
3954                 kfree_skb(skb);
3955                 return NULL;
3956         }
3957
3958         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3959         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3960
3961         ((void **)skb->cb)[0] = rdev;
3962         ((void **)skb->cb)[1] = hdr;
3963         ((void **)skb->cb)[2] = data;
3964
3965         return skb;
3966
3967  nla_put_failure:
3968         kfree_skb(skb);
3969         return NULL;
3970 }
3971
3972 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3973                                                   int approxlen)
3974 {
3975         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3976
3977         if (WARN_ON(!rdev->testmode_info))
3978                 return NULL;
3979
3980         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3981                                 rdev->testmode_info->snd_pid,
3982                                 rdev->testmode_info->snd_seq,
3983                                 GFP_KERNEL);
3984 }
3985 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3986
3987 int cfg80211_testmode_reply(struct sk_buff *skb)
3988 {
3989         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3990         void *hdr = ((void **)skb->cb)[1];
3991         struct nlattr *data = ((void **)skb->cb)[2];
3992
3993         if (WARN_ON(!rdev->testmode_info)) {
3994                 kfree_skb(skb);
3995                 return -EINVAL;
3996         }
3997
3998         nla_nest_end(skb, data);
3999         genlmsg_end(skb, hdr);
4000         return genlmsg_reply(skb, rdev->testmode_info);
4001 }
4002 EXPORT_SYMBOL(cfg80211_testmode_reply);
4003
4004 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4005                                                   int approxlen, gfp_t gfp)
4006 {
4007         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4008
4009         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4010 }
4011 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4012
4013 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4014 {
4015         void *hdr = ((void **)skb->cb)[1];
4016         struct nlattr *data = ((void **)skb->cb)[2];
4017
4018         nla_nest_end(skb, data);
4019         genlmsg_end(skb, hdr);
4020         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4021 }
4022 EXPORT_SYMBOL(cfg80211_testmode_event);
4023 #endif
4024
4025 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4026 {
4027         struct cfg80211_registered_device *rdev;
4028         struct net_device *dev;
4029         struct cfg80211_connect_params connect;
4030         struct wiphy *wiphy;
4031         struct cfg80211_cached_keys *connkeys = NULL;
4032         int err;
4033
4034         memset(&connect, 0, sizeof(connect));
4035
4036         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4037                 return -EINVAL;
4038
4039         if (!info->attrs[NL80211_ATTR_SSID] ||
4040             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4041                 return -EINVAL;
4042
4043         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4044                 connect.auth_type =
4045                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4046                 if (!nl80211_valid_auth_type(connect.auth_type))
4047                         return -EINVAL;
4048         } else
4049                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4050
4051         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4052
4053         err = nl80211_crypto_settings(info, &connect.crypto,
4054                                       NL80211_MAX_NR_CIPHER_SUITES);
4055         if (err)
4056                 return err;
4057         rtnl_lock();
4058
4059         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4060         if (err)
4061                 goto unlock_rtnl;
4062
4063         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4064                 err = -EOPNOTSUPP;
4065                 goto out;
4066         }
4067
4068         if (!netif_running(dev)) {
4069                 err = -ENETDOWN;
4070                 goto out;
4071         }
4072
4073         wiphy = &rdev->wiphy;
4074
4075         if (info->attrs[NL80211_ATTR_MAC])
4076                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4077         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4078         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4079
4080         if (info->attrs[NL80211_ATTR_IE]) {
4081                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4082                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4083         }
4084
4085         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4086                 connect.channel =
4087                         ieee80211_get_channel(wiphy,
4088                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4089                 if (!connect.channel ||
4090                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4091                         err = -EINVAL;
4092                         goto out;
4093                 }
4094         }
4095
4096         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4097                 connkeys = nl80211_parse_connkeys(rdev,
4098                                         info->attrs[NL80211_ATTR_KEYS]);
4099                 if (IS_ERR(connkeys)) {
4100                         err = PTR_ERR(connkeys);
4101                         connkeys = NULL;
4102                         goto out;
4103                 }
4104         }
4105
4106         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4107
4108 out:
4109         cfg80211_unlock_rdev(rdev);
4110         dev_put(dev);
4111 unlock_rtnl:
4112         if (err)
4113                 kfree(connkeys);
4114         rtnl_unlock();
4115         return err;
4116 }
4117
4118 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4119 {
4120         struct cfg80211_registered_device *rdev;
4121         struct net_device *dev;
4122         int err;
4123         u16 reason;
4124
4125         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4126                 reason = WLAN_REASON_DEAUTH_LEAVING;
4127         else
4128                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4129
4130         if (reason == 0)
4131                 return -EINVAL;
4132
4133         rtnl_lock();
4134
4135         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4136         if (err)
4137                 goto unlock_rtnl;
4138
4139         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4140                 err = -EOPNOTSUPP;
4141                 goto out;
4142         }
4143
4144         if (!netif_running(dev)) {
4145                 err = -ENETDOWN;
4146                 goto out;
4147         }
4148
4149         err = cfg80211_disconnect(rdev, dev, reason, true);
4150
4151 out:
4152         cfg80211_unlock_rdev(rdev);
4153         dev_put(dev);
4154 unlock_rtnl:
4155         rtnl_unlock();
4156         return err;
4157 }
4158
4159 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4160 {
4161         struct cfg80211_registered_device *rdev;
4162         struct net *net;
4163         int err;
4164         u32 pid;
4165
4166         if (!info->attrs[NL80211_ATTR_PID])
4167                 return -EINVAL;
4168
4169         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4170
4171         rtnl_lock();
4172
4173         rdev = cfg80211_get_dev_from_info(info);
4174         if (IS_ERR(rdev)) {
4175                 err = PTR_ERR(rdev);
4176                 goto out_rtnl;
4177         }
4178
4179         net = get_net_ns_by_pid(pid);
4180         if (IS_ERR(net)) {
4181                 err = PTR_ERR(net);
4182                 goto out;
4183         }
4184
4185         err = 0;
4186
4187         /* check if anything to do */
4188         if (net_eq(wiphy_net(&rdev->wiphy), net))
4189                 goto out_put_net;
4190
4191         err = cfg80211_switch_netns(rdev, net);
4192  out_put_net:
4193         put_net(net);
4194  out:
4195         cfg80211_unlock_rdev(rdev);
4196  out_rtnl:
4197         rtnl_unlock();
4198         return err;
4199 }
4200
4201 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4202 {
4203         struct cfg80211_registered_device *rdev;
4204         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4205                         struct cfg80211_pmksa *pmksa) = NULL;
4206         int err;
4207         struct net_device *dev;
4208         struct cfg80211_pmksa pmksa;
4209
4210         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4211
4212         if (!info->attrs[NL80211_ATTR_MAC])
4213                 return -EINVAL;
4214
4215         if (!info->attrs[NL80211_ATTR_PMKID])
4216                 return -EINVAL;
4217
4218         rtnl_lock();
4219
4220         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4221         if (err)
