net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 /* the netlink family */
  27 static struct genl_family nl80211_fam = {
  28         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  29         .name = "nl80211",      /* have users key off the name instead */
  30         .hdrsize = 0,           /* no private header */
  31         .version = 1,           /* no particular meaning now */
  32         .maxattr = NL80211_ATTR_MAX,
  33         .netnsok = true,
  34 };
  35
  36 /* internal helper: get rdev and dev */
  37 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  38                                        struct cfg80211_registered_device **rdev,
  39                                        struct net_device **dev)
  40 {
  41         struct nlattr **attrs = info->attrs;
  42         int ifindex;
  43
  44         if (!attrs[NL80211_ATTR_IFINDEX])
  45                 return -EINVAL;
  46
  47         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  48         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  49         if (!*dev)
  50                 return -ENODEV;
  51
  52         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  53         if (IS_ERR(*rdev)) {
  54                 dev_put(*dev);
  55                 return PTR_ERR(*rdev);
  56         }
  57
  58         return 0;
  59 }
  60
  61 /* policy for the attributes */
  62 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  63         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  65                                       .len = 20-1 },
  66         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  67         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  69         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  71         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  73         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  74
  75         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  77         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  78
  79         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  81
  82         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  83         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  84                                     .len = WLAN_MAX_KEY_LEN },
  85         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  86         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  87         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  88         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  89
  90         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  91         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  92         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  95                                        .len = IEEE80211_MAX_DATA_LEN },
  96         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  98         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  99         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 100                                                .len = NL80211_MAX_SUPP_RATES },
 101         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 102         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 103         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 104         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 105                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 106         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 107
 108         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 109         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 114         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 115                                            .len = NL80211_MAX_SUPP_RATES },
 116
 117         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 120                                          .len = NL80211_HT_CAPABILITY_LEN },
 121
 122         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 123         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 124                               .len = IEEE80211_MAX_DATA_LEN },
 125         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 126         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 127
 128         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 129                                 .len = IEEE80211_MAX_SSID_LEN },
 130         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 131         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 132         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 134         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 135         [NL80211_ATTR_STA_FLAGS2] = {
 136                 .len = sizeof(struct nl80211_sta_flag_update),
 137         },
 138         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 140         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 141         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 142         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 143         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 144         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 145                                  .len = WLAN_PMKID_LEN },
 146         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 147         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 148         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 149         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 150                                  .len = IEEE80211_MAX_DATA_LEN },
 151         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 152         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 153         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 154         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 156 };
 157
 158 /* policy for the attributes */
 159 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 160         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 161         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 162         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 163         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 164         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 165         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 166 };
 167
 168 /* ifidx get helper */
 169 static int nl80211_get_ifidx(struct netlink_callback *cb)
 170 {
 171         int res;
 172
 173         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 174                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 175                           nl80211_policy);
 176         if (res)
 177                 return res;
 178
 179         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 180                 return -EINVAL;
 181
 182         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 183         if (!res)
 184                 return -EINVAL;
 185         return res;
 186 }
 187
 188 /* IE validation */
 189 static bool is_valid_ie_attr(const struct nlattr *attr)
 190 {
 191         const u8 *pos;
 192         int len;
 193
 194         if (!attr)
 195                 return true;
 196
 197         pos = nla_data(attr);
 198         len = nla_len(attr);
 199
 200         while (len) {
 201                 u8 elemlen;
 202
 203                 if (len < 2)
 204                         return false;
 205                 len -= 2;
 206
 207                 elemlen = pos[1];
 208                 if (elemlen > len)
 209                         return false;
 210
 211                 len -= elemlen;
 212                 pos += 2 + elemlen;
 213         }
 214
 215         return true;
 216 }
 217
 218 /* message building helper */
 219 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 220                                    int flags, u8 cmd)
 221 {
 222         /* since there is no private header just add the generic one */
 223         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 224 }
 225
 226 static int nl80211_msg_put_channel(struct sk_buff *msg,
 227                                    struct ieee80211_channel *chan)
 228 {
 229         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 230                     chan->center_freq);
 231
 232         if (chan->flags & IEEE80211_CHAN_DISABLED)
 233                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 234         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 235                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 236         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 237                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 238         if (chan->flags & IEEE80211_CHAN_RADAR)
 239                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 240
 241         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 242                     DBM_TO_MBM(chan->max_power));
 243
 244         return 0;
 245
 246  nla_put_failure:
 247         return -ENOBUFS;
 248 }
 249
 250 /* netlink command implementations */
 251
 252 struct key_parse {
 253         struct key_params p;
 254         int idx;
 255         bool def, defmgmt;
 256 };
 257
 258 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 259 {
 260         struct nlattr *tb[NL80211_KEY_MAX + 1];
 261         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 262                                    nl80211_key_policy);
 263         if (err)
 264                 return err;
 265
 266         k->def = !!tb[NL80211_KEY_DEFAULT];
 267         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 268
 269         if (tb[NL80211_KEY_IDX])
 270                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 271
 272         if (tb[NL80211_KEY_DATA]) {
 273                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 274                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 275         }
 276
 277         if (tb[NL80211_KEY_SEQ]) {
 278                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 279                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 280         }
 281
 282         if (tb[NL80211_KEY_CIPHER])
 283                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 284
 285         return 0;
 286 }
 287
 288 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 289 {
 290         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 291                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 292                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 293         }
 294
 295         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 296                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 297                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 298         }
 299
 300         if (info->attrs[NL80211_ATTR_KEY_IDX])
 301                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 302
 303         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 304                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 305
 306         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 307         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 308
 309         return 0;
 310 }
 311
 312 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 313 {
 314         int err;
 315
 316         memset(k, 0, sizeof(*k));
 317         k->idx = -1;
 318
 319         if (info->attrs[NL80211_ATTR_KEY])
 320                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 321         else
 322                 err = nl80211_parse_key_old(info, k);
 323
 324         if (err)
 325                 return err;
 326
 327         if (k->def && k->defmgmt)
 328                 return -EINVAL;
 329
 330         if (k->idx != -1) {
 331                 if (k->defmgmt) {
 332                         if (k->idx < 4 || k->idx > 5)
 333                                 return -EINVAL;
 334                 } else if (k->def) {
 335                         if (k->idx < 0 || k->idx > 3)
 336                                 return -EINVAL;
 337                 } else {
 338                         if (k->idx < 0 || k->idx > 5)
 339                                 return -EINVAL;
 340                 }
 341         }
 342
 343         return 0;
 344 }
 345
 346 static struct cfg80211_cached_keys *
 347 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 348                        struct nlattr *keys)
 349 {
 350         struct key_parse parse;
 351         struct nlattr *key;
 352         struct cfg80211_cached_keys *result;
 353         int rem, err, def = 0;
 354
 355         result = kzalloc(sizeof(*result), GFP_KERNEL);
 356         if (!result)
 357                 return ERR_PTR(-ENOMEM);
 358
 359         result->def = -1;
 360         result->defmgmt = -1;
 361
 362         nla_for_each_nested(key, keys, rem) {
 363                 memset(&parse, 0, sizeof(parse));
 364                 parse.idx = -1;
 365
 366                 err = nl80211_parse_key_new(key, &parse);
 367                 if (err)
 368                         goto error;
 369                 err = -EINVAL;
 370                 if (!parse.p.key)
 371                         goto error;
 372                 if (parse.idx < 0 || parse.idx > 4)
 373                         goto error;
 374                 if (parse.def) {
 375                         if (def)
 376                                 goto error;
 377                         def = 1;
 378                         result->def = parse.idx;
 379                 } else if (parse.defmgmt)
 380                         goto error;
 381                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 382                                                      parse.idx, NULL);
 383                 if (err)
 384                         goto error;
 385                 result->params[parse.idx].cipher = parse.p.cipher;
 386                 result->params[parse.idx].key_len = parse.p.key_len;
 387                 result->params[parse.idx].key = result->data[parse.idx];
 388                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 389         }
 390
 391         return result;
 392  error:
 393         kfree(result);
 394         return ERR_PTR(err);
 395 }
 396
 397 static int nl80211_key_allowed(struct wireless_dev *wdev)
 398 {
 399         ASSERT_WDEV_LOCK(wdev);
 400
 401         if (!netif_running(wdev->netdev))
 402                 return -ENETDOWN;
 403
 404         switch (wdev->iftype) {
 405         case NL80211_IFTYPE_AP:
 406         case NL80211_IFTYPE_AP_VLAN:
 407                 break;
 408         case NL80211_IFTYPE_ADHOC:
 409                 if (!wdev->current_bss)
 410                         return -ENOLINK;
 411                 break;
 412         case NL80211_IFTYPE_STATION:
 413                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 414                         return -ENOLINK;
 415                 break;
 416         default:
 417                 return -EINVAL;
 418         }
 419
 420         return 0;
 421 }
 422
 423 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 424                               struct cfg80211_registered_device *dev)
 425 {
 426         void *hdr;
 427         struct nlattr *nl_bands, *nl_band;
 428         struct nlattr *nl_freqs, *nl_freq;
 429         struct nlattr *nl_rates, *nl_rate;
 430         struct nlattr *nl_modes;
 431         struct nlattr *nl_cmds;
 432         enum ieee80211_band band;
 433         struct ieee80211_channel *chan;
 434         struct ieee80211_rate *rate;
 435         int i;
 436         u16 ifmodes = dev->wiphy.interface_modes;
 437
 438         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 439         if (!hdr)
 440                 return -1;
 441
 442         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 443         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 444
 445         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 446                     cfg80211_rdev_list_generation);
 447
 448         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 449                    dev->wiphy.retry_short);
 450         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 451                    dev->wiphy.retry_long);
 452         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 453                     dev->wiphy.frag_threshold);
 454         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 455                     dev->wiphy.rts_threshold);
 456         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 457                     dev->wiphy.coverage_class);
 458
 459         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 460                    dev->wiphy.max_scan_ssids);
 461         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 462                     dev->wiphy.max_scan_ie_len);
 463
 464         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 465                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 466                 dev->wiphy.cipher_suites);
 467
 468         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 469                    dev->wiphy.max_num_pmkids);
 470
 471         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 472         if (!nl_modes)
 473                 goto nla_put_failure;
 474
 475         i = 0;
 476         while (ifmodes) {
 477                 if (ifmodes & 1)
 478                         NLA_PUT_FLAG(msg, i);
 479                 ifmodes >>= 1;
 480                 i++;
 481         }
 482
 483         nla_nest_end(msg, nl_modes);
 484
 485         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 486         if (!nl_bands)
 487                 goto nla_put_failure;
 488
 489         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 490                 if (!dev->wiphy.bands[band])
 491                         continue;
 492
 493                 nl_band = nla_nest_start(msg, band);
 494                 if (!nl_band)
 495                         goto nla_put_failure;
 496
 497                 /* add HT info */
 498                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 499                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 500                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 501                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 502                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 503                                 dev->wiphy.bands[band]->ht_cap.cap);
 504                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 505                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 506                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 507                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 508                 }
 509
 510                 /* add frequencies */
 511                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 512                 if (!nl_freqs)
 513                         goto nla_put_failure;
 514
 515                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 516                         nl_freq = nla_nest_start(msg, i);
 517                         if (!nl_freq)
 518                                 goto nla_put_failure;
 519
 520                         chan = &dev->wiphy.bands[band]->channels[i];
 521
 522                         if (nl80211_msg_put_channel(msg, chan))
 523                                 goto nla_put_failure;
