net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  27                             struct genl_info *info);
  28 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  29                               struct genl_info *info);
  30
  31 /* the netlink family */
  32 static struct genl_family nl80211_fam = {
  33         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  34         .name = "nl80211",      /* have users key off the name instead */
  35         .hdrsize = 0,           /* no private header */
  36         .version = 1,           /* no particular meaning now */
  37         .maxattr = NL80211_ATTR_MAX,
  38         .netnsok = true,
  39         .pre_doit = nl80211_pre_doit,
  40         .post_doit = nl80211_post_doit,
  41 };
  42
  43 /* internal helper: get rdev and dev */
  44 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  45                                        struct cfg80211_registered_device **rdev,
  46                                        struct net_device **dev)
  47 {
  48         struct nlattr **attrs = info->attrs;
  49         int ifindex;
  50
  51         if (!attrs[NL80211_ATTR_IFINDEX])
  52                 return -EINVAL;
  53
  54         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  55         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  56         if (!*dev)
  57                 return -ENODEV;
  58
  59         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  60         if (IS_ERR(*rdev)) {
  61                 dev_put(*dev);
  62                 return PTR_ERR(*rdev);
  63         }
  64
  65         return 0;
  66 }
  67
  68 /* policy for the attributes */
  69 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  70         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  72                                       .len = 20-1 },
  73         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  74         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  75         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  77         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  78         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  80         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  81
  82         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  83         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  84         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  85
  86         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  87         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  88
  89         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  90         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  91                                     .len = WLAN_MAX_KEY_LEN },
  92         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  93         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  94         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  95         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  96         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
  97
  98         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  99         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 100         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 101                                        .len = IEEE80211_MAX_DATA_LEN },
 102         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 103                                        .len = IEEE80211_MAX_DATA_LEN },
 104         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 105         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 106         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 107         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 108                                                .len = NL80211_MAX_SUPP_RATES },
 109         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 110         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 111         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 112         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 113                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 114         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 115
 116         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 117         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 120         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 122         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 123                                            .len = NL80211_MAX_SUPP_RATES },
 124         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 125
 126         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 127
 128         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 129                                          .len = NL80211_HT_CAPABILITY_LEN },
 130
 131         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 132         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 133                               .len = IEEE80211_MAX_DATA_LEN },
 134         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 135         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 136
 137         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 138                                 .len = IEEE80211_MAX_SSID_LEN },
 139         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 140         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 141         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 142         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 143         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 144         [NL80211_ATTR_STA_FLAGS2] = {
 145                 .len = sizeof(struct nl80211_sta_flag_update),
 146         },
 147         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 148         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 149         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 150         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 151         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 152         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 153         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 154         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 155         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 156                                  .len = WLAN_PMKID_LEN },
 157         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 158         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 159         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 160         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 161                                  .len = IEEE80211_MAX_DATA_LEN },
 162         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 163         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 164         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 165         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 166         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 167         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 168         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 169         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 170         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 171         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 172         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 173         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 174         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 175 };
 176
 177 /* policy for the key attributes */
 178 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 179         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 180         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 181         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 182         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 183         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 184         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 185         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 186         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 187 };
 188
 189 /* policy for the key default flags */
 190 static const struct nla_policy
 191 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 192         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 193         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 194 };
 195
 196 /* ifidx get helper */
 197 static int nl80211_get_ifidx(struct netlink_callback *cb)
 198 {
 199         int res;
 200
 201         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 202                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 203                           nl80211_policy);
 204         if (res)
 205                 return res;
 206
 207         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 208                 return -EINVAL;
 209
 210         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 211         if (!res)
 212                 return -EINVAL;
 213         return res;
 214 }
 215
 216 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 217                                        struct netlink_callback *cb,
 218                                        struct cfg80211_registered_device **rdev,
 219                                        struct net_device **dev)
 220 {
 221         int ifidx = cb->args[0];
 222         int err;
 223
 224         if (!ifidx)
 225                 ifidx = nl80211_get_ifidx(cb);
 226         if (ifidx < 0)
 227                 return ifidx;
 228
 229         cb->args[0] = ifidx;
 230
 231         rtnl_lock();
 232
 233         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 234         if (!*dev) {
 235                 err = -ENODEV;
 236                 goto out_rtnl;
 237         }
 238
 239         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 240         if (IS_ERR(*rdev)) {
 241                 err = PTR_ERR(*rdev);
 242                 goto out_rtnl;
 243         }
 244
 245         return 0;
 246  out_rtnl:
 247         rtnl_unlock();
 248         return err;
 249 }
 250
 251 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 252 {
 253         cfg80211_unlock_rdev(rdev);
 254         rtnl_unlock();
 255 }
 256
 257 /* IE validation */
 258 static bool is_valid_ie_attr(const struct nlattr *attr)
 259 {
 260         const u8 *pos;
 261         int len;
 262
 263         if (!attr)
 264                 return true;
 265
 266         pos = nla_data(attr);
 267         len = nla_len(attr);
 268
 269         while (len) {
 270                 u8 elemlen;
 271
 272                 if (len < 2)
 273                         return false;
 274                 len -= 2;
 275
 276                 elemlen = pos[1];
 277                 if (elemlen > len)
 278                         return false;
 279
 280                 len -= elemlen;
 281                 pos += 2 + elemlen;
 282         }
 283
 284         return true;
 285 }
 286
 287 /* message building helper */
 288 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 289                                    int flags, u8 cmd)
 290 {
 291         /* since there is no private header just add the generic one */
 292         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 293 }
 294
 295 static int nl80211_msg_put_channel(struct sk_buff *msg,
 296                                    struct ieee80211_channel *chan)
 297 {
 298         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 299                     chan->center_freq);
 300
 301         if (chan->flags & IEEE80211_CHAN_DISABLED)
 302                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 303         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 304                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 305         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 306                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 307         if (chan->flags & IEEE80211_CHAN_RADAR)
 308                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 309
 310         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 311                     DBM_TO_MBM(chan->max_power));
 312
 313         return 0;
 314
 315  nla_put_failure:
 316         return -ENOBUFS;
 317 }
 318
 319 /* netlink command implementations */
 320
 321 struct key_parse {
 322         struct key_params p;
 323         int idx;
 324         int type;
 325         bool def, defmgmt;
 326         bool def_uni, def_multi;
 327 };
 328
 329 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 330 {
 331         struct nlattr *tb[NL80211_KEY_MAX + 1];
 332         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 333                                    nl80211_key_policy);
 334         if (err)
 335                 return err;
 336
 337         k->def = !!tb[NL80211_KEY_DEFAULT];
 338         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 339
 340         if (k->def) {
 341                 k->def_uni = true;
 342                 k->def_multi = true;
 343         }
 344         if (k->defmgmt)
 345                 k->def_multi = true;
 346
 347         if (tb[NL80211_KEY_IDX])
 348                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 349
 350         if (tb[NL80211_KEY_DATA]) {
 351                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 352                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 353         }
 354
 355         if (tb[NL80211_KEY_SEQ]) {
 356                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 357                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 358         }
 359
 360         if (tb[NL80211_KEY_CIPHER])
 361                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 362
 363         if (tb[NL80211_KEY_TYPE]) {
 364                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 365                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 366                         return -EINVAL;
 367         }
 368
 369         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 370                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 371                 int err = nla_parse_nested(kdt,
 372                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 373                                            tb[NL80211_KEY_DEFAULT_TYPES],
 374                                            nl80211_key_default_policy);
 375                 if (err)
 376                         return err;
 377
 378                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 379                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 380         }
 381
 382         return 0;
 383 }
 384
 385 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 386 {
 387         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 388                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 389                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 390         }
 391
 392         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 393                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 394                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 395         }
 396
 397         if (info->attrs[NL80211_ATTR_KEY_IDX])
 398                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 399
 400         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 401                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 402
 403         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 404         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 405
 406         if (k->def) {
 407                 k->def_uni = true;
 408                 k->def_multi = true;
 409         }
 410         if (k->defmgmt)
 411                 k->def_multi = true;
 412
 413         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 414                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 415                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 416                         return -EINVAL;
 417         }
 418
 419         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 420                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 421                 int err = nla_parse_nested(
 422                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 423                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 424                                 nl80211_key_default_policy);
 425                 if (err)
 426                         return err;
 427
 428                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 429                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 430         }
 431
 432         return 0;
 433 }
 434
 435 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 436 {
 437         int err;
 438
 439         memset(k, 0, sizeof(*k));
 440         k->idx = -1;
 441         k->type = -1;
 442
 443         if (info->attrs[NL80211_ATTR_KEY])
 444                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 445         else
 446                 err = nl80211_parse_key_old(info, k);
 447
 448         if (err)
 449                 return err;
 450
 451         if (k->def && k->defmgmt)
 452                 return -EINVAL;
 453
 454         if (k->defmgmt) {
 455                 if (k->def_uni || !k->def_multi)
 456                         return -EINVAL;
 457         }
 458
 459         if (k->idx != -1) {
 460                 if (k->defmgmt) {
 461                         if (k->idx < 4 || k->idx > 5)
 462                                 return -EINVAL;
 463                 } else if (k->def) {
 464                         if (k->idx < 0 || k->idx > 3)
 465                                 return -EINVAL;
 466                 } else {
 467                         if (k->idx < 0 || k->idx > 5)
 468                                 return -EINVAL;
 469                 }
 470         }
 471
 472         return 0;
 473 }
 474
 475 static struct cfg80211_cached_keys *
 476 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 477                        struct nlattr *keys)
 478 {
 479         struct key_parse parse;
 480         struct nlattr *key;
 481         struct cfg80211_cached_keys *result;
 482         int rem, err, def = 0;
 483
 484         result = kzalloc(sizeof(*result), GFP_KERNEL);
 485         if (!result)
 486                 return ERR_PTR(-ENOMEM);
 487
 488         result->def = -1;
 489         result->defmgmt = -1;
 490
 491         nla_for_each_nested(key, keys, rem) {
 492                 memset(&parse, 0, sizeof(parse));
 493                 parse.idx = -1;
 494
 495                 err = nl80211_parse_key_new(key, &parse);
 496                 if (err)
 497                         goto error;
 498                 err = -EINVAL;
 499                 if (!parse.p.key)
 500                         goto error;
 501                 if (parse.idx < 0 || parse.idx > 4)
 502                         goto error;
 503                 if (parse.def) {
 504                         if (def)
 505                                 goto error;
 506                         def = 1;
 507                         result->def = parse.idx;
 508                         if (!parse.def_uni || !parse.def_multi)
 509                                 goto error;
 510                 } else if (parse.defmgmt)
 511                         goto error;
 512                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 513                                                      parse.idx, false, NULL);
 514                 if (err)
 515                         goto error;
 516                 result->params[parse.idx].cipher = parse.p.cipher;
 517                 result->params[parse.idx].key_len = parse.p.key_len;
 518                 result->params[parse.idx].key = result->data[parse.idx];
 519                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 520         }
 521
 522         return result;
 523  error:
 524         kfree(result);
 525         return ERR_PTR(err);
 526 }
 527
 528 static int nl80211_key_allowed(struct wireless_dev *wdev)
 529 {
 530         ASSERT_WDEV_LOCK(wdev);
 531
 532         switch (wdev->iftype) {
 533         case NL80211_IFTYPE_AP:
 534         case NL80211_IFTYPE_AP_VLAN:
 535         case NL80211_IFTYPE_P2P_GO:
 536                 break;
 537         case NL80211_IFTYPE_ADHOC:
 538                 if (!wdev->current_bss)
 539                         return -ENOLINK;
 540                 break;
 541         case NL80211_IFTYPE_STATION:
 542         case NL80211_IFTYPE_P2P_CLIENT:
 543                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 544                         return -ENOLINK;
 545                 break;
 546         default:
 547                 return -EINVAL;
 548         }
 549
 550         return 0;
 551 }
 552
 553 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 554                               struct cfg80211_registered_device *dev)
 555 {
 556         void *hdr;
 557         struct nlattr *nl_bands, *nl_band;
 558         struct nlattr *nl_freqs, *nl_freq;
 559         struct nlattr *nl_rates, *nl_rate;
 560         struct nlattr *nl_modes;
 561         struct nlattr *nl_cmds;
 562         enum ieee80211_band band;
 563         struct ieee80211_channel *chan;
 564         struct ieee80211_rate *rate;
 565         int i;
 566         u16 ifmodes = dev->wiphy.interface_modes;
 567         const struct ieee80211_txrx_stypes *mgmt_stypes =
 568                                 dev->wiphy.mgmt_stypes;
 569
 570         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 571         if (!hdr)
 572                 return -1;
 573
 574         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 575         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 576
 577         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 578                     cfg80211_rdev_list_generation);
 579
 580         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 581                    dev->wiphy.retry_short);
 582         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 583                    dev->wiphy.retry_long);
 584         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 585                     dev->wiphy.frag_threshold);
 586         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 587                     dev->wiphy.rts_threshold);
 588         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 589                     dev->wiphy.coverage_class);
 590         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 591                    dev->wiphy.max_scan_ssids);
 592         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 593                     dev->wiphy.max_scan_ie_len);
 594
 595         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 596                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 597
 598         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 599                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 600                 dev->wiphy.cipher_suites);
 601
 602         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 603                    dev->wiphy.max_num_pmkids);
 604
 605         if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 606                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 607
 608         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 609                     dev->wiphy.available_antennas_tx);
 610         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 611                     dev->wiphy.available_antennas_rx);
 612
 613         if ((dev->wiphy.available_antennas_tx ||
 614              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 615                 u32 tx_ant = 0, rx_ant = 0;
 616                 int res;
 617                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 618                 if (!res) {
 619                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 620                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 621                 }
 622         }
 623
 624         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 625         if (!nl_modes)
 626                 goto nla_put_failure;
 627
 628         i = 0;
 629         while (ifmodes) {
 630                 if (ifmodes & 1)
 631                         NLA_PUT_FLAG(msg, i);
 632                 ifmodes >>= 1;
 633                 i++;
 634         }
 635
 636         nla_nest_end(msg, nl_modes);
 637
 638         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 639         if (!nl_bands)
 640                 goto nla_put_failure;
 641
 642         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 643                 if (!dev->wiphy.bands[band])
 644                         continue;
 645
 646                 nl_band = nla_nest_start(msg, band);
 647                 if (!nl_band)
 648                         goto nla_put_failure;
 649
 650                 /* add HT info */
 651                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 652                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 653                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 654                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 655                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 656                                 dev->wiphy.bands[band]->ht_cap.cap);
 657                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 658                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 659                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 660                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 661                 }
 662
 663                 /* add frequencies */
 664                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 665                 if (!nl_freqs)
 666                         goto nla_put_failure;
 667
 668                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 669                         nl_freq = nla_nest_start(msg, i);
 670                         if (!nl_freq)
 671                                 goto nla_put_failure;
 672
 673                         chan = &dev->wiphy.bands[band]->channels[i];
 674
 675                         if (nl80211_msg_put_channel(msg, chan))
 676                                 goto nla_put_failure;
 677
 678                         nla_nest_end(msg, nl_freq);
 679                 }
 680
 681                 nla_nest_end(msg, nl_freqs);
 682
 683                 /* add bitrates */
 684                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 685                 if (!nl_rates)
 686                         goto nla_put_failure;
 687
 688                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 689                         nl_rate = nla_nest_start(msg, i);
 690                         if (!nl_rate)
 691                                 goto nla_put_failure;
 692
 693                         rate = &dev->wiphy.bands[band]->bitrates[i];
 694                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 695                                     rate->bitrate);
 696                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 697                                 NLA_PUT_FLAG(msg,
 698                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 699
 700                         nla_nest_end(msg, nl_rate);
 701                 }
 702
 703                 nla_nest_end(msg, nl_rates);
 704
 705                 nla_nest_end(msg, nl_band);
 706         }
 707         nla_nest_end(msg, nl_bands);
 708
 709         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 710         if (!nl_cmds)
 711                 goto nla_put_failure;
 712
 713         i = 0;
 714 #define CMD(op, n)                                              \
 715          do {                                                   \
 716                 if (dev->ops->op) {                             \
 717                         i++;                                    \
 718                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 719                 }                                               \
 720         } while (0)
 721
 722         CMD(add_virtual_intf, NEW_INTERFACE);
 723         CMD(change_virtual_intf, SET_INTERFACE);
 724         CMD(add_key, NEW_KEY);
 725         CMD(add_beacon, NEW_BEACON);
 726         CMD(add_station, NEW_STATION);
 727         CMD(add_mpath, NEW_MPATH);
 728         CMD(update_mesh_config, SET_MESH_CONFIG);
 729         CMD(change_bss, SET_BSS);
 730         CMD(auth, AUTHENTICATE);
 731         CMD(assoc, ASSOCIATE);
 732         CMD(deauth, DEAUTHENTICATE);
 733         CMD(disassoc, DISASSOCIATE);
 734         CMD(join_ibss, JOIN_IBSS);
 735         CMD(join_mesh, JOIN_MESH);
 736         CMD(set_pmksa, SET_PMKSA);
 737         CMD(del_pmksa, DEL_PMKSA);
 738         CMD(flush_pmksa, FLUSH_PMKSA);
 739         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 740         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 741         CMD(mgmt_tx, FRAME);
 742         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 743         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 744                 i++;
 745                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 746         }
 747         CMD(set_channel, SET_CHANNEL);
 748         CMD(set_wds_peer, SET_WDS_PEER);
 749
 750 #undef CMD
 751
 752         if (dev->ops->connect || dev->ops->auth) {
 753                 i++;
 754                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 755         }
 756
 757         if (dev->ops->disconnect || dev->ops->deauth) {
 758                 i++;
 759                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 760         }
 761
 762         nla_nest_end(msg, nl_cmds);
 763
 764         if (dev->ops->remain_on_channel)
 765                 NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 766                             dev->wiphy.max_remain_on_channel_duration);
 767
 768         /* for now at least assume all drivers have it */
 769         if (dev->ops->mgmt_tx)
 770                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 771
 772         if (mgmt_stypes) {
 773                 u16 stypes;
 774                 struct nlattr *nl_ftypes, *nl_ifs;
 775                 enum nl80211_iftype ift;
 776
 777                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
 778                 if (!nl_ifs)
 779                         goto nla_put_failure;
 780
 781                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 782                         nl_ftypes = nla_nest_start(msg, ift);
 783                         if (!nl_ftypes)
 784                                 goto nla_put_failure;
 785                         i = 0;
 786                         stypes = mgmt_stypes[ift].tx;
 787                         while (stypes) {
 788                                 if (stypes & 1)
 789                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 790                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 791                                 stypes >>= 1;
 792                                 i++;
 793                         }
 794                         nla_nest_end(msg, nl_ftypes);
 795                 }
 796
 797                 nla_nest_end(msg, nl_ifs);
 798
 799                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
 800                 if (!nl_ifs)
 801                         goto nla_put_failure;
 802
 803                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 804                         nl_ftypes = nla_nest_start(msg, ift);
 805                         if (!nl_ftypes)
 806                                 goto nla_put_failure;
 807                         i = 0;
 808                         stypes = mgmt_stypes[ift].rx;
 809                         while (stypes) {
 810                                 if (stypes & 1)
 811                                         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 812                                                     (i << 4) | IEEE80211_FTYPE_MGMT);
 813                                 stypes >>= 1;
 814                                 i++;
 815                         }
 816                         nla_nest_end(msg, nl_ftypes);
 817                 }
 818                 nla_nest_end(msg, nl_ifs);
 819         }
 820
 821         return genlmsg_end(msg, hdr);
 822
 823  nla_put_failure:
 824         genlmsg_cancel(msg, hdr);
 825         return -EMSGSIZE;
 826 }
 827
 828 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 829 {
 830         int idx = 0;
 831         int start = cb->args[0];
 832         struct cfg80211_registered_device *dev;
 833
 834         mutex_lock(&cfg80211_mutex);
 835         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 836                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 837                         continue;
 838                 if (++idx <= start)
 839                         continue;
 840                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 841                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 842                                        dev) < 0) {
 843                         idx--;
 844                         break;
 845                 }
 846         }
 847         mutex_unlock(&cfg80211_mutex);
 848
 849         cb->args[0] = idx;
 850
 851         return skb->len;
 852 }
 853
 854 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 855 {
 856         struct sk_buff *msg;
 857         struct cfg80211_registered_device *dev = info->user_ptr[0];
 858
 859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 860         if (!msg)
 861                 return -ENOMEM;
 862
 863         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0) {
 864                 nlmsg_free(msg);
 865                 return -ENOBUFS;
 866         }
 867
 868         return genlmsg_reply(msg, info);
 869 }
 870
 871 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 872         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 873         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 874         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 875         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 876         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 877 };
 878
 879 static int parse_txq_params(struct nlattr *tb[],
 880                             struct ieee80211_txq_params *txq_params)
 881 {
 882         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 883             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 884             !tb[NL80211_TXQ_ATTR_AIFS])
 885                 return -EINVAL;
 886
 887         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 888         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 889         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 890         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 891         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 892
 893         return 0;
 894 }
 895
 896 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 897 {
 898         /*
 899          * You can only set the channel explicitly for AP, mesh
 900          * and WDS type interfaces; all others have their channel
 901          * managed via their respective "establish a connection"
 902          * command (connect, join, ...)