4222                 goto out_rtnl;
4223
4224         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4225         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4226
4227         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4228                 err = -EOPNOTSUPP;
4229                 goto out;
4230         }
4231
4232         switch (info->genlhdr->cmd) {
4233         case NL80211_CMD_SET_PMKSA:
4234                 rdev_ops = rdev->ops->set_pmksa;
4235                 break;
4236         case NL80211_CMD_DEL_PMKSA:
4237                 rdev_ops = rdev->ops->del_pmksa;
4238                 break;
4239         default:
4240                 WARN_ON(1);
4241                 break;
4242         }
4243
4244         if (!rdev_ops) {
4245                 err = -EOPNOTSUPP;
4246                 goto out;
4247         }
4248
4249         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4250
4251  out:
4252         cfg80211_unlock_rdev(rdev);
4253         dev_put(dev);
4254  out_rtnl:
4255         rtnl_unlock();
4256
4257         return err;
4258 }
4259
4260 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4261 {
4262         struct cfg80211_registered_device *rdev;
4263         int err;
4264         struct net_device *dev;
4265
4266         rtnl_lock();
4267
4268         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4269         if (err)
4270                 goto out_rtnl;
4271
4272         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4273                 err = -EOPNOTSUPP;
4274                 goto out;
4275         }
4276
4277         if (!rdev->ops->flush_pmksa) {
4278                 err = -EOPNOTSUPP;
4279                 goto out;
4280         }
4281
4282         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4283
4284  out:
4285         cfg80211_unlock_rdev(rdev);
4286         dev_put(dev);
4287  out_rtnl:
4288         rtnl_unlock();
4289
4290         return err;
4291
4292 }
4293
4294 static int nl80211_remain_on_channel(struct sk_buff *skb,
4295                                      struct genl_info *info)
4296 {
4297         struct cfg80211_registered_device *rdev;
4298         struct net_device *dev;
4299         struct ieee80211_channel *chan;
4300         struct sk_buff *msg;
4301         void *hdr;
4302         u64 cookie;
4303         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4304         u32 freq, duration;
4305         int err;
4306
4307         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4308             !info->attrs[NL80211_ATTR_DURATION])
4309                 return -EINVAL;
4310
4311         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4312
4313         /*
4314          * We should be on that channel for at least one jiffie,
4315          * and more than 5 seconds seems excessive.
4316          */
4317         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4318                 return -EINVAL;
4319
4320         rtnl_lock();
4321
4322         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4323         if (err)
4324                 goto unlock_rtnl;
4325
4326         if (!rdev->ops->remain_on_channel) {
4327                 err = -EOPNOTSUPP;
4328                 goto out;
4329         }
4330
4331         if (!netif_running(dev)) {
4332                 err = -ENETDOWN;
4333                 goto out;
4334         }
4335
4336         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4337                 channel_type = nla_get_u32(
4338                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4339                 if (channel_type != NL80211_CHAN_NO_HT &&
4340                     channel_type != NL80211_CHAN_HT20 &&
4341                     channel_type != NL80211_CHAN_HT40PLUS &&
4342                     channel_type != NL80211_CHAN_HT40MINUS)
4343                         err = -EINVAL;
4344                         goto out;
4345         }
4346
4347         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4348         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4349         if (chan == NULL) {
4350                 err = -EINVAL;
4351                 goto out;
4352         }
4353
4354         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4355         if (!msg) {
4356                 err = -ENOMEM;
4357                 goto out;
4358         }
4359
4360         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4361                              NL80211_CMD_REMAIN_ON_CHANNEL);
4362
4363         if (IS_ERR(hdr)) {
4364                 err = PTR_ERR(hdr);
4365                 goto free_msg;
4366         }
4367
4368         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4369                                            channel_type, duration, &cookie);
4370
4371         if (err)
4372                 goto free_msg;
4373
4374         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4375
4376         genlmsg_end(msg, hdr);
4377         err = genlmsg_reply(msg, info);
4378         goto out;
4379
4380  nla_put_failure:
4381         err = -ENOBUFS;
4382  free_msg:
4383         nlmsg_free(msg);
4384  out:
4385         cfg80211_unlock_rdev(rdev);
4386         dev_put(dev);
4387  unlock_rtnl:
4388         rtnl_unlock();
4389         return err;
4390 }
4391
4392 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4393                                             struct genl_info *info)
4394 {
4395         struct cfg80211_registered_device *rdev;
4396         struct net_device *dev;
4397         u64 cookie;
4398         int err;
4399
4400         if (!info->attrs[NL80211_ATTR_COOKIE])
4401                 return -EINVAL;
4402
4403         rtnl_lock();
4404
4405         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4406         if (err)
4407                 goto unlock_rtnl;
4408
4409         if (!rdev->ops->cancel_remain_on_channel) {
4410                 err = -EOPNOTSUPP;
4411                 goto out;
4412         }
4413
4414         if (!netif_running(dev)) {
4415                 err = -ENETDOWN;
4416                 goto out;
4417         }
4418
4419         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4420
4421         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4422
4423  out:
4424         cfg80211_unlock_rdev(rdev);
4425         dev_put(dev);
4426  unlock_rtnl:
4427         rtnl_unlock();
4428         return err;
4429 }
4430
4431 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4432                            u8 *rates, u8 rates_len)
4433 {
4434         u8 i;
4435         u32 mask = 0;
4436
4437         for (i = 0; i < rates_len; i++) {
4438                 int rate = (rates[i] & 0x7f) * 5;
4439                 int ridx;
4440                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4441                         struct ieee80211_rate *srate =
4442                                 &sband->bitrates[ridx];
4443                         if (rate == srate->bitrate) {
4444                                 mask |= 1 << ridx;
4445                                 break;
4446                         }
4447                 }
4448                 if (ridx == sband->n_bitrates)
4449                         return 0; /* rate not found */
4450         }
4451
4452         return mask;
4453 }
4454
4455 static struct nla_policy
4456 nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] __read_mostly = {
4457         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4458                                     .len = NL80211_MAX_SUPP_RATES },
4459 };
4460
4461 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4462                                        struct genl_info *info)
4463 {
4464         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4465         struct cfg80211_registered_device *rdev;
4466         struct cfg80211_bitrate_mask mask;
4467         int err, rem, i;
4468         struct net_device *dev;
4469         struct nlattr *tx_rates;
4470         struct ieee80211_supported_band *sband;
4471
4472         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4473                 return -EINVAL;
4474
4475         rtnl_lock();
4476
4477         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4478         if (err)
4479                 goto unlock_rtnl;
4480
4481         if (!rdev->ops->set_bitrate_mask) {
4482                 err = -EOPNOTSUPP;
4483                 goto unlock;
4484         }
4485
4486         memset(&mask, 0, sizeof(mask));
4487         /* Default to all rates enabled */
4488         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4489                 sband = rdev->wiphy.bands[i];
4490                 mask.control[i].legacy =
4491                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4492         }
4493
4494         /*
4495          * The nested attribute uses enum nl80211_band as the index. This maps
4496          * directly to the enum ieee80211_band values used in cfg80211.