 524
 525                         nla_nest_end(msg, nl_freq);
 526                 }
 527
 528                 nla_nest_end(msg, nl_freqs);
 529
 530                 /* add bitrates */
 531                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 532                 if (!nl_rates)
 533                         goto nla_put_failure;
 534
 535                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 536                         nl_rate = nla_nest_start(msg, i);
 537                         if (!nl_rate)
 538                                 goto nla_put_failure;
 539
 540                         rate = &dev->wiphy.bands[band]->bitrates[i];
 541                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 542                                     rate->bitrate);
 543                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 544                                 NLA_PUT_FLAG(msg,
 545                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 546
 547                         nla_nest_end(msg, nl_rate);
 548                 }
 549
 550                 nla_nest_end(msg, nl_rates);
 551
 552                 nla_nest_end(msg, nl_band);
 553         }
 554         nla_nest_end(msg, nl_bands);
 555
 556         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 557         if (!nl_cmds)
 558                 goto nla_put_failure;
 559
 560         i = 0;
 561 #define CMD(op, n)                                              \
 562          do {                                                   \
 563                 if (dev->ops->op) {                             \
 564                         i++;                                    \
 565                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 566                 }                                               \
 567         } while (0)
 568
 569         CMD(add_virtual_intf, NEW_INTERFACE);
 570         CMD(change_virtual_intf, SET_INTERFACE);
 571         CMD(add_key, NEW_KEY);
 572         CMD(add_beacon, NEW_BEACON);
 573         CMD(add_station, NEW_STATION);
 574         CMD(add_mpath, NEW_MPATH);
 575         CMD(set_mesh_params, SET_MESH_PARAMS);
 576         CMD(change_bss, SET_BSS);
 577         CMD(auth, AUTHENTICATE);
 578         CMD(assoc, ASSOCIATE);
 579         CMD(deauth, DEAUTHENTICATE);
 580         CMD(disassoc, DISASSOCIATE);
 581         CMD(join_ibss, JOIN_IBSS);
 582         CMD(set_pmksa, SET_PMKSA);
 583         CMD(del_pmksa, DEL_PMKSA);
 584         CMD(flush_pmksa, FLUSH_PMKSA);
 585         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 586         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 587         CMD(action, ACTION);
 588         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 589                 i++;
 590                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 591         }
 592
 593 #undef CMD
 594
 595         if (dev->ops->connect || dev->ops->auth) {
 596                 i++;
 597                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 598         }
 599
 600         if (dev->ops->disconnect || dev->ops->deauth) {
 601                 i++;
 602                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 603         }
 604
 605         nla_nest_end(msg, nl_cmds);
 606
 607         return genlmsg_end(msg, hdr);
 608
 609  nla_put_failure:
 610         genlmsg_cancel(msg, hdr);
 611         return -EMSGSIZE;
 612 }
 613
 614 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 615 {
 616         int idx = 0;
 617         int start = cb->args[0];
 618         struct cfg80211_registered_device *dev;
 619
 620         mutex_lock(&cfg80211_mutex);
 621         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 622                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 623                         continue;
 624                 if (++idx <= start)
 625                         continue;
 626                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 627                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 628                                        dev) < 0) {
 629                         idx--;
 630                         break;
 631                 }
 632         }
 633         mutex_unlock(&cfg80211_mutex);
 634
 635         cb->args[0] = idx;
 636
 637         return skb->len;
 638 }
 639
 640 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 641 {
 642         struct sk_buff *msg;
 643         struct cfg80211_registered_device *dev;
 644
 645         dev = cfg80211_get_dev_from_info(info);
 646         if (IS_ERR(dev))
 647                 return PTR_ERR(dev);
 648
 649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 650         if (!msg)
 651                 goto out_err;
 652
 653         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 654                 goto out_free;
 655
 656         cfg80211_unlock_rdev(dev);
 657
 658         return genlmsg_reply(msg, info);
 659
 660  out_free:
 661         nlmsg_free(msg);
 662  out_err:
 663         cfg80211_unlock_rdev(dev);
 664         return -ENOBUFS;
 665 }
 666
 667 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 668         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 669         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 670         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 671         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 672         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 673 };
 674
 675 static int parse_txq_params(struct nlattr *tb[],
 676                             struct ieee80211_txq_params *txq_params)
 677 {
 678         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 679             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 680             !tb[NL80211_TXQ_ATTR_AIFS])
 681                 return -EINVAL;
 682
 683         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 684         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 685         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 686         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 687         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 688
 689         return 0;
 690 }
 691
 692 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 693 {
 694         struct cfg80211_registered_device *rdev;
 695         int result = 0, rem_txq_params = 0;
 696         struct nlattr *nl_txq_params;
 697         u32 changed;
 698         u8 retry_short = 0, retry_long = 0;
 699         u32 frag_threshold = 0, rts_threshold = 0;
 700         u8 coverage_class = 0;
 701
 702         rtnl_lock();
 703
 704         mutex_lock(&cfg80211_mutex);
 705
 706         rdev = __cfg80211_rdev_from_info(info);
 707         if (IS_ERR(rdev)) {
 708                 mutex_unlock(&cfg80211_mutex);
 709                 result = PTR_ERR(rdev);
 710                 goto unlock;
 711         }
 712
 713         mutex_lock(&rdev->mtx);
 714
 715         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 716                 result = cfg80211_dev_rename(
 717                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 718
 719         mutex_unlock(&cfg80211_mutex);
 720
 721         if (result)
 722                 goto bad_res;
 723
 724         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 725                 struct ieee80211_txq_params txq_params;
 726                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 727
 728                 if (!rdev->ops->set_txq_params) {
 729                         result = -EOPNOTSUPP;
 730                         goto bad_res;
 731                 }
 732
 733                 nla_for_each_nested(nl_txq_params,
 734                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 735                                     rem_txq_params) {
 736                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 737                                   nla_data(nl_txq_params),
 738                                   nla_len(nl_txq_params),
 739                                   txq_params_policy);
 740                         result = parse_txq_params(tb, &txq_params);
 741                         if (result)
 742                                 goto bad_res;
 743
 744                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 745                                                            &txq_params);
 746                         if (result)
 747                                 goto bad_res;
 748                 }
 749         }
 750
 751         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 752                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 753                 u32 freq;
 754
 755                 result = -EINVAL;
 756
 757                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 758                         channel_type = nla_get_u32(info->attrs[
 759                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 760                         if (channel_type != NL80211_CHAN_NO_HT &&
 761                             channel_type != NL80211_CHAN_HT20 &&
 762                             channel_type != NL80211_CHAN_HT40PLUS &&
 763                             channel_type != NL80211_CHAN_HT40MINUS)
 764                                 goto bad_res;
 765                 }
 766
 767                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 768
 769                 mutex_lock(&rdev->devlist_mtx);
 770                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 771                 mutex_unlock(&rdev->devlist_mtx);
 772                 if (result)
 773                         goto bad_res;
 774         }
 775
 776         changed = 0;
 777
 778         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 779                 retry_short = nla_get_u8(
 780                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 781                 if (retry_short == 0) {
 782                         result = -EINVAL;
 783                         goto bad_res;
 784                 }
 785                 changed |= WIPHY_PARAM_RETRY_SHORT;
 786         }
 787
 788         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 789                 retry_long = nla_get_u8(
 790                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 791                 if (retry_long == 0) {
 792                         result = -EINVAL;
 793                         goto bad_res;
 794                 }
 795                 changed |= WIPHY_PARAM_RETRY_LONG;
 796         }
 797
 798         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 799                 frag_threshold = nla_get_u32(
 800                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 801                 if (frag_threshold < 256) {
 802                         result = -EINVAL;
 803                         goto bad_res;
 804                 }
 805                 if (frag_threshold != (u32) -1) {
 806                         /*
 807                          * Fragments (apart from the last one) are required to
 808                          * have even length. Make the fragmentation code
 809                          * simpler by stripping LSB should someone try to use
 810                          * odd threshold value.
 811                          */
 812                         frag_threshold &= ~0x1;
 813                 }
 814                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 815         }
 816
 817         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 818                 rts_threshold = nla_get_u32(
 819                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 820                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 821         }
 822
 823         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 824                 coverage_class = nla_get_u8(
 825                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 826                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 827         }
 828
 829         if (changed) {
 830                 u8 old_retry_short, old_retry_long;
 831                 u32 old_frag_threshold, old_rts_threshold;
 832                 u8 old_coverage_class;
 833
 834                 if (!rdev->ops->set_wiphy_params) {
 835                         result = -EOPNOTSUPP;
 836                         goto bad_res;
 837                 }
 838
 839                 old_retry_short = rdev->wiphy.retry_short;
 840                 old_retry_long = rdev->wiphy.retry_long;
 841                 old_frag_threshold = rdev->wiphy.frag_threshold;
 842                 old_rts_threshold = rdev->wiphy.rts_threshold;
 843                 old_coverage_class = rdev->wiphy.coverage_class;
 844
 845                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 846                         rdev->wiphy.retry_short = retry_short;
 847                 if (changed & WIPHY_PARAM_RETRY_LONG)
 848                         rdev->wiphy.retry_long = retry_long;
 849                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 850                         rdev->wiphy.frag_threshold = frag_threshold;
 851                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 852                         rdev->wiphy.rts_threshold = rts_threshold;
 853                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 854                         rdev->wiphy.coverage_class = coverage_class;
 855
 856                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 857                 if (result) {
 858                         rdev->wiphy.retry_short = old_retry_short;
 859                         rdev->wiphy.retry_long = old_retry_long;
 860                         rdev->wiphy.frag_threshold = old_frag_threshold;
 861                         rdev->wiphy.rts_threshold = old_rts_threshold;
 862                         rdev->wiphy.coverage_class = old_coverage_class;
 863                 }
 864         }
 865
 866  bad_res:
 867         mutex_unlock(&rdev->mtx);
 868  unlock:
 869         rtnl_unlock();
 870         return result;
 871 }
 872
 873
 874 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 875                               struct cfg80211_registered_device *rdev,
 876                               struct net_device *dev)
 877 {
 878         void *hdr;
 879
 880         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 881         if (!hdr)
 882                 return -1;
 883
 884         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 885         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 886         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 887         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 888
 889         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 890                     rdev->devlist_generation ^
 891                         (cfg80211_rdev_list_generation << 2));
 892
 893         return genlmsg_end(msg, hdr);
 894
 895  nla_put_failure:
 896         genlmsg_cancel(msg, hdr);
 897         return -EMSGSIZE;
 898 }
 899
 900 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 901 {
 902         int wp_idx = 0;
 903         int if_idx = 0;
 904         int wp_start = cb->args[0];
 905         int if_start = cb->args[1];
 906         struct cfg80211_registered_device *rdev;
 907         struct wireless_dev *wdev;
 908
 909         mutex_lock(&cfg80211_mutex);
 910         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 911                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 912                         continue;
 913                 if (wp_idx < wp_start) {
 914                         wp_idx++;
 915                         continue;
 916                 }
 917                 if_idx = 0;
 918
 919                 mutex_lock(&rdev->devlist_mtx);
 920                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 921                         if (if_idx < if_start) {
 922                                 if_idx++;
 923                                 continue;
 924                         }
 925                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 926                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 927                                                rdev, wdev->netdev) < 0) {
 928                                 mutex_unlock(&rdev->devlist_mtx);
 929                                 goto out;
 930                         }
 931                         if_idx++;
 932                 }
 933                 mutex_unlock(&rdev->devlist_mtx);
 934
 935                 wp_idx++;
 936         }
 937  out:
 938         mutex_unlock(&cfg80211_mutex);
 939
 940         cb->args[0] = wp_idx;
 941         cb->args[1] = if_idx;
 942
 943         return skb->len;
 944 }
 945
 946 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 947 {
 948         struct sk_buff *msg;
 949         struct cfg80211_registered_device *dev;
 950         struct net_device *netdev;
 951         int err;
 952
 953         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 954         if (err)
 955                 return err;
 956
 957         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 958         if (!msg)
 959                 goto out_err;
 960
 961         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 962                                dev, netdev) < 0)
 963                 goto out_free;
 964
 965         dev_put(netdev);
 966         cfg80211_unlock_rdev(dev);
 967
 968         return genlmsg_reply(msg, info);
 969
 970  out_free:
 971         nlmsg_free(msg);
 972  out_err:
 973         dev_put(netdev);
 974         cfg80211_unlock_rdev(dev);
 975         return -ENOBUFS;
 976 }
 977
 978 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 979         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 980         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 981         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 982         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 983         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 984 };
 985
 986 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 987 {
 988         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 989         int flag;
 990
 991         *mntrflags = 0;
 992
 993         if (!nla)
 994                 return -EINVAL;
 995
 996         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 997                              nla, mntr_flags_policy))
 998                 return -EINVAL;
 999
1000         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1001                 if (flags[flag])
1002                         *mntrflags |= (1<<flag);
1003
1004         return 0;
1005 }
1006
1007 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1008                                struct net_device *netdev, u8 use_4addr,
1009                                enum nl80211_iftype iftype)
1010 {
1011         if (!use_4addr) {
1012                 if (netdev && netdev->br_port)
1013                         return -EBUSY;
1014                 return 0;
1015         }
1016
1017         switch (iftype) {
1018         case NL80211_IFTYPE_AP_VLAN:
1019                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1020                         return 0;
1021                 break;
1022         case NL80211_IFTYPE_STATION:
1023                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1024                         return 0;
1025                 break;