 903          *
 904          * Monitors are special as they are normally slaved to
 905          * whatever else is going on, so they behave as though
 906          * you tried setting the wiphy channel itself.
 907          */
 908         return !wdev ||
 909                 wdev->iftype == NL80211_IFTYPE_AP ||
 910                 wdev->iftype == NL80211_IFTYPE_WDS ||
 911                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 912                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
 913                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
 914 }
 915
 916 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 917                                  struct wireless_dev *wdev,
 918                                  struct genl_info *info)
 919 {
 920         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 921         u32 freq;
 922         int result;
 923
 924         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
 925                 return -EINVAL;
 926
 927         if (!nl80211_can_set_dev_channel(wdev))
 928                 return -EOPNOTSUPP;
 929
 930         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 931                 channel_type = nla_get_u32(info->attrs[
 932                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 933                 if (channel_type != NL80211_CHAN_NO_HT &&
 934                     channel_type != NL80211_CHAN_HT20 &&
 935                     channel_type != NL80211_CHAN_HT40PLUS &&
 936                     channel_type != NL80211_CHAN_HT40MINUS)
 937                         return -EINVAL;
 938         }
 939
 940         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 941
 942         mutex_lock(&rdev->devlist_mtx);
 943         if (wdev) {
 944                 wdev_lock(wdev);
 945                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
 946                 wdev_unlock(wdev);
 947         } else {
 948                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
 949         }
 950         mutex_unlock(&rdev->devlist_mtx);
 951
 952         return result;
 953 }
 954
 955 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 956 {
 957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 958         struct net_device *netdev = info->user_ptr[1];
 959
 960         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 961 }
 962
 963 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
 964 {
 965         struct cfg80211_registered_device *rdev = info->user_ptr[0];
 966         struct net_device *dev = info->user_ptr[1];
 967         struct wireless_dev *wdev = dev->ieee80211_ptr;
 968         const u8 *bssid;
 969
 970         if (!info->attrs[NL80211_ATTR_MAC])
 971                 return -EINVAL;
 972
 973         if (netif_running(dev))
 974                 return -EBUSY;
 975
 976         if (!rdev->ops->set_wds_peer)
 977                 return -EOPNOTSUPP;
 978
 979         if (wdev->iftype != NL80211_IFTYPE_WDS)
 980                 return -EOPNOTSUPP;
 981
 982         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 983         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
 984 }
 985
 986
 987 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 988 {
 989         struct cfg80211_registered_device *rdev;
 990         struct net_device *netdev = NULL;
 991         struct wireless_dev *wdev;
 992         int result = 0, rem_txq_params = 0;
 993         struct nlattr *nl_txq_params;
 994         u32 changed;
 995         u8 retry_short = 0, retry_long = 0;
 996         u32 frag_threshold = 0, rts_threshold = 0;
 997         u8 coverage_class = 0;
 998
 999         /*
1000          * Try to find the wiphy and netdev. Normally this
1001          * function shouldn't need the netdev, but this is
1002          * done for backward compatibility -- previously
1003          * setting the channel was done per wiphy, but now
1004          * it is per netdev. Previous userland like hostapd
1005          * also passed a netdev to set_wiphy, so that it is
1006          * possible to let that go to the right netdev!
1007          */
1008         mutex_lock(&cfg80211_mutex);
1009
1010         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1011                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1012
1013                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1014                 if (netdev && netdev->ieee80211_ptr) {
1015                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1016                         mutex_lock(&rdev->mtx);
1017                 } else
1018                         netdev = NULL;
1019         }
1020
1021         if (!netdev) {
1022                 rdev = __cfg80211_rdev_from_info(info);
1023                 if (IS_ERR(rdev)) {
1024                         mutex_unlock(&cfg80211_mutex);
1025                         return PTR_ERR(rdev);
1026                 }
1027                 wdev = NULL;
1028                 netdev = NULL;
1029                 result = 0;
1030
1031                 mutex_lock(&rdev->mtx);
1032         } else if (netif_running(netdev) &&
1033                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1034                 wdev = netdev->ieee80211_ptr;
1035         else
1036                 wdev = NULL;
1037
1038         /*
1039          * end workaround code, by now the rdev is available
1040          * and locked, and wdev may or may not be NULL.
1041          */
1042
1043         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1044                 result = cfg80211_dev_rename(
1045                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1046
1047         mutex_unlock(&cfg80211_mutex);
1048
1049         if (result)
1050                 goto bad_res;
1051
1052         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1053                 struct ieee80211_txq_params txq_params;
1054                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1055
1056                 if (!rdev->ops->set_txq_params) {
1057                         result = -EOPNOTSUPP;
1058                         goto bad_res;
1059                 }
1060
1061                 nla_for_each_nested(nl_txq_params,
1062                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1063                                     rem_txq_params) {
1064                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1065                                   nla_data(nl_txq_params),
1066                                   nla_len(nl_txq_params),
1067                                   txq_params_policy);
1068                         result = parse_txq_params(tb, &txq_params);
1069                         if (result)
1070                                 goto bad_res;
1071
1072                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1073                                                            &txq_params);
1074                         if (result)
1075                                 goto bad_res;
1076                 }
1077         }
1078
1079         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1080                 result = __nl80211_set_channel(rdev, wdev, info);
1081                 if (result)
1082                         goto bad_res;
1083         }
1084
1085         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1086                 enum nl80211_tx_power_setting type;
1087                 int idx, mbm = 0;
1088
1089                 if (!rdev->ops->set_tx_power) {
1090                         result = -EOPNOTSUPP;
1091                         goto bad_res;
1092                 }
1093
1094                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1095                 type = nla_get_u32(info->attrs[idx]);
1096
1097                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1098                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1099                         result = -EINVAL;
1100                         goto bad_res;
1101                 }
1102
1103                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1104                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1105                         mbm = nla_get_u32(info->attrs[idx]);
1106                 }
1107
1108                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1109                 if (result)
1110                         goto bad_res;
1111         }
1112
1113         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1114             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1115                 u32 tx_ant, rx_ant;
1116                 if ((!rdev->wiphy.available_antennas_tx &&
1117                      !rdev->wiphy.available_antennas_rx) ||
1118                     !rdev->ops->set_antenna) {
1119                         result = -EOPNOTSUPP;
1120                         goto bad_res;
1121                 }
1122
1123                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1124                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1125
1126                 /* reject antenna configurations which don't match the
1127                  * available antenna masks, except for the "all" mask */
1128                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1129                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1130                         result = -EINVAL;
1131                         goto bad_res;
1132                 }
1133
1134                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1135                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1136
1137                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1138                 if (result)
1139                         goto bad_res;
1140         }
1141
1142         changed = 0;
1143
1144         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1145                 retry_short = nla_get_u8(
1146                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1147                 if (retry_short == 0) {
1148                         result = -EINVAL;
1149                         goto bad_res;
1150                 }
1151                 changed |= WIPHY_PARAM_RETRY_SHORT;
1152         }
1153
1154         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1155                 retry_long = nla_get_u8(
1156                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1157                 if (retry_long == 0) {
1158                         result = -EINVAL;
1159                         goto bad_res;
1160                 }
1161                 changed |= WIPHY_PARAM_RETRY_LONG;
1162         }
1163
1164         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1165                 frag_threshold = nla_get_u32(
1166                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1167                 if (frag_threshold < 256) {
1168                         result = -EINVAL;
1169                         goto bad_res;
1170                 }
1171                 if (frag_threshold != (u32) -1) {
1172                         /*
1173                          * Fragments (apart from the last one) are required to
1174                          * have even length. Make the fragmentation code
1175                          * simpler by stripping LSB should someone try to use
1176                          * odd threshold value.
1177                          */
1178                         frag_threshold &= ~0x1;
1179                 }
1180                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1181         }
1182
1183         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1184                 rts_threshold = nla_get_u32(
1185                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1186                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1187         }
1188
1189         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1190                 coverage_class = nla_get_u8(
1191                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1192                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1193         }
1194
1195         if (changed) {
1196                 u8 old_retry_short, old_retry_long;
1197                 u32 old_frag_threshold, old_rts_threshold;
1198                 u8 old_coverage_class;
1199
1200                 if (!rdev->ops->set_wiphy_params) {
1201                         result = -EOPNOTSUPP;
1202                         goto bad_res;
1203                 }
1204
1205                 old_retry_short = rdev->wiphy.retry_short;
1206                 old_retry_long = rdev->wiphy.retry_long;
1207                 old_frag_threshold = rdev->wiphy.frag_threshold;
1208                 old_rts_threshold = rdev->wiphy.rts_threshold;
1209                 old_coverage_class = rdev->wiphy.coverage_class;
1210
1211                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1212                         rdev->wiphy.retry_short = retry_short;
1213                 if (changed & WIPHY_PARAM_RETRY_LONG)
1214                         rdev->wiphy.retry_long = retry_long;
1215                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1216                         rdev->wiphy.frag_threshold = frag_threshold;
1217                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1218                         rdev->wiphy.rts_threshold = rts_threshold;
1219                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1220                         rdev->wiphy.coverage_class = coverage_class;
1221
1222                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1223                 if (result) {
1224                         rdev->wiphy.retry_short = old_retry_short;
1225                         rdev->wiphy.retry_long = old_retry_long;
1226                         rdev->wiphy.frag_threshold = old_frag_threshold;
1227                         rdev->wiphy.rts_threshold = old_rts_threshold;
1228                         rdev->wiphy.coverage_class = old_coverage_class;
1229                 }
1230         }
1231
1232  bad_res:
1233         mutex_unlock(&rdev->mtx);
1234         if (netdev)
1235                 dev_put(netdev);
1236         return result;
1237 }
1238
1239
1240 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1241                               struct cfg80211_registered_device *rdev,
1242                               struct net_device *dev)
1243 {
1244         void *hdr;
1245
1246         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1247         if (!hdr)
1248                 return -1;
1249
1250         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1251         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1252         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1253         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1254
1255         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1256                     rdev->devlist_generation ^
1257                         (cfg80211_rdev_list_generation << 2));
1258
1259         return genlmsg_end(msg, hdr);
1260
1261  nla_put_failure:
1262         genlmsg_cancel(msg, hdr);
1263         return -EMSGSIZE;
1264 }
1265
1266 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1267 {
1268         int wp_idx = 0;
1269         int if_idx = 0;
1270         int wp_start = cb->args[0];
1271         int if_start = cb->args[1];
1272         struct cfg80211_registered_device *rdev;
1273         struct wireless_dev *wdev;
1274
1275         mutex_lock(&cfg80211_mutex);
1276         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1277                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1278                         continue;
1279                 if (wp_idx < wp_start) {
1280                         wp_idx++;
1281                         continue;
1282                 }
1283                 if_idx = 0;
1284
1285                 mutex_lock(&rdev->devlist_mtx);
1286                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1287                         if (if_idx < if_start) {
1288                                 if_idx++;
1289                                 continue;
1290                         }
1291                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1292                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1293                                                rdev, wdev->netdev) < 0) {
1294                                 mutex_unlock(&rdev->devlist_mtx);
1295                                 goto out;
1296                         }
1297                         if_idx++;
1298                 }
1299                 mutex_unlock(&rdev->devlist_mtx);
1300
1301                 wp_idx++;
1302         }
1303  out:
1304         mutex_unlock(&cfg80211_mutex);
1305
1306         cb->args[0] = wp_idx;
1307         cb->args[1] = if_idx;
1308
1309         return skb->len;
1310 }
1311
1312 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1313 {
1314         struct sk_buff *msg;
1315         struct cfg80211_registered_device *dev = info->user_ptr[0];
1316         struct net_device *netdev = info->user_ptr[1];
1317
1318         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1319         if (!msg)
1320                 return -ENOMEM;
1321
1322         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1323                                dev, netdev) < 0) {
1324                 nlmsg_free(msg);
1325                 return -ENOBUFS;
1326         }
1327
1328         return genlmsg_reply(msg, info);
1329 }
1330
1331 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1332         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1333         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1334         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1335         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1336         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1337 };
1338
1339 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1340 {
1341         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1342         int flag;
1343
1344         *mntrflags = 0;
1345
1346         if (!nla)
1347                 return -EINVAL;
1348
1349         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1350                              nla, mntr_flags_policy))
1351                 return -EINVAL;
1352
1353         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1354                 if (flags[flag])
1355                         *mntrflags |= (1<<flag);
1356
1357         return 0;
1358 }
1359
1360 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1361                                struct net_device *netdev, u8 use_4addr,
1362                                enum nl80211_iftype iftype)
1363 {
1364         if (!use_4addr) {
1365                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1366                         return -EBUSY;
1367                 return 0;
1368         }
1369
1370         switch (iftype) {
1371         case NL80211_IFTYPE_AP_VLAN:
1372                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1373                         return 0;
1374                 break;
1375         case NL80211_IFTYPE_STATION:
1376                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1377                         return 0;
1378                 break;
1379         default:
1380                 break;
1381         }
1382
1383         return -EOPNOTSUPP;
1384 }
1385
1386 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1387 {
1388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1389         struct vif_params params;
1390         int err;
1391         enum nl80211_iftype otype, ntype;
1392         struct net_device *dev = info->user_ptr[1];
1393         u32 _flags, *flags = NULL;
1394         bool change = false;
1395
1396         memset(&params, 0, sizeof(params));
1397
1398         otype = ntype = dev->ieee80211_ptr->iftype;
1399
1400         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1401                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1402                 if (otype != ntype)
1403                         change = true;
1404                 if (ntype > NL80211_IFTYPE_MAX)
1405                         return -EINVAL;
1406         }
1407
1408         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1409                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1410
1411                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1412                         return -EINVAL;
1413                 if (netif_running(dev))
1414                         return -EBUSY;
1415
1416                 wdev_lock(wdev);
1417                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1418                              IEEE80211_MAX_MESH_ID_LEN);
1419                 wdev->mesh_id_up_len =
1420                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1421                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1422                        wdev->mesh_id_up_len);
1423                 wdev_unlock(wdev);
1424         }
1425
1426         if (info->attrs[NL80211_ATTR_4ADDR]) {
1427                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1428                 change = true;
1429                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1430                 if (err)
1431                         return err;
1432         } else {
1433                 params.use_4addr = -1;
1434         }
1435
1436         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1437                 if (ntype != NL80211_IFTYPE_MONITOR)
1438                         return -EINVAL;
1439                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1440                                           &_flags);
1441                 if (err)
1442                         return err;
1443
1444                 flags = &_flags;
1445                 change = true;
1446         }
1447
1448         if (change)
1449                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1450         else
1451                 err = 0;
1452
1453         if (!err && params.use_4addr != -1)
1454                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1455
1456         return err;
1457 }
1458
1459 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1460 {
1461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1462         struct vif_params params;
1463         struct net_device *dev;
1464         int err;
1465         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1466         u32 flags;
1467
1468         memset(&params, 0, sizeof(params));
1469
1470         if (!info->attrs[NL80211_ATTR_IFNAME])
1471                 return -EINVAL;
1472
1473         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1474                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1475                 if (type > NL80211_IFTYPE_MAX)
1476                         return -EINVAL;
1477         }
1478
1479         if (!rdev->ops->add_virtual_intf ||
1480             !(rdev->wiphy.interface_modes & (1 << type)))
1481                 return -EOPNOTSUPP;
1482
1483         if (info->attrs[NL80211_ATTR_4ADDR]) {
1484                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1485                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1486                 if (err)
1487                         return err;
1488         }
1489
1490         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1491                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1492                                   &flags);
1493         dev = rdev->ops->add_virtual_intf(&rdev->wiphy,
1494                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1495                 type, err ? NULL : &flags, &params);
1496         if (IS_ERR(dev))
1497                 return PTR_ERR(dev);
1498
1499         if (type == NL80211_IFTYPE_MESH_POINT &&
1500             info->attrs[NL80211_ATTR_MESH_ID]) {
1501                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1502
1503                 wdev_lock(wdev);
1504                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1505                              IEEE80211_MAX_MESH_ID_LEN);
1506                 wdev->mesh_id_up_len =
1507                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1508                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1509                        wdev->mesh_id_up_len);
1510                 wdev_unlock(wdev);
1511         }
1512
1513         return 0;
1514 }
1515
1516 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1517 {
1518         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1519         struct net_device *dev = info->user_ptr[1];
1520
1521         if (!rdev->ops->del_virtual_intf)
1522                 return -EOPNOTSUPP;
1523
1524         return rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1525 }
1526
1527 struct get_key_cookie {
1528         struct sk_buff *msg;
1529         int error;
1530         int idx;
1531 };
1532
1533 static void get_key_callback(void *c, struct key_params *params)
1534 {
1535         struct nlattr *key;
1536         struct get_key_cookie *cookie = c;
1537
1538         if (params->key)
1539                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1540                         params->key_len, params->key);
1541
1542         if (params->seq)
1543                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1544                         params->seq_len, params->seq);
1545
1546         if (params->cipher)
1547                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1548                             params->cipher);
1549
1550         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1551         if (!key)
1552                 goto nla_put_failure;
1553
1554         if (params->key)
1555                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1556                         params->key_len, params->key);
1557
1558         if (params->seq)
1559                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1560                         params->seq_len, params->seq);
1561
1562         if (params->cipher)
1563                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1564                             params->cipher);
1565
1566         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1567
1568         nla_nest_end(cookie->msg, key);
1569
1570         return;
1571  nla_put_failure:
1572         cookie->error = 1;
1573 }
1574
1575 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1576 {
1577         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1578         int err;
1579         struct net_device *dev = info->user_ptr[1];
1580         u8 key_idx = 0;
1581         const u8 *mac_addr = NULL;
1582         bool pairwise;
1583         struct get_key_cookie cookie = {
1584                 .error = 0,
1585         };
1586         void *hdr;
1587         struct sk_buff *msg;
1588
1589         if (info->attrs[NL80211_ATTR_KEY_IDX])
1590                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1591
1592         if (key_idx > 5)
1593                 return -EINVAL;
1594
1595         if (info->attrs[NL80211_ATTR_MAC])
1596                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1597
1598         pairwise = !!mac_addr;
1599         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
1600                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1601                 if (kt >= NUM_NL80211_KEYTYPES)
1602                         return -EINVAL;
1603                 if (kt != NL80211_KEYTYPE_GROUP &&
1604                     kt != NL80211_KEYTYPE_PAIRWISE)
1605                         return -EINVAL;
1606                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
1607         }
1608
1609         if (!rdev->ops->get_key)
1610                 return -EOPNOTSUPP;
1611
1612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1613         if (!msg)
1614                 return -ENOMEM;
1615
1616         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1617                              NL80211_CMD_NEW_KEY);
1618         if (IS_ERR(hdr))
1619                 return PTR_ERR(hdr);
1620
1621         cookie.msg = msg;
1622         cookie.idx = key_idx;
1623
1624         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1625         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1626         if (mac_addr)
1627                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1628
1629         if (pairwise && mac_addr &&
1630             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1631                 return -ENOENT;
1632
1633         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
1634                                  mac_addr, &cookie, get_key_callback);
1635
1636         if (err)
1637                 goto free_msg;
1638
1639         if (cookie.error)
1640                 goto nla_put_failure;
1641
1642         genlmsg_end(msg, hdr);
1643         return genlmsg_reply(msg, info);
1644
1645  nla_put_failure:
1646         err = -ENOBUFS;
1647  free_msg:
1648         nlmsg_free(msg);
1649         return err;
1650 }
1651
1652 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1653 {
1654         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1655         struct key_parse key;
1656         int err;
1657         struct net_device *dev = info->user_ptr[1];
1658
1659         err = nl80211_parse_key(info, &key);
1660         if (err)
1661                 return err;
1662
1663         if (key.idx < 0)
1664                 return -EINVAL;
1665
1666         /* only support setting default key */
1667         if (!key.def && !key.defmgmt)
1668                 return -EINVAL;
1669
1670         wdev_lock(dev->ieee80211_ptr);
1671
1672         if (key.def) {
1673                 if (!rdev->ops->set_default_key) {
1674                         err = -EOPNOTSUPP;
1675                         goto out;
1676                 }
1677
1678                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1679                 if (err)
1680                         goto out;
1681
1682                 if (!(rdev->wiphy.flags &
1683                                 WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS)) {
1684                         if (!key.def_uni || !key.def_multi) {
1685                                 err = -EOPNOTSUPP;
1686                                 goto out;
1687                         }
1688                 }
1689
1690                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
1691                                                  key.def_uni, key.def_multi);
1692
1693                 if (err)
1694                         goto out;
1695
1696 #ifdef CONFIG_CFG80211_WEXT
1697                 dev->ieee80211_ptr->wext.default_key = key.idx;
1698 #endif
1699         } else {
1700                 if (key.def_uni || !key.def_multi) {
1701                         err = -EINVAL;
1702                         goto out;
1703                 }
1704
1705                 if (!rdev->ops->set_default_mgmt_key) {
1706                         err = -EOPNOTSUPP;
1707                         goto out;
1708                 }
1709
1710                 err = nl80211_key_allowed(dev->ieee80211_ptr);
1711                 if (err)
1712                         goto out;
1713
1714                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
1715                                                       dev, key.idx);
1716                 if (err)
1717                         goto out;
1718
1719 #ifdef CONFIG_CFG80211_WEXT
1720                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1721 #endif
1722         }
1723
1724  out:
1725         wdev_unlock(dev->ieee80211_ptr);
1726
1727         return err;
1728 }
1729
1730 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1731 {
1732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1733         int err;
1734         struct net_device *dev = info->user_ptr[1];
1735         struct key_parse key;
1736         const u8 *mac_addr = NULL;
1737
1738         err = nl80211_parse_key(info, &key);
1739         if (err)
1740                 return err;
1741
1742         if (!key.p.key)
1743                 return -EINVAL;
1744
1745         if (info->attrs[NL80211_ATTR_MAC])
1746                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1747
1748         if (key.type == -1) {
1749                 if (mac_addr)
1750                         key.type = NL80211_KEYTYPE_PAIRWISE;
1751                 else
1752                         key.type = NL80211_KEYTYPE_GROUP;
1753         }
1754
1755         /* for now */
1756         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1757             key.type != NL80211_KEYTYPE_GROUP)
1758                 return -EINVAL;
1759
1760         if (!rdev->ops->add_key)
1761                 return -EOPNOTSUPP;
1762
1763         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
1764                                            key.type == NL80211_KEYTYPE_PAIRWISE,
1765                                            mac_addr))
1766                 return -EINVAL;
1767
1768         wdev_lock(dev->ieee80211_ptr);
1769         err = nl80211_key_allowed(dev->ieee80211_ptr);
1770         if (!err)
1771                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1772                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1773                                          mac_addr, &key.p);
1774         wdev_unlock(dev->ieee80211_ptr);
1775
1776         return err;
1777 }
1778
1779 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1780 {
1781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1782         int err;
1783         struct net_device *dev = info->user_ptr[1];
1784         u8 *mac_addr = NULL;
1785         struct key_parse key;
1786
1787         err = nl80211_parse_key(info, &key);
1788         if (err)
1789                 return err;
1790
1791         if (info->attrs[NL80211_ATTR_MAC])
1792                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1793
1794         if (key.type == -1) {
1795                 if (mac_addr)
1796                         key.type = NL80211_KEYTYPE_PAIRWISE;
1797                 else
1798                         key.type = NL80211_KEYTYPE_GROUP;
1799         }
1800
1801         /* for now */
1802         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
1803             key.type != NL80211_KEYTYPE_GROUP)
1804                 return -EINVAL;
1805
1806         if (!rdev->ops->del_key)
1807                 return -EOPNOTSUPP;
1808
1809         wdev_lock(dev->ieee80211_ptr);
1810         err = nl80211_key_allowed(dev->ieee80211_ptr);
1811
1812         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
1813             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
1814                 err = -ENOENT;
1815
1816         if (!err)
1817                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
1818                                          key.type == NL80211_KEYTYPE_PAIRWISE,
1819                                          mac_addr);
1820
1821 #ifdef CONFIG_CFG80211_WEXT
1822         if (!err) {
1823                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1824                         dev->ieee80211_ptr->wext.default_key = -1;
1825                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1826                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1827         }
1828 #endif
1829         wdev_unlock(dev->ieee80211_ptr);
1830
1831         return err;
1832 }
1833
1834 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1835 {
1836         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1837                     struct beacon_parameters *info);
1838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1839         struct net_device *dev = info->user_ptr[1];
1840         struct beacon_parameters params;
1841         int haveinfo = 0;
1842
1843         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1844                 return -EINVAL;
1845
1846         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1847             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1848                 return -EOPNOTSUPP;
1849
1850         switch (info->genlhdr->cmd) {
1851         case NL80211_CMD_NEW_BEACON:
1852                 /* these are required for NEW_BEACON */
1853                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1854                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1855                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
1856                         return -EINVAL;
1857
1858                 call = rdev->ops->add_beacon;
1859                 break;
1860         case NL80211_CMD_SET_BEACON:
1861                 call = rdev->ops->set_beacon;
1862                 break;
1863         default:
1864                 WARN_ON(1);
1865                 return -EOPNOTSUPP;
1866         }
1867
1868         if (!call)
1869                 return -EOPNOTSUPP;
1870
1871         memset(&params, 0, sizeof(params));
1872
1873         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1874                 params.interval =
1875                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1876                 haveinfo = 1;
1877         }
1878
1879         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1880                 params.dtim_period =
1881                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1882                 haveinfo = 1;
1883         }
1884
1885         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1886                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1887                 params.head_len =
1888                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1889                 haveinfo = 1;
1890         }
1891
1892         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1893                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1894                 params.tail_len =
1895                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1896                 haveinfo = 1;
1897         }
1898
1899         if (!haveinfo)
1900                 return -EINVAL;
1901
1902         return call(&rdev->wiphy, dev, &params);
1903 }
1904
1905 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908         struct net_device *dev = info->user_ptr[1];
1909
1910         if (!rdev->ops->del_beacon)
1911                 return -EOPNOTSUPP;
1912
1913         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1914             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
1915                 return -EOPNOTSUPP;
1916
1917         return rdev->ops->del_beacon(&rdev->wiphy, dev);
1918 }
1919
1920 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1921         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1922         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1923         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1924         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1925 };
1926
1927 static int parse_station_flags(struct genl_info *info,
1928                                struct station_parameters *params)
1929 {
1930         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1931         struct nlattr *nla;
1932         int flag;
1933
1934         /*
1935          * Try parsing the new attribute first so userspace
1936          * can specify both for older kernels.
1937          */
1938         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1939         if (nla) {
1940                 struct nl80211_sta_flag_update *sta_flags;
1941
1942                 sta_flags = nla_data(nla);
1943                 params->sta_flags_mask = sta_flags->mask;
1944                 params->sta_flags_set = sta_flags->set;
1945                 if ((params->sta_flags_mask |
1946                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1947                         return -EINVAL;
1948                 return 0;
1949         }
1950
1951         /* if present, parse the old attribute */
1952
1953         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1954         if (!nla)
1955                 return 0;
1956
1957         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1958                              nla, sta_flags_policy))
1959                 return -EINVAL;
1960
1961         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1962         params->sta_flags_mask &= ~1;
1963
1964         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1965                 if (flags[flag])
1966                         params->sta_flags_set |= (1<<flag);
1967
1968         return 0;
1969 }
1970
1971 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
1972                                  int attr)
1973 {
1974         struct nlattr *rate;
1975         u16 bitrate;
1976
1977         rate = nla_nest_start(msg, attr);
1978         if (!rate)
1979                 goto nla_put_failure;
1980
1981         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1982         bitrate = cfg80211_calculate_bitrate(info);
1983         if (bitrate > 0)
1984                 NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1985
1986         if (info->flags & RATE_INFO_FLAGS_MCS)
1987                 NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
1988         if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1989                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1990         if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
1991                 NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1992
1993         nla_nest_end(msg, rate);
1994         return true;
1995
1996 nla_put_failure:
1997         return false;
1998 }
1999
2000 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
2001                                 int flags, struct net_device *dev,
2002                                 const u8 *mac_addr, struct station_info *sinfo)
2003 {
2004         void *hdr;
2005         struct nlattr *sinfoattr, *bss_param;
2006
2007         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2008         if (!hdr)
2009                 return -1;
2010
2011         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2012         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
2013
2014         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
2015
2016         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2017         if (!sinfoattr)
2018                 goto nla_put_failure;
2019         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
2020                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2021                             sinfo->inactive_time);
2022         if (sinfo->filled & STATION_INFO_RX_BYTES)
2023                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
2024                             sinfo->rx_bytes);
2025         if (sinfo->filled & STATION_INFO_TX_BYTES)
2026                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
2027                             sinfo->tx_bytes);
2028         if (sinfo->filled & STATION_INFO_LLID)
2029                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
2030                             sinfo->llid);
2031         if (sinfo->filled & STATION_INFO_PLID)
2032                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
2033                             sinfo->plid);
2034         if (sinfo->filled & STATION_INFO_PLINK_STATE)
2035                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
2036                             sinfo->plink_state);
2037         if (sinfo->filled & STATION_INFO_SIGNAL)
2038                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
2039                            sinfo->signal);
2040         if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
2041                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2042                            sinfo->signal_avg);
2043         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2044                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2045                                           NL80211_STA_INFO_TX_BITRATE))
2046                         goto nla_put_failure;
2047         }
2048         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2049                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2050                                           NL80211_STA_INFO_RX_BITRATE))
2051                         goto nla_put_failure;
2052         }
2053         if (sinfo->filled & STATION_INFO_RX_PACKETS)
2054                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
2055                             sinfo->rx_packets);
2056         if (sinfo->filled & STATION_INFO_TX_PACKETS)
2057                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
2058                             sinfo->tx_packets);
2059         if (sinfo->filled & STATION_INFO_TX_RETRIES)
2060                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
2061                             sinfo->tx_retries);
2062         if (sinfo->filled & STATION_INFO_TX_FAILED)
2063                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
2064                             sinfo->tx_failed);
2065         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2066                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2067                 if (!bss_param)
2068                         goto nla_put_failure;
2069
2070                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
2071                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
2072                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
2073                         NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
2074                 if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
2075                         NLA_PUT_FLAG(msg,
2076                                      NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
2077                 NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2078                            sinfo->bss_param.dtim_period);
2079                 NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2080                             sinfo->bss_param.beacon_interval);
2081
2082                 nla_nest_end(msg, bss_param);
2083         }
2084         nla_nest_end(msg, sinfoattr);
2085
2086         return genlmsg_end(msg, hdr);
2087
2088  nla_put_failure:
2089         genlmsg_cancel(msg, hdr);
2090         return -EMSGSIZE;
2091 }
2092
2093 static int nl80211_dump_station(struct sk_buff *skb,
2094                                 struct netlink_callback *cb)
2095 {
2096         struct station_info sinfo;
2097         struct cfg80211_registered_device *dev;
2098         struct net_device *netdev;
2099         u8 mac_addr[ETH_ALEN];
2100         int sta_idx = cb->args[1];
2101         int err;
2102
2103         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2104         if (err)
2105                 return err;
2106
2107         if (!dev->ops->dump_station) {
2108                 err = -EOPNOTSUPP;
2109                 goto out_err;
2110         }
2111
2112         while (1) {
2113                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2114                                              mac_addr, &sinfo);
2115                 if (err == -ENOENT)
2116                         break;
2117                 if (err)
2118                         goto out_err;
2119
2120                 if (nl80211_send_station(skb,
2121                                 NETLINK_CB(cb->skb).pid,
2122                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2123                                 netdev, mac_addr,
2124                                 &sinfo) < 0)
2125                         goto out;
2126
2127                 sta_idx++;
2128         }
2129
2130
2131  out:
2132         cb->args[1] = sta_idx;
2133         err = skb->len;
2134  out_err:
2135         nl80211_finish_netdev_dump(dev);
2136
2137         return err;
2138 }
2139
2140 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2141 {
2142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2143         struct net_device *dev = info->user_ptr[1];
2144         struct station_info sinfo;
2145         struct sk_buff *msg;
2146         u8 *mac_addr = NULL;
2147         int err;
2148
2149         memset(&sinfo, 0, sizeof(sinfo));
2150
2151         if (!info->attrs[NL80211_ATTR_MAC])
2152                 return -EINVAL;
2153
2154         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2155
2156         if (!rdev->ops->get_station)
2157                 return -EOPNOTSUPP;
2158
2159         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2160         if (err)
2161                 return err;
2162
2163         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2164         if (!msg)
2165                 return -ENOMEM;
2166
2167         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
2168                                  dev, mac_addr, &sinfo) < 0) {
2169                 nlmsg_free(msg);
2170                 return -ENOBUFS;
2171         }
2172
2173         return genlmsg_reply(msg, info);
2174 }
2175
2176 /*
2177  * Get vlan interface making sure it is running and on the right wiphy.
2178  */
2179 static int get_vlan(struct genl_info *info,
2180                     struct cfg80211_registered_device *rdev,
2181                     struct net_device **vlan)
2182 {
2183         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2184         *vlan = NULL;
2185
2186         if (vlanattr) {
2187                 *vlan = dev_get_by_index(genl_info_net(info),
2188                                          nla_get_u32(vlanattr));
2189                 if (!*vlan)
2190                         return -ENODEV;
2191                 if (!(*vlan)->ieee80211_ptr)
2192                         return -EINVAL;
2193                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2194                         return -EINVAL;
2195                 if (!netif_running(*vlan))
2196                         return -ENETDOWN;
2197         }
2198         return 0;
2199 }
2200
2201 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2202 {
2203         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2204         int err;
2205         struct net_device *dev = info->user_ptr[1];
2206         struct station_parameters params;
2207         u8 *mac_addr = NULL;
2208
2209         memset(&params, 0, sizeof(params));
2210
2211         params.listen_interval = -1;
2212
2213         if (info->attrs[NL80211_ATTR_STA_AID])
2214                 return -EINVAL;
2215
2216         if (!info->attrs[NL80211_ATTR_MAC])
2217                 return -EINVAL;
2218
2219         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2220
2221         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2222                 params.supported_rates =
2223                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2224                 params.supported_rates_len =
2225                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2226         }
2227
2228         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2229                 params.listen_interval =
2230                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2231
2232         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2233                 params.ht_capa =
2234                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2235
2236         if (parse_station_flags(info, &params))
2237                 return -EINVAL;
2238
2239         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2240                 params.plink_action =
2241                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2242
2243         err = get_vlan(info, rdev, &params.vlan);
2244         if (err)
2245                 goto out;
2246
2247         /* validate settings */
2248         err = 0;
2249
2250         switch (dev->ieee80211_ptr->iftype) {
2251         case NL80211_IFTYPE_AP:
2252         case NL80211_IFTYPE_AP_VLAN:
2253         case NL80211_IFTYPE_P2P_GO:
2254                 /* disallow mesh-specific things */
2255                 if (params.plink_action)
2256                         err = -EINVAL;
2257                 break;
2258         case NL80211_IFTYPE_P2P_CLIENT:
2259         case NL80211_IFTYPE_STATION:
2260                 /* disallow everything but AUTHORIZED flag */
2261                 if (params.plink_action)
2262                         err = -EINVAL;
2263                 if (params.vlan)
2264                         err = -EINVAL;
2265                 if (params.supported_rates)
2266                         err = -EINVAL;
2267                 if (params.ht_capa)
2268                         err = -EINVAL;
2269                 if (params.listen_interval >= 0)
2270                         err = -EINVAL;
2271                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2272                         err = -EINVAL;
2273                 break;
2274         case NL80211_IFTYPE_MESH_POINT:
2275                 /* disallow things mesh doesn't support */
2276                 if (params.vlan)
2277                         err = -EINVAL;
2278                 if (params.ht_capa)
2279                         err = -EINVAL;
2280                 if (params.listen_interval >= 0)
2281                         err = -EINVAL;
2282                 if (params.supported_rates)
2283                         err = -EINVAL;
2284                 if (params.sta_flags_mask)
2285                         err = -EINVAL;
2286                 break;
2287         default:
2288                 err = -EINVAL;
2289         }
2290
2291         if (err)
2292                 goto out;
2293
2294         if (!rdev->ops->change_station) {
2295                 err = -EOPNOTSUPP;
2296                 goto out;
2297         }
2298
2299         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2300
2301  out:
2302         if (params.vlan)
2303                 dev_put(params.vlan);
2304
2305         return err;
2306 }
2307
2308 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2309 {
2310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2311         int err;
2312         struct net_device *dev = info->user_ptr[1];
2313         struct station_parameters params;
2314         u8 *mac_addr = NULL;
2315
2316         memset(&params, 0, sizeof(params));
2317
2318         if (!info->attrs[NL80211_ATTR_MAC])
2319                 return -EINVAL;
2320
2321         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2322                 return -EINVAL;
2323
2324         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2325                 return -EINVAL;
2326
2327         if (!info->attrs[NL80211_ATTR_STA_AID])
2328                 return -EINVAL;
2329
2330         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2331         params.supported_rates =
2332                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2333         params.supported_rates_len =
2334                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2335         params.listen_interval =
2336                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2337
2338         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2339         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2340                 return -EINVAL;
2341
2342         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2343                 params.ht_capa =
2344                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2345
2346         if (parse_station_flags(info, &params))
2347                 return -EINVAL;
2348
2349         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2350             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2351             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2352                 return -EINVAL;
2353
2354         err = get_vlan(info, rdev, &params.vlan);
2355         if (err)
2356                 goto out;
2357
2358         /* validate settings */
2359         err = 0;
2360
2361         if (!rdev->ops->add_station) {
2362                 err = -EOPNOTSUPP;
2363                 goto out;
2364         }
2365
2366         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2367
2368  out:
2369         if (params.vlan)
2370                 dev_put(params.vlan);
2371         return err;
2372 }
2373
2374 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2375 {
2376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2377         struct net_device *dev = info->user_ptr[1];
2378         u8 *mac_addr = NULL;
2379
2380         if (info->attrs[NL80211_ATTR_MAC])
2381                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2382
2383         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2384             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2385             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
2386             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2387                 return -EINVAL;
2388
2389         if (!rdev->ops->del_station)
2390                 return -EOPNOTSUPP;
2391
2392         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2393 }
2394
2395 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2396                                 int flags, struct net_device *dev,
2397                                 u8 *dst, u8 *next_hop,
2398                                 struct mpath_info *pinfo)
2399 {
2400         void *hdr;
2401         struct nlattr *pinfoattr;
2402
2403         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2404         if (!hdr)
2405                 return -1;
2406
2407         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2408         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2409         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2410
2411         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2412
2413         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2414         if (!pinfoattr)
2415                 goto nla_put_failure;
2416         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2417                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2418                             pinfo->frame_qlen);