4497          */
4498         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4499         {
4500                 enum ieee80211_band band = nla_type(tx_rates);
4501                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4502                         err = -EINVAL;
4503                         goto unlock;
4504                 }
4505                 sband = rdev->wiphy.bands[band];
4506                 if (sband == NULL) {
4507                         err = -EINVAL;
4508                         goto unlock;
4509                 }
4510                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4511                           nla_len(tx_rates), nl80211_txattr_policy);
4512                 if (tb[NL80211_TXRATE_LEGACY]) {
4513                         mask.control[band].legacy = rateset_to_mask(
4514                                 sband,
4515                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4516                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4517                         if (mask.control[band].legacy == 0) {
4518                                 err = -EINVAL;
4519                                 goto unlock;
4520                         }
4521                 }
4522         }
4523
4524         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4525
4526  unlock:
4527         dev_put(dev);
4528         cfg80211_unlock_rdev(rdev);
4529  unlock_rtnl:
4530         rtnl_unlock();
4531         return err;
4532 }
4533
4534 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4535 {
4536         struct cfg80211_registered_device *rdev;
4537         struct net_device *dev;
4538         int err;
4539
4540         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4541                 return -EINVAL;
4542
4543         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4544                 return -EINVAL;
4545
4546         rtnl_lock();
4547
4548         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4549         if (err)
4550                 goto unlock_rtnl;
4551
4552         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4553                 err = -EOPNOTSUPP;
4554                 goto out;
4555         }
4556
4557         /* not much point in registering if we can't reply */
4558         if (!rdev->ops->action) {
4559                 err = -EOPNOTSUPP;
4560                 goto out;
4561         }
4562
4563         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4564                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4565                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4566  out:
4567         cfg80211_unlock_rdev(rdev);
4568         dev_put(dev);
4569  unlock_rtnl:
4570         rtnl_unlock();
4571         return err;
4572 }
4573
4574 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4575 {
4576         struct cfg80211_registered_device *rdev;
4577         struct net_device *dev;
4578         struct ieee80211_channel *chan;
4579         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4580         u32 freq;
4581         int err;
4582         void *hdr;
4583         u64 cookie;
4584         struct sk_buff *msg;
4585
4586         if (!info->attrs[NL80211_ATTR_FRAME] ||
4587             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4588                 return -EINVAL;
4589
4590         rtnl_lock();
4591
4592         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4593         if (err)
4594                 goto unlock_rtnl;
4595
4596         if (!rdev->ops->action) {
4597                 err = -EOPNOTSUPP;
4598                 goto out;
4599         }
4600
4601         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4602                 err = -EOPNOTSUPP;
4603                 goto out;
4604         }
4605
4606         if (!netif_running(dev)) {
4607                 err = -ENETDOWN;
4608                 goto out;
4609         }
4610
4611         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4612                 channel_type = nla_get_u32(
4613                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4614                 if (channel_type != NL80211_CHAN_NO_HT &&
4615                     channel_type != NL80211_CHAN_HT20 &&
4616                     channel_type != NL80211_CHAN_HT40PLUS &&
4617                     channel_type != NL80211_CHAN_HT40MINUS)
4618                         err = -EINVAL;
4619                         goto out;
4620         }
4621
4622         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4623         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4624         if (chan == NULL) {
4625                 err = -EINVAL;
4626                 goto out;
4627         }
4628
4629         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4630         if (!msg) {
4631                 err = -ENOMEM;
4632                 goto out;
4633         }
4634
4635         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4636                              NL80211_CMD_ACTION);
4637
4638         if (IS_ERR(hdr)) {
4639                 err = PTR_ERR(hdr);
4640                 goto free_msg;
4641         }
4642         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4643                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4644                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4645                                    &cookie);
4646         if (err)
4647                 goto free_msg;
4648
4649         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4650
4651         genlmsg_end(msg, hdr);
4652         err = genlmsg_reply(msg, info);
4653         goto out;
4654
4655  nla_put_failure:
4656         err = -ENOBUFS;
4657  free_msg:
4658         nlmsg_free(msg);
4659  out:
4660         cfg80211_unlock_rdev(rdev);
4661         dev_put(dev);
4662 unlock_rtnl:
4663         rtnl_unlock();
4664         return err;
4665 }
4666
4667 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4668 {
4669         struct cfg80211_registered_device *rdev;
4670         struct wireless_dev *wdev;
4671         struct net_device *dev;
4672         u8 ps_state;
4673         bool state;
4674         int err;
4675
4676         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4677                 err = -EINVAL;
4678                 goto out;
4679         }
4680
4681         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4682
4683         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4684                 err = -EINVAL;
4685                 goto out;
4686         }
4687
4688         rtnl_lock();
4689
4690         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4691         if (err)
4692                 goto unlock_rdev;
4693
4694         wdev = dev->ieee80211_ptr;
4695
4696         if (!rdev->ops->set_power_mgmt) {
4697                 err = -EOPNOTSUPP;
4698                 goto unlock_rdev;
4699         }
4700
4701         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4702
4703         if (state == wdev->ps)
4704                 goto unlock_rdev;
4705
4706         wdev->ps = state;
4707
4708         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4709                                       wdev->ps_timeout))
4710                 /* assume this means it's off */
4711                 wdev->ps = false;
4712
4713 unlock_rdev:
4714         cfg80211_unlock_rdev(rdev);
4715         dev_put(dev);
4716         rtnl_unlock();
4717
4718 out:
4719         return err;
4720 }
4721
4722 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4723 {
4724         struct cfg80211_registered_device *rdev;
4725         enum nl80211_ps_state ps_state;
4726         struct wireless_dev *wdev;
4727         struct net_device *dev;
4728         struct sk_buff *msg;
4729         void *hdr;
4730         int err;
4731
4732         rtnl_lock();
4733
4734         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4735         if (err)
4736                 goto unlock_rtnl;
4737
4738         wdev = dev->ieee80211_ptr;
4739
4740         if (!rdev->ops->set_power_mgmt) {
4741                 err = -EOPNOTSUPP;
4742                 goto out;
4743         }
4744
4745         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4746         if (!msg) {
4747                 err = -ENOMEM;
4748                 goto out;
4749         }