1026         default:
1027                 break;
1028         }
1029
1030         return -EOPNOTSUPP;
1031 }
1032
1033 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1034 {
1035         struct cfg80211_registered_device *rdev;
1036         struct vif_params params;
1037         int err;
1038         enum nl80211_iftype otype, ntype;
1039         struct net_device *dev;
1040         u32 _flags, *flags = NULL;
1041         bool change = false;
1042
1043         memset(&params, 0, sizeof(params));
1044
1045         rtnl_lock();
1046
1047         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1048         if (err)
1049                 goto unlock_rtnl;
1050
1051         otype = ntype = dev->ieee80211_ptr->iftype;
1052
1053         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1054                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1055                 if (otype != ntype)
1056                         change = true;
1057                 if (ntype > NL80211_IFTYPE_MAX) {
1058                         err = -EINVAL;
1059                         goto unlock;
1060                 }
1061         }
1062
1063         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1064                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1065                         err = -EINVAL;
1066                         goto unlock;
1067                 }
1068                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1069                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1070                 change = true;
1071         }
1072
1073         if (info->attrs[NL80211_ATTR_4ADDR]) {
1074                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1075                 change = true;
1076                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1077                 if (err)
1078                         goto unlock;
1079         } else {
1080                 params.use_4addr = -1;
1081         }
1082
1083         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1084                 if (ntype != NL80211_IFTYPE_MONITOR) {
1085                         err = -EINVAL;
1086                         goto unlock;
1087                 }
1088                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1089                                           &_flags);
1090                 if (err)
1091                         goto unlock;
1092
1093                 flags = &_flags;
1094                 change = true;
1095         }
1096
1097         if (change)
1098                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1099         else
1100                 err = 0;
1101
1102         if (!err && params.use_4addr != -1)
1103                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1104
1105  unlock:
1106         dev_put(dev);
1107         cfg80211_unlock_rdev(rdev);
1108  unlock_rtnl:
1109         rtnl_unlock();
1110         return err;
1111 }
1112
1113 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1114 {
1115         struct cfg80211_registered_device *rdev;
1116         struct vif_params params;
1117         int err;
1118         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1119         u32 flags;
1120
1121         memset(&params, 0, sizeof(params));
1122
1123         if (!info->attrs[NL80211_ATTR_IFNAME])
1124                 return -EINVAL;
1125
1126         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1127                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1128                 if (type > NL80211_IFTYPE_MAX)
1129                         return -EINVAL;
1130         }
1131
1132         rtnl_lock();
1133
1134         rdev = cfg80211_get_dev_from_info(info);
1135         if (IS_ERR(rdev)) {
1136                 err = PTR_ERR(rdev);
1137                 goto unlock_rtnl;
1138         }
1139
1140         if (!rdev->ops->add_virtual_intf ||
1141             !(rdev->wiphy.interface_modes & (1 << type))) {
1142                 err = -EOPNOTSUPP;
1143                 goto unlock;
1144         }
1145
1146         if (type == NL80211_IFTYPE_MESH_POINT &&
1147             info->attrs[NL80211_ATTR_MESH_ID]) {
1148                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1149                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1150         }
1151
1152         if (info->attrs[NL80211_ATTR_4ADDR]) {
1153                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1154                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1155                 if (err)
1156                         goto unlock;
1157         }
1158
1159         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1160                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1161                                   &flags);
1162         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1163                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1164                 type, err ? NULL : &flags, &params);
1165
1166  unlock:
1167         cfg80211_unlock_rdev(rdev);
1168  unlock_rtnl:
1169         rtnl_unlock();
1170         return err;
1171 }
1172
1173 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1174 {
1175         struct cfg80211_registered_device *rdev;
1176         int err;
1177         struct net_device *dev;
1178
1179         rtnl_lock();
1180
1181         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1182         if (err)
1183                 goto unlock_rtnl;
1184
1185         if (!rdev->ops->del_virtual_intf) {
1186                 err = -EOPNOTSUPP;
1187                 goto out;
1188         }
1189
1190         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1191
1192  out:
1193         cfg80211_unlock_rdev(rdev);
1194         dev_put(dev);
1195  unlock_rtnl:
1196         rtnl_unlock();
1197         return err;
1198 }
1199
1200 struct get_key_cookie {
1201         struct sk_buff *msg;
1202         int error;
1203         int idx;
1204 };
1205
1206 static void get_key_callback(void *c, struct key_params *params)
1207 {
1208         struct nlattr *key;
1209         struct get_key_cookie *cookie = c;
1210
1211         if (params->key)
1212                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1213                         params->key_len, params->key);
1214
1215         if (params->seq)
1216                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1217                         params->seq_len, params->seq);
1218
1219         if (params->cipher)
1220                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1221                             params->cipher);
1222
1223         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1224         if (!key)
1225                 goto nla_put_failure;
1226
1227         if (params->key)
1228                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1229                         params->key_len, params->key);
1230
1231         if (params->seq)
1232                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1233                         params->seq_len, params->seq);
1234
1235         if (params->cipher)
1236                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1237                             params->cipher);
1238
1239         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1240
1241         nla_nest_end(cookie->msg, key);
1242
1243         return;
1244  nla_put_failure:
1245         cookie->error = 1;
1246 }
1247
1248 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1249 {
1250         struct cfg80211_registered_device *rdev;
1251         int err;
1252         struct net_device *dev;
1253         u8 key_idx = 0;
1254         u8 *mac_addr = NULL;
1255         struct get_key_cookie cookie = {
1256                 .error = 0,
1257         };
1258         void *hdr;
1259         struct sk_buff *msg;
1260
1261         if (info->attrs[NL80211_ATTR_KEY_IDX])
1262                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1263
1264         if (key_idx > 5)
1265                 return -EINVAL;
1266
1267         if (info->attrs[NL80211_ATTR_MAC])
1268                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1269
1270         rtnl_lock();
1271
1272         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1273         if (err)
1274                 goto unlock_rtnl;
1275
1276         if (!rdev->ops->get_key) {
1277                 err = -EOPNOTSUPP;
1278                 goto out;
1279         }
1280
1281         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1282         if (!msg) {
1283                 err = -ENOMEM;
1284                 goto out;
1285         }
1286
1287         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1288                              NL80211_CMD_NEW_KEY);
1289
1290         if (IS_ERR(hdr)) {
1291                 err = PTR_ERR(hdr);
1292                 goto free_msg;
1293         }
1294
1295         cookie.msg = msg;
1296         cookie.idx = key_idx;
1297
1298         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1299         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1300         if (mac_addr)
1301                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1302
1303         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1304                                 &cookie, get_key_callback);
1305
1306         if (err)
1307                 goto free_msg;
1308
1309         if (cookie.error)
1310                 goto nla_put_failure;
1311
1312         genlmsg_end(msg, hdr);
1313         err = genlmsg_reply(msg, info);
1314         goto out;
1315
1316  nla_put_failure:
1317         err = -ENOBUFS;
1318  free_msg:
1319         nlmsg_free(msg);
1320  out:
1321         cfg80211_unlock_rdev(rdev);
1322         dev_put(dev);
1323  unlock_rtnl:
1324         rtnl_unlock();
1325
1326         return err;
1327 }
1328
1329 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1330 {
1331         struct cfg80211_registered_device *rdev;
1332         struct key_parse key;
1333         int err;
1334         struct net_device *dev;
1335         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1336                     u8 key_index);
1337
1338         err = nl80211_parse_key(info, &key);
1339         if (err)
1340                 return err;
1341
1342         if (key.idx < 0)
1343                 return -EINVAL;
1344
1345         /* only support setting default key */
1346         if (!key.def && !key.defmgmt)
1347                 return -EINVAL;
1348
1349         rtnl_lock();
1350
1351         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1352         if (err)
1353                 goto unlock_rtnl;
1354
1355         if (key.def)
1356                 func = rdev->ops->set_default_key;
1357         else
1358                 func = rdev->ops->set_default_mgmt_key;
1359
1360         if (!func) {
1361                 err = -EOPNOTSUPP;
1362                 goto out;
1363         }
1364
1365         wdev_lock(dev->ieee80211_ptr);
1366         err = nl80211_key_allowed(dev->ieee80211_ptr);
1367         if (!err)
1368                 err = func(&rdev->wiphy, dev, key.idx);
1369
1370 #ifdef CONFIG_CFG80211_WEXT
1371         if (!err) {
1372                 if (func == rdev->ops->set_default_key)
1373                         dev->ieee80211_ptr->wext.default_key = key.idx;
1374                 else
1375                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1376         }
1377 #endif
1378         wdev_unlock(dev->ieee80211_ptr);
1379
1380  out:
1381         cfg80211_unlock_rdev(rdev);
1382         dev_put(dev);
1383
1384  unlock_rtnl:
1385         rtnl_unlock();
1386
1387         return err;
1388 }
1389
1390 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1391 {
1392         struct cfg80211_registered_device *rdev;
1393         int err;
1394         struct net_device *dev;
1395         struct key_parse key;
1396         u8 *mac_addr = NULL;
1397
1398         err = nl80211_parse_key(info, &key);
1399         if (err)
1400                 return err;
1401
1402         if (!key.p.key)
1403                 return -EINVAL;
1404
1405         if (info->attrs[NL80211_ATTR_MAC])
1406                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1407
1408         rtnl_lock();
1409
1410         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1411         if (err)
1412                 goto unlock_rtnl;
1413
1414         if (!rdev->ops->add_key) {
1415                 err = -EOPNOTSUPP;
1416                 goto out;
1417         }
1418
1419         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1420                 err = -EINVAL;
1421                 goto out;
1422         }
1423
1424         wdev_lock(dev->ieee80211_ptr);
1425         err = nl80211_key_allowed(dev->ieee80211_ptr);
1426         if (!err)
1427                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1428                                          mac_addr, &key.p);
1429         wdev_unlock(dev->ieee80211_ptr);
1430
1431  out:
1432         cfg80211_unlock_rdev(rdev);
1433         dev_put(dev);
1434  unlock_rtnl:
1435         rtnl_unlock();
1436
1437         return err;
1438 }
1439
1440 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1441 {
1442         struct cfg80211_registered_device *rdev;
1443         int err;
1444         struct net_device *dev;
1445         u8 *mac_addr = NULL;
1446         struct key_parse key;
1447
1448         err = nl80211_parse_key(info, &key);
1449         if (err)
1450                 return err;
1451
1452         if (info->attrs[NL80211_ATTR_MAC])
1453                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1454
1455         rtnl_lock();
1456
1457         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1458         if (err)
1459                 goto unlock_rtnl;
1460
1461         if (!rdev->ops->del_key) {
1462                 err = -EOPNOTSUPP;
1463                 goto out;
1464         }
1465
1466         wdev_lock(dev->ieee80211_ptr);
1467         err = nl80211_key_allowed(dev->ieee80211_ptr);
1468         if (!err)
1469                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1470
1471 #ifdef CONFIG_CFG80211_WEXT
1472         if (!err) {
1473                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1474                         dev->ieee80211_ptr->wext.default_key = -1;
1475                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1476                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1477         }
1478 #endif
1479         wdev_unlock(dev->ieee80211_ptr);
1480
1481  out:
1482         cfg80211_unlock_rdev(rdev);
1483         dev_put(dev);
1484
1485  unlock_rtnl:
1486         rtnl_unlock();
1487
1488         return err;
1489 }
1490
1491 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1492 {
1493         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1494                     struct beacon_parameters *info);
1495         struct cfg80211_registered_device *rdev;
1496         int err;
1497         struct net_device *dev;
1498         struct beacon_parameters params;
1499         int haveinfo = 0;
1500
1501         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1502                 return -EINVAL;
1503
1504         rtnl_lock();
1505
1506         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1507         if (err)
1508                 goto unlock_rtnl;
1509
1510         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1511                 err = -EOPNOTSUPP;
1512                 goto out;
1513         }
1514
1515         switch (info->genlhdr->cmd) {
1516         case NL80211_CMD_NEW_BEACON:
1517                 /* these are required for NEW_BEACON */
1518                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1519                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1520                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1521                         err = -EINVAL;
1522                         goto out;
1523                 }
1524
1525                 call = rdev->ops->add_beacon;
1526                 break;
1527         case NL80211_CMD_SET_BEACON:
1528                 call = rdev->ops->set_beacon;
1529                 break;
1530         default:
1531                 WARN_ON(1);
1532                 err = -EOPNOTSUPP;
1533                 goto out;
1534         }
1535
1536         if (!call) {
1537                 err = -EOPNOTSUPP;
1538                 goto out;
1539         }
1540
1541         memset(&params, 0, sizeof(params));
1542
1543         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1544                 params.interval =
1545                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1546                 haveinfo = 1;
1547         }
1548
1549         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1550                 params.dtim_period =
1551                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1552                 haveinfo = 1;
1553         }
1554
1555         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1556                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1557                 params.head_len =
1558                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1559                 haveinfo = 1;
1560         }
1561
1562         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1563                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1564                 params.tail_len =
1565                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1566                 haveinfo = 1;
1567         }
1568
1569         if (!haveinfo) {
1570                 err = -EINVAL;
1571                 goto out;
1572         }
1573
1574         err = call(&rdev->wiphy, dev, &params);
1575
1576  out:
1577         cfg80211_unlock_rdev(rdev);
1578         dev_put(dev);
1579  unlock_rtnl:
1580         rtnl_unlock();
1581
1582         return err;
1583 }
1584
1585 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1586 {
1587         struct cfg80211_registered_device *rdev;
1588         int err;
1589         struct net_device *dev;
1590
1591         rtnl_lock();
1592
1593         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1594         if (err)
1595                 goto unlock_rtnl;
1596
1597         if (!rdev->ops->del_beacon) {
1598                 err = -EOPNOTSUPP;
1599                 goto out;
1600         }
1601
1602         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1603                 err = -EOPNOTSUPP;
1604                 goto out;
1605         }
1606         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1607
1608  out:
1609         cfg80211_unlock_rdev(rdev);
1610         dev_put(dev);
1611  unlock_rtnl:
1612         rtnl_unlock();
1613
1614         return err;
1615 }
1616
1617 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1618         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1619         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1620         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1621         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1622 };
1623
1624 static int parse_station_flags(struct genl_info *info,
1625                                struct station_parameters *params)
1626 {
1627         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1628         struct nlattr *nla;
1629         int flag;
1630
1631         /*
1632          * Try parsing the new attribute first so userspace
1633          * can specify both for older kernels.