2419         if (pinfo->filled & MPATH_INFO_SN)
2420                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2421                             pinfo->sn);
2422         if (pinfo->filled & MPATH_INFO_METRIC)
2423                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2424                             pinfo->metric);
2425         if (pinfo->filled & MPATH_INFO_EXPTIME)
2426                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2427                             pinfo->exptime);
2428         if (pinfo->filled & MPATH_INFO_FLAGS)
2429                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2430                             pinfo->flags);
2431         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2432                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2433                             pinfo->discovery_timeout);
2434         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2435                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2436                             pinfo->discovery_retries);
2437
2438         nla_nest_end(msg, pinfoattr);
2439
2440         return genlmsg_end(msg, hdr);
2441
2442  nla_put_failure:
2443         genlmsg_cancel(msg, hdr);
2444         return -EMSGSIZE;
2445 }
2446
2447 static int nl80211_dump_mpath(struct sk_buff *skb,
2448                               struct netlink_callback *cb)
2449 {
2450         struct mpath_info pinfo;
2451         struct cfg80211_registered_device *dev;
2452         struct net_device *netdev;
2453         u8 dst[ETH_ALEN];
2454         u8 next_hop[ETH_ALEN];
2455         int path_idx = cb->args[1];
2456         int err;
2457
2458         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2459         if (err)
2460                 return err;
2461
2462         if (!dev->ops->dump_mpath) {
2463                 err = -EOPNOTSUPP;
2464                 goto out_err;
2465         }
2466
2467         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2468                 err = -EOPNOTSUPP;
2469                 goto out_err;
2470         }
2471
2472         while (1) {
2473                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2474                                            dst, next_hop, &pinfo);
2475                 if (err == -ENOENT)
2476                         break;
2477                 if (err)
2478                         goto out_err;
2479
2480                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2481                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2482                                        netdev, dst, next_hop,
2483                                        &pinfo) < 0)
2484                         goto out;
2485
2486                 path_idx++;
2487         }
2488
2489
2490  out:
2491         cb->args[1] = path_idx;
2492         err = skb->len;
2493  out_err:
2494         nl80211_finish_netdev_dump(dev);
2495         return err;
2496 }
2497
2498 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2499 {
2500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2501         int err;
2502         struct net_device *dev = info->user_ptr[1];
2503         struct mpath_info pinfo;
2504         struct sk_buff *msg;
2505         u8 *dst = NULL;
2506         u8 next_hop[ETH_ALEN];
2507
2508         memset(&pinfo, 0, sizeof(pinfo));
2509
2510         if (!info->attrs[NL80211_ATTR_MAC])
2511                 return -EINVAL;
2512
2513         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2514
2515         if (!rdev->ops->get_mpath)
2516                 return -EOPNOTSUPP;
2517
2518         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2519                 return -EOPNOTSUPP;
2520
2521         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2522         if (err)
2523                 return err;
2524
2525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2526         if (!msg)
2527                 return -ENOMEM;
2528
2529         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2530                                  dev, dst, next_hop, &pinfo) < 0) {
2531                 nlmsg_free(msg);
2532                 return -ENOBUFS;
2533         }
2534
2535         return genlmsg_reply(msg, info);
2536 }
2537
2538 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2539 {
2540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2541         struct net_device *dev = info->user_ptr[1];
2542         u8 *dst = NULL;
2543         u8 *next_hop = NULL;
2544
2545         if (!info->attrs[NL80211_ATTR_MAC])
2546                 return -EINVAL;
2547
2548         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2549                 return -EINVAL;
2550
2551         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2552         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2553
2554         if (!rdev->ops->change_mpath)
2555                 return -EOPNOTSUPP;
2556
2557         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2558                 return -EOPNOTSUPP;
2559
2560         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2561 }
2562
2563 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2564 {
2565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2566         struct net_device *dev = info->user_ptr[1];
2567         u8 *dst = NULL;
2568         u8 *next_hop = NULL;
2569
2570         if (!info->attrs[NL80211_ATTR_MAC])
2571                 return -EINVAL;
2572
2573         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2574                 return -EINVAL;
2575
2576         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2577         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2578
2579         if (!rdev->ops->add_mpath)
2580                 return -EOPNOTSUPP;
2581
2582         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
2583                 return -EOPNOTSUPP;
2584
2585         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2586 }
2587
2588 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2589 {
2590         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2591         struct net_device *dev = info->user_ptr[1];
2592         u8 *dst = NULL;
2593
2594         if (info->attrs[NL80211_ATTR_MAC])
2595                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2596
2597         if (!rdev->ops->del_mpath)
2598                 return -EOPNOTSUPP;
2599
2600         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2601 }
2602
2603 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2604 {
2605         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2606         struct net_device *dev = info->user_ptr[1];
2607         struct bss_parameters params;
2608
2609         memset(&params, 0, sizeof(params));
2610         /* default to not changing parameters */
2611         params.use_cts_prot = -1;
2612         params.use_short_preamble = -1;
2613         params.use_short_slot_time = -1;
2614         params.ap_isolate = -1;
2615         params.ht_opmode = -1;
2616
2617         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2618                 params.use_cts_prot =
2619                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2620         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2621                 params.use_short_preamble =
2622                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2623         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2624                 params.use_short_slot_time =
2625                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2626         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2627                 params.basic_rates =
2628                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2629                 params.basic_rates_len =
2630                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2631         }
2632         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2633                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2634         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
2635                 params.ht_opmode =
2636                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
2637
2638         if (!rdev->ops->change_bss)
2639                 return -EOPNOTSUPP;
2640
2641         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2642             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2643                 return -EOPNOTSUPP;
2644
2645         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2646 }
2647
2648 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2649         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2650         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2651         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2652         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2653         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2654         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2655 };
2656
2657 static int parse_reg_rule(struct nlattr *tb[],
2658         struct ieee80211_reg_rule *reg_rule)
2659 {
2660         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2661         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2662
2663         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2664                 return -EINVAL;
2665         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2666                 return -EINVAL;
2667         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2668                 return -EINVAL;
2669         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2670                 return -EINVAL;
2671         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2672                 return -EINVAL;
2673
2674         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2675
2676         freq_range->start_freq_khz =
2677                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2678         freq_range->end_freq_khz =
2679                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2680         freq_range->max_bandwidth_khz =
2681                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2682
2683         power_rule->max_eirp =
2684                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2685
2686         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2687                 power_rule->max_antenna_gain =
2688                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2689
2690         return 0;
2691 }
2692
2693 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2694 {
2695         int r;
2696         char *data = NULL;
2697
2698         /*
2699          * You should only get this when cfg80211 hasn't yet initialized
2700          * completely when built-in to the kernel right between the time
2701          * window between nl80211_init() and regulatory_init(), if that is
2702          * even possible.
2703          */
2704         mutex_lock(&cfg80211_mutex);
2705         if (unlikely(!cfg80211_regdomain)) {
2706                 mutex_unlock(&cfg80211_mutex);
2707                 return -EINPROGRESS;
2708         }
2709         mutex_unlock(&cfg80211_mutex);
2710
2711         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2712                 return -EINVAL;
2713
2714         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2715
2716         r = regulatory_hint_user(data);
2717
2718         return r;
2719 }
2720
2721 static int nl80211_get_mesh_config(struct sk_buff *skb,
2722                                    struct genl_info *info)
2723 {
2724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2725         struct net_device *dev = info->user_ptr[1];
2726         struct wireless_dev *wdev = dev->ieee80211_ptr;
2727         struct mesh_config cur_params;
2728         int err = 0;
2729         void *hdr;
2730         struct nlattr *pinfoattr;
2731         struct sk_buff *msg;
2732
2733         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2734                 return -EOPNOTSUPP;
2735
2736         if (!rdev->ops->get_mesh_config)
2737                 return -EOPNOTSUPP;
2738
2739         wdev_lock(wdev);
2740         /* If not connected, get default parameters */
2741         if (!wdev->mesh_id_len)
2742                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
2743         else
2744                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
2745                                                  &cur_params);
2746         wdev_unlock(wdev);
2747
2748         if (err)
2749                 return err;
2750
2751         /* Draw up a netlink message to send back */
2752         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2753         if (!msg)
2754                 return -ENOMEM;
2755         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2756                              NL80211_CMD_GET_MESH_CONFIG);
2757         if (!hdr)
2758                 goto out;
2759         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
2760         if (!pinfoattr)
2761                 goto nla_put_failure;
2762         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2763         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2764                         cur_params.dot11MeshRetryTimeout);
2765         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2766                         cur_params.dot11MeshConfirmTimeout);
2767         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2768                         cur_params.dot11MeshHoldingTimeout);
2769         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2770                         cur_params.dot11MeshMaxPeerLinks);
2771         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2772                         cur_params.dot11MeshMaxRetries);
2773         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2774                         cur_params.dot11MeshTTL);
2775         NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
2776                         cur_params.element_ttl);
2777         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2778                         cur_params.auto_open_plinks);
2779         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2780                         cur_params.dot11MeshHWMPmaxPREQretries);
2781         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2782                         cur_params.path_refresh_time);
2783         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2784                         cur_params.min_discovery_timeout);
2785         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2786                         cur_params.dot11MeshHWMPactivePathTimeout);
2787         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2788                         cur_params.dot11MeshHWMPpreqMinInterval);
2789         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2790                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2791         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2792                         cur_params.dot11MeshHWMPRootMode);
2793         nla_nest_end(msg, pinfoattr);
2794         genlmsg_end(msg, hdr);
2795         return genlmsg_reply(msg, info);
2796
2797  nla_put_failure:
2798         genlmsg_cancel(msg, hdr);
2799  out:
2800         nlmsg_free(msg);
2801         return -ENOBUFS;
2802 }
2803
2804 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2805         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2806         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2807         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2808         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2809         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2810         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2811         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
2812         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2813
2814         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2815         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2816         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2817         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2818         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2819         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2820 };
2821
2822 static const struct nla_policy
2823         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
2824         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
2825         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
2826         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
2827                 .len = IEEE80211_MAX_DATA_LEN },
2828 };
2829
2830 static int nl80211_parse_mesh_config(struct genl_info *info,
2831                                      struct mesh_config *cfg,
2832                                      u32 *mask_out)
2833 {
2834         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2835         u32 mask = 0;
2836
2837 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2838 do {\
2839         if (table[attr_num]) {\
2840                 cfg->param = nla_fn(table[attr_num]); \
2841                 mask |= (1 << (attr_num - 1)); \
2842         } \
2843 } while (0);\
2844
2845
2846         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
2847                 return -EINVAL;
2848         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2849                              info->attrs[NL80211_ATTR_MESH_CONFIG],
2850                              nl80211_meshconf_params_policy))
2851                 return -EINVAL;
2852
2853         /* This makes sure that there aren't more than 32 mesh config
2854          * parameters (otherwise our bitfield scheme would not work.) */
2855         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2856
2857         /* Fill in the params struct */
2858         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2859                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2860         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2861                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2862         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2863                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2864         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2865                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2866         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2867                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2868         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2869                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
2871                         mask, NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
2872         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2873                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2875                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2876                         nla_get_u8);
2877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2878                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2879         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2880                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2881                         nla_get_u16);
2882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2883                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2884                         nla_get_u32);
2885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2886                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2887                         nla_get_u16);
2888         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2889                         dot11MeshHWMPnetDiameterTraversalTime,
2890                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2891                         nla_get_u16);
2892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2893                         dot11MeshHWMPRootMode, mask,
2894                         NL80211_MESHCONF_HWMP_ROOTMODE,
2895                         nla_get_u8);
2896         if (mask_out)
2897                 *mask_out = mask;
2898
2899         return 0;
2900
2901 #undef FILL_IN_MESH_PARAM_IF_SET
2902 }
2903
2904 static int nl80211_parse_mesh_setup(struct genl_info *info,
2905                                      struct mesh_setup *setup)
2906 {
2907         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
2908
2909         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
2910                 return -EINVAL;
2911         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
2912                              info->attrs[NL80211_ATTR_MESH_SETUP],
2913                              nl80211_mesh_setup_params_policy))
2914                 return -EINVAL;
2915
2916         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
2917                 setup->path_sel_proto =
2918                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
2919                  IEEE80211_PATH_PROTOCOL_VENDOR :
2920                  IEEE80211_PATH_PROTOCOL_HWMP;
2921
2922         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
2923                 setup->path_metric =
2924                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
2925                  IEEE80211_PATH_METRIC_VENDOR :
2926                  IEEE80211_PATH_METRIC_AIRTIME;
2927
2928
2929         if (tb[NL80211_MESH_SETUP_IE]) {
2930                 struct nlattr *ieattr =
2931                         tb[NL80211_MESH_SETUP_IE];
2932                 if (!is_valid_ie_attr(ieattr))
2933                         return -EINVAL;
2934                 setup->ie = nla_data(ieattr);
2935                 setup->ie_len = nla_len(ieattr);
2936         }
2937
2938         return 0;
2939 }
2940
2941 static int nl80211_update_mesh_config(struct sk_buff *skb,
2942                                       struct genl_info *info)
2943 {
2944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2945         struct net_device *dev = info->user_ptr[1];
2946         struct wireless_dev *wdev = dev->ieee80211_ptr;
2947         struct mesh_config cfg;
2948         u32 mask;
2949         int err;
2950
2951         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
2952                 return -EOPNOTSUPP;
2953
2954         if (!rdev->ops->update_mesh_config)
2955                 return -EOPNOTSUPP;
2956
2957         err = nl80211_parse_mesh_config(info, &cfg, &mask);
2958         if (err)
2959                 return err;
2960
2961         wdev_lock(wdev);
2962         if (!wdev->mesh_id_len)
2963                 err = -ENOLINK;
2964
2965         if (!err)
2966                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
2967                                                     mask, &cfg);
2968
2969         wdev_unlock(wdev);
2970
2971         return err;
2972 }
2973
2974 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2975 {
2976         struct sk_buff *msg;
2977         void *hdr = NULL;
2978         struct nlattr *nl_reg_rules;
2979         unsigned int i;
2980         int err = -EINVAL;
2981
2982         mutex_lock(&cfg80211_mutex);
2983
2984         if (!cfg80211_regdomain)
2985                 goto out;
2986
2987         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2988         if (!msg) {
2989                 err = -ENOBUFS;
2990                 goto out;
2991         }
2992
2993         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2994                              NL80211_CMD_GET_REG);
2995         if (!hdr)
2996                 goto put_failure;
2997
2998         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2999                 cfg80211_regdomain->alpha2);
3000
3001         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
3002         if (!nl_reg_rules)
3003                 goto nla_put_failure;
3004
3005         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
3006                 struct nlattr *nl_reg_rule;
3007                 const struct ieee80211_reg_rule *reg_rule;
3008                 const struct ieee80211_freq_range *freq_range;
3009                 const struct ieee80211_power_rule *power_rule;
3010
3011                 reg_rule = &cfg80211_regdomain->reg_rules[i];
3012                 freq_range = &reg_rule->freq_range;
3013                 power_rule = &reg_rule->power_rule;
3014
3015                 nl_reg_rule = nla_nest_start(msg, i);
3016                 if (!nl_reg_rule)
3017                         goto nla_put_failure;
3018
3019                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
3020                         reg_rule->flags);
3021                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
3022                         freq_range->start_freq_khz);
3023                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
3024                         freq_range->end_freq_khz);
3025                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
3026                         freq_range->max_bandwidth_khz);
3027                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
3028                         power_rule->max_antenna_gain);
3029                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
3030                         power_rule->max_eirp);
3031
3032                 nla_nest_end(msg, nl_reg_rule);
3033         }
3034
3035         nla_nest_end(msg, nl_reg_rules);
3036
3037         genlmsg_end(msg, hdr);
3038         err = genlmsg_reply(msg, info);
3039         goto out;
3040
3041 nla_put_failure:
3042         genlmsg_cancel(msg, hdr);
3043 put_failure:
3044         nlmsg_free(msg);
3045         err = -EMSGSIZE;
3046 out:
3047         mutex_unlock(&cfg80211_mutex);
3048         return err;
3049 }
3050
3051 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
3052 {
3053         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
3054         struct nlattr *nl_reg_rule;
3055         char *alpha2 = NULL;
3056         int rem_reg_rules = 0, r = 0;
3057         u32 num_rules = 0, rule_idx = 0, size_of_regd;
3058         struct ieee80211_regdomain *rd = NULL;
3059
3060         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3061                 return -EINVAL;
3062
3063         if (!info->attrs[NL80211_ATTR_REG_RULES])
3064                 return -EINVAL;
3065
3066         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3067
3068         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3069                         rem_reg_rules) {
3070                 num_rules++;
3071                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
3072                         return -EINVAL;
3073         }
3074
3075         mutex_lock(&cfg80211_mutex);
3076
3077         if (!reg_is_valid_request(alpha2)) {
3078                 r = -EINVAL;
3079                 goto bad_reg;
3080         }
3081
3082         size_of_regd = sizeof(struct ieee80211_regdomain) +
3083                 (num_rules * sizeof(struct ieee80211_reg_rule));
3084
3085         rd = kzalloc(size_of_regd, GFP_KERNEL);
3086         if (!rd) {
3087                 r = -ENOMEM;
3088                 goto bad_reg;
3089         }
3090
3091         rd->n_reg_rules = num_rules;
3092         rd->alpha2[0] = alpha2[0];
3093         rd->alpha2[1] = alpha2[1];
3094
3095         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3096                         rem_reg_rules) {
3097                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3098                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3099                         reg_rule_policy);
3100                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3101                 if (r)
3102                         goto bad_reg;
3103
3104                 rule_idx++;
3105
3106                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3107                         r = -EINVAL;
3108                         goto bad_reg;
3109                 }
3110         }
3111
3112         BUG_ON(rule_idx != num_rules);
3113
3114         r = set_regdom(rd);
3115
3116         mutex_unlock(&cfg80211_mutex);
3117
3118         return r;
3119
3120  bad_reg:
3121         mutex_unlock(&cfg80211_mutex);
3122         kfree(rd);
3123         return r;
3124 }
3125
3126 static int validate_scan_freqs(struct nlattr *freqs)
3127 {
3128         struct nlattr *attr1, *attr2;
3129         int n_channels = 0, tmp1, tmp2;
3130
3131         nla_for_each_nested(attr1, freqs, tmp1) {
3132                 n_channels++;
3133                 /*
3134                  * Some hardware has a limited channel list for
3135                  * scanning, and it is pretty much nonsensical
3136                  * to scan for a channel twice, so disallow that
3137                  * and don't require drivers to check that the
3138                  * channel list they get isn't longer than what
3139                  * they can scan, as long as they can scan all
3140                  * the channels they registered at once.