4750
4751         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4752                              NL80211_CMD_GET_POWER_SAVE);
4753         if (!hdr) {
4754                 err = -ENOMEM;
4755                 goto free_msg;
4756         }
4757
4758         if (wdev->ps)
4759                 ps_state = NL80211_PS_ENABLED;
4760         else
4761                 ps_state = NL80211_PS_DISABLED;
4762
4763         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4764
4765         genlmsg_end(msg, hdr);
4766         err = genlmsg_reply(msg, info);
4767         goto out;
4768
4769 nla_put_failure:
4770         err = -ENOBUFS;
4771
4772 free_msg:
4773         nlmsg_free(msg);
4774
4775 out:
4776         cfg80211_unlock_rdev(rdev);
4777         dev_put(dev);
4778
4779 unlock_rtnl:
4780         rtnl_unlock();
4781
4782         return err;
4783 }
4784
4785 static struct genl_ops nl80211_ops[] = {
4786         {
4787                 .cmd = NL80211_CMD_GET_WIPHY,
4788                 .doit = nl80211_get_wiphy,
4789                 .dumpit = nl80211_dump_wiphy,
4790                 .policy = nl80211_policy,
4791                 /* can be retrieved by unprivileged users */
4792         },
4793         {
4794                 .cmd = NL80211_CMD_SET_WIPHY,
4795                 .doit = nl80211_set_wiphy,
4796                 .policy = nl80211_policy,
4797                 .flags = GENL_ADMIN_PERM,
4798         },
4799         {
4800                 .cmd = NL80211_CMD_GET_INTERFACE,
4801                 .doit = nl80211_get_interface,
4802                 .dumpit = nl80211_dump_interface,
4803                 .policy = nl80211_policy,
4804                 /* can be retrieved by unprivileged users */
4805         },
4806         {
4807                 .cmd = NL80211_CMD_SET_INTERFACE,
4808                 .doit = nl80211_set_interface,
4809                 .policy = nl80211_policy,
4810                 .flags = GENL_ADMIN_PERM,
4811         },
4812         {
4813                 .cmd = NL80211_CMD_NEW_INTERFACE,
4814                 .doit = nl80211_new_interface,
4815                 .policy = nl80211_policy,
4816                 .flags = GENL_ADMIN_PERM,
4817         },
4818         {
4819                 .cmd = NL80211_CMD_DEL_INTERFACE,
4820                 .doit = nl80211_del_interface,
4821                 .policy = nl80211_policy,
4822                 .flags = GENL_ADMIN_PERM,
4823         },
4824         {
4825                 .cmd = NL80211_CMD_GET_KEY,
4826                 .doit = nl80211_get_key,
4827                 .policy = nl80211_policy,
4828                 .flags = GENL_ADMIN_PERM,
4829         },
4830         {
4831                 .cmd = NL80211_CMD_SET_KEY,
4832                 .doit = nl80211_set_key,
4833                 .policy = nl80211_policy,
4834                 .flags = GENL_ADMIN_PERM,
4835         },
4836         {
4837                 .cmd = NL80211_CMD_NEW_KEY,
4838                 .doit = nl80211_new_key,
4839                 .policy = nl80211_policy,
4840                 .flags = GENL_ADMIN_PERM,
4841         },
4842         {
4843                 .cmd = NL80211_CMD_DEL_KEY,
4844                 .doit = nl80211_del_key,
4845                 .policy = nl80211_policy,
4846                 .flags = GENL_ADMIN_PERM,
4847         },
4848         {
4849                 .cmd = NL80211_CMD_SET_BEACON,
4850                 .policy = nl80211_policy,
4851                 .flags = GENL_ADMIN_PERM,
4852                 .doit = nl80211_addset_beacon,
4853         },
4854         {
4855                 .cmd = NL80211_CMD_NEW_BEACON,
4856                 .policy = nl80211_policy,
4857                 .flags = GENL_ADMIN_PERM,
4858                 .doit = nl80211_addset_beacon,
4859         },
4860         {
4861                 .cmd = NL80211_CMD_DEL_BEACON,
4862                 .policy = nl80211_policy,
4863                 .flags = GENL_ADMIN_PERM,
4864                 .doit = nl80211_del_beacon,
4865         },
4866         {
4867                 .cmd = NL80211_CMD_GET_STATION,
4868                 .doit = nl80211_get_station,
4869                 .dumpit = nl80211_dump_station,
4870                 .policy = nl80211_policy,
4871         },
4872         {
4873                 .cmd = NL80211_CMD_SET_STATION,
4874                 .doit = nl80211_set_station,
4875                 .policy = nl80211_policy,
4876                 .flags = GENL_ADMIN_PERM,
4877         },
4878         {
4879                 .cmd = NL80211_CMD_NEW_STATION,
4880                 .doit = nl80211_new_station,
4881                 .policy = nl80211_policy,
4882                 .flags = GENL_ADMIN_PERM,
4883         },
4884         {
4885                 .cmd = NL80211_CMD_DEL_STATION,
4886                 .doit = nl80211_del_station,
4887                 .policy = nl80211_policy,
4888                 .flags = GENL_ADMIN_PERM,
4889         },
4890         {
4891                 .cmd = NL80211_CMD_GET_MPATH,
4892                 .doit = nl80211_get_mpath,
4893                 .dumpit = nl80211_dump_mpath,
4894                 .policy = nl80211_policy,
4895                 .flags = GENL_ADMIN_PERM,
4896         },
4897         {
4898                 .cmd = NL80211_CMD_SET_MPATH,
4899                 .doit = nl80211_set_mpath,
4900                 .policy = nl80211_policy,
4901                 .flags = GENL_ADMIN_PERM,
4902         },
4903         {
4904                 .cmd = NL80211_CMD_NEW_MPATH,
4905                 .doit = nl80211_new_mpath,
4906                 .policy = nl80211_policy,
4907                 .flags = GENL_ADMIN_PERM,
4908         },
4909         {
4910                 .cmd = NL80211_CMD_DEL_MPATH,
4911                 .doit = nl80211_del_mpath,
4912                 .policy = nl80211_policy,
4913                 .flags = GENL_ADMIN_PERM,
4914         },
4915         {
4916                 .cmd = NL80211_CMD_SET_BSS,
4917                 .doit = nl80211_set_bss,
4918                 .policy = nl80211_policy,
4919                 .flags = GENL_ADMIN_PERM,
4920         },
4921         {
4922                 .cmd = NL80211_CMD_GET_REG,
4923                 .doit = nl80211_get_reg,
4924                 .policy = nl80211_policy,
4925                 /* can be retrieved by unprivileged users */
4926         },
4927         {
4928                 .cmd = NL80211_CMD_SET_REG,
4929                 .doit = nl80211_set_reg,
4930                 .policy = nl80211_policy,
4931                 .flags = GENL_ADMIN_PERM,
4932         },
4933         {
4934                 .cmd = NL80211_CMD_REQ_SET_REG,
4935                 .doit = nl80211_req_set_reg,
4936                 .policy = nl80211_policy,
4937                 .flags = GENL_ADMIN_PERM,
4938         },
4939         {
4940                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4941                 .doit = nl80211_get_mesh_params,
4942                 .policy = nl80211_policy,
4943                 /* can be retrieved by unprivileged users */
4944         },
4945         {
4946                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4947                 .doit = nl80211_set_mesh_params,
4948                 .policy = nl80211_policy,
4949                 .flags = GENL_ADMIN_PERM,
4950         },
4951         {
4952                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4953                 .doit = nl80211_trigger_scan,
4954                 .policy = nl80211_policy,
4955                 .flags = GENL_ADMIN_PERM,
4956         },
4957         {
4958                 .cmd = NL80211_CMD_GET_SCAN,
4959                 .policy = nl80211_policy,
4960                 .dumpit = nl80211_dump_scan,
4961         },
4962         {
4963                 .cmd = NL80211_CMD_AUTHENTICATE,
4964                 .doit = nl80211_authenticate,
4965                 .policy = nl80211_policy,
4966                 .flags = GENL_ADMIN_PERM,
4967         },
4968         {
4969                 .cmd = NL80211_CMD_ASSOCIATE,
4970                 .doit = nl80211_associate,
4971                 .policy = nl80211_policy,
4972                 .flags = GENL_ADMIN_PERM,
4973         },
4974         {
4975                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4976                 .doit = nl80211_deauthenticate,
4977                 .policy = nl80211_policy,