1634          */
1635         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1636         if (nla) {
1637                 struct nl80211_sta_flag_update *sta_flags;
1638
1639                 sta_flags = nla_data(nla);
1640                 params->sta_flags_mask = sta_flags->mask;
1641                 params->sta_flags_set = sta_flags->set;
1642                 if ((params->sta_flags_mask |
1643                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1644                         return -EINVAL;
1645                 return 0;
1646         }
1647
1648         /* if present, parse the old attribute */
1649
1650         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1651         if (!nla)
1652                 return 0;
1653
1654         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1655                              nla, sta_flags_policy))
1656                 return -EINVAL;
1657
1658         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1659         params->sta_flags_mask &= ~1;
1660
1661         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1662                 if (flags[flag])
1663                         params->sta_flags_set |= (1<<flag);
1664
1665         return 0;
1666 }
1667
1668 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1669                                 int flags, struct net_device *dev,
1670                                 const u8 *mac_addr, struct station_info *sinfo)
1671 {
1672         void *hdr;
1673         struct nlattr *sinfoattr, *txrate;
1674         u16 bitrate;
1675
1676         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1677         if (!hdr)
1678                 return -1;
1679
1680         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1681         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1682
1683         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1684
1685         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1686         if (!sinfoattr)
1687                 goto nla_put_failure;
1688         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1689                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1690                             sinfo->inactive_time);
1691         if (sinfo->filled & STATION_INFO_RX_BYTES)
1692                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1693                             sinfo->rx_bytes);
1694         if (sinfo->filled & STATION_INFO_TX_BYTES)
1695                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1696                             sinfo->tx_bytes);
1697         if (sinfo->filled & STATION_INFO_LLID)
1698                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1699                             sinfo->llid);
1700         if (sinfo->filled & STATION_INFO_PLID)
1701                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1702                             sinfo->plid);
1703         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1704                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1705                             sinfo->plink_state);
1706         if (sinfo->filled & STATION_INFO_SIGNAL)
1707                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1708                            sinfo->signal);
1709         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1710                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1711                 if (!txrate)
1712                         goto nla_put_failure;
1713
1714                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1715                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1716                 if (bitrate > 0)
1717                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1718
1719                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1720                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1721                                     sinfo->txrate.mcs);
1722                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1723                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1724                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1725                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1726
1727                 nla_nest_end(msg, txrate);
1728         }
1729         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1730                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1731                             sinfo->rx_packets);
1732         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1733                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1734                             sinfo->tx_packets);
1735         nla_nest_end(msg, sinfoattr);
1736
1737         return genlmsg_end(msg, hdr);
1738
1739  nla_put_failure:
1740         genlmsg_cancel(msg, hdr);
1741         return -EMSGSIZE;
1742 }
1743
1744 static int nl80211_dump_station(struct sk_buff *skb,
1745                                 struct netlink_callback *cb)
1746 {
1747         struct station_info sinfo;
1748         struct cfg80211_registered_device *dev;
1749         struct net_device *netdev;
1750         u8 mac_addr[ETH_ALEN];
1751         int ifidx = cb->args[0];
1752         int sta_idx = cb->args[1];
1753         int err;
1754
1755         if (!ifidx)
1756                 ifidx = nl80211_get_ifidx(cb);
1757         if (ifidx < 0)
1758                 return ifidx;
1759
1760         rtnl_lock();
1761
1762         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1763         if (!netdev) {
1764                 err = -ENODEV;
1765                 goto out_rtnl;
1766         }
1767
1768         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1769         if (IS_ERR(dev)) {
1770                 err = PTR_ERR(dev);
1771                 goto out_rtnl;
1772         }
1773
1774         if (!dev->ops->dump_station) {
1775                 err = -EOPNOTSUPP;
1776                 goto out_err;
1777         }
1778
1779         while (1) {
1780                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1781                                              mac_addr, &sinfo);
1782                 if (err == -ENOENT)
1783                         break;
1784                 if (err)
1785                         goto out_err;
1786
1787                 if (nl80211_send_station(skb,
1788                                 NETLINK_CB(cb->skb).pid,
1789                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1790                                 netdev, mac_addr,
1791                                 &sinfo) < 0)
1792                         goto out;
1793
1794                 sta_idx++;
1795         }
1796
1797
1798  out:
1799         cb->args[1] = sta_idx;
1800         err = skb->len;
1801  out_err:
1802         cfg80211_unlock_rdev(dev);
1803  out_rtnl:
1804         rtnl_unlock();
1805
1806         return err;
1807 }
1808
1809 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1810 {
1811         struct cfg80211_registered_device *rdev;
1812         int err;
1813         struct net_device *dev;
1814         struct station_info sinfo;
1815         struct sk_buff *msg;
1816         u8 *mac_addr = NULL;
1817
1818         memset(&sinfo, 0, sizeof(sinfo));
1819
1820         if (!info->attrs[NL80211_ATTR_MAC])
1821                 return -EINVAL;
1822
1823         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1824
1825         rtnl_lock();
1826
1827         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1828         if (err)
1829                 goto out_rtnl;
1830
1831         if (!rdev->ops->get_station) {
1832                 err = -EOPNOTSUPP;
1833                 goto out;
1834         }
1835
1836         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1837         if (err)
1838                 goto out;
1839
1840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1841         if (!msg)
1842                 goto out;
1843
1844         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1845                                  dev, mac_addr, &sinfo) < 0)
1846                 goto out_free;
1847
1848         err = genlmsg_reply(msg, info);
1849         goto out;
1850
1851  out_free:
1852         nlmsg_free(msg);
1853  out:
1854         cfg80211_unlock_rdev(rdev);
1855         dev_put(dev);
1856  out_rtnl:
1857         rtnl_unlock();
1858
1859         return err;
1860 }
1861
1862 /*
1863  * Get vlan interface making sure it is running and on the right wiphy.
1864  */
1865 static int get_vlan(struct genl_info *info,
1866                     struct cfg80211_registered_device *rdev,
1867                     struct net_device **vlan)
1868 {
1869         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1870         *vlan = NULL;
1871
1872         if (vlanattr) {
1873                 *vlan = dev_get_by_index(genl_info_net(info),
1874                                          nla_get_u32(vlanattr));
1875                 if (!*vlan)
1876                         return -ENODEV;
1877                 if (!(*vlan)->ieee80211_ptr)
1878                         return -EINVAL;
1879                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1880                         return -EINVAL;
1881                 if (!netif_running(*vlan))
1882                         return -ENETDOWN;
1883         }
1884         return 0;
1885 }
1886
1887 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1888 {
1889         struct cfg80211_registered_device *rdev;
1890         int err;
1891         struct net_device *dev;
1892         struct station_parameters params;
1893         u8 *mac_addr = NULL;
1894
1895         memset(&params, 0, sizeof(params));
1896
1897         params.listen_interval = -1;
1898
1899         if (info->attrs[NL80211_ATTR_STA_AID])
1900                 return -EINVAL;
1901
1902         if (!info->attrs[NL80211_ATTR_MAC])
1903                 return -EINVAL;
1904
1905         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1906
1907         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1908                 params.supported_rates =
1909                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1910                 params.supported_rates_len =
1911                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1912         }
1913
1914         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1915                 params.listen_interval =
1916                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1917
1918         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1919                 params.ht_capa =
1920                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1921
1922         if (parse_station_flags(info, &params))
1923                 return -EINVAL;
1924
1925         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1926                 params.plink_action =
1927                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1928
1929         rtnl_lock();
1930
1931         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1932         if (err)
1933                 goto out_rtnl;
1934
1935         err = get_vlan(info, rdev, &params.vlan);
1936         if (err)
1937                 goto out;
1938
1939         /* validate settings */
1940         err = 0;
1941
1942         switch (dev->ieee80211_ptr->iftype) {
1943         case NL80211_IFTYPE_AP:
1944         case NL80211_IFTYPE_AP_VLAN:
1945                 /* disallow mesh-specific things */
1946                 if (params.plink_action)
1947                         err = -EINVAL;
1948                 break;
1949         case NL80211_IFTYPE_STATION:
1950                 /* disallow everything but AUTHORIZED flag */
1951                 if (params.plink_action)
1952                         err = -EINVAL;
1953                 if (params.vlan)
1954                         err = -EINVAL;
1955                 if (params.supported_rates)
1956                         err = -EINVAL;
1957                 if (params.ht_capa)
1958                         err = -EINVAL;
1959                 if (params.listen_interval >= 0)
1960                         err = -EINVAL;
1961                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1962                         err = -EINVAL;
1963                 break;
1964         case NL80211_IFTYPE_MESH_POINT:
1965                 /* disallow things mesh doesn't support */
1966                 if (params.vlan)
1967                         err = -EINVAL;
1968                 if (params.ht_capa)
1969                         err = -EINVAL;
1970                 if (params.listen_interval >= 0)
1971                         err = -EINVAL;
1972                 if (params.supported_rates)
1973                         err = -EINVAL;
1974                 if (params.sta_flags_mask)
1975                         err = -EINVAL;
1976                 break;
1977         default:
1978                 err = -EINVAL;
1979         }
1980
1981         if (err)
1982                 goto out;
1983
1984         if (!rdev->ops->change_station) {
1985                 err = -EOPNOTSUPP;
1986                 goto out;
1987         }
1988
1989         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1990
1991  out:
1992         if (params.vlan)
1993                 dev_put(params.vlan);
1994         cfg80211_unlock_rdev(rdev);
1995         dev_put(dev);
1996  out_rtnl:
1997         rtnl_unlock();
1998
1999         return err;
2000 }
2001
2002 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2003 {
2004         struct cfg80211_registered_device *rdev;
2005         int err;
2006         struct net_device *dev;
2007         struct station_parameters params;
2008         u8 *mac_addr = NULL;
2009
2010         memset(&params, 0, sizeof(params));
2011
2012         if (!info->attrs[NL80211_ATTR_MAC])
2013                 return -EINVAL;
2014
2015         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2016                 return -EINVAL;
2017
2018         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2019                 return -EINVAL;
2020
2021         if (!info->attrs[NL80211_ATTR_STA_AID])
2022                 return -EINVAL;
2023
2024         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2025         params.supported_rates =
2026                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2027         params.supported_rates_len =
2028                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2029         params.listen_interval =
2030                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2031
2032         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2033         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2034                 return -EINVAL;
2035
2036         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2037                 params.ht_capa =
2038                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2039
2040         if (parse_station_flags(info, &params))
2041                 return -EINVAL;
2042
2043         rtnl_lock();
2044
2045         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2046         if (err)
2047                 goto out_rtnl;
2048
2049         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2050             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2051                 err = -EINVAL;
2052                 goto out;
2053         }
2054
2055         err = get_vlan(info, rdev, &params.vlan);
2056         if (err)
2057                 goto out;
2058
2059         /* validate settings */
2060         err = 0;
2061
2062         if (!rdev->ops->add_station) {
2063                 err = -EOPNOTSUPP;
2064                 goto out;
2065         }
2066
2067         if (!netif_running(dev)) {
2068                 err = -ENETDOWN;
2069                 goto out;
2070         }
2071
2072         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2073
2074  out:
2075         if (params.vlan)
2076                 dev_put(params.vlan);
2077         cfg80211_unlock_rdev(rdev);
2078         dev_put(dev);
2079  out_rtnl:
2080         rtnl_unlock();
2081
2082         return err;
2083 }
2084
2085 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2086 {
2087         struct cfg80211_registered_device *rdev;
2088         int err;
2089         struct net_device *dev;
2090         u8 *mac_addr = NULL;
2091
2092         if (info->attrs[NL80211_ATTR_MAC])
2093                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2094
2095         rtnl_lock();
2096
2097         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2098         if (err)
2099                 goto out_rtnl;
2100
2101         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2103             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2104                 err = -EINVAL;
2105                 goto out;
2106         }
2107
2108         if (!rdev->ops->del_station) {
2109                 err = -EOPNOTSUPP;
2110                 goto out;
2111         }
2112
2113         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2114
2115  out:
2116         cfg80211_unlock_rdev(rdev);
2117         dev_put(dev);
2118  out_rtnl:
2119         rtnl_unlock();
2120
2121         return err;
2122 }
2123
2124 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2125                                 int flags, struct net_device *dev,
2126                                 u8 *dst, u8 *next_hop,
2127                                 struct mpath_info *pinfo)
2128 {
2129         void *hdr;
2130         struct nlattr *pinfoattr;
2131
2132         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2133         if (!hdr)
2134                 return -1;
2135
2136         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2137         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2138         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2139
2140         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2141
2142         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2143         if (!pinfoattr)
2144                 goto nla_put_failure;
2145         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2146                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2147                             pinfo->frame_qlen);
2148         if (pinfo->filled & MPATH_INFO_SN)
2149                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2150                             pinfo->sn);
2151         if (pinfo->filled & MPATH_INFO_METRIC)
2152                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2153                             pinfo->metric);
2154         if (pinfo->filled & MPATH_INFO_EXPTIME)
2155                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2156                             pinfo->exptime);
2157         if (pinfo->filled & MPATH_INFO_FLAGS)
2158                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2159                             pinfo->flags);
2160         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2161                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2162                             pinfo->discovery_timeout);
2163         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2164                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2165                             pinfo->discovery_retries);
2166
2167         nla_nest_end(msg, pinfoattr);
2168
2169         return genlmsg_end(msg, hdr);
2170
2171  nla_put_failure:
2172         genlmsg_cancel(msg, hdr);
2173         return -EMSGSIZE;
2174 }
2175
2176 static int nl80211_dump_mpath(struct sk_buff *skb,
2177                               struct netlink_callback *cb)
2178 {
2179         struct mpath_info pinfo;
2180         struct cfg80211_registered_device *dev;
2181         struct net_device *netdev;
2182         u8 dst[ETH_ALEN];
2183         u8 next_hop[ETH_ALEN];
2184         int ifidx = cb->args[0];
2185         int path_idx = cb->args[1];
2186         int err;
2187
2188         if (!ifidx)
2189                 ifidx = nl80211_get_ifidx(cb);
2190         if (ifidx < 0)
2191                 return ifidx;
2192
2193         rtnl_lock();
2194
2195         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2196         if (!netdev) {
2197                 err = -ENODEV;
2198                 goto out_rtnl;
2199         }
2200
2201         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2202         if (IS_ERR(dev)) {
2203                 err = PTR_ERR(dev);
2204                 goto out_rtnl;
2205         }
2206
2207         if (!dev->ops->dump_mpath) {
2208                 err = -EOPNOTSUPP;
2209                 goto out_err;
2210         }
2211
2212         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2213                 err = -EOPNOTSUPP;
2214                 goto out_err;
2215         }
2216
2217         while (1) {
2218                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2219                                            dst, next_hop, &pinfo);
2220                 if (err == -ENOENT)
2221                         break;
2222                 if (err)
2223                         goto out_err;
2224
2225                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2226                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2227                                        netdev, dst, next_hop,
2228                                        &pinfo) < 0)
2229                         goto out;
2230
2231                 path_idx++;
2232         }
2233
2234
2235  out:
2236         cb->args[1] = path_idx;
2237         err = skb->len;
2238  out_err:
2239         cfg80211_unlock_rdev(dev);
2240  out_rtnl:
2241         rtnl_unlock();
2242
2243         return err;
2244 }
2245
2246 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2247 {
2248         struct cfg80211_registered_device *rdev;
2249         int err;
2250         struct net_device *dev;
2251         struct mpath_info pinfo;
2252         struct sk_buff *msg;
2253         u8 *dst = NULL;
2254         u8 next_hop[ETH_ALEN];
2255
2256         memset(&pinfo, 0, sizeof(pinfo));
2257
2258         if (!info->attrs[NL80211_ATTR_MAC])
2259                 return -EINVAL;
2260
2261         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2262
2263         rtnl_lock();
2264
2265         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2266         if (err)
2267                 goto out_rtnl;
2268
2269         if (!rdev->ops->get_mpath) {
2270                 err = -EOPNOTSUPP;
2271                 goto out;
2272         }
2273
2274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2275                 err = -EOPNOTSUPP;
2276                 goto out;
2277         }
2278
2279         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2280         if (err)
2281                 goto out;
2282
2283         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2284         if (!msg)
2285                 goto out;
2286
2287         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2288                                  dev, dst, next_hop, &pinfo) < 0)
2289                 goto out_free;
2290
2291         err = genlmsg_reply(msg, info);
2292         goto out;
2293
2294  out_free:
2295         nlmsg_free(msg);
2296  out:
2297         cfg80211_unlock_rdev(rdev);
2298         dev_put(dev);
2299  out_rtnl:
2300         rtnl_unlock();
2301
2302         return err;
2303 }
2304
2305 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2306 {
2307         struct cfg80211_registered_device *rdev;
2308         int err;
2309         struct net_device *dev;
2310         u8 *dst = NULL;
2311         u8 *next_hop = NULL;
2312
2313         if (!info->attrs[NL80211_ATTR_MAC])
2314                 return -EINVAL;
2315
2316         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2317                 return -EINVAL;
2318
2319         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2320         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2321
2322         rtnl_lock();
2323
2324         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2325         if (err)
2326                 goto out_rtnl;
2327
2328         if (!rdev->ops->change_mpath) {
2329                 err = -EOPNOTSUPP;
2330                 goto out;
2331         }
2332
2333         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2334                 err = -EOPNOTSUPP;
2335                 goto out;
2336         }
2337
2338         if (!netif_running(dev)) {
2339                 err = -ENETDOWN;
2340                 goto out;
2341         }
2342
2343         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2344
2345  out:
2346         cfg80211_unlock_rdev(rdev);
2347         dev_put(dev);
2348  out_rtnl:
2349         rtnl_unlock();
2350
2351         return err;
2352 }
2353 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2354 {
2355         struct cfg80211_registered_device *rdev;
2356         int err;
2357         struct net_device *dev;
2358         u8 *dst = NULL;
2359         u8 *next_hop = NULL;
2360
2361         if (!info->attrs[NL80211_ATTR_MAC])
2362                 return -EINVAL;
2363
2364         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2365                 return -EINVAL;
2366
2367         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2368         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2369
2370         rtnl_lock();
2371
2372         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2373         if (err)
2374                 goto out_rtnl;
2375
2376         if (!rdev->ops->add_mpath) {
2377                 err = -EOPNOTSUPP;
2378                 goto out;
2379         }
2380
2381         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2382                 err = -EOPNOTSUPP;
2383                 goto out;
2384         }
2385
2386         if (!netif_running(dev)) {
2387                 err = -ENETDOWN;
2388                 goto out;
2389         }
2390
2391         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2392
2393  out:
2394         cfg80211_unlock_rdev(rdev);
2395         dev_put(dev);
2396  out_rtnl:
2397         rtnl_unlock();
2398
2399         return err;
2400 }
2401
2402 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2403 {
2404         struct cfg80211_registered_device *rdev;
2405         int err;
2406         struct net_device *dev;
2407         u8 *dst = NULL;
2408
2409         if (info->attrs[NL80211_ATTR_MAC])
2410                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2411
2412         rtnl_lock();
2413
2414         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2415         if (err)
2416                 goto out_rtnl;
2417
2418         if (!rdev->ops->del_mpath) {
2419                 err = -EOPNOTSUPP;
2420                 goto out;
2421         }
2422
2423         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2424
2425  out:
2426         cfg80211_unlock_rdev(rdev);
2427         dev_put(dev);
2428  out_rtnl:
2429         rtnl_unlock();
2430
2431         return err;
2432 }
2433
2434 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2435 {
2436         struct cfg80211_registered_device *rdev;
2437         int err;
2438         struct net_device *dev;
2439         struct bss_parameters params;
2440
2441         memset(&params, 0, sizeof(params));
2442         /* default to not changing parameters */
2443         params.use_cts_prot = -1;
2444         params.use_short_preamble = -1;
2445         params.use_short_slot_time = -1;
2446         params.ap_isolate = -1;
2447
2448         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2449                 params.use_cts_prot =
2450                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2451         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2452                 params.use_short_preamble =
2453                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2454         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2455                 params.use_short_slot_time =
2456                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2457         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2458                 params.basic_rates =
2459                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2460                 params.basic_rates_len =
2461                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2462         }
2463         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2464                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2465
2466         rtnl_lock();
2467
2468         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2469         if (err)
2470                 goto out_rtnl;
2471
2472         if (!rdev->ops->change_bss) {
2473                 err = -EOPNOTSUPP;
2474                 goto out;
2475         }
2476
2477         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2478                 err = -EOPNOTSUPP;
2479                 goto out;
2480         }
2481
2482         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2483
2484  out:
2485         cfg80211_unlock_rdev(rdev);
2486         dev_put(dev);
2487  out_rtnl:
2488         rtnl_unlock();
2489
2490         return err;
2491 }
2492
2493 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2494         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2495         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2496         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2497         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2498         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2499         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2500 };
2501
2502 static int parse_reg_rule(struct nlattr *tb[],
2503         struct ieee80211_reg_rule *reg_rule)
2504 {
2505         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2506         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2507
2508         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2509                 return -EINVAL;
2510         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2511                 return -EINVAL;
2512         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2513                 return -EINVAL;
2514         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2515                 return -EINVAL;
2516         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2517                 return -EINVAL;
2518
2519         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2520
2521         freq_range->start_freq_khz =
2522                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2523         freq_range->end_freq_khz =
2524                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2525         freq_range->max_bandwidth_khz =
2526                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2527
2528         power_rule->max_eirp =
2529                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2530
2531         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2532                 power_rule->max_antenna_gain =
2533                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2534
2535         return 0;
2536 }
2537
2538 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2539 {
2540         int r;
2541         char *data = NULL;
2542
2543         /*
2544          * You should only get this when cfg80211 hasn't yet initialized
2545          * completely when built-in to the kernel right between the time
2546          * window between nl80211_init() and regulatory_init(), if that is
2547          * even possible.
2548          */
2549         mutex_lock(&cfg80211_mutex);
2550         if (unlikely(!cfg80211_regdomain)) {
2551                 mutex_unlock(&cfg80211_mutex);
2552                 return -EINPROGRESS;
2553         }
2554         mutex_unlock(&cfg80211_mutex);
2555
2556         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2557                 return -EINVAL;
2558
2559         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2560
2561         r = regulatory_hint_user(data);
2562
2563         return r;
2564 }
2565
2566 static int nl80211_get_mesh_params(struct sk_buff *skb,
2567         struct genl_info *info)
2568 {
2569         struct cfg80211_registered_device *rdev;
2570         struct mesh_config cur_params;
2571         int err;
2572         struct net_device *dev;
2573         void *hdr;
2574         struct nlattr *pinfoattr;
2575         struct sk_buff *msg;
2576
2577         rtnl_lock();
2578
2579         /* Look up our device */
2580         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2581         if (err)
2582                 goto out_rtnl;
2583
2584         if (!rdev->ops->get_mesh_params) {
2585                 err = -EOPNOTSUPP;
2586                 goto out;
2587         }
2588
2589         /* Get the mesh params */
2590         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2591         if (err)
2592                 goto out;
2593
2594         /* Draw up a netlink message to send back */
2595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2596         if (!msg) {
2597                 err = -ENOBUFS;
2598                 goto out;
2599         }
2600         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2601                              NL80211_CMD_GET_MESH_PARAMS);
2602         if (!hdr)
2603                 goto nla_put_failure;
2604         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2605         if (!pinfoattr)
2606                 goto nla_put_failure;
2607         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2609                         cur_params.dot11MeshRetryTimeout);
2610         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2611                         cur_params.dot11MeshConfirmTimeout);
2612         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2613                         cur_params.dot11MeshHoldingTimeout);
2614         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2615                         cur_params.dot11MeshMaxPeerLinks);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2617                         cur_params.dot11MeshMaxRetries);
2618         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2619                         cur_params.dot11MeshTTL);
2620         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2621                         cur_params.auto_open_plinks);
2622         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2623                         cur_params.dot11MeshHWMPmaxPREQretries);
2624         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2625                         cur_params.path_refresh_time);
2626         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2627                         cur_params.min_discovery_timeout);
2628         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2629                         cur_params.dot11MeshHWMPactivePathTimeout);
2630         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2631                         cur_params.dot11MeshHWMPpreqMinInterval);
2632         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2633                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2634         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2635                         cur_params.dot11MeshHWMPRootMode);
2636         nla_nest_end(msg, pinfoattr);
2637         genlmsg_end(msg, hdr);
2638         err = genlmsg_reply(msg, info);
2639         goto out;
2640
2641  nla_put_failure:
2642         genlmsg_cancel(msg, hdr);
2643         err = -EMSGSIZE;
2644  out:
2645         /* Cleanup */
2646         cfg80211_unlock_rdev(rdev);
2647         dev_put(dev);
2648  out_rtnl:
2649         rtnl_unlock();
2650
2651         return err;
2652 }
2653
2654 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2655 do {\
2656         if (table[attr_num]) {\
2657                 cfg.param = nla_fn(table[attr_num]); \
2658                 mask |= (1 << (attr_num - 1)); \
2659         } \
2660 } while (0);\
2661
2662 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2663         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2664         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2665         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2666         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2667         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2668         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2669         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2670
2671         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2672         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2673         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2674         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2675         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2676         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2677 };
2678
2679 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2680 {
2681         int err;
2682         u32 mask;
2683         struct cfg80211_registered_device *rdev;
2684         struct net_device *dev;
2685         struct mesh_config cfg;
2686         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2687         struct nlattr *parent_attr;
2688
2689         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2690         if (!parent_attr)
2691                 return -EINVAL;
2692         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2693                         parent_attr, nl80211_meshconf_params_policy))
2694                 return -EINVAL;
2695
2696         rtnl_lock();
2697
2698         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2699         if (err)
2700                 goto out_rtnl;
2701
2702         if (!rdev->ops->set_mesh_params) {
2703                 err = -EOPNOTSUPP;
2704                 goto out;
2705         }
2706
2707         /* This makes sure that there aren't more than 32 mesh config
2708          * parameters (otherwise our bitfield scheme would not work.) */
2709         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2710
2711         /* Fill in the params struct */
2712         mask = 0;
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2714                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2716                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2718                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2720                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2722                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2724                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2726                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2728                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2729                         nla_get_u8);
2730         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2731                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2732         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2733                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2734                         nla_get_u16);
2735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2736                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2737                         nla_get_u32);
2738         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2739                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2740                         nla_get_u16);
2741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2742                         dot11MeshHWMPnetDiameterTraversalTime,
2743                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2744                         nla_get_u16);
2745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2746                         dot11MeshHWMPRootMode, mask,
2747                         NL80211_MESHCONF_HWMP_ROOTMODE,
2748                         nla_get_u8);
2749
2750         /* Apply changes */
2751         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2752
2753  out:
2754         /* cleanup */
2755         cfg80211_unlock_rdev(rdev);
2756         dev_put(dev);
2757  out_rtnl:
2758         rtnl_unlock();
2759
2760         return err;
2761 }
2762
2763 #undef FILL_IN_MESH_PARAM_IF_SET
2764
2765 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2766 {
2767         struct sk_buff *msg;
2768         void *hdr = NULL;
2769         struct nlattr *nl_reg_rules;
2770         unsigned int i;
2771         int err = -EINVAL;
2772
2773         mutex_lock(&cfg80211_mutex);
2774
2775         if (!cfg80211_regdomain)
2776                 goto out;
2777
2778         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2779         if (!msg) {
2780                 err = -ENOBUFS;
2781                 goto out;
2782         }
2783
2784         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2785                              NL80211_CMD_GET_REG);
2786         if (!hdr)
2787                 goto nla_put_failure;
2788
2789         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2790                 cfg80211_regdomain->alpha2);
2791
2792         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2793         if (!nl_reg_rules)
2794                 goto nla_put_failure;
2795
2796         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2797                 struct nlattr *nl_reg_rule;
2798                 const struct ieee80211_reg_rule *reg_rule;
2799                 const struct ieee80211_freq_range *freq_range;
2800                 const struct ieee80211_power_rule *power_rule;
2801
2802                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2803                 freq_range = &reg_rule->freq_range;
2804                 power_rule = &reg_rule->power_rule;
2805
2806                 nl_reg_rule = nla_nest_start(msg, i);
2807                 if (!nl_reg_rule)
2808                         goto nla_put_failure;
2809
2810                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2811                         reg_rule->flags);
2812                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2813                         freq_range->start_freq_khz);
2814                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2815                         freq_range->end_freq_khz);
2816                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2817                         freq_range->max_bandwidth_khz);
2818                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2819                         power_rule->max_antenna_gain);
2820                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2821                         power_rule->max_eirp);
2822
2823                 nla_nest_end(msg, nl_reg_rule);
2824         }
2825
2826         nla_nest_end(msg, nl_reg_rules);
2827
2828         genlmsg_end(msg, hdr);
2829         err = genlmsg_reply(msg, info);
2830         goto out;
2831
2832 nla_put_failure:
2833         genlmsg_cancel(msg, hdr);
2834         err = -EMSGSIZE;
2835 out:
2836         mutex_unlock(&cfg80211_mutex);
2837         return err;
2838 }
2839
2840 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2841 {
2842         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2843         struct nlattr *nl_reg_rule;
2844         char *alpha2 = NULL;
2845         int rem_reg_rules = 0, r = 0;
2846         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2847         struct ieee80211_regdomain *rd = NULL;
2848
2849         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2850                 return -EINVAL;
2851
2852         if (!info->attrs[NL80211_ATTR_REG_RULES])
2853                 return -EINVAL;
2854
2855         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2856
2857         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2858                         rem_reg_rules) {
2859                 num_rules++;
2860                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2861                         return -EINVAL;
2862         }
2863
2864         mutex_lock(&cfg80211_mutex);
2865
2866         if (!reg_is_valid_request(alpha2)) {
2867                 r = -EINVAL;
2868                 goto bad_reg;
2869         }
2870
2871         size_of_regd = sizeof(struct ieee80211_regdomain) +
2872                 (num_rules * sizeof(struct ieee80211_reg_rule));
2873
2874         rd = kzalloc(size_of_regd, GFP_KERNEL);
2875         if (!rd) {
2876                 r = -ENOMEM;
2877                 goto bad_reg;
2878         }
2879
2880         rd->n_reg_rules = num_rules;
2881         rd->alpha2[0] = alpha2[0];
2882         rd->alpha2[1] = alpha2[1];
2883
2884         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2885                         rem_reg_rules) {
2886                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2887                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2888                         reg_rule_policy);
2889                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2890                 if (r)
2891                         goto bad_reg;
2892
2893                 rule_idx++;
2894
2895                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2896                         r = -EINVAL;
2897                         goto bad_reg;
2898                 }
2899         }
2900
2901         BUG_ON(rule_idx != num_rules);
2902
2903         r = set_regdom(rd);
2904
2905         mutex_unlock(&cfg80211_mutex);
2906
2907         return r;
2908
2909  bad_reg:
2910         mutex_unlock(&cfg80211_mutex);
2911         kfree(rd);
2912         return r;
2913 }
2914
2915 static int validate_scan_freqs(struct nlattr *freqs)
2916 {
2917         struct nlattr *attr1, *attr2;
2918         int n_channels = 0, tmp1, tmp2;
2919
2920         nla_for_each_nested(attr1, freqs, tmp1) {
2921                 n_channels++;
2922                 /*
2923                  * Some hardware has a limited channel list for
2924                  * scanning, and it is pretty much nonsensical
2925                  * to scan for a channel twice, so disallow that
2926                  * and don't require drivers to check that the
2927                  * channel list they get isn't longer than what
2928                  * they can scan, as long as they can scan all
2929                  * the channels they registered at once.