3141                  */
3142                 nla_for_each_nested(attr2, freqs, tmp2)
3143                         if (attr1 != attr2 &&
3144                             nla_get_u32(attr1) == nla_get_u32(attr2))
3145                                 return 0;
3146         }
3147
3148         return n_channels;
3149 }
3150
3151 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3152 {
3153         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3154         struct net_device *dev = info->user_ptr[1];
3155         struct cfg80211_scan_request *request;
3156         struct cfg80211_ssid *ssid;
3157         struct ieee80211_channel *channel;
3158         struct nlattr *attr;
3159         struct wiphy *wiphy;
3160         int err, tmp, n_ssids = 0, n_channels, i;
3161         enum ieee80211_band band;
3162         size_t ie_len;
3163
3164         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3165                 return -EINVAL;
3166
3167         wiphy = &rdev->wiphy;
3168
3169         if (!rdev->ops->scan)
3170                 return -EOPNOTSUPP;
3171
3172         if (rdev->scan_req)
3173                 return -EBUSY;
3174
3175         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3176                 n_channels = validate_scan_freqs(
3177                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3178                 if (!n_channels)
3179                         return -EINVAL;
3180         } else {
3181                 n_channels = 0;
3182
3183                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3184                         if (wiphy->bands[band])
3185                                 n_channels += wiphy->bands[band]->n_channels;
3186         }
3187
3188         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3189                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3190                         n_ssids++;
3191
3192         if (n_ssids > wiphy->max_scan_ssids)
3193                 return -EINVAL;
3194
3195         if (info->attrs[NL80211_ATTR_IE])
3196                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3197         else
3198                 ie_len = 0;
3199
3200         if (ie_len > wiphy->max_scan_ie_len)
3201                 return -EINVAL;
3202
3203         request = kzalloc(sizeof(*request)
3204                         + sizeof(*ssid) * n_ssids
3205                         + sizeof(channel) * n_channels
3206                         + ie_len, GFP_KERNEL);
3207         if (!request)
3208                 return -ENOMEM;
3209
3210         if (n_ssids)
3211                 request->ssids = (void *)&request->channels[n_channels];
3212         request->n_ssids = n_ssids;
3213         if (ie_len) {
3214                 if (request->ssids)
3215                         request->ie = (void *)(request->ssids + n_ssids);
3216                 else
3217                         request->ie = (void *)(request->channels + n_channels);
3218         }
3219
3220         i = 0;
3221         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3222                 /* user specified, bail out if channel not found */
3223                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3224                         struct ieee80211_channel *chan;
3225
3226                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3227
3228                         if (!chan) {
3229                                 err = -EINVAL;
3230                                 goto out_free;
3231                         }
3232
3233                         /* ignore disabled channels */
3234                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3235                                 continue;
3236
3237                         request->channels[i] = chan;
3238                         i++;
3239                 }
3240         } else {
3241                 /* all channels */
3242                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3243                         int j;
3244                         if (!wiphy->bands[band])
3245                                 continue;
3246                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3247                                 struct ieee80211_channel *chan;
3248
3249                                 chan = &wiphy->bands[band]->channels[j];
3250
3251                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3252                                         continue;
3253
3254                                 request->channels[i] = chan;
3255                                 i++;
3256                         }
3257                 }
3258         }
3259
3260         if (!i) {
3261                 err = -EINVAL;
3262                 goto out_free;
3263         }
3264
3265         request->n_channels = i;
3266
3267         i = 0;
3268         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3269                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3270                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3271                                 err = -EINVAL;
3272                                 goto out_free;
3273                         }
3274                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3275                         request->ssids[i].ssid_len = nla_len(attr);
3276                         i++;
3277                 }
3278         }
3279
3280         if (info->attrs[NL80211_ATTR_IE]) {
3281                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3282                 memcpy((void *)request->ie,
3283                        nla_data(info->attrs[NL80211_ATTR_IE]),
3284                        request->ie_len);
3285         }
3286
3287         request->dev = dev;
3288         request->wiphy = &rdev->wiphy;
3289
3290         rdev->scan_req = request;
3291         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3292
3293         if (!err) {
3294                 nl80211_send_scan_start(rdev, dev);
3295                 dev_hold(dev);
3296         } else {
3297  out_free:
3298                 rdev->scan_req = NULL;
3299                 kfree(request);
3300         }
3301
3302         return err;
3303 }
3304
3305 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3306                             struct cfg80211_registered_device *rdev,
3307                             struct wireless_dev *wdev,
3308                             struct cfg80211_internal_bss *intbss)
3309 {
3310         struct cfg80211_bss *res = &intbss->pub;
3311         void *hdr;
3312         struct nlattr *bss;
3313         int i;
3314
3315         ASSERT_WDEV_LOCK(wdev);
3316
3317         hdr = nl80211hdr_put(msg, pid, seq, flags,
3318                              NL80211_CMD_NEW_SCAN_RESULTS);
3319         if (!hdr)
3320                 return -1;
3321
3322         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3323         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3324
3325         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3326         if (!bss)
3327                 goto nla_put_failure;
3328         if (!is_zero_ether_addr(res->bssid))
3329                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3330         if (res->information_elements && res->len_information_elements)
3331                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3332                         res->len_information_elements,
3333                         res->information_elements);
3334         if (res->beacon_ies && res->len_beacon_ies &&
3335             res->beacon_ies != res->information_elements)
3336                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3337                         res->len_beacon_ies, res->beacon_ies);
3338         if (res->tsf)
3339                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3340         if (res->beacon_interval)
3341                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3342         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3343         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3344         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3345                 jiffies_to_msecs(jiffies - intbss->ts));
3346
3347         switch (rdev->wiphy.signal_type) {
3348         case CFG80211_SIGNAL_TYPE_MBM:
3349                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3350                 break;
3351         case CFG80211_SIGNAL_TYPE_UNSPEC:
3352                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3353                 break;
3354         default:
3355                 break;
3356         }
3357
3358         switch (wdev->iftype) {
3359         case NL80211_IFTYPE_P2P_CLIENT:
3360         case NL80211_IFTYPE_STATION:
3361                 if (intbss == wdev->current_bss)
3362                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3363                                     NL80211_BSS_STATUS_ASSOCIATED);
3364                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3365                         if (intbss != wdev->auth_bsses[i])
3366                                 continue;
3367                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3368                                     NL80211_BSS_STATUS_AUTHENTICATED);
3369                         break;
3370                 }
3371                 break;
3372         case NL80211_IFTYPE_ADHOC:
3373                 if (intbss == wdev->current_bss)
3374                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3375                                     NL80211_BSS_STATUS_IBSS_JOINED);
3376                 break;
3377         default:
3378                 break;
3379         }
3380
3381         nla_nest_end(msg, bss);
3382
3383         return genlmsg_end(msg, hdr);
3384
3385  nla_put_failure:
3386         genlmsg_cancel(msg, hdr);
3387         return -EMSGSIZE;
3388 }
3389
3390 static int nl80211_dump_scan(struct sk_buff *skb,
3391                              struct netlink_callback *cb)
3392 {
3393         struct cfg80211_registered_device *rdev;
3394         struct net_device *dev;
3395         struct cfg80211_internal_bss *scan;
3396         struct wireless_dev *wdev;
3397         int start = cb->args[1], idx = 0;
3398         int err;
3399
3400         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
3401         if (err)
3402                 return err;
3403
3404         wdev = dev->ieee80211_ptr;
3405
3406         wdev_lock(wdev);
3407         spin_lock_bh(&rdev->bss_lock);
3408         cfg80211_bss_expire(rdev);
3409
3410         list_for_each_entry(scan, &rdev->bss_list, list) {
3411                 if (++idx <= start)
3412                         continue;
3413                 if (nl80211_send_bss(skb,
3414                                 NETLINK_CB(cb->skb).pid,
3415                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3416                                 rdev, wdev, scan) < 0) {
3417                         idx--;
3418                         break;
3419                 }
3420         }
3421
3422         spin_unlock_bh(&rdev->bss_lock);
3423         wdev_unlock(wdev);
3424
3425         cb->args[1] = idx;
3426         nl80211_finish_netdev_dump(rdev);
3427
3428         return skb->len;
3429 }
3430
3431 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3432                                 int flags, struct net_device *dev,
3433                                 struct survey_info *survey)
3434 {
3435         void *hdr;
3436         struct nlattr *infoattr;
3437
3438         /* Survey without a channel doesn't make sense */
3439         if (!survey->channel)
3440                 return -EINVAL;
3441
3442         hdr = nl80211hdr_put(msg, pid, seq, flags,
3443                              NL80211_CMD_NEW_SURVEY_RESULTS);
3444         if (!hdr)
3445                 return -ENOMEM;
3446
3447         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3448
3449         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3450         if (!infoattr)
3451                 goto nla_put_failure;
3452
3453         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3454                     survey->channel->center_freq);
3455         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3456                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3457                             survey->noise);
3458         if (survey->filled & SURVEY_INFO_IN_USE)
3459                 NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
3460         if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
3461                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
3462                             survey->channel_time);
3463         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
3464                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
3465                             survey->channel_time_busy);
3466         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
3467                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
3468                             survey->channel_time_ext_busy);
3469         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
3470                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
3471                             survey->channel_time_rx);
3472         if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
3473                 NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
3474                             survey->channel_time_tx);
3475
3476         nla_nest_end(msg, infoattr);
3477
3478         return genlmsg_end(msg, hdr);
3479
3480  nla_put_failure:
3481         genlmsg_cancel(msg, hdr);
3482         return -EMSGSIZE;
3483 }
3484
3485 static int nl80211_dump_survey(struct sk_buff *skb,
3486                         struct netlink_callback *cb)
3487 {
3488         struct survey_info survey;
3489         struct cfg80211_registered_device *dev;
3490         struct net_device *netdev;
3491         int survey_idx = cb->args[1];
3492         int res;
3493
3494         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3495         if (res)
3496                 return res;
3497
3498         if (!dev->ops->dump_survey) {
3499                 res = -EOPNOTSUPP;
3500                 goto out_err;
3501         }
3502
3503         while (1) {
3504                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3505                                             &survey);
3506                 if (res == -ENOENT)
3507                         break;
3508                 if (res)
3509                         goto out_err;
3510
3511                 if (nl80211_send_survey(skb,
3512                                 NETLINK_CB(cb->skb).pid,
3513                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3514                                 netdev,
3515                                 &survey) < 0)
3516                         goto out;
3517                 survey_idx++;
3518         }
3519
3520  out:
3521         cb->args[1] = survey_idx;
3522         res = skb->len;
3523  out_err:
3524         nl80211_finish_netdev_dump(dev);
3525         return res;
3526 }
3527
3528 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3529 {
3530         return auth_type <= NL80211_AUTHTYPE_MAX;
3531 }
3532
3533 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3534 {
3535         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3536                                   NL80211_WPA_VERSION_2));
3537 }
3538
3539 static bool nl80211_valid_akm_suite(u32 akm)
3540 {
3541         return akm == WLAN_AKM_SUITE_8021X ||
3542                 akm == WLAN_AKM_SUITE_PSK;
3543 }
3544
3545 static bool nl80211_valid_cipher_suite(u32 cipher)
3546 {
3547         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3548                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3549                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3550                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3551                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3552 }
3553
3554
3555 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3556 {
3557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3558         struct net_device *dev = info->user_ptr[1];
3559         struct ieee80211_channel *chan;
3560         const u8 *bssid, *ssid, *ie = NULL;
3561         int err, ssid_len, ie_len = 0;
3562         enum nl80211_auth_type auth_type;
3563         struct key_parse key;
3564         bool local_state_change;
3565
3566         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3567                 return -EINVAL;
3568
3569         if (!info->attrs[NL80211_ATTR_MAC])
3570                 return -EINVAL;
3571
3572         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3573                 return -EINVAL;
3574
3575         if (!info->attrs[NL80211_ATTR_SSID])
3576                 return -EINVAL;
3577
3578         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3579                 return -EINVAL;
3580
3581         err = nl80211_parse_key(info, &key);
3582         if (err)
3583                 return err;
3584
3585         if (key.idx >= 0) {
3586                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
3587                         return -EINVAL;
3588                 if (!key.p.key || !key.p.key_len)
3589                         return -EINVAL;
3590                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3591                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3592                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3593                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3594                         return -EINVAL;
3595                 if (key.idx > 4)
3596                         return -EINVAL;
3597         } else {
3598                 key.p.key_len = 0;
3599                 key.p.key = NULL;
3600         }
3601
3602         if (key.idx >= 0) {
3603                 int i;
3604                 bool ok = false;
3605                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
3606                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
3607                                 ok = true;
3608                                 break;
3609                         }
3610                 }
3611                 if (!ok)
3612                         return -EINVAL;
3613         }
3614
3615         if (!rdev->ops->auth)
3616                 return -EOPNOTSUPP;
3617
3618         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3619             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3620                 return -EOPNOTSUPP;
3621
3622         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3623         chan = ieee80211_get_channel(&rdev->wiphy,
3624                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3625         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3626                 return -EINVAL;
3627
3628         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3629         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3630
3631         if (info->attrs[NL80211_ATTR_IE]) {
3632                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3633                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3634         }
3635
3636         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3637         if (!nl80211_valid_auth_type(auth_type))
3638                 return -EINVAL;
3639
3640         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3641
3642         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3643                                   ssid, ssid_len, ie, ie_len,
3644                                   key.p.key, key.p.key_len, key.idx,
3645                                   local_state_change);
3646 }
3647
3648 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
3649                                    struct genl_info *info,
3650                                    struct cfg80211_crypto_settings *settings,
3651                                    int cipher_limit)
3652 {
3653         memset(settings, 0, sizeof(*settings));
3654
3655         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3656
3657         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
3658                 u16 proto;
3659                 proto = nla_get_u16(
3660                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3661                 settings->control_port_ethertype = cpu_to_be16(proto);
3662                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
3663                     proto != ETH_P_PAE)
3664                         return -EINVAL;
3665                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
3666                         settings->control_port_no_encrypt = true;
3667         } else
3668                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
3669
3670         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3671                 void *data;
3672                 int len, i;
3673
3674                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3675                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3676                 settings->n_ciphers_pairwise = len / sizeof(u32);
3677
3678                 if (len % sizeof(u32))
3679                         return -EINVAL;
3680
3681                 if (settings->n_ciphers_pairwise > cipher_limit)
3682                         return -EINVAL;
3683
3684                 memcpy(settings->ciphers_pairwise, data, len);
3685
3686                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3687                         if (!nl80211_valid_cipher_suite(
3688                                         settings->ciphers_pairwise[i]))
3689                                 return -EINVAL;
3690         }
3691
3692         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3693                 settings->cipher_group =
3694                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3695                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3696                         return -EINVAL;
3697         }
3698
3699         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3700                 settings->wpa_versions =
3701                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3702                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3703                         return -EINVAL;
3704         }
3705
3706         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3707                 void *data;
3708                 int len, i;
3709
3710                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3711                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3712                 settings->n_akm_suites = len / sizeof(u32);
3713
3714                 if (len % sizeof(u32))
3715                         return -EINVAL;
3716
3717                 memcpy(settings->akm_suites, data, len);
3718
3719                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3720                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3721                                 return -EINVAL;
3722         }
3723
3724         return 0;
3725 }
3726
3727 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3728 {
3729         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3730         struct net_device *dev = info->user_ptr[1];
3731         struct cfg80211_crypto_settings crypto;
3732         struct ieee80211_channel *chan;
3733         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3734         int err, ssid_len, ie_len = 0;
3735         bool use_mfp = false;
3736
3737         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3738                 return -EINVAL;
3739
3740         if (!info->attrs[NL80211_ATTR_MAC] ||
3741             !info->attrs[NL80211_ATTR_SSID] ||
3742             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3743                 return -EINVAL;
3744
3745         if (!rdev->ops->assoc)
3746                 return -EOPNOTSUPP;
3747
3748         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3749             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3750                 return -EOPNOTSUPP;
3751
3752         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3753
3754         chan = ieee80211_get_channel(&rdev->wiphy,
3755                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3756         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
3757                 return -EINVAL;
3758
3759         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3760         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3761
3762         if (info->attrs[NL80211_ATTR_IE]) {
3763                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3764                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3765         }
3766
3767         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3768                 enum nl80211_mfp mfp =
3769                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3770                 if (mfp == NL80211_MFP_REQUIRED)
3771                         use_mfp = true;
3772                 else if (mfp != NL80211_MFP_NO)
3773                         return -EINVAL;
3774         }
3775
3776         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3777                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3778
3779         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
3780         if (!err)
3781                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3782                                           ssid, ssid_len, ie, ie_len, use_mfp,
3783                                           &crypto);
3784
3785         return err;
3786 }
3787
3788 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3789 {
3790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3791         struct net_device *dev = info->user_ptr[1];
3792         const u8 *ie = NULL, *bssid;
3793         int ie_len = 0;
3794         u16 reason_code;
3795         bool local_state_change;
3796
3797         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3798                 return -EINVAL;
3799
3800         if (!info->attrs[NL80211_ATTR_MAC])
3801                 return -EINVAL;
3802
3803         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3804                 return -EINVAL;
3805
3806         if (!rdev->ops->deauth)
3807                 return -EOPNOTSUPP;
3808
3809         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3810             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3811                 return -EOPNOTSUPP;
3812
3813         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3814
3815         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3816         if (reason_code == 0) {
3817                 /* Reason Code 0 is reserved */
3818                 return -EINVAL;
3819         }
3820
3821         if (info->attrs[NL80211_ATTR_IE]) {
3822                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3823                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3824         }
3825
3826         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3827
3828         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3829                                     local_state_change);
3830 }
3831
3832 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3833 {
3834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3835         struct net_device *dev = info->user_ptr[1];
3836         const u8 *ie = NULL, *bssid;
3837         int ie_len = 0;
3838         u16 reason_code;
3839         bool local_state_change;
3840
3841         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3842                 return -EINVAL;
3843
3844         if (!info->attrs[NL80211_ATTR_MAC])
3845                 return -EINVAL;
3846
3847         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3848                 return -EINVAL;
3849
3850         if (!rdev->ops->disassoc)
3851                 return -EOPNOTSUPP;
3852
3853         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
3854             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
3855                 return -EOPNOTSUPP;
3856
3857         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3858
3859         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3860         if (reason_code == 0) {
3861                 /* Reason Code 0 is reserved */
3862                 return -EINVAL;
3863         }
3864
3865         if (info->attrs[NL80211_ATTR_IE]) {
3866                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3867                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3868         }
3869
3870         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3871
3872         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3873                                       local_state_change);
3874 }
3875
3876 static bool
3877 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
3878                          int mcast_rate[IEEE80211_NUM_BANDS],
3879                          int rateval)
3880 {
3881         struct wiphy *wiphy = &rdev->wiphy;
3882         bool found = false;
3883         int band, i;
3884
3885         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3886                 struct ieee80211_supported_band *sband;
3887
3888                 sband = wiphy->bands[band];
3889                 if (!sband)
3890                         continue;
3891
3892                 for (i = 0; i < sband->n_bitrates; i++) {
3893                         if (sband->bitrates[i].bitrate == rateval) {
3894                                 mcast_rate[band] = i + 1;
3895                                 found = true;
3896                                 break;
3897                         }
3898                 }
3899         }
3900
3901         return found;
3902 }
3903
3904 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3905 {
3906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3907         struct net_device *dev = info->user_ptr[1];
3908         struct cfg80211_ibss_params ibss;
3909         struct wiphy *wiphy;
3910         struct cfg80211_cached_keys *connkeys = NULL;
3911         int err;
3912
3913         memset(&ibss, 0, sizeof(ibss));