4978                 .flags = GENL_ADMIN_PERM,
4979         },
4980         {
4981                 .cmd = NL80211_CMD_DISASSOCIATE,
4982                 .doit = nl80211_disassociate,
4983                 .policy = nl80211_policy,
4984                 .flags = GENL_ADMIN_PERM,
4985         },
4986         {
4987                 .cmd = NL80211_CMD_JOIN_IBSS,
4988                 .doit = nl80211_join_ibss,
4989                 .policy = nl80211_policy,
4990                 .flags = GENL_ADMIN_PERM,
4991         },
4992         {
4993                 .cmd = NL80211_CMD_LEAVE_IBSS,
4994                 .doit = nl80211_leave_ibss,
4995                 .policy = nl80211_policy,
4996                 .flags = GENL_ADMIN_PERM,
4997         },
4998 #ifdef CONFIG_NL80211_TESTMODE
4999         {
5000                 .cmd = NL80211_CMD_TESTMODE,
5001                 .doit = nl80211_testmode_do,
5002                 .policy = nl80211_policy,
5003                 .flags = GENL_ADMIN_PERM,
5004         },
5005 #endif
5006         {
5007                 .cmd = NL80211_CMD_CONNECT,
5008                 .doit = nl80211_connect,
5009                 .policy = nl80211_policy,
5010                 .flags = GENL_ADMIN_PERM,
5011         },
5012         {
5013                 .cmd = NL80211_CMD_DISCONNECT,
5014                 .doit = nl80211_disconnect,
5015                 .policy = nl80211_policy,
5016                 .flags = GENL_ADMIN_PERM,
5017         },
5018         {
5019                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5020                 .doit = nl80211_wiphy_netns,
5021                 .policy = nl80211_policy,
5022                 .flags = GENL_ADMIN_PERM,
5023         },
5024         {
5025                 .cmd = NL80211_CMD_GET_SURVEY,
5026                 .policy = nl80211_policy,
5027                 .dumpit = nl80211_dump_survey,
5028         },
5029         {
5030                 .cmd = NL80211_CMD_SET_PMKSA,
5031                 .doit = nl80211_setdel_pmksa,
5032                 .policy = nl80211_policy,
5033                 .flags = GENL_ADMIN_PERM,
5034         },
5035         {
5036                 .cmd = NL80211_CMD_DEL_PMKSA,
5037                 .doit = nl80211_setdel_pmksa,
5038                 .policy = nl80211_policy,
5039                 .flags = GENL_ADMIN_PERM,
5040         },
5041         {
5042                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5043                 .doit = nl80211_flush_pmksa,
5044                 .policy = nl80211_policy,
5045                 .flags = GENL_ADMIN_PERM,
5046         },
5047         {
5048                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5049                 .doit = nl80211_remain_on_channel,
5050                 .policy = nl80211_policy,
5051                 .flags = GENL_ADMIN_PERM,
5052         },
5053         {
5054                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5055                 .doit = nl80211_cancel_remain_on_channel,
5056                 .policy = nl80211_policy,
5057                 .flags = GENL_ADMIN_PERM,
5058         },
5059         {
5060                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5061                 .doit = nl80211_set_tx_bitrate_mask,
5062                 .policy = nl80211_policy,
5063                 .flags = GENL_ADMIN_PERM,
5064         },
5065         {
5066                 .cmd = NL80211_CMD_REGISTER_ACTION,
5067                 .doit = nl80211_register_action,
5068                 .policy = nl80211_policy,
5069                 .flags = GENL_ADMIN_PERM,
5070         },
5071         {
5072                 .cmd = NL80211_CMD_ACTION,
5073                 .doit = nl80211_action,
5074                 .policy = nl80211_policy,
5075                 .flags = GENL_ADMIN_PERM,
5076         },
5077         {
5078                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5079                 .doit = nl80211_set_power_save,
5080                 .policy = nl80211_policy,
5081                 .flags = GENL_ADMIN_PERM,
5082         },
5083         {
5084                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5085                 .doit = nl80211_get_power_save,
5086                 .policy = nl80211_policy,
5087                 /* can be retrieved by unprivileged users */
5088         },
5089 };
5090
5091 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5092         .name = "mlme",
5093 };
5094
5095 /* multicast groups */
5096 static struct genl_multicast_group nl80211_config_mcgrp = {
5097         .name = "config",
5098 };
5099 static struct genl_multicast_group nl80211_scan_mcgrp = {
5100         .name = "scan",
5101 };
5102 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5103         .name = "regulatory",
5104 };
5105
5106 /* notification functions */
5107
5108 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5109 {
5110         struct sk_buff *msg;
5111
5112         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5113         if (!msg)
5114                 return;
5115
5116         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5117                 nlmsg_free(msg);
5118                 return;
5119         }
5120
5121         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5122                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5123 }
5124
5125 static int nl80211_add_scan_req(struct sk_buff *msg,
5126                                 struct cfg80211_registered_device *rdev)
5127 {
5128         struct cfg80211_scan_request *req = rdev->scan_req;
5129         struct nlattr *nest;
5130         int i;
5131
5132         ASSERT_RDEV_LOCK(rdev);
5133
5134         if (WARN_ON(!req))
5135                 return 0;
5136
5137         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5138         if (!nest)
5139                 goto nla_put_failure;
5140         for (i = 0; i < req->n_ssids; i++)
5141                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5142         nla_nest_end(msg, nest);
5143
5144         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5145         if (!nest)
5146                 goto nla_put_failure;
5147         for (i = 0; i < req->n_channels; i++)
5148                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5149         nla_nest_end(msg, nest);
5150
5151         if (req->ie)
5152                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5153
5154         return 0;
5155  nla_put_failure:
5156         return -ENOBUFS;
5157 }
5158
5159 static int nl80211_send_scan_msg(struct sk_buff *msg,
5160                                  struct cfg80211_registered_device *rdev,
5161                                  struct net_device *netdev,
5162                                  u32 pid, u32 seq, int flags,
5163                                  u32 cmd)
5164 {
5165         void *hdr;
5166
5167         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5168         if (!hdr)
5169                 return -1;
5170
5171         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5172         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5173
5174         /* ignore errors and send incomplete event anyway */
5175         nl80211_add_scan_req(msg, rdev);
5176
5177         return genlmsg_end(msg, hdr);
5178
5179  nla_put_failure:
5180         genlmsg_cancel(msg, hdr);
5181         return -EMSGSIZE;
5182 }
5183
5184 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5185                              struct net_device *netdev)
5186 {
5187         struct sk_buff *msg;
5188
5189         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5190         if (!msg)
5191                 return;
5192
5193         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5194                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5195                 nlmsg_free(msg);
5196                 return;
5197         }
5198
5199         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5200                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5201 }
5202
5203 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5204                             struct net_device *netdev)
5205 {
5206         struct sk_buff *msg;
5207
5208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5209         if (!msg)
5210                 return;
5211