2930                  */
2931                 nla_for_each_nested(attr2, freqs, tmp2)
2932                         if (attr1 != attr2 &&
2933                             nla_get_u32(attr1) == nla_get_u32(attr2))
2934                                 return 0;
2935         }
2936
2937         return n_channels;
2938 }
2939
2940 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2941 {
2942         struct cfg80211_registered_device *rdev;
2943         struct net_device *dev;
2944         struct cfg80211_scan_request *request;
2945         struct cfg80211_ssid *ssid;
2946         struct ieee80211_channel *channel;
2947         struct nlattr *attr;
2948         struct wiphy *wiphy;
2949         int err, tmp, n_ssids = 0, n_channels, i;
2950         enum ieee80211_band band;
2951         size_t ie_len;
2952
2953         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2954                 return -EINVAL;
2955
2956         rtnl_lock();
2957
2958         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2959         if (err)
2960                 goto out_rtnl;
2961
2962         wiphy = &rdev->wiphy;
2963
2964         if (!rdev->ops->scan) {
2965                 err = -EOPNOTSUPP;
2966                 goto out;
2967         }
2968
2969         if (!netif_running(dev)) {
2970                 err = -ENETDOWN;
2971                 goto out;
2972         }
2973
2974         if (rdev->scan_req) {
2975                 err = -EBUSY;
2976                 goto out;
2977         }
2978
2979         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2980                 n_channels = validate_scan_freqs(
2981                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2982                 if (!n_channels) {
2983                         err = -EINVAL;
2984                         goto out;
2985                 }
2986         } else {
2987                 n_channels = 0;
2988
2989                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2990                         if (wiphy->bands[band])
2991                                 n_channels += wiphy->bands[band]->n_channels;
2992         }
2993
2994         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2995                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2996                         n_ssids++;
2997
2998         if (n_ssids > wiphy->max_scan_ssids) {
2999                 err = -EINVAL;
3000                 goto out;
3001         }
3002
3003         if (info->attrs[NL80211_ATTR_IE])
3004                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3005         else
3006                 ie_len = 0;
3007
3008         if (ie_len > wiphy->max_scan_ie_len) {
3009                 err = -EINVAL;
3010                 goto out;
3011         }
3012
3013         request = kzalloc(sizeof(*request)
3014                         + sizeof(*ssid) * n_ssids
3015                         + sizeof(channel) * n_channels
3016                         + ie_len, GFP_KERNEL);
3017         if (!request) {
3018                 err = -ENOMEM;
3019                 goto out;
3020         }
3021
3022         if (n_ssids)
3023                 request->ssids = (void *)&request->channels[n_channels];
3024         request->n_ssids = n_ssids;
3025         if (ie_len) {
3026                 if (request->ssids)
3027                         request->ie = (void *)(request->ssids + n_ssids);
3028                 else
3029                         request->ie = (void *)(request->channels + n_channels);
3030         }
3031
3032         i = 0;
3033         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3034                 /* user specified, bail out if channel not found */
3035                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3036                         struct ieee80211_channel *chan;
3037
3038                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3039
3040                         if (!chan) {
3041                                 err = -EINVAL;
3042                                 goto out_free;
3043                         }
3044
3045                         /* ignore disabled channels */
3046                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3047                                 continue;
3048
3049                         request->channels[i] = chan;
3050                         i++;
3051                 }
3052         } else {
3053                 /* all channels */
3054                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3055                         int j;
3056                         if (!wiphy->bands[band])
3057                                 continue;
3058                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3059                                 struct ieee80211_channel *chan;
3060
3061                                 chan = &wiphy->bands[band]->channels[j];
3062
3063                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3064                                         continue;
3065
3066                                 request->channels[i] = chan;
3067                                 i++;
3068                         }
3069                 }
3070         }
3071
3072         if (!i) {
3073                 err = -EINVAL;
3074                 goto out_free;
3075         }
3076
3077         request->n_channels = i;
3078
3079         i = 0;
3080         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3081                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3082                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3083                                 err = -EINVAL;
3084                                 goto out_free;
3085                         }
3086                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3087                         request->ssids[i].ssid_len = nla_len(attr);
3088                         i++;
3089                 }
3090         }
3091
3092         if (info->attrs[NL80211_ATTR_IE]) {
3093                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3094                 memcpy((void *)request->ie,
3095                        nla_data(info->attrs[NL80211_ATTR_IE]),
3096                        request->ie_len);
3097         }
3098
3099         request->dev = dev;
3100         request->wiphy = &rdev->wiphy;
3101
3102         rdev->scan_req = request;
3103         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3104
3105         if (!err) {
3106                 nl80211_send_scan_start(rdev, dev);
3107                 dev_hold(dev);
3108         }
3109
3110  out_free:
3111         if (err) {
3112                 rdev->scan_req = NULL;
3113                 kfree(request);
3114         }
3115  out:
3116         cfg80211_unlock_rdev(rdev);
3117         dev_put(dev);
3118  out_rtnl:
3119         rtnl_unlock();
3120
3121         return err;
3122 }
3123
3124 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3125                             struct cfg80211_registered_device *rdev,
3126                             struct wireless_dev *wdev,
3127                             struct cfg80211_internal_bss *intbss)
3128 {
3129         struct cfg80211_bss *res = &intbss->pub;
3130         void *hdr;
3131         struct nlattr *bss;
3132         int i;
3133
3134         ASSERT_WDEV_LOCK(wdev);
3135
3136         hdr = nl80211hdr_put(msg, pid, seq, flags,
3137                              NL80211_CMD_NEW_SCAN_RESULTS);
3138         if (!hdr)
3139                 return -1;
3140
3141         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3142         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3143
3144         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3145         if (!bss)
3146                 goto nla_put_failure;
3147         if (!is_zero_ether_addr(res->bssid))
3148                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3149         if (res->information_elements && res->len_information_elements)
3150                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3151                         res->len_information_elements,
3152                         res->information_elements);
3153         if (res->beacon_ies && res->len_beacon_ies &&
3154             res->beacon_ies != res->information_elements)
3155                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3156                         res->len_beacon_ies, res->beacon_ies);
3157         if (res->tsf)
3158                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3159         if (res->beacon_interval)
3160                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3161         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3162         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3163         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3164                 jiffies_to_msecs(jiffies - intbss->ts));
3165
3166         switch (rdev->wiphy.signal_type) {
3167         case CFG80211_SIGNAL_TYPE_MBM:
3168                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3169                 break;
3170         case CFG80211_SIGNAL_TYPE_UNSPEC:
3171                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3172                 break;
3173         default:
3174                 break;
3175         }
3176
3177         switch (wdev->iftype) {
3178         case NL80211_IFTYPE_STATION:
3179                 if (intbss == wdev->current_bss)
3180                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3181                                     NL80211_BSS_STATUS_ASSOCIATED);
3182                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3183                         if (intbss != wdev->auth_bsses[i])
3184                                 continue;
3185                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3186                                     NL80211_BSS_STATUS_AUTHENTICATED);
3187                         break;
3188                 }
3189                 break;
3190         case NL80211_IFTYPE_ADHOC:
3191                 if (intbss == wdev->current_bss)
3192                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3193                                     NL80211_BSS_STATUS_IBSS_JOINED);
3194                 break;
3195         default:
3196                 break;
3197         }
3198
3199         nla_nest_end(msg, bss);
3200
3201         return genlmsg_end(msg, hdr);
3202
3203  nla_put_failure:
3204         genlmsg_cancel(msg, hdr);
3205         return -EMSGSIZE;
3206 }
3207
3208 static int nl80211_dump_scan(struct sk_buff *skb,
3209                              struct netlink_callback *cb)
3210 {
3211         struct cfg80211_registered_device *rdev;
3212         struct net_device *dev;
3213         struct cfg80211_internal_bss *scan;
3214         struct wireless_dev *wdev;
3215         int ifidx = cb->args[0];
3216         int start = cb->args[1], idx = 0;
3217         int err;
3218
3219         if (!ifidx)
3220                 ifidx = nl80211_get_ifidx(cb);
3221         if (ifidx < 0)
3222                 return ifidx;
3223         cb->args[0] = ifidx;
3224
3225         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3226         if (!dev)
3227                 return -ENODEV;
3228
3229         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3230         if (IS_ERR(rdev)) {
3231                 err = PTR_ERR(rdev);
3232                 goto out_put_netdev;
3233         }
3234
3235         wdev = dev->ieee80211_ptr;
3236
3237         wdev_lock(wdev);
3238         spin_lock_bh(&rdev->bss_lock);
3239         cfg80211_bss_expire(rdev);
3240
3241         list_for_each_entry(scan, &rdev->bss_list, list) {
3242                 if (++idx <= start)
3243                         continue;
3244                 if (nl80211_send_bss(skb,
3245                                 NETLINK_CB(cb->skb).pid,
3246                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3247                                 rdev, wdev, scan) < 0) {
3248                         idx--;
3249                         goto out;
3250                 }
3251         }
3252
3253  out:
3254         spin_unlock_bh(&rdev->bss_lock);
3255         wdev_unlock(wdev);
3256
3257         cb->args[1] = idx;
3258         err = skb->len;
3259         cfg80211_unlock_rdev(rdev);
3260  out_put_netdev:
3261         dev_put(dev);
3262
3263         return err;
3264 }
3265
3266 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3267                                 int flags, struct net_device *dev,
3268                                 struct survey_info *survey)
3269 {
3270         void *hdr;
3271         struct nlattr *infoattr;
3272
3273         /* Survey without a channel doesn't make sense */
3274         if (!survey->channel)
3275                 return -EINVAL;
3276
3277         hdr = nl80211hdr_put(msg, pid, seq, flags,
3278                              NL80211_CMD_NEW_SURVEY_RESULTS);
3279         if (!hdr)
3280                 return -ENOMEM;
3281
3282         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3283
3284         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3285         if (!infoattr)
3286                 goto nla_put_failure;
3287
3288         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3289                     survey->channel->center_freq);
3290         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3291                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3292                             survey->noise);
3293
3294         nla_nest_end(msg, infoattr);
3295
3296         return genlmsg_end(msg, hdr);
3297
3298  nla_put_failure:
3299         genlmsg_cancel(msg, hdr);
3300         return -EMSGSIZE;
3301 }
3302
3303 static int nl80211_dump_survey(struct sk_buff *skb,
3304                         struct netlink_callback *cb)
3305 {
3306         struct survey_info survey;
3307         struct cfg80211_registered_device *dev;
3308         struct net_device *netdev;
3309         int ifidx = cb->args[0];
3310         int survey_idx = cb->args[1];
3311         int res;
3312
3313         if (!ifidx)
3314                 ifidx = nl80211_get_ifidx(cb);
3315         if (ifidx < 0)
3316                 return ifidx;
3317         cb->args[0] = ifidx;
3318
3319         rtnl_lock();
3320
3321         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3322         if (!netdev) {
3323                 res = -ENODEV;
3324                 goto out_rtnl;
3325         }
3326
3327         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3328         if (IS_ERR(dev)) {
3329                 res = PTR_ERR(dev);
3330                 goto out_rtnl;
3331         }
3332
3333         if (!dev->ops->dump_survey) {
3334                 res = -EOPNOTSUPP;
3335                 goto out_err;
3336         }
3337
3338         while (1) {
3339                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3340                                             &survey);
3341                 if (res == -ENOENT)
3342                         break;
3343                 if (res)
3344                         goto out_err;
3345
3346                 if (nl80211_send_survey(skb,
3347                                 NETLINK_CB(cb->skb).pid,
3348                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3349                                 netdev,
3350                                 &survey) < 0)
3351                         goto out;
3352                 survey_idx++;
3353         }
3354
3355  out:
3356         cb->args[1] = survey_idx;
3357         res = skb->len;
3358  out_err:
3359         cfg80211_unlock_rdev(dev);
3360  out_rtnl:
3361         rtnl_unlock();
3362
3363         return res;
3364 }
3365
3366 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3367 {
3368         return auth_type <= NL80211_AUTHTYPE_MAX;
3369 }
3370
3371 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3372 {
3373         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3374                                   NL80211_WPA_VERSION_2));
3375 }
3376
3377 static bool nl80211_valid_akm_suite(u32 akm)
3378 {
3379         return akm == WLAN_AKM_SUITE_8021X ||
3380                 akm == WLAN_AKM_SUITE_PSK;
3381 }
3382
3383 static bool nl80211_valid_cipher_suite(u32 cipher)
3384 {
3385         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3386                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3387                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3388                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3389                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3390 }
3391
3392
3393 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3394 {
3395         struct cfg80211_registered_device *rdev;
3396         struct net_device *dev;