3914
3915         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3916                 return -EINVAL;
3917
3918         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3919             !info->attrs[NL80211_ATTR_SSID] ||
3920             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3921                 return -EINVAL;
3922
3923         ibss.beacon_interval = 100;
3924
3925         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3926                 ibss.beacon_interval =
3927                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3928                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3929                         return -EINVAL;
3930         }
3931
3932         if (!rdev->ops->join_ibss)
3933                 return -EOPNOTSUPP;
3934
3935         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
3936                 return -EOPNOTSUPP;
3937
3938         wiphy = &rdev->wiphy;
3939
3940         if (info->attrs[NL80211_ATTR_MAC])
3941                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3942         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3943         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3944
3945         if (info->attrs[NL80211_ATTR_IE]) {
3946                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3947                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3948         }
3949
3950         ibss.channel = ieee80211_get_channel(wiphy,
3951                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3952         if (!ibss.channel ||
3953             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3954             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
3955                 return -EINVAL;
3956
3957         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3958         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3959
3960         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3961                 u8 *rates =
3962                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3963                 int n_rates =
3964                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3965                 struct ieee80211_supported_band *sband =
3966                         wiphy->bands[ibss.channel->band];
3967                 int i, j;
3968
3969                 if (n_rates == 0)
3970                         return -EINVAL;
3971
3972                 for (i = 0; i < n_rates; i++) {
3973                         int rate = (rates[i] & 0x7f) * 5;
3974                         bool found = false;
3975
3976                         for (j = 0; j < sband->n_bitrates; j++) {
3977                                 if (sband->bitrates[j].bitrate == rate) {
3978                                         found = true;
3979                                         ibss.basic_rates |= BIT(j);
3980                                         break;
3981                                 }
3982                         }
3983                         if (!found)
3984                                 return -EINVAL;
3985                 }
3986         }
3987
3988         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
3989             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
3990                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
3991                 return -EINVAL;
3992
3993         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3994                 connkeys = nl80211_parse_connkeys(rdev,
3995                                         info->attrs[NL80211_ATTR_KEYS]);
3996                 if (IS_ERR(connkeys))
3997                         return PTR_ERR(connkeys);
3998         }
3999
4000         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4001         if (err)
4002                 kfree(connkeys);
4003         return err;
4004 }
4005
4006 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4007 {
4008         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4009         struct net_device *dev = info->user_ptr[1];
4010
4011         if (!rdev->ops->leave_ibss)
4012                 return -EOPNOTSUPP;
4013
4014         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
4015                 return -EOPNOTSUPP;
4016
4017         return cfg80211_leave_ibss(rdev, dev, false);
4018 }
4019
4020 #ifdef CONFIG_NL80211_TESTMODE
4021 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4022         .name = "testmode",
4023 };
4024
4025 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4026 {
4027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4028         int err;
4029
4030         if (!info->attrs[NL80211_ATTR_TESTDATA])
4031                 return -EINVAL;
4032
4033         err = -EOPNOTSUPP;
4034         if (rdev->ops->testmode_cmd) {
4035                 rdev->testmode_info = info;
4036                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4037                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4038                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4039                 rdev->testmode_info = NULL;
4040         }
4041
4042         return err;
4043 }
4044
4045 static struct sk_buff *
4046 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4047                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4048 {
4049         struct sk_buff *skb;
4050         void *hdr;
4051         struct nlattr *data;
4052
4053         skb = nlmsg_new(approxlen + 100, gfp);
4054         if (!skb)
4055                 return NULL;
4056
4057         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4058         if (!hdr) {
4059                 kfree_skb(skb);
4060                 return NULL;
4061         }
4062
4063         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4064         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4065
4066         ((void **)skb->cb)[0] = rdev;
4067         ((void **)skb->cb)[1] = hdr;
4068         ((void **)skb->cb)[2] = data;
4069
4070         return skb;
4071
4072  nla_put_failure:
4073         kfree_skb(skb);
4074         return NULL;
4075 }
4076
4077 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4078                                                   int approxlen)
4079 {
4080         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4081
4082         if (WARN_ON(!rdev->testmode_info))
4083                 return NULL;
4084
4085         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4086                                 rdev->testmode_info->snd_pid,
4087                                 rdev->testmode_info->snd_seq,
4088                                 GFP_KERNEL);
4089 }
4090 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4091
4092 int cfg80211_testmode_reply(struct sk_buff *skb)
4093 {
4094         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4095         void *hdr = ((void **)skb->cb)[1];
4096         struct nlattr *data = ((void **)skb->cb)[2];
4097
4098         if (WARN_ON(!rdev->testmode_info)) {
4099                 kfree_skb(skb);
4100                 return -EINVAL;
4101         }
4102
4103         nla_nest_end(skb, data);
4104         genlmsg_end(skb, hdr);
4105         return genlmsg_reply(skb, rdev->testmode_info);
4106 }
4107 EXPORT_SYMBOL(cfg80211_testmode_reply);
4108
4109 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4110                                                   int approxlen, gfp_t gfp)
4111 {
4112         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4113
4114         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4115 }
4116 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4117
4118 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4119 {
4120         void *hdr = ((void **)skb->cb)[1];
4121         struct nlattr *data = ((void **)skb->cb)[2];
4122
4123         nla_nest_end(skb, data);
4124         genlmsg_end(skb, hdr);
4125         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4126 }
4127 EXPORT_SYMBOL(cfg80211_testmode_event);
4128 #endif
4129
4130 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4131 {
4132         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4133         struct net_device *dev = info->user_ptr[1];
4134         struct cfg80211_connect_params connect;
4135         struct wiphy *wiphy;
4136         struct cfg80211_cached_keys *connkeys = NULL;
4137         int err;
4138
4139         memset(&connect, 0, sizeof(connect));
4140
4141         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4142                 return -EINVAL;
4143
4144         if (!info->attrs[NL80211_ATTR_SSID] ||
4145             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4146                 return -EINVAL;
4147
4148         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4149                 connect.auth_type =
4150                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4151                 if (!nl80211_valid_auth_type(connect.auth_type))
4152                         return -EINVAL;
4153         } else
4154                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4155
4156         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4157
4158         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
4159                                       NL80211_MAX_NR_CIPHER_SUITES);
4160         if (err)
4161                 return err;
4162
4163         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4164             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4165                 return -EOPNOTSUPP;
4166
4167         wiphy = &rdev->wiphy;
4168
4169         if (info->attrs[NL80211_ATTR_MAC])
4170                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4171         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4172         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4173
4174         if (info->attrs[NL80211_ATTR_IE]) {
4175                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4176                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4177         }
4178
4179         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4180                 connect.channel =
4181                         ieee80211_get_channel(wiphy,
4182                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4183                 if (!connect.channel ||
4184                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
4185                         return -EINVAL;
4186         }
4187
4188         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4189                 connkeys = nl80211_parse_connkeys(rdev,
4190                                         info->attrs[NL80211_ATTR_KEYS]);
4191                 if (IS_ERR(connkeys))
4192                         return PTR_ERR(connkeys);
4193         }
4194
4195         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4196         if (err)
4197                 kfree(connkeys);
4198         return err;
4199 }
4200
4201 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4202 {
4203         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4204         struct net_device *dev = info->user_ptr[1];
4205         u16 reason;
4206
4207         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4208                 reason = WLAN_REASON_DEAUTH_LEAVING;
4209         else
4210                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4211
4212         if (reason == 0)
4213                 return -EINVAL;
4214
4215         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4216             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4217                 return -EOPNOTSUPP;
4218
4219         return cfg80211_disconnect(rdev, dev, reason, true);
4220 }
4221
4222 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4223 {
4224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4225         struct net *net;
4226         int err;
4227         u32 pid;
4228
4229         if (!info->attrs[NL80211_ATTR_PID])
4230                 return -EINVAL;
4231
4232         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4233
4234         net = get_net_ns_by_pid(pid);
4235         if (IS_ERR(net))
4236                 return PTR_ERR(net);
4237
4238         err = 0;
4239
4240         /* check if anything to do */
4241         if (!net_eq(wiphy_net(&rdev->wiphy), net))
4242                 err = cfg80211_switch_netns(rdev, net);
4243
4244         put_net(net);
4245         return err;
4246 }
4247
4248 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4249 {
4250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4251         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4252                         struct cfg80211_pmksa *pmksa) = NULL;
4253         struct net_device *dev = info->user_ptr[1];
4254         struct cfg80211_pmksa pmksa;
4255
4256         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4257
4258         if (!info->attrs[NL80211_ATTR_MAC])
4259                 return -EINVAL;
4260
4261         if (!info->attrs[NL80211_ATTR_PMKID])
4262                 return -EINVAL;
4263
4264         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4265         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4266
4267         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4268             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4269                 return -EOPNOTSUPP;
4270
4271         switch (info->genlhdr->cmd) {
4272         case NL80211_CMD_SET_PMKSA:
4273                 rdev_ops = rdev->ops->set_pmksa;
4274                 break;
4275         case NL80211_CMD_DEL_PMKSA:
4276                 rdev_ops = rdev->ops->del_pmksa;
4277                 break;
4278         default:
4279                 WARN_ON(1);
4280                 break;
4281         }
4282
4283         if (!rdev_ops)
4284                 return -EOPNOTSUPP;
4285
4286         return rdev_ops(&rdev->wiphy, dev, &pmksa);
4287 }
4288
4289 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4290 {
4291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4292         struct net_device *dev = info->user_ptr[1];
4293
4294         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4295             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4296                 return -EOPNOTSUPP;
4297
4298         if (!rdev->ops->flush_pmksa)
4299                 return -EOPNOTSUPP;
4300
4301         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4302 }
4303
4304 static int nl80211_remain_on_channel(struct sk_buff *skb,
4305                                      struct genl_info *info)
4306 {
4307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4308         struct net_device *dev = info->user_ptr[1];
4309         struct ieee80211_channel *chan;
4310         struct sk_buff *msg;
4311         void *hdr;
4312         u64 cookie;
4313         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4314         u32 freq, duration;
4315         int err;
4316
4317         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4318             !info->attrs[NL80211_ATTR_DURATION])
4319                 return -EINVAL;
4320
4321         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4322
4323         /*
4324          * We should be on that channel for at least one jiffie,
4325          * and more than 5 seconds seems excessive.
4326          */
4327         if (!duration || !msecs_to_jiffies(duration) ||
4328             duration > rdev->wiphy.max_remain_on_channel_duration)
4329                 return -EINVAL;
4330
4331         if (!rdev->ops->remain_on_channel)
4332                 return -EOPNOTSUPP;
4333
4334         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4335                 channel_type = nla_get_u32(
4336                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4337                 if (channel_type != NL80211_CHAN_NO_HT &&
4338                     channel_type != NL80211_CHAN_HT20 &&
4339                     channel_type != NL80211_CHAN_HT40PLUS &&
4340                     channel_type != NL80211_CHAN_HT40MINUS)
4341                         return -EINVAL;
4342         }
4343
4344         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4345         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4346         if (chan == NULL)
4347                 return -EINVAL;
4348
4349         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4350         if (!msg)
4351                 return -ENOMEM;
4352
4353         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4354                              NL80211_CMD_REMAIN_ON_CHANNEL);
4355
4356         if (IS_ERR(hdr)) {
4357                 err = PTR_ERR(hdr);
4358                 goto free_msg;
4359         }
4360
4361         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4362                                            channel_type, duration, &cookie);
4363
4364         if (err)
4365                 goto free_msg;
4366
4367         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4368
4369         genlmsg_end(msg, hdr);
4370
4371         return genlmsg_reply(msg, info);
4372
4373  nla_put_failure:
4374         err = -ENOBUFS;
4375  free_msg:
4376         nlmsg_free(msg);
4377         return err;
4378 }
4379
4380 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4381                                             struct genl_info *info)
4382 {
4383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4384         struct net_device *dev = info->user_ptr[1];
4385         u64 cookie;
4386
4387         if (!info->attrs[NL80211_ATTR_COOKIE])
4388                 return -EINVAL;
4389
4390         if (!rdev->ops->cancel_remain_on_channel)
4391                 return -EOPNOTSUPP;
4392
4393         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4394
4395         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4396 }
4397
4398 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4399                            u8 *rates, u8 rates_len)
4400 {
4401         u8 i;
4402         u32 mask = 0;
4403
4404         for (i = 0; i < rates_len; i++) {
4405                 int rate = (rates[i] & 0x7f) * 5;
4406                 int ridx;
4407                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4408                         struct ieee80211_rate *srate =
4409                                 &sband->bitrates[ridx];
4410                         if (rate == srate->bitrate) {
4411                                 mask |= 1 << ridx;
4412                                 break;
4413                         }
4414                 }
4415                 if (ridx == sband->n_bitrates)
4416                         return 0; /* rate not found */
4417         }
4418
4419         return mask;
4420 }
4421
4422 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4423         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4424                                     .len = NL80211_MAX_SUPP_RATES },
4425 };
4426
4427 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4428                                        struct genl_info *info)
4429 {
4430         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         struct cfg80211_bitrate_mask mask;
4433         int rem, i;
4434         struct net_device *dev = info->user_ptr[1];
4435         struct nlattr *tx_rates;
4436         struct ieee80211_supported_band *sband;
4437
4438         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4439                 return -EINVAL;
4440
4441         if (!rdev->ops->set_bitrate_mask)
4442                 return -EOPNOTSUPP;
4443
4444         memset(&mask, 0, sizeof(mask));
4445         /* Default to all rates enabled */
4446         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4447                 sband = rdev->wiphy.bands[i];
4448                 mask.control[i].legacy =
4449                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4450         }
4451
4452         /*
4453          * The nested attribute uses enum nl80211_band as the index. This maps
4454          * directly to the enum ieee80211_band values used in cfg80211.
4455          */
4456         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4457         {
4458                 enum ieee80211_band band = nla_type(tx_rates);
4459                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
4460                         return -EINVAL;
4461                 sband = rdev->wiphy.bands[band];
4462                 if (sband == NULL)
4463                         return -EINVAL;
4464                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4465                           nla_len(tx_rates), nl80211_txattr_policy);
4466                 if (tb[NL80211_TXRATE_LEGACY]) {
4467                         mask.control[band].legacy = rateset_to_mask(
4468                                 sband,
4469                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4470                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4471                         if (mask.control[band].legacy == 0)
4472                                 return -EINVAL;
4473                 }
4474         }
4475
4476         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4477 }
4478
4479 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
4480 {
4481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4482         struct net_device *dev = info->user_ptr[1];
4483         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
4484
4485         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4486                 return -EINVAL;
4487
4488         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
4489                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
4490
4491         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4492             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4493             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4494             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4495             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4496             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4497             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4498                 return -EOPNOTSUPP;
4499
4500         /* not much point in registering if we can't reply */
4501         if (!rdev->ops->mgmt_tx)
4502                 return -EOPNOTSUPP;
4503
4504         return cfg80211_mlme_register_mgmt(dev->ieee80211_ptr, info->snd_pid,
4505                         frame_type,
4506                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4507                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4508 }
4509
4510 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
4511 {
4512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4513         struct net_device *dev = info->user_ptr[1];
4514         struct ieee80211_channel *chan;
4515         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4516         bool channel_type_valid = false;
4517         u32 freq;
4518         int err;
4519         void *hdr;
4520         u64 cookie;
4521         struct sk_buff *msg;
4522         unsigned int wait = 0;
4523         bool offchan;
4524
4525         if (!info->attrs[NL80211_ATTR_FRAME] ||
4526             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4527                 return -EINVAL;
4528
4529         if (!rdev->ops->mgmt_tx)
4530                 return -EOPNOTSUPP;
4531
4532         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4533             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4534             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4535             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4536             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4537             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4538             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4539                 return -EOPNOTSUPP;
4540
4541         if (info->attrs[NL80211_ATTR_DURATION]) {
4542                 if (!rdev->ops->mgmt_tx_cancel_wait)
4543                         return -EINVAL;
4544                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4545         }
4546
4547         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4548                 channel_type = nla_get_u32(
4549                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4550                 if (channel_type != NL80211_CHAN_NO_HT &&
4551                     channel_type != NL80211_CHAN_HT20 &&
4552                     channel_type != NL80211_CHAN_HT40PLUS &&
4553                     channel_type != NL80211_CHAN_HT40MINUS)
4554                         return -EINVAL;
4555                 channel_type_valid = true;
4556         }
4557
4558         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
4559
4560         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4561         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4562         if (chan == NULL)
4563                 return -EINVAL;
4564
4565         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4566         if (!msg)
4567                 return -ENOMEM;
4568
4569         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4570                              NL80211_CMD_FRAME);
4571
4572         if (IS_ERR(hdr)) {
4573                 err = PTR_ERR(hdr);
4574                 goto free_msg;
4575         }
4576         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
4577                                     channel_type_valid, wait,
4578                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
4579                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
4580                                     &cookie);
4581         if (err)
4582                 goto free_msg;
4583
4584         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4585
4586         genlmsg_end(msg, hdr);
4587         return genlmsg_reply(msg, info);
4588
4589  nla_put_failure:
4590         err = -ENOBUFS;
4591  free_msg:
4592         nlmsg_free(msg);
4593         return err;
4594 }
4595
4596 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
4597 {
4598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4599         struct net_device *dev = info->user_ptr[1];
4600         u64 cookie;
4601
4602         if (!info->attrs[NL80211_ATTR_COOKIE])
4603                 return -EINVAL;
4604
4605         if (!rdev->ops->mgmt_tx_cancel_wait)
4606                 return -EOPNOTSUPP;
4607
4608         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4609             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
4610             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
4611             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4612             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4613             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4614                 return -EOPNOTSUPP;
4615
4616         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4617
4618         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, dev, cookie);
4619 }
4620
4621 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4622 {
4623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4624         struct wireless_dev *wdev;
4625         struct net_device *dev = info->user_ptr[1];
4626         u8 ps_state;
4627         bool state;
4628         int err;
4629
4630         if (!info->attrs[NL80211_ATTR_PS_STATE])
4631                 return -EINVAL;
4632
4633         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4634
4635         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
4636                 return -EINVAL;
4637
4638         wdev = dev->ieee80211_ptr;
4639
4640         if (!rdev->ops->set_power_mgmt)
4641                 return -EOPNOTSUPP;
4642
4643         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4644
4645         if (state == wdev->ps)
4646                 return 0;
4647
4648         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
4649                                         wdev->ps_timeout);
4650         if (!err)
4651                 wdev->ps = state;
4652         return err;
4653 }
4654
4655 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4656 {
4657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4658         enum nl80211_ps_state ps_state;
4659         struct wireless_dev *wdev;
4660         struct net_device *dev = info->user_ptr[1];
4661         struct sk_buff *msg;
4662         void *hdr;
4663         int err;
4664
4665         wdev = dev->ieee80211_ptr;
4666
4667         if (!rdev->ops->set_power_mgmt)
4668                 return -EOPNOTSUPP;
4669
4670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4671         if (!msg)
4672                 return -ENOMEM;
4673
4674         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4675                              NL80211_CMD_GET_POWER_SAVE);
4676         if (!hdr) {
4677                 err = -ENOBUFS;
4678                 goto free_msg;
4679         }
4680
4681         if (wdev->ps)
4682                 ps_state = NL80211_PS_ENABLED;
4683         else
4684                 ps_state = NL80211_PS_DISABLED;
4685
4686         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4687
4688         genlmsg_end(msg, hdr);
4689         return genlmsg_reply(msg, info);
4690
4691  nla_put_failure:
4692         err = -ENOBUFS;
4693  free_msg:
4694         nlmsg_free(msg);
4695         return err;
4696 }
4697
4698 static struct nla_policy
4699 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4700         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4701         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4702         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4703 };
4704
4705 static int nl80211_set_cqm_rssi(struct genl_info *info,
4706                                 s32 threshold, u32 hysteresis)
4707 {
4708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4709         struct wireless_dev *wdev;
4710         struct net_device *dev = info->user_ptr[1];
4711
4712         if (threshold > 0)
4713                 return -EINVAL;
4714
4715         wdev = dev->ieee80211_ptr;
4716
4717         if (!rdev->ops->set_cqm_rssi_config)
4718                 return -EOPNOTSUPP;
4719