5212         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5213                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5214                 nlmsg_free(msg);
5215                 return;
5216         }
5217
5218         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5219                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5220 }
5221
5222 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5223                                struct net_device *netdev)
5224 {
5225         struct sk_buff *msg;
5226
5227         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5228         if (!msg)
5229                 return;
5230
5231         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5232                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5233                 nlmsg_free(msg);
5234                 return;
5235         }
5236
5237         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5238                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5239 }
5240
5241 /*
5242  * This can happen on global regulatory changes or device specific settings
5243  * based on custom world regulatory domains.
5244  */
5245 void nl80211_send_reg_change_event(struct regulatory_request *request)
5246 {
5247         struct sk_buff *msg;
5248         void *hdr;
5249
5250         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5251         if (!msg)
5252                 return;
5253
5254         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5255         if (!hdr) {
5256                 nlmsg_free(msg);
5257                 return;
5258         }
5259
5260         /* Userspace can always count this one always being set */
5261         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5262
5263         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5264                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5265                            NL80211_REGDOM_TYPE_WORLD);
5266         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5267                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5268                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5269         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5270                  request->intersect)
5271                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5272                            NL80211_REGDOM_TYPE_INTERSECTION);
5273         else {
5274                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5275                            NL80211_REGDOM_TYPE_COUNTRY);
5276                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5277         }
5278
5279         if (wiphy_idx_valid(request->wiphy_idx))
5280                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5281
5282         if (genlmsg_end(msg, hdr) < 0) {
5283                 nlmsg_free(msg);
5284                 return;
5285         }
5286
5287         rcu_read_lock();
5288         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5289                                 GFP_ATOMIC);
5290         rcu_read_unlock();
5291
5292         return;
5293
5294 nla_put_failure:
5295         genlmsg_cancel(msg, hdr);
5296         nlmsg_free(msg);
5297 }
5298
5299 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5300                                     struct net_device *netdev,
5301                                     const u8 *buf, size_t len,
5302                                     enum nl80211_commands cmd, gfp_t gfp)
5303 {
5304         struct sk_buff *msg;
5305         void *hdr;
5306
5307         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5308         if (!msg)
5309                 return;
5310
5311         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5312         if (!hdr) {
5313                 nlmsg_free(msg);
5314                 return;
5315         }
5316
5317         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5318         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5319         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5320
5321         if (genlmsg_end(msg, hdr) < 0) {
5322                 nlmsg_free(msg);
5323                 return;
5324         }
5325
5326         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5327                                 nl80211_mlme_mcgrp.id, gfp);
5328         return;
5329
5330  nla_put_failure:
5331         genlmsg_cancel(msg, hdr);
5332         nlmsg_free(msg);
5333 }
5334
5335 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5336                           struct net_device *netdev, const u8 *buf,
5337                           size_t len, gfp_t gfp)
5338 {
5339         nl80211_send_mlme_event(rdev, netdev, buf, len,
5340                                 NL80211_CMD_AUTHENTICATE, gfp);
5341 }
5342
5343 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5344                            struct net_device *netdev, const u8 *buf,
5345                            size_t len, gfp_t gfp)
5346 {
5347         nl80211_send_mlme_event(rdev, netdev, buf, len,
5348                                 NL80211_CMD_ASSOCIATE, gfp);
5349 }
5350
5351 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5352                          struct net_device *netdev, const u8 *buf,
5353                          size_t len, gfp_t gfp)
5354 {
5355         nl80211_send_mlme_event(rdev, netdev, buf, len,
5356                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5357 }
5358
5359 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5360                            struct net_device *netdev, const u8 *buf,
5361                            size_t len, gfp_t gfp)
5362 {
5363         nl80211_send_mlme_event(rdev, netdev, buf, len,
5364                                 NL80211_CMD_DISASSOCIATE, gfp);
5365 }
5366
5367 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5368                                       struct net_device *netdev, int cmd,
5369                                       const u8 *addr, gfp_t gfp)
5370 {
5371         struct sk_buff *msg;
5372         void *hdr;
5373
5374         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5375         if (!msg)
5376                 return;
5377
5378         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5379         if (!hdr) {
5380                 nlmsg_free(msg);
5381                 return;
5382         }
5383
5384         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5385         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5386         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5387         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5388
5389         if (genlmsg_end(msg, hdr) < 0) {
5390                 nlmsg_free(msg);
5391                 return;
5392         }
5393
5394         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5395                                 nl80211_mlme_mcgrp.id, gfp);
5396         return;
5397
5398  nla_put_failure:
5399         genlmsg_cancel(msg, hdr);
5400         nlmsg_free(msg);
5401 }
5402
5403 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5404                                struct net_device *netdev, const u8 *addr,
5405                                gfp_t gfp)
5406 {
5407         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5408                                   addr, gfp);
5409 }
5410
5411 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5412                                 struct net_device *netdev, const u8 *addr,
5413                                 gfp_t gfp)
5414 {
5415         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5416                                   addr, gfp);
5417 }
5418
5419 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5420                                  struct net_device *netdev, const u8 *bssid,
5421                                  const u8 *req_ie, size_t req_ie_len,
5422                                  const u8 *resp_ie, size_t resp_ie_len,
5423                                  u16 status, gfp_t gfp)
5424 {
5425         struct sk_buff *msg;
5426         void *hdr;
5427
5428         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5429         if (!msg)
5430                 return;
5431
5432         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5433         if (!hdr) {