3397         struct ieee80211_channel *chan;
3398         const u8 *bssid, *ssid, *ie = NULL;
3399         int err, ssid_len, ie_len = 0;
3400         enum nl80211_auth_type auth_type;
3401         struct key_parse key;
3402         bool local_state_change;
3403
3404         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3405                 return -EINVAL;
3406
3407         if (!info->attrs[NL80211_ATTR_MAC])
3408                 return -EINVAL;
3409
3410         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3411                 return -EINVAL;
3412
3413         if (!info->attrs[NL80211_ATTR_SSID])
3414                 return -EINVAL;
3415
3416         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3417                 return -EINVAL;
3418
3419         err = nl80211_parse_key(info, &key);
3420         if (err)
3421                 return err;
3422
3423         if (key.idx >= 0) {
3424                 if (!key.p.key || !key.p.key_len)
3425                         return -EINVAL;
3426                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3427                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3428                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3429                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3430                         return -EINVAL;
3431                 if (key.idx > 4)
3432                         return -EINVAL;
3433         } else {
3434                 key.p.key_len = 0;
3435                 key.p.key = NULL;
3436         }
3437
3438         rtnl_lock();
3439
3440         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3441         if (err)
3442                 goto unlock_rtnl;
3443
3444         if (!rdev->ops->auth) {
3445                 err = -EOPNOTSUPP;
3446                 goto out;
3447         }
3448
3449         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3450                 err = -EOPNOTSUPP;
3451                 goto out;
3452         }
3453
3454         if (!netif_running(dev)) {
3455                 err = -ENETDOWN;
3456                 goto out;
3457         }
3458
3459         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3460         chan = ieee80211_get_channel(&rdev->wiphy,
3461                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3462         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3463                 err = -EINVAL;
3464                 goto out;
3465         }
3466
3467         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3468         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3469
3470         if (info->attrs[NL80211_ATTR_IE]) {
3471                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3472                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3473         }
3474
3475         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3476         if (!nl80211_valid_auth_type(auth_type)) {
3477                 err = -EINVAL;
3478                 goto out;
3479         }
3480
3481         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3482
3483         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3484                                  ssid, ssid_len, ie, ie_len,
3485                                  key.p.key, key.p.key_len, key.idx,
3486                                  local_state_change);
3487
3488 out:
3489         cfg80211_unlock_rdev(rdev);
3490         dev_put(dev);
3491 unlock_rtnl:
3492         rtnl_unlock();
3493         return err;
3494 }
3495
3496 static int nl80211_crypto_settings(struct genl_info *info,
3497                                    struct cfg80211_crypto_settings *settings,
3498                                    int cipher_limit)
3499 {
3500         memset(settings, 0, sizeof(*settings));
3501
3502         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3503
3504         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3505                 void *data;
3506                 int len, i;
3507
3508                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3509                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3510                 settings->n_ciphers_pairwise = len / sizeof(u32);
3511
3512                 if (len % sizeof(u32))
3513                         return -EINVAL;
3514
3515                 if (settings->n_ciphers_pairwise > cipher_limit)
3516                         return -EINVAL;
3517
3518                 memcpy(settings->ciphers_pairwise, data, len);
3519
3520                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3521                         if (!nl80211_valid_cipher_suite(
3522                                         settings->ciphers_pairwise[i]))
3523                                 return -EINVAL;
3524         }
3525
3526         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3527                 settings->cipher_group =
3528                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3529                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3530                         return -EINVAL;
3531         }
3532
3533         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3534                 settings->wpa_versions =
3535                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3536                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3537                         return -EINVAL;
3538         }
3539
3540         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3541                 void *data;
3542                 int len, i;
3543
3544                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3545                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3546                 settings->n_akm_suites = len / sizeof(u32);
3547
3548                 if (len % sizeof(u32))
3549                         return -EINVAL;
3550
3551                 memcpy(settings->akm_suites, data, len);
3552
3553                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3554                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3555                                 return -EINVAL;
3556         }
3557
3558         return 0;
3559 }
3560
3561 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3562 {
3563         struct cfg80211_registered_device *rdev;
3564         struct net_device *dev;
3565         struct wireless_dev *wdev;
3566         struct cfg80211_crypto_settings crypto;
3567         struct ieee80211_channel *chan, *fixedchan;
3568         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3569         int err, ssid_len, ie_len = 0;
3570         bool use_mfp = false;
3571
3572         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3573                 return -EINVAL;
3574
3575         if (!info->attrs[NL80211_ATTR_MAC] ||
3576             !info->attrs[NL80211_ATTR_SSID] ||
3577             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3578                 return -EINVAL;
3579
3580         rtnl_lock();
3581
3582         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3583         if (err)
3584                 goto unlock_rtnl;
3585
3586         if (!rdev->ops->assoc) {
3587                 err = -EOPNOTSUPP;
3588                 goto out;
3589         }
3590
3591         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3592                 err = -EOPNOTSUPP;
3593                 goto out;
3594         }
3595
3596         if (!netif_running(dev)) {
3597                 err = -ENETDOWN;
3598                 goto out;
3599         }
3600
3601         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3602
3603         chan = ieee80211_get_channel(&rdev->wiphy,
3604                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3605         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3606                 err = -EINVAL;
3607                 goto out;
3608         }
3609
3610         mutex_lock(&rdev->devlist_mtx);
3611         wdev = dev->ieee80211_ptr;
3612         fixedchan = rdev_fixed_channel(rdev, wdev);
3613         if (fixedchan && chan != fixedchan) {
3614                 err = -EBUSY;
3615                 mutex_unlock(&rdev->devlist_mtx);
3616                 goto out;
3617         }
3618         mutex_unlock(&rdev->devlist_mtx);
3619
3620         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3621         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3622
3623         if (info->attrs[NL80211_ATTR_IE]) {
3624                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3625                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3626         }
3627
3628         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3629                 enum nl80211_mfp mfp =
3630                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3631                 if (mfp == NL80211_MFP_REQUIRED)
3632                         use_mfp = true;
3633                 else if (mfp != NL80211_MFP_NO) {
3634                         err = -EINVAL;
3635                         goto out;
3636                 }
3637         }
3638
3639         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3640                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3641
3642         err = nl80211_crypto_settings(info, &crypto, 1);
3643         if (!err)
3644                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3645                                           ssid, ssid_len, ie, ie_len, use_mfp,
3646                                           &crypto);
3647
3648 out:
3649         cfg80211_unlock_rdev(rdev);
3650         dev_put(dev);
3651 unlock_rtnl:
3652         rtnl_unlock();
3653         return err;
3654 }
3655
3656 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3657 {
3658         struct cfg80211_registered_device *rdev;
3659         struct net_device *dev;
3660         const u8 *ie = NULL, *bssid;
3661         int err, ie_len = 0;
3662         u16 reason_code;
3663         bool local_state_change;
3664
3665         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3666                 return -EINVAL;
3667
3668         if (!info->attrs[NL80211_ATTR_MAC])
3669                 return -EINVAL;
3670
3671         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3672                 return -EINVAL;
3673
3674         rtnl_lock();
3675
3676         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3677         if (err)
3678                 goto unlock_rtnl;
3679
3680         if (!rdev->ops->deauth) {
3681                 err = -EOPNOTSUPP;
3682                 goto out;
3683         }
3684
3685         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3686                 err = -EOPNOTSUPP;
3687                 goto out;
3688         }
3689
3690         if (!netif_running(dev)) {
3691                 err = -ENETDOWN;
3692                 goto out;
3693         }
3694
3695         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3696
3697         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3698         if (reason_code == 0) {
3699                 /* Reason Code 0 is reserved */
3700                 err = -EINVAL;
3701                 goto out;
3702         }
3703
3704         if (info->attrs[NL80211_ATTR_IE]) {
3705                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3706                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3707         }
3708
3709         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3710
3711         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3712                                    local_state_change);
3713
3714 out:
3715         cfg80211_unlock_rdev(rdev);
3716         dev_put(dev);
3717 unlock_rtnl:
3718         rtnl_unlock();
3719         return err;
3720 }
3721
3722 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3723 {
3724         struct cfg80211_registered_device *rdev;
3725         struct net_device *dev;
3726         const u8 *ie = NULL, *bssid;
3727         int err, ie_len = 0;
3728         u16 reason_code;
3729         bool local_state_change;
3730
3731         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3732                 return -EINVAL;
3733
3734         if (!info->attrs[NL80211_ATTR_MAC])
3735                 return -EINVAL;
3736
3737         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3738                 return -EINVAL;
3739
3740         rtnl_lock();
3741
3742         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3743         if (err)
3744                 goto unlock_rtnl;
3745
3746         if (!rdev->ops->disassoc) {
3747                 err = -EOPNOTSUPP;
3748                 goto out;
3749         }
3750
3751         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3752                 err = -EOPNOTSUPP;
3753                 goto out;
3754         }
3755
3756         if (!netif_running(dev)) {
3757                 err = -ENETDOWN;
3758                 goto out;
3759         }
3760
3761         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3762
3763         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3764         if (reason_code == 0) {
3765                 /* Reason Code 0 is reserved */
3766                 err = -EINVAL;
3767                 goto out;
3768         }
3769
3770         if (info->attrs[NL80211_ATTR_IE]) {
3771                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3772                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3773         }
3774
3775         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3776
3777         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3778                                      local_state_change);
3779
3780 out:
3781         cfg80211_unlock_rdev(rdev);
3782         dev_put(dev);
3783 unlock_rtnl:
3784         rtnl_unlock();
3785         return err;
3786 }
3787
3788 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3789 {
3790         struct cfg80211_registered_device *rdev;
3791         struct net_device *dev;
3792         struct cfg80211_ibss_params ibss;
3793         struct wiphy *wiphy;
3794         struct cfg80211_cached_keys *connkeys = NULL;
3795         int err;
3796
3797         memset(&ibss, 0, sizeof(ibss));
3798
3799         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3800                 return -EINVAL;
3801
3802         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3803             !info->attrs[NL80211_ATTR_SSID] ||
3804             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3805                 return -EINVAL;
3806
3807         ibss.beacon_interval = 100;
3808
3809         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3810                 ibss.beacon_interval =
3811                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3812                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3813                         return -EINVAL;
3814         }
3815
3816         rtnl_lock();
3817
3818         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3819         if (err)
3820                 goto unlock_rtnl;
3821
3822         if (!rdev->ops->join_ibss) {
3823                 err = -EOPNOTSUPP;
3824                 goto out;
3825         }
3826
3827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3828                 err = -EOPNOTSUPP;
3829                 goto out;
3830         }
3831
3832         if (!netif_running(dev)) {
3833                 err = -ENETDOWN;
3834                 goto out;
3835         }
3836
3837         wiphy = &rdev->wiphy;
3838
3839         if (info->attrs[NL80211_ATTR_MAC])
3840                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3841         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3842         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3843
3844         if (info->attrs[NL80211_ATTR_IE]) {
3845                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3846                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3847         }
3848
3849         ibss.channel = ieee80211_get_channel(wiphy,
3850                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3851         if (!ibss.channel ||
3852             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3853             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3854                 err = -EINVAL;
3855                 goto out;
3856         }
3857
3858         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3859         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3860
3861         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3862                 connkeys = nl80211_parse_connkeys(rdev,
3863                                         info->attrs[NL80211_ATTR_KEYS]);
3864                 if (IS_ERR(connkeys)) {
3865                         err = PTR_ERR(connkeys);
3866                         connkeys = NULL;
3867                         goto out;
3868                 }
3869         }
3870
3871         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3872
3873 out:
3874         cfg80211_unlock_rdev(rdev);
3875         dev_put(dev);
3876 unlock_rtnl:
3877         if (err)
3878                 kfree(connkeys);
3879         rtnl_unlock();
3880         return err;
3881 }
3882
3883 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3884 {
3885         struct cfg80211_registered_device *rdev;
3886         struct net_device *dev;
3887         int err;
3888
3889         rtnl_lock();
3890
3891         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3892         if (err)
3893                 goto unlock_rtnl;
3894
3895         if (!rdev->ops->leave_ibss) {
3896                 err = -EOPNOTSUPP;
3897                 goto out;
3898         }
3899
3900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3901                 err = -EOPNOTSUPP;
3902                 goto out;
3903         }
3904
3905         if (!netif_running(dev)) {
3906                 err = -ENETDOWN;
3907                 goto out;
3908         }
3909
3910         err = cfg80211_leave_ibss(rdev, dev, false);
3911
3912 out:
3913         cfg80211_unlock_rdev(rdev);
3914         dev_put(dev);
3915 unlock_rtnl:
3916         rtnl_unlock();
3917         return err;
3918 }
3919
3920 #ifdef CONFIG_NL80211_TESTMODE
3921 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3922         .name = "testmode",
3923 };
3924
3925 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3926 {
3927         struct cfg80211_registered_device *rdev;
3928         int err;
3929
3930         if (!info->attrs[NL80211_ATTR_TESTDATA])
3931                 return -EINVAL;
3932
3933         rtnl_lock();
3934
3935         rdev = cfg80211_get_dev_from_info(info);
3936         if (IS_ERR(rdev)) {
3937                 err = PTR_ERR(rdev);
3938                 goto unlock_rtnl;
3939         }
3940
3941         err = -EOPNOTSUPP;
3942         if (rdev->ops->testmode_cmd) {
3943                 rdev->testmode_info = info;
3944                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3945                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3946                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3947                 rdev->testmode_info = NULL;
3948         }
3949
3950         cfg80211_unlock_rdev(rdev);
3951
3952  unlock_rtnl:
3953         rtnl_unlock();
3954         return err;
3955 }
3956
3957 static struct sk_buff *
3958 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3959                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3960 {
3961         struct sk_buff *skb;
3962         void *hdr;
3963         struct nlattr *data;
3964
3965         skb = nlmsg_new(approxlen + 100, gfp);
3966         if (!skb)
3967                 return NULL;
3968
3969         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3970         if (!hdr) {
3971                 kfree_skb(skb);
3972                 return NULL;
3973         }
3974
3975         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3976         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3977
3978         ((void **)skb->cb)[0] = rdev;
3979         ((void **)skb->cb)[1] = hdr;
3980         ((void **)skb->cb)[2] = data;
3981
3982         return skb;
3983
3984  nla_put_failure:
3985         kfree_skb(skb);
3986         return NULL;
3987 }
3988
3989 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3990                                                   int approxlen)
3991 {
3992         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3993
3994         if (WARN_ON(!rdev->testmode_info))
3995                 return NULL;
3996
3997         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3998                                 rdev->testmode_info->snd_pid,
3999                                 rdev->testmode_info->snd_seq,
4000                                 GFP_KERNEL);
4001 }
4002 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4003
4004 int cfg80211_testmode_reply(struct sk_buff *skb)
4005 {
4006         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4007         void *hdr = ((void **)skb->cb)[1];
4008         struct nlattr *data = ((void **)skb->cb)[2];
4009
4010         if (WARN_ON(!rdev->testmode_info)) {
4011                 kfree_skb(skb);
4012                 return -EINVAL;
4013         }
4014
4015         nla_nest_end(skb, data);
4016         genlmsg_end(skb, hdr);
4017         return genlmsg_reply(skb, rdev->testmode_info);
4018 }
4019 EXPORT_SYMBOL(cfg80211_testmode_reply);
4020
4021 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4022                                                   int approxlen, gfp_t gfp)
4023 {
4024         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4025
4026         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4027 }
4028 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4029
4030 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4031 {
4032         void *hdr = ((void **)skb->cb)[1];
4033         struct nlattr *data = ((void **)skb->cb)[2];
4034
4035         nla_nest_end(skb, data);
4036         genlmsg_end(skb, hdr);
4037         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4038 }
4039 EXPORT_SYMBOL(cfg80211_testmode_event);
4040 #endif
4041
4042 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4043 {
4044         struct cfg80211_registered_device *rdev;
4045         struct net_device *dev;
4046         struct cfg80211_connect_params connect;
4047         struct wiphy *wiphy;
4048         struct cfg80211_cached_keys *connkeys = NULL;
4049         int err;
4050
4051         memset(&connect, 0, sizeof(connect));
4052
4053         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4054                 return -EINVAL;
4055
4056         if (!info->attrs[NL80211_ATTR_SSID] ||
4057             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4058                 return -EINVAL;
4059
4060         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4061                 connect.auth_type =
4062                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4063                 if (!nl80211_valid_auth_type(connect.auth_type))
4064                         return -EINVAL;
4065         } else
4066                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4067
4068         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4069
4070         err = nl80211_crypto_settings(info, &connect.crypto,
4071                                       NL80211_MAX_NR_CIPHER_SUITES);
4072         if (err)
4073                 return err;
4074         rtnl_lock();
4075
4076         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4077         if (err)
4078                 goto unlock_rtnl;
4079
4080         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4081                 err = -EOPNOTSUPP;
4082                 goto out;
4083         }
4084
4085         if (!netif_running(dev)) {
4086                 err = -ENETDOWN;
4087                 goto out;
4088         }
4089
4090         wiphy = &rdev->wiphy;
4091
4092         if (info->attrs[NL80211_ATTR_MAC])
4093                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4094         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4095         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4096
4097         if (info->attrs[NL80211_ATTR_IE]) {
4098                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4099                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4100         }
4101
4102         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4103                 connect.channel =
4104                         ieee80211_get_channel(wiphy,
4105                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4106                 if (!connect.channel ||
4107                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4108                         err = -EINVAL;
4109                         goto out;
4110                 }
4111         }
4112
4113         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4114                 connkeys = nl80211_parse_connkeys(rdev,
4115                                         info->attrs[NL80211_ATTR_KEYS]);
4116                 if (IS_ERR(connkeys)) {
4117                         err = PTR_ERR(connkeys);
4118                         connkeys = NULL;
4119                         goto out;
4120                 }
4121         }
4122
4123         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4124
4125 out:
4126         cfg80211_unlock_rdev(rdev);
4127         dev_put(dev);
4128 unlock_rtnl:
4129         if (err)
4130                 kfree(connkeys);
4131         rtnl_unlock();
4132         return err;
4133 }
4134
4135 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4136 {
4137         struct cfg80211_registered_device *rdev;
4138         struct net_device *dev;
4139         int err;
4140         u16 reason;
4141
4142         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4143                 reason = WLAN_REASON_DEAUTH_LEAVING;
4144         else
4145                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4146
4147         if (reason == 0)
4148                 return -EINVAL;
4149
4150         rtnl_lock();
4151
4152         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4153         if (err)
4154                 goto unlock_rtnl;
4155
4156         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4157                 err = -EOPNOTSUPP;
4158                 goto out;
4159         }
4160
4161         if (!netif_running(dev)) {
4162                 err = -ENETDOWN;
4163                 goto out;
4164         }
4165
4166         err = cfg80211_disconnect(rdev, dev, reason, true);
4167
4168 out:
4169         cfg80211_unlock_rdev(rdev);
4170         dev_put(dev);
4171 unlock_rtnl:
4172         rtnl_unlock();
4173         return err;
4174 }
4175
4176 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4177 {
4178         struct cfg80211_registered_device *rdev;
4179         struct net *net;
4180         int err;
4181         u32 pid;
4182
4183         if (!info->attrs[NL80211_ATTR_PID])
4184                 return -EINVAL;
4185
4186         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4187
4188         rtnl_lock();
4189
4190         rdev = cfg80211_get_dev_from_info(info);
4191         if (IS_ERR(rdev)) {
4192                 err = PTR_ERR(rdev);
4193                 goto out_rtnl;
4194         }
4195
4196         net = get_net_ns_by_pid(pid);
4197         if (IS_ERR(net)) {
4198                 err = PTR_ERR(net);
4199                 goto out;
4200         }
4201
4202         err = 0;
4203
4204         /* check if anything to do */
4205         if (net_eq(wiphy_net(&rdev->wiphy), net))
4206                 goto out_put_net;
4207
4208         err = cfg80211_switch_netns(rdev, net);
4209  out_put_net:
4210         put_net(net);
4211  out:
4212         cfg80211_unlock_rdev(rdev);
4213  out_rtnl:
4214         rtnl_unlock();
4215         return err;
4216 }
4217
4218 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4219 {
4220         struct cfg80211_registered_device *rdev;
4221         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4222                         struct cfg80211_pmksa *pmksa) = NULL;
4223         int err;
4224         struct net_device *dev;
4225         struct cfg80211_pmksa pmksa;
4226
4227         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4228
4229         if (!info->attrs[NL80211_ATTR_MAC])
4230                 return -EINVAL;
4231
4232         if (!info->attrs[NL80211_ATTR_PMKID])
4233                 return -EINVAL;
4234
4235         rtnl_lock();
4236
4237         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4238         if (err)
4239                 goto out_rtnl;
4240
4241         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4242         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4243
4244         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4245                 err = -EOPNOTSUPP;
4246                 goto out;
4247         }
4248
4249         switch (info->genlhdr->cmd) {
4250         case NL80211_CMD_SET_PMKSA:
4251                 rdev_ops = rdev->ops->set_pmksa;
4252                 break;
4253         case NL80211_CMD_DEL_PMKSA:
4254                 rdev_ops = rdev->ops->del_pmksa;
4255                 break;
4256         default:
4257                 WARN_ON(1);
4258                 break;
4259         }
4260
4261         if (!rdev_ops) {
4262                 err = -EOPNOTSUPP;
4263                 goto out;
4264         }
4265
4266         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4267
4268  out:
4269         cfg80211_unlock_rdev(rdev);
4270         dev_put(dev);
4271  out_rtnl:
4272         rtnl_unlock();
4273
4274         return err;
4275 }
4276
4277 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4278 {
4279         struct cfg80211_registered_device *rdev;
4280         int err;
4281         struct net_device *dev;
4282
4283         rtnl_lock();
4284
4285         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4286         if (err)
4287                 goto out_rtnl;
4288
4289         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4290                 err = -EOPNOTSUPP;
4291                 goto out;
4292         }
4293
4294         if (!rdev->ops->flush_pmksa) {
4295                 err = -EOPNOTSUPP;
4296                 goto out;
4297         }
4298
4299         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4300
4301  out:
4302         cfg80211_unlock_rdev(rdev);
4303         dev_put(dev);
4304  out_rtnl:
4305         rtnl_unlock();
4306
4307         return err;
4308
4309 }
4310
4311 static int nl80211_remain_on_channel(struct sk_buff *skb,
4312                                      struct genl_info *info)
4313 {
4314         struct cfg80211_registered_device *rdev;
4315         struct net_device *dev;
4316         struct ieee80211_channel *chan;
4317         struct sk_buff *msg;
4318         void *hdr;
4319         u64 cookie;
4320         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4321         u32 freq, duration;
4322         int err;
4323
4324         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4325             !info->attrs[NL80211_ATTR_DURATION])
4326                 return -EINVAL;
4327
4328         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4329
4330         /*
4331          * We should be on that channel for at least one jiffie,
4332          * and more than 5 seconds seems excessive.
4333          */
4334         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4335                 return -EINVAL;
4336
4337         rtnl_lock();
4338
4339         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4340         if (err)
4341                 goto unlock_rtnl;
4342
4343         if (!rdev->ops->remain_on_channel) {
4344                 err = -EOPNOTSUPP;
4345                 goto out;
4346         }
4347
4348         if (!netif_running(dev)) {
4349                 err = -ENETDOWN;
4350                 goto out;
4351         }
4352
4353         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4354                 channel_type = nla_get_u32(
4355                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4356                 if (channel_type != NL80211_CHAN_NO_HT &&
4357                     channel_type != NL80211_CHAN_HT20 &&
4358                     channel_type != NL80211_CHAN_HT40PLUS &&
4359                     channel_type != NL80211_CHAN_HT40MINUS)
4360                         err = -EINVAL;
4361                         goto out;
4362         }
4363
4364         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4365         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4366         if (chan == NULL) {
4367                 err = -EINVAL;
4368                 goto out;
4369         }
4370
4371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4372         if (!msg) {
4373                 err = -ENOMEM;
4374                 goto out;
4375         }
4376
4377         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4378                              NL80211_CMD_REMAIN_ON_CHANNEL);
4379
4380         if (IS_ERR(hdr)) {
4381                 err = PTR_ERR(hdr);
4382                 goto free_msg;
4383         }
4384
4385         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4386                                            channel_type, duration, &cookie);
4387
4388         if (err)
4389                 goto free_msg;