4720         if (wdev->iftype != NL80211_IFTYPE_STATION &&
4721             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
4722                 return -EOPNOTSUPP;
4723
4724         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4725                                               threshold, hysteresis);
4726 }
4727
4728 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4729 {
4730         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4731         struct nlattr *cqm;
4732         int err;
4733
4734         cqm = info->attrs[NL80211_ATTR_CQM];
4735         if (!cqm) {
4736                 err = -EINVAL;
4737                 goto out;
4738         }
4739
4740         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4741                                nl80211_attr_cqm_policy);
4742         if (err)
4743                 goto out;
4744
4745         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4746             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4747                 s32 threshold;
4748                 u32 hysteresis;
4749                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4750                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4751                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4752         } else
4753                 err = -EINVAL;
4754
4755 out:
4756         return err;
4757 }
4758
4759 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
4760 {
4761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4762         struct net_device *dev = info->user_ptr[1];
4763         struct mesh_config cfg;
4764         struct mesh_setup setup;
4765         int err;
4766
4767         /* start with default */
4768         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
4769         memcpy(&setup, &default_mesh_setup, sizeof(setup));
4770
4771         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
4772                 /* and parse parameters if given */
4773                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
4774                 if (err)
4775                         return err;
4776         }
4777
4778         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
4779             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
4780                 return -EINVAL;
4781
4782         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
4783         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4784
4785         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
4786                 /* parse additional setup parameters if given */
4787                 err = nl80211_parse_mesh_setup(info, &setup);
4788                 if (err)
4789                         return err;
4790         }
4791
4792         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
4793 }
4794
4795 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
4796 {
4797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4798         struct net_device *dev = info->user_ptr[1];
4799
4800         return cfg80211_leave_mesh(rdev, dev);
4801 }
4802
4803 #define NL80211_FLAG_NEED_WIPHY         0x01
4804 #define NL80211_FLAG_NEED_NETDEV        0x02
4805 #define NL80211_FLAG_NEED_RTNL          0x04
4806 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
4807 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
4808                                          NL80211_FLAG_CHECK_NETDEV_UP)
4809
4810 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
4811                             struct genl_info *info)
4812 {
4813         struct cfg80211_registered_device *rdev;
4814         struct net_device *dev;
4815         int err;
4816         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
4817
4818         if (rtnl)
4819                 rtnl_lock();
4820
4821         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
4822                 rdev = cfg80211_get_dev_from_info(info);
4823                 if (IS_ERR(rdev)) {
4824                         if (rtnl)
4825                                 rtnl_unlock();
4826                         return PTR_ERR(rdev);
4827                 }
4828                 info->user_ptr[0] = rdev;
4829         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
4830                 err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4831                 if (err) {
4832                         if (rtnl)
4833                                 rtnl_unlock();
4834                         return err;
4835                 }
4836                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
4837                     !netif_running(dev)) {
4838                         cfg80211_unlock_rdev(rdev);
4839                         dev_put(dev);
4840                         if (rtnl)
4841                                 rtnl_unlock();
4842                         return -ENETDOWN;
4843                 }
4844                 info->user_ptr[0] = rdev;
4845                 info->user_ptr[1] = dev;
4846         }
4847
4848         return 0;
4849 }
4850
4851 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
4852                               struct genl_info *info)
4853 {
4854         if (info->user_ptr[0])
4855                 cfg80211_unlock_rdev(info->user_ptr[0]);
4856         if (info->user_ptr[1])
4857                 dev_put(info->user_ptr[1]);
4858         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
4859                 rtnl_unlock();
4860 }
4861
4862 static struct genl_ops nl80211_ops[] = {
4863         {
4864                 .cmd = NL80211_CMD_GET_WIPHY,
4865                 .doit = nl80211_get_wiphy,
4866                 .dumpit = nl80211_dump_wiphy,
4867                 .policy = nl80211_policy,
4868                 /* can be retrieved by unprivileged users */
4869                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
4870         },
4871         {
4872                 .cmd = NL80211_CMD_SET_WIPHY,
4873                 .doit = nl80211_set_wiphy,
4874                 .policy = nl80211_policy,
4875                 .flags = GENL_ADMIN_PERM,
4876                 .internal_flags = NL80211_FLAG_NEED_RTNL,
4877         },
4878         {
4879                 .cmd = NL80211_CMD_GET_INTERFACE,
4880                 .doit = nl80211_get_interface,
4881                 .dumpit = nl80211_dump_interface,
4882                 .policy = nl80211_policy,
4883                 /* can be retrieved by unprivileged users */
4884                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
4885         },
4886         {
4887                 .cmd = NL80211_CMD_SET_INTERFACE,
4888                 .doit = nl80211_set_interface,
4889                 .policy = nl80211_policy,
4890                 .flags = GENL_ADMIN_PERM,
4891                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4892                                   NL80211_FLAG_NEED_RTNL,
4893         },
4894         {
4895                 .cmd = NL80211_CMD_NEW_INTERFACE,
4896                 .doit = nl80211_new_interface,
4897                 .policy = nl80211_policy,
4898                 .flags = GENL_ADMIN_PERM,
4899                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
4900                                   NL80211_FLAG_NEED_RTNL,
4901         },
4902         {
4903                 .cmd = NL80211_CMD_DEL_INTERFACE,
4904                 .doit = nl80211_del_interface,
4905                 .policy = nl80211_policy,
4906                 .flags = GENL_ADMIN_PERM,
4907                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4908                                   NL80211_FLAG_NEED_RTNL,
4909         },
4910         {
4911                 .cmd = NL80211_CMD_GET_KEY,
4912                 .doit = nl80211_get_key,
4913                 .policy = nl80211_policy,
4914                 .flags = GENL_ADMIN_PERM,
4915                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4916                                   NL80211_FLAG_NEED_RTNL,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_SET_KEY,
4920                 .doit = nl80211_set_key,
4921                 .policy = nl80211_policy,
4922                 .flags = GENL_ADMIN_PERM,
4923                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4924                                   NL80211_FLAG_NEED_RTNL,
4925         },
4926         {
4927                 .cmd = NL80211_CMD_NEW_KEY,
4928                 .doit = nl80211_new_key,
4929                 .policy = nl80211_policy,
4930                 .flags = GENL_ADMIN_PERM,
4931                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4932                                   NL80211_FLAG_NEED_RTNL,
4933         },
4934         {
4935                 .cmd = NL80211_CMD_DEL_KEY,
4936                 .doit = nl80211_del_key,
4937                 .policy = nl80211_policy,
4938                 .flags = GENL_ADMIN_PERM,
4939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4940                                   NL80211_FLAG_NEED_RTNL,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_SET_BEACON,
4944                 .policy = nl80211_policy,
4945                 .flags = GENL_ADMIN_PERM,
4946                 .doit = nl80211_addset_beacon,
4947                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4948                                   NL80211_FLAG_NEED_RTNL,
4949         },
4950         {
4951                 .cmd = NL80211_CMD_NEW_BEACON,
4952                 .policy = nl80211_policy,
4953                 .flags = GENL_ADMIN_PERM,
4954                 .doit = nl80211_addset_beacon,
4955                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4956                                   NL80211_FLAG_NEED_RTNL,
4957         },
4958         {
4959                 .cmd = NL80211_CMD_DEL_BEACON,
4960                 .policy = nl80211_policy,
4961                 .flags = GENL_ADMIN_PERM,
4962                 .doit = nl80211_del_beacon,
4963                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4964                                   NL80211_FLAG_NEED_RTNL,
4965         },
4966         {
4967                 .cmd = NL80211_CMD_GET_STATION,
4968                 .doit = nl80211_get_station,
4969                 .dumpit = nl80211_dump_station,
4970                 .policy = nl80211_policy,
4971                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4972                                   NL80211_FLAG_NEED_RTNL,
4973         },
4974         {
4975                 .cmd = NL80211_CMD_SET_STATION,
4976                 .doit = nl80211_set_station,
4977                 .policy = nl80211_policy,
4978                 .flags = GENL_ADMIN_PERM,
4979                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4980                                   NL80211_FLAG_NEED_RTNL,
4981         },
4982         {
4983                 .cmd = NL80211_CMD_NEW_STATION,
4984                 .doit = nl80211_new_station,
4985                 .policy = nl80211_policy,
4986                 .flags = GENL_ADMIN_PERM,
4987                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
4988                                   NL80211_FLAG_NEED_RTNL,
4989         },
4990         {
4991                 .cmd = NL80211_CMD_DEL_STATION,
4992                 .doit = nl80211_del_station,
4993                 .policy = nl80211_policy,
4994                 .flags = GENL_ADMIN_PERM,
4995                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
4996                                   NL80211_FLAG_NEED_RTNL,
4997         },
4998         {
4999                 .cmd = NL80211_CMD_GET_MPATH,
5000                 .doit = nl80211_get_mpath,
5001                 .dumpit = nl80211_dump_mpath,
5002                 .policy = nl80211_policy,
5003                 .flags = GENL_ADMIN_PERM,
5004                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5005                                   NL80211_FLAG_NEED_RTNL,
5006         },
5007         {
5008                 .cmd = NL80211_CMD_SET_MPATH,
5009                 .doit = nl80211_set_mpath,
5010                 .policy = nl80211_policy,
5011                 .flags = GENL_ADMIN_PERM,
5012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5013                                   NL80211_FLAG_NEED_RTNL,
5014         },
5015         {
5016                 .cmd = NL80211_CMD_NEW_MPATH,
5017                 .doit = nl80211_new_mpath,
5018                 .policy = nl80211_policy,
5019                 .flags = GENL_ADMIN_PERM,
5020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5021                                   NL80211_FLAG_NEED_RTNL,
5022         },
5023         {
5024                 .cmd = NL80211_CMD_DEL_MPATH,
5025                 .doit = nl80211_del_mpath,
5026                 .policy = nl80211_policy,
5027                 .flags = GENL_ADMIN_PERM,
5028                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5029                                   NL80211_FLAG_NEED_RTNL,
5030         },
5031         {
5032                 .cmd = NL80211_CMD_SET_BSS,
5033                 .doit = nl80211_set_bss,
5034                 .policy = nl80211_policy,
5035                 .flags = GENL_ADMIN_PERM,
5036                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5037                                   NL80211_FLAG_NEED_RTNL,
5038         },
5039         {
5040                 .cmd = NL80211_CMD_GET_REG,
5041                 .doit = nl80211_get_reg,
5042                 .policy = nl80211_policy,
5043                 /* can be retrieved by unprivileged users */
5044         },
5045         {
5046                 .cmd = NL80211_CMD_SET_REG,
5047                 .doit = nl80211_set_reg,
5048                 .policy = nl80211_policy,
5049                 .flags = GENL_ADMIN_PERM,
5050         },
5051         {
5052                 .cmd = NL80211_CMD_REQ_SET_REG,
5053                 .doit = nl80211_req_set_reg,
5054                 .policy = nl80211_policy,
5055                 .flags = GENL_ADMIN_PERM,
5056         },
5057         {
5058                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
5059                 .doit = nl80211_get_mesh_config,
5060                 .policy = nl80211_policy,
5061                 /* can be retrieved by unprivileged users */
5062                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5063                                   NL80211_FLAG_NEED_RTNL,
5064         },
5065         {
5066                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
5067                 .doit = nl80211_update_mesh_config,
5068                 .policy = nl80211_policy,
5069                 .flags = GENL_ADMIN_PERM,
5070                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5071                                   NL80211_FLAG_NEED_RTNL,
5072         },
5073         {
5074                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5075                 .doit = nl80211_trigger_scan,
5076                 .policy = nl80211_policy,
5077                 .flags = GENL_ADMIN_PERM,
5078                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5079                                   NL80211_FLAG_NEED_RTNL,
5080         },
5081         {
5082                 .cmd = NL80211_CMD_GET_SCAN,
5083                 .policy = nl80211_policy,
5084                 .dumpit = nl80211_dump_scan,
5085         },
5086         {
5087                 .cmd = NL80211_CMD_AUTHENTICATE,
5088                 .doit = nl80211_authenticate,
5089                 .policy = nl80211_policy,
5090                 .flags = GENL_ADMIN_PERM,
5091                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5092                                   NL80211_FLAG_NEED_RTNL,
5093         },
5094         {
5095                 .cmd = NL80211_CMD_ASSOCIATE,
5096                 .doit = nl80211_associate,
5097                 .policy = nl80211_policy,
5098                 .flags = GENL_ADMIN_PERM,
5099                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5100                                   NL80211_FLAG_NEED_RTNL,
5101         },
5102         {
5103                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5104                 .doit = nl80211_deauthenticate,
5105                 .policy = nl80211_policy,
5106                 .flags = GENL_ADMIN_PERM,
5107                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5108                                   NL80211_FLAG_NEED_RTNL,
5109         },
5110         {
5111                 .cmd = NL80211_CMD_DISASSOCIATE,
5112                 .doit = nl80211_disassociate,
5113                 .policy = nl80211_policy,
5114                 .flags = GENL_ADMIN_PERM,
5115                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5116                                   NL80211_FLAG_NEED_RTNL,
5117         },
5118         {
5119                 .cmd = NL80211_CMD_JOIN_IBSS,
5120                 .doit = nl80211_join_ibss,
5121                 .policy = nl80211_policy,
5122                 .flags = GENL_ADMIN_PERM,
5123                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5124                                   NL80211_FLAG_NEED_RTNL,
5125         },
5126         {
5127                 .cmd = NL80211_CMD_LEAVE_IBSS,
5128                 .doit = nl80211_leave_ibss,
5129                 .policy = nl80211_policy,
5130                 .flags = GENL_ADMIN_PERM,
5131                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5132                                   NL80211_FLAG_NEED_RTNL,
5133         },
5134 #ifdef CONFIG_NL80211_TESTMODE
5135         {
5136                 .cmd = NL80211_CMD_TESTMODE,
5137                 .doit = nl80211_testmode_do,
5138                 .policy = nl80211_policy,
5139                 .flags = GENL_ADMIN_PERM,
5140                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5141                                   NL80211_FLAG_NEED_RTNL,
5142         },
5143 #endif
5144         {
5145                 .cmd = NL80211_CMD_CONNECT,
5146                 .doit = nl80211_connect,
5147                 .policy = nl80211_policy,
5148                 .flags = GENL_ADMIN_PERM,
5149                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5150                                   NL80211_FLAG_NEED_RTNL,
5151         },
5152         {
5153                 .cmd = NL80211_CMD_DISCONNECT,
5154                 .doit = nl80211_disconnect,
5155                 .policy = nl80211_policy,
5156                 .flags = GENL_ADMIN_PERM,
5157                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5158                                   NL80211_FLAG_NEED_RTNL,
5159         },
5160         {
5161                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5162                 .doit = nl80211_wiphy_netns,
5163                 .policy = nl80211_policy,
5164                 .flags = GENL_ADMIN_PERM,
5165                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
5166                                   NL80211_FLAG_NEED_RTNL,
5167         },
5168         {
5169                 .cmd = NL80211_CMD_GET_SURVEY,
5170                 .policy = nl80211_policy,
5171                 .dumpit = nl80211_dump_survey,
5172         },
5173         {
5174                 .cmd = NL80211_CMD_SET_PMKSA,
5175                 .doit = nl80211_setdel_pmksa,
5176                 .policy = nl80211_policy,
5177                 .flags = GENL_ADMIN_PERM,
5178                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5179                                   NL80211_FLAG_NEED_RTNL,
5180         },
5181         {
5182                 .cmd = NL80211_CMD_DEL_PMKSA,
5183                 .doit = nl80211_setdel_pmksa,
5184                 .policy = nl80211_policy,
5185                 .flags = GENL_ADMIN_PERM,
5186                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5187                                   NL80211_FLAG_NEED_RTNL,
5188         },
5189         {
5190                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5191                 .doit = nl80211_flush_pmksa,
5192                 .policy = nl80211_policy,
5193                 .flags = GENL_ADMIN_PERM,
5194                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5195                                   NL80211_FLAG_NEED_RTNL,
5196         },
5197         {
5198                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5199                 .doit = nl80211_remain_on_channel,
5200                 .policy = nl80211_policy,
5201                 .flags = GENL_ADMIN_PERM,
5202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5203                                   NL80211_FLAG_NEED_RTNL,
5204         },
5205         {
5206                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5207                 .doit = nl80211_cancel_remain_on_channel,
5208                 .policy = nl80211_policy,
5209                 .flags = GENL_ADMIN_PERM,
5210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5211                                   NL80211_FLAG_NEED_RTNL,
5212         },
5213         {
5214                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5215                 .doit = nl80211_set_tx_bitrate_mask,
5216                 .policy = nl80211_policy,
5217                 .flags = GENL_ADMIN_PERM,
5218                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5219                                   NL80211_FLAG_NEED_RTNL,
5220         },
5221         {
5222                 .cmd = NL80211_CMD_REGISTER_FRAME,
5223                 .doit = nl80211_register_mgmt,
5224                 .policy = nl80211_policy,
5225                 .flags = GENL_ADMIN_PERM,
5226                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5227                                   NL80211_FLAG_NEED_RTNL,
5228         },
5229         {
5230                 .cmd = NL80211_CMD_FRAME,
5231                 .doit = nl80211_tx_mgmt,
5232                 .policy = nl80211_policy,
5233                 .flags = GENL_ADMIN_PERM,
5234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5235                                   NL80211_FLAG_NEED_RTNL,
5236         },
5237         {
5238                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
5239                 .doit = nl80211_tx_mgmt_cancel_wait,
5240                 .policy = nl80211_policy,
5241                 .flags = GENL_ADMIN_PERM,
5242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5243                                   NL80211_FLAG_NEED_RTNL,
5244         },
5245         {
5246                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5247                 .doit = nl80211_set_power_save,
5248                 .policy = nl80211_policy,
5249                 .flags = GENL_ADMIN_PERM,
5250                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5251                                   NL80211_FLAG_NEED_RTNL,
5252         },
5253         {
5254                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5255                 .doit = nl80211_get_power_save,
5256                 .policy = nl80211_policy,
5257                 /* can be retrieved by unprivileged users */
5258                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5259                                   NL80211_FLAG_NEED_RTNL,
5260         },
5261         {
5262                 .cmd = NL80211_CMD_SET_CQM,
5263                 .doit = nl80211_set_cqm,
5264                 .policy = nl80211_policy,
5265                 .flags = GENL_ADMIN_PERM,
5266                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5267                                   NL80211_FLAG_NEED_RTNL,
5268         },
5269         {
5270                 .cmd = NL80211_CMD_SET_CHANNEL,
5271                 .doit = nl80211_set_channel,
5272                 .policy = nl80211_policy,
5273                 .flags = GENL_ADMIN_PERM,
5274                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5275                                   NL80211_FLAG_NEED_RTNL,
5276         },
5277         {
5278                 .cmd = NL80211_CMD_SET_WDS_PEER,
5279                 .doit = nl80211_set_wds_peer,
5280                 .policy = nl80211_policy,
5281                 .flags = GENL_ADMIN_PERM,
5282                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
5283                                   NL80211_FLAG_NEED_RTNL,
5284         },
5285         {
5286                 .cmd = NL80211_CMD_JOIN_MESH,
5287                 .doit = nl80211_join_mesh,
5288                 .policy = nl80211_policy,
5289                 .flags = GENL_ADMIN_PERM,
5290                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5291                                   NL80211_FLAG_NEED_RTNL,
5292         },
5293         {
5294                 .cmd = NL80211_CMD_LEAVE_MESH,
5295                 .doit = nl80211_leave_mesh,
5296                 .policy = nl80211_policy,
5297                 .flags = GENL_ADMIN_PERM,
5298                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
5299                                   NL80211_FLAG_NEED_RTNL,
5300         },
5301 };
5302
5303 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5304         .name = "mlme",
5305 };
5306
5307 /* multicast groups */
5308 static struct genl_multicast_group nl80211_config_mcgrp = {
5309         .name = "config",
5310 };
5311 static struct genl_multicast_group nl80211_scan_mcgrp = {
5312         .name = "scan",
5313 };
5314 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5315         .name = "regulatory",
5316 };
5317
5318 /* notification functions */
5319
5320 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5321 {
5322         struct sk_buff *msg;
5323
5324         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5325         if (!msg)
5326                 return;
5327
5328         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5329                 nlmsg_free(msg);
5330                 return;
5331         }
5332
5333         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5334                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5335 }
5336
5337 static int nl80211_add_scan_req(struct sk_buff *msg,
5338                                 struct cfg80211_registered_device *rdev)
5339 {
5340         struct cfg80211_scan_request *req = rdev->scan_req;
5341         struct nlattr *nest;
5342         int i;
5343
5344         ASSERT_RDEV_LOCK(rdev);
5345
5346         if (WARN_ON(!req))
5347                 return 0;
5348
5349         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5350         if (!nest)
5351                 goto nla_put_failure;
5352         for (i = 0; i < req->n_ssids; i++)
5353                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5354         nla_nest_end(msg, nest);
5355
5356         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5357         if (!nest)
5358                 goto nla_put_failure;
5359         for (i = 0; i < req->n_channels; i++)
5360                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5361         nla_nest_end(msg, nest);
5362
5363         if (req->ie)
5364                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5365
5366         return 0;
5367  nla_put_failure:
5368         return -ENOBUFS;
5369 }
5370
5371 static int nl80211_send_scan_msg(struct sk_buff *msg,
5372                                  struct cfg80211_registered_device *rdev,
5373                                  struct net_device *netdev,
5374                                  u32 pid, u32 seq, int flags,
5375                                  u32 cmd)
5376 {
5377         void *hdr;
5378
5379         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5380         if (!hdr)
5381                 return -1;
5382
5383         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5384         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5385
5386         /* ignore errors and send incomplete event anyway */
5387         nl80211_add_scan_req(msg, rdev);
5388
5389         return genlmsg_end(msg, hdr);
5390
5391  nla_put_failure:
5392         genlmsg_cancel(msg, hdr);
5393         return -EMSGSIZE;
5394 }
5395
5396 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5397                              struct net_device *netdev)
5398 {
5399         struct sk_buff *msg;
5400
5401         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5402         if (!msg)
5403                 return;
5404
5405         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5406                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5407                 nlmsg_free(msg);
5408                 return;
5409         }
5410
5411         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5412                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5413 }
5414
5415 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5416                             struct net_device *netdev)
5417 {
5418         struct sk_buff *msg;
5419
5420         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5421         if (!msg)
5422                 return;
5423
5424         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5425                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5426                 nlmsg_free(msg);
5427                 return;
5428         }
5429
5430         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5431                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5432 }
5433
5434 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5435                                struct net_device *netdev)
5436 {
5437         struct sk_buff *msg;
5438
5439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5440         if (!msg)
5441                 return;
5442
5443         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5444                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5445                 nlmsg_free(msg);
5446                 return;
5447         }
5448
5449         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5450                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5451 }
5452
5453 /*
5454  * This can happen on global regulatory changes or device specific settings
5455  * based on custom world regulatory domains.