5434                 nlmsg_free(msg);
5435                 return;
5436         }
5437
5438         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5439         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5440         if (bssid)
5441                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5442         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5443         if (req_ie)
5444                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5445         if (resp_ie)
5446                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5447
5448         if (genlmsg_end(msg, hdr) < 0) {
5449                 nlmsg_free(msg);
5450                 return;
5451         }
5452
5453         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5454                                 nl80211_mlme_mcgrp.id, gfp);
5455         return;
5456
5457  nla_put_failure:
5458         genlmsg_cancel(msg, hdr);
5459         nlmsg_free(msg);
5460
5461 }
5462
5463 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5464                          struct net_device *netdev, const u8 *bssid,
5465                          const u8 *req_ie, size_t req_ie_len,
5466                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5467 {
5468         struct sk_buff *msg;
5469         void *hdr;
5470
5471         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5472         if (!msg)
5473                 return;
5474
5475         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5476         if (!hdr) {
5477                 nlmsg_free(msg);
5478                 return;
5479         }
5480
5481         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5482         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5483         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5484         if (req_ie)
5485                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5486         if (resp_ie)
5487                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5488
5489         if (genlmsg_end(msg, hdr) < 0) {
5490                 nlmsg_free(msg);
5491                 return;
5492         }
5493
5494         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5495                                 nl80211_mlme_mcgrp.id, gfp);
5496         return;
5497
5498  nla_put_failure:
5499         genlmsg_cancel(msg, hdr);
5500         nlmsg_free(msg);
5501
5502 }
5503
5504 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5505                                struct net_device *netdev, u16 reason,
5506                                const u8 *ie, size_t ie_len, bool from_ap)
5507 {
5508         struct sk_buff *msg;
5509         void *hdr;
5510
5511         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5512         if (!msg)
5513                 return;
5514
5515         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5516         if (!hdr) {
5517                 nlmsg_free(msg);
5518                 return;
5519         }
5520
5521         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5522         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5523         if (from_ap && reason)
5524                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5525         if (from_ap)
5526                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5527         if (ie)
5528                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5529
5530         if (genlmsg_end(msg, hdr) < 0) {
5531                 nlmsg_free(msg);
5532                 return;
5533         }
5534
5535         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5536                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5537         return;
5538
5539  nla_put_failure:
5540         genlmsg_cancel(msg, hdr);
5541         nlmsg_free(msg);
5542
5543 }
5544
5545 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5546                              struct net_device *netdev, const u8 *bssid,
5547                              gfp_t gfp)
5548 {
5549         struct sk_buff *msg;
5550         void *hdr;
5551
5552         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5553         if (!msg)
5554                 return;
5555
5556         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5557         if (!hdr) {
5558                 nlmsg_free(msg);
5559                 return;
5560         }
5561
5562         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5563         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5564         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5565
5566         if (genlmsg_end(msg, hdr) < 0) {
5567                 nlmsg_free(msg);
5568                 return;
5569         }
5570
5571         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5572                                 nl80211_mlme_mcgrp.id, gfp);
5573         return;
5574
5575  nla_put_failure:
5576         genlmsg_cancel(msg, hdr);
5577         nlmsg_free(msg);
5578 }
5579
5580 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5581                                  struct net_device *netdev, const u8 *addr,
5582                                  enum nl80211_key_type key_type, int key_id,
5583                                  const u8 *tsc, gfp_t gfp)
5584 {
5585         struct sk_buff *msg;
5586         void *hdr;
5587
5588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5589         if (!msg)
5590                 return;
5591
5592         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5593         if (!hdr) {
5594                 nlmsg_free(msg);
5595                 return;
5596         }
5597
5598         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5599         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5600         if (addr)
5601                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5602         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5603         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5604         if (tsc)
5605                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5606
5607         if (genlmsg_end(msg, hdr) < 0) {
5608                 nlmsg_free(msg);
5609                 return;
5610         }
5611
5612         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5613                                 nl80211_mlme_mcgrp.id, gfp);
5614         return;
5615
5616  nla_put_failure:
5617         genlmsg_cancel(msg, hdr);
5618         nlmsg_free(msg);
5619 }
5620
5621 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5622                                     struct ieee80211_channel *channel_before,
5623                                     struct ieee80211_channel *channel_after)
5624 {
5625         struct sk_buff *msg;
5626         void *hdr;
5627         struct nlattr *nl_freq;
5628
5629         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5630         if (!msg)
5631                 return;
5632
5633         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5634         if (!hdr) {
5635                 nlmsg_free(msg);
5636                 return;
5637         }
5638
5639         /*
5640          * Since we are applying the beacon hint to a wiphy we know its
5641          * wiphy_idx is valid
5642          */
5643         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5644
5645         /* Before */
5646         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5647         if (!nl_freq)
5648                 goto nla_put_failure;
5649         if (nl80211_msg_put_channel(msg, channel_before))
5650                 goto nla_put_failure;
5651         nla_nest_end(msg, nl_freq);
5652
5653         /* After */
5654         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5655         if (!nl_freq)
5656                 goto nla_put_failure;
5657         if (nl80211_msg_put_channel(msg, channel_after))
5658                 goto nla_put_failure;
5659         nla_nest_end(msg, nl_freq);
5660
5661         if (genlmsg_end(msg, hdr) < 0) {
5662                 nlmsg_free(msg);
5663                 return;
5664         }
5665
5666         rcu_read_lock();
5667         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5668                                 GFP_ATOMIC);
5669         rcu_read_unlock();
5670
5671         return;
5672
5673 nla_put_failure:
5674         genlmsg_cancel(msg, hdr);
5675         nlmsg_free(msg);
5676 }
5677
5678 static void nl80211_send_remain_on_chan_event(
5679         int cmd, struct cfg80211_registered_device *rdev,
5680         struct net_device *netdev, u64 cookie,
5681         struct ieee80211_channel *chan,
5682         enum nl80211_channel_type channel_type,
5683         unsigned int duration, gfp_t gfp)
5684 {
5685         struct sk_buff *msg;
5686         void *hdr;
5687
5688         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5689         if (!msg)
5690                 return;
5691
5692         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5693         if (!hdr) {
5694                 nlmsg_free(msg);
5695                 return;
5696         }
5697
5698         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5699         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5700         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5701         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5702         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5703
5704         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5705                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5706
5707         if (genlmsg_end(msg, hdr) < 0) {
5708                 nlmsg_free(msg);
5709                 return;
5710         }
5711
5712         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5713                                 nl80211_mlme_mcgrp.id, gfp);
5714         return;
5715
5716  nla_put_failure:
5717         genlmsg_cancel(msg, hdr);
5718         nlmsg_free(msg);
5719 }
5720
5721 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5722                                     struct net_device *netdev, u64 cookie,
5723                                     struct ieee80211_channel *chan,
5724                                     enum nl80211_channel_type channel_type,
5725                                     unsigned int duration, gfp_t gfp)
5726 {
5727         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5728                                           rdev, netdev, cookie, chan,
5729                                           channel_type, duration, gfp);
5730 }
5731
5732 void nl80211_send_remain_on_channel_cancel(
5733         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5734         u64 cookie, struct ieee80211_channel *chan,
5735         enum nl80211_channel_type channel_type, gfp_t gfp)
5736 {
5737         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5738                                           rdev, netdev, cookie, chan,
5739                                           channel_type, 0, gfp);
5740 }
5741
5742 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5743                             struct net_device *dev, const u8 *mac_addr,
5744                             struct station_info *sinfo, gfp_t gfp)
5745 {
5746         struct sk_buff *msg;
5747
5748         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5749         if (!msg)
5750                 return;
5751
5752         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5753                 nlmsg_free(msg);
5754                 return;
5755         }
5756
5757         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5758                                 nl80211_mlme_mcgrp.id, gfp);
5759 }
5760
5761 int nl80211_send_action(struct cfg80211_registered_device *rdev,
5762                         struct net_device *netdev, u32 nlpid,
5763                         int freq, const u8 *buf, size_t len, gfp_t gfp)
5764 {
5765         struct sk_buff *msg;
5766         void *hdr;
5767         int err;
5768
5769         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5770         if (!msg)
5771                 return -ENOMEM;
5772
5773         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
5774         if (!hdr) {
5775                 nlmsg_free(msg);
5776                 return -ENOMEM;
5777         }
5778
5779         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5780         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5781         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5782         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5783
5784         err = genlmsg_end(msg, hdr);
5785         if (err < 0) {
5786                 nlmsg_free(msg);
5787                 return err;
5788         }
5789
5790         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5791         if (err < 0)
5792                 return err;
5793         return 0;
5794
5795  nla_put_failure:
5796         genlmsg_cancel(msg, hdr);
5797         nlmsg_free(msg);
5798         return -ENOBUFS;
5799 }
5800
5801 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
5802                                    struct net_device *netdev, u64 cookie,
5803                                    const u8 *buf, size_t len, bool ack,
5804                                    gfp_t gfp)
5805 {
5806         struct sk_buff *msg;
5807         void *hdr;
5808
5809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5810         if (!msg)
5811                 return;
5812
5813         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
5814         if (!hdr) {
5815                 nlmsg_free(msg);
5816                 return;
5817         }
5818
5819         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5820         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5821         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5822         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5823         if (ack)
5824                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5825
5826         if (genlmsg_end(msg, hdr) < 0) {
5827                 nlmsg_free(msg);
5828                 return;
5829         }
5830
5831         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5832         return;
5833
5834  nla_put_failure:
5835         genlmsg_cancel(msg, hdr);
5836         nlmsg_free(msg);
5837 }
5838
5839 static int nl80211_netlink_notify(struct notifier_block * nb,
5840                                   unsigned long state,
5841                                   void *_notify)
5842 {
5843         struct netlink_notify *notify = _notify;
5844         struct cfg80211_registered_device *rdev;
5845         struct wireless_dev *wdev;
5846
5847         if (state != NETLINK_URELEASE)
5848                 return NOTIFY_DONE;
5849
5850         rcu_read_lock();
5851
5852         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5853                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5854                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
5855
5856         rcu_read_unlock();
5857
5858         return NOTIFY_DONE;
5859 }
5860
5861 static struct notifier_block nl80211_netlink_notifier = {
5862         .notifier_call = nl80211_netlink_notify,
5863 };
5864
5865 /* initialisation/exit functions */
5866
5867 int nl80211_init(void)
5868 {
5869         int err;
5870
5871         err = genl_register_family_with_ops(&nl80211_fam,
5872                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5873         if (err)
5874                 return err;
5875
5876         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5877         if (err)
5878                 goto err_out;
5879
5880         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5881         if (err)
5882                 goto err_out;
5883
5884         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5885         if (err)
5886                 goto err_out;
5887
5888         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5889         if (err)
5890                 goto err_out;
5891
5892 #ifdef CONFIG_NL80211_TESTMODE
5893         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5894         if (err)
5895                 goto err_out;
5896 #endif
5897
5898         err = netlink_register_notifier(&nl80211_netlink_notifier);
5899         if (err)
5900                 goto err_out;
5901
5902         return 0;
5903  err_out:
5904         genl_unregister_family(&nl80211_fam);
5905         return err;
5906 }
5907
5908 void nl80211_exit(void)
5909 {
5910         netlink_unregister_notifier(&nl80211_netlink_notifier);
5911         genl_unregister_family(&nl80211_fam);
5912 }