5456  */
5457 void nl80211_send_reg_change_event(struct regulatory_request *request)
5458 {
5459         struct sk_buff *msg;
5460         void *hdr;
5461
5462         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5463         if (!msg)
5464                 return;
5465
5466         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5467         if (!hdr) {
5468                 nlmsg_free(msg);
5469                 return;
5470         }
5471
5472         /* Userspace can always count this one always being set */
5473         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5474
5475         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5476                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5477                            NL80211_REGDOM_TYPE_WORLD);
5478         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5479                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5480                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5481         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5482                  request->intersect)
5483                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5484                            NL80211_REGDOM_TYPE_INTERSECTION);
5485         else {
5486                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5487                            NL80211_REGDOM_TYPE_COUNTRY);
5488                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5489         }
5490
5491         if (wiphy_idx_valid(request->wiphy_idx))
5492                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5493
5494         if (genlmsg_end(msg, hdr) < 0) {
5495                 nlmsg_free(msg);
5496                 return;
5497         }
5498
5499         rcu_read_lock();
5500         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5501                                 GFP_ATOMIC);
5502         rcu_read_unlock();
5503
5504         return;
5505
5506 nla_put_failure:
5507         genlmsg_cancel(msg, hdr);
5508         nlmsg_free(msg);
5509 }
5510
5511 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5512                                     struct net_device *netdev,
5513                                     const u8 *buf, size_t len,
5514                                     enum nl80211_commands cmd, gfp_t gfp)
5515 {
5516         struct sk_buff *msg;
5517         void *hdr;
5518
5519         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5520         if (!msg)
5521                 return;
5522
5523         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5524         if (!hdr) {
5525                 nlmsg_free(msg);
5526                 return;
5527         }
5528
5529         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5530         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5531         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5532
5533         if (genlmsg_end(msg, hdr) < 0) {
5534                 nlmsg_free(msg);
5535                 return;
5536         }
5537
5538         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5539                                 nl80211_mlme_mcgrp.id, gfp);
5540         return;
5541
5542  nla_put_failure:
5543         genlmsg_cancel(msg, hdr);
5544         nlmsg_free(msg);
5545 }
5546
5547 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5548                           struct net_device *netdev, const u8 *buf,
5549                           size_t len, gfp_t gfp)
5550 {
5551         nl80211_send_mlme_event(rdev, netdev, buf, len,
5552                                 NL80211_CMD_AUTHENTICATE, gfp);
5553 }
5554
5555 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5556                            struct net_device *netdev, const u8 *buf,
5557                            size_t len, gfp_t gfp)
5558 {
5559         nl80211_send_mlme_event(rdev, netdev, buf, len,
5560                                 NL80211_CMD_ASSOCIATE, gfp);
5561 }
5562
5563 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5564                          struct net_device *netdev, const u8 *buf,
5565                          size_t len, gfp_t gfp)
5566 {
5567         nl80211_send_mlme_event(rdev, netdev, buf, len,
5568                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5569 }
5570
5571 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5572                            struct net_device *netdev, const u8 *buf,
5573                            size_t len, gfp_t gfp)
5574 {
5575         nl80211_send_mlme_event(rdev, netdev, buf, len,
5576                                 NL80211_CMD_DISASSOCIATE, gfp);
5577 }
5578
5579 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
5580                                 struct net_device *netdev, const u8 *buf,
5581                                 size_t len, gfp_t gfp)
5582 {
5583         nl80211_send_mlme_event(rdev, netdev, buf, len,
5584                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
5585 }
5586
5587 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
5588                                   struct net_device *netdev, const u8 *buf,
5589                                   size_t len, gfp_t gfp)
5590 {
5591         nl80211_send_mlme_event(rdev, netdev, buf, len,
5592                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
5593 }
5594
5595 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5596                                       struct net_device *netdev, int cmd,
5597                                       const u8 *addr, gfp_t gfp)
5598 {
5599         struct sk_buff *msg;
5600         void *hdr;
5601
5602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5603         if (!msg)
5604                 return;
5605
5606         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5607         if (!hdr) {
5608                 nlmsg_free(msg);
5609                 return;
5610         }
5611
5612         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5613         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5614         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5615         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5616
5617         if (genlmsg_end(msg, hdr) < 0) {
5618                 nlmsg_free(msg);
5619                 return;
5620         }
5621
5622         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5623                                 nl80211_mlme_mcgrp.id, gfp);
5624         return;
5625
5626  nla_put_failure:
5627         genlmsg_cancel(msg, hdr);
5628         nlmsg_free(msg);
5629 }
5630
5631 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5632                                struct net_device *netdev, const u8 *addr,
5633                                gfp_t gfp)
5634 {
5635         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5636                                   addr, gfp);
5637 }
5638
5639 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5640                                 struct net_device *netdev, const u8 *addr,
5641                                 gfp_t gfp)
5642 {
5643         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5644                                   addr, gfp);
5645 }
5646
5647 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5648                                  struct net_device *netdev, const u8 *bssid,
5649                                  const u8 *req_ie, size_t req_ie_len,
5650                                  const u8 *resp_ie, size_t resp_ie_len,
5651                                  u16 status, gfp_t gfp)
5652 {
5653         struct sk_buff *msg;
5654         void *hdr;
5655
5656         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5657         if (!msg)
5658                 return;
5659
5660         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5661         if (!hdr) {
5662                 nlmsg_free(msg);
5663                 return;
5664         }
5665
5666         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5667         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5668         if (bssid)
5669                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5670         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5671         if (req_ie)
5672                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5673         if (resp_ie)
5674                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5675
5676         if (genlmsg_end(msg, hdr) < 0) {
5677                 nlmsg_free(msg);
5678                 return;
5679         }
5680
5681         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5682                                 nl80211_mlme_mcgrp.id, gfp);
5683         return;
5684
5685  nla_put_failure:
5686         genlmsg_cancel(msg, hdr);
5687         nlmsg_free(msg);
5688
5689 }
5690
5691 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5692                          struct net_device *netdev, const u8 *bssid,
5693                          const u8 *req_ie, size_t req_ie_len,
5694                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5695 {
5696         struct sk_buff *msg;
5697         void *hdr;
5698
5699         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5700         if (!msg)
5701                 return;
5702
5703         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5704         if (!hdr) {
5705                 nlmsg_free(msg);
5706                 return;
5707         }
5708
5709         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5710         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5711         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5712         if (req_ie)
5713                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5714         if (resp_ie)
5715                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5716
5717         if (genlmsg_end(msg, hdr) < 0) {
5718                 nlmsg_free(msg);
5719                 return;
5720         }
5721
5722         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5723                                 nl80211_mlme_mcgrp.id, gfp);
5724         return;
5725
5726  nla_put_failure:
5727         genlmsg_cancel(msg, hdr);
5728         nlmsg_free(msg);
5729
5730 }
5731
5732 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5733                                struct net_device *netdev, u16 reason,
5734                                const u8 *ie, size_t ie_len, bool from_ap)
5735 {
5736         struct sk_buff *msg;
5737         void *hdr;
5738
5739         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5740         if (!msg)
5741                 return;
5742
5743         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5744         if (!hdr) {
5745                 nlmsg_free(msg);
5746                 return;
5747         }
5748
5749         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5750         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5751         if (from_ap && reason)
5752                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5753         if (from_ap)
5754                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5755         if (ie)
5756                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5757
5758         if (genlmsg_end(msg, hdr) < 0) {
5759                 nlmsg_free(msg);
5760                 return;
5761         }
5762
5763         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5764                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5765         return;
5766
5767  nla_put_failure:
5768         genlmsg_cancel(msg, hdr);
5769         nlmsg_free(msg);
5770
5771 }
5772
5773 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5774                              struct net_device *netdev, const u8 *bssid,
5775                              gfp_t gfp)
5776 {
5777         struct sk_buff *msg;
5778         void *hdr;
5779
5780         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5781         if (!msg)
5782                 return;
5783
5784         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5785         if (!hdr) {
5786                 nlmsg_free(msg);
5787                 return;
5788         }
5789
5790         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5791         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5792         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5793
5794         if (genlmsg_end(msg, hdr) < 0) {
5795                 nlmsg_free(msg);
5796                 return;
5797         }
5798
5799         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5800                                 nl80211_mlme_mcgrp.id, gfp);
5801         return;
5802
5803  nla_put_failure:
5804         genlmsg_cancel(msg, hdr);
5805         nlmsg_free(msg);
5806 }
5807
5808 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5809                                  struct net_device *netdev, const u8 *addr,
5810                                  enum nl80211_key_type key_type, int key_id,
5811                                  const u8 *tsc, gfp_t gfp)
5812 {
5813         struct sk_buff *msg;
5814         void *hdr;
5815
5816         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5817         if (!msg)
5818                 return;
5819
5820         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5821         if (!hdr) {
5822                 nlmsg_free(msg);
5823                 return;
5824         }
5825
5826         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5827         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5828         if (addr)
5829                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5830         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5831         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5832         if (tsc)
5833                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5834
5835         if (genlmsg_end(msg, hdr) < 0) {
5836                 nlmsg_free(msg);
5837                 return;
5838         }
5839
5840         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5841                                 nl80211_mlme_mcgrp.id, gfp);
5842         return;
5843
5844  nla_put_failure:
5845         genlmsg_cancel(msg, hdr);
5846         nlmsg_free(msg);
5847 }
5848
5849 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5850                                     struct ieee80211_channel *channel_before,
5851                                     struct ieee80211_channel *channel_after)
5852 {
5853         struct sk_buff *msg;
5854         void *hdr;
5855         struct nlattr *nl_freq;
5856
5857         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5858         if (!msg)
5859                 return;
5860
5861         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5862         if (!hdr) {
5863                 nlmsg_free(msg);
5864                 return;
5865         }
5866
5867         /*
5868          * Since we are applying the beacon hint to a wiphy we know its
5869          * wiphy_idx is valid
5870          */
5871         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5872
5873         /* Before */
5874         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5875         if (!nl_freq)
5876                 goto nla_put_failure;
5877         if (nl80211_msg_put_channel(msg, channel_before))
5878                 goto nla_put_failure;
5879         nla_nest_end(msg, nl_freq);
5880
5881         /* After */
5882         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5883         if (!nl_freq)
5884                 goto nla_put_failure;
5885         if (nl80211_msg_put_channel(msg, channel_after))
5886                 goto nla_put_failure;
5887         nla_nest_end(msg, nl_freq);
5888
5889         if (genlmsg_end(msg, hdr) < 0) {
5890                 nlmsg_free(msg);
5891                 return;
5892         }
5893
5894         rcu_read_lock();
5895         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5896                                 GFP_ATOMIC);
5897         rcu_read_unlock();
5898
5899         return;
5900
5901 nla_put_failure:
5902         genlmsg_cancel(msg, hdr);
5903         nlmsg_free(msg);
5904 }
5905
5906 static void nl80211_send_remain_on_chan_event(
5907         int cmd, struct cfg80211_registered_device *rdev,
5908         struct net_device *netdev, u64 cookie,
5909         struct ieee80211_channel *chan,
5910         enum nl80211_channel_type channel_type,
5911         unsigned int duration, gfp_t gfp)
5912 {
5913         struct sk_buff *msg;
5914         void *hdr;
5915
5916         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5917         if (!msg)
5918                 return;
5919
5920         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5921         if (!hdr) {
5922                 nlmsg_free(msg);
5923                 return;
5924         }
5925
5926         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5927         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5928         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5929         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5930         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5931
5932         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5933                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5934
5935         if (genlmsg_end(msg, hdr) < 0) {
5936                 nlmsg_free(msg);
5937                 return;
5938         }
5939
5940         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5941                                 nl80211_mlme_mcgrp.id, gfp);
5942         return;
5943
5944  nla_put_failure:
5945         genlmsg_cancel(msg, hdr);
5946         nlmsg_free(msg);
5947 }
5948
5949 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5950                                     struct net_device *netdev, u64 cookie,
5951                                     struct ieee80211_channel *chan,
5952                                     enum nl80211_channel_type channel_type,
5953                                     unsigned int duration, gfp_t gfp)
5954 {
5955         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5956                                           rdev, netdev, cookie, chan,
5957                                           channel_type, duration, gfp);
5958 }
5959
5960 void nl80211_send_remain_on_channel_cancel(
5961         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5962         u64 cookie, struct ieee80211_channel *chan,
5963         enum nl80211_channel_type channel_type, gfp_t gfp)
5964 {
5965         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5966                                           rdev, netdev, cookie, chan,
5967                                           channel_type, 0, gfp);
5968 }
5969
5970 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5971                             struct net_device *dev, const u8 *mac_addr,
5972                             struct station_info *sinfo, gfp_t gfp)
5973 {
5974         struct sk_buff *msg;
5975
5976         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5977         if (!msg)
5978                 return;
5979
5980         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5981                 nlmsg_free(msg);
5982                 return;
5983         }
5984
5985         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5986                                 nl80211_mlme_mcgrp.id, gfp);
5987 }
5988
5989 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
5990                                 struct net_device *dev, const u8 *mac_addr,
5991                                 gfp_t gfp)
5992 {
5993         struct sk_buff *msg;
5994         void *hdr;
5995
5996         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5997         if (!msg)
5998                 return;
5999
6000         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
6001         if (!hdr) {
6002                 nlmsg_free(msg);
6003                 return;
6004         }
6005
6006         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
6007         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
6008
6009         if (genlmsg_end(msg, hdr) < 0) {
6010                 nlmsg_free(msg);
6011                 return;
6012         }
6013
6014         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6015                                 nl80211_mlme_mcgrp.id, gfp);
6016         return;
6017
6018  nla_put_failure:
6019         genlmsg_cancel(msg, hdr);
6020         nlmsg_free(msg);
6021 }
6022
6023 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
6024                       struct net_device *netdev, u32 nlpid,
6025                       int freq, const u8 *buf, size_t len, gfp_t gfp)
6026 {
6027         struct sk_buff *msg;
6028         void *hdr;
6029         int err;
6030
6031         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6032         if (!msg)
6033                 return -ENOMEM;
6034
6035         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
6036         if (!hdr) {
6037                 nlmsg_free(msg);
6038                 return -ENOMEM;
6039         }
6040
6041         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6042         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6043         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6044         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6045
6046         err = genlmsg_end(msg, hdr);
6047         if (err < 0) {
6048                 nlmsg_free(msg);
6049                 return err;
6050         }
6051
6052         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
6053         if (err < 0)
6054                 return err;
6055         return 0;
6056
6057  nla_put_failure:
6058         genlmsg_cancel(msg, hdr);
6059         nlmsg_free(msg);
6060         return -ENOBUFS;
6061 }
6062
6063 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
6064                                  struct net_device *netdev, u64 cookie,
6065                                  const u8 *buf, size_t len, bool ack,
6066                                  gfp_t gfp)
6067 {
6068         struct sk_buff *msg;
6069         void *hdr;
6070
6071         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6072         if (!msg)
6073                 return;
6074
6075         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
6076         if (!hdr) {
6077                 nlmsg_free(msg);
6078                 return;
6079         }
6080
6081         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6082         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6083         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6084         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6085         if (ack)
6086                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
6087
6088         if (genlmsg_end(msg, hdr) < 0) {
6089                 nlmsg_free(msg);
6090                 return;
6091         }
6092
6093         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
6094         return;
6095
6096  nla_put_failure:
6097         genlmsg_cancel(msg, hdr);
6098         nlmsg_free(msg);
6099 }
6100
6101 void
6102 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
6103                              struct net_device *netdev,
6104                              enum nl80211_cqm_rssi_threshold_event rssi_event,
6105                              gfp_t gfp)
6106 {
6107         struct sk_buff *msg;
6108         struct nlattr *pinfoattr;
6109         void *hdr;
6110
6111         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6112         if (!msg)
6113                 return;
6114
6115         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6116         if (!hdr) {
6117                 nlmsg_free(msg);
6118                 return;
6119         }
6120
6121         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6122         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6123
6124         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6125         if (!pinfoattr)
6126                 goto nla_put_failure;
6127
6128         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
6129                     rssi_event);
6130
6131         nla_nest_end(msg, pinfoattr);
6132
6133         if (genlmsg_end(msg, hdr) < 0) {
6134                 nlmsg_free(msg);
6135                 return;
6136         }
6137
6138         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6139                                 nl80211_mlme_mcgrp.id, gfp);
6140         return;
6141
6142  nla_put_failure:
6143         genlmsg_cancel(msg, hdr);
6144         nlmsg_free(msg);
6145 }
6146
6147 void
6148 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
6149                                 struct net_device *netdev, const u8 *peer,
6150                                 u32 num_packets, gfp_t gfp)
6151 {
6152         struct sk_buff *msg;
6153         struct nlattr *pinfoattr;
6154         void *hdr;
6155
6156         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6157         if (!msg)
6158                 return;
6159
6160         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6161         if (!hdr) {
6162                 nlmsg_free(msg);
6163                 return;
6164         }
6165
6166         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6167         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6168         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
6169
6170         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6171         if (!pinfoattr)
6172                 goto nla_put_failure;
6173
6174         NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
6175
6176         nla_nest_end(msg, pinfoattr);
6177
6178         if (genlmsg_end(msg, hdr) < 0) {
6179                 nlmsg_free(msg);
6180                 return;
6181         }
6182
6183         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6184                                 nl80211_mlme_mcgrp.id, gfp);
6185         return;
6186
6187  nla_put_failure:
6188         genlmsg_cancel(msg, hdr);
6189         nlmsg_free(msg);
6190 }
6191
6192 static int nl80211_netlink_notify(struct notifier_block * nb,
6193                                   unsigned long state,
6194                                   void *_notify)
6195 {
6196         struct netlink_notify *notify = _notify;
6197         struct cfg80211_registered_device *rdev;
6198         struct wireless_dev *wdev;
6199
6200         if (state != NETLINK_URELEASE)
6201                 return NOTIFY_DONE;
6202
6203         rcu_read_lock();
6204
6205         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
6206                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
6207                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
6208
6209         rcu_read_unlock();
6210
6211         return NOTIFY_DONE;
6212 }
6213
6214 static struct notifier_block nl80211_netlink_notifier = {
6215         .notifier_call = nl80211_netlink_notify,
6216 };
6217
6218 /* initialisation/exit functions */
6219
6220 int nl80211_init(void)
6221 {
6222         int err;
6223
6224         err = genl_register_family_with_ops(&nl80211_fam,
6225                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6226         if (err)
6227                 return err;
6228
6229         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6230         if (err)
6231                 goto err_out;
6232
6233         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6234         if (err)
6235                 goto err_out;
6236
6237         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6238         if (err)
6239                 goto err_out;
6240
6241         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6242         if (err)
6243                 goto err_out;
6244
6245 #ifdef CONFIG_NL80211_TESTMODE
6246         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6247         if (err)
6248                 goto err_out;
6249 #endif
6250
6251         err = netlink_register_notifier(&nl80211_netlink_notifier);
6252         if (err)
6253                 goto err_out;
6254
6255         return 0;
6256  err_out:
6257         genl_unregister_family(&nl80211_fam);
6258         return err;
6259 }
6260
6261 void nl80211_exit(void)
6262 {
6263         netlink_unregister_notifier(&nl80211_netlink_notifier);
6264         genl_unregister_family(&nl80211_fam);
6265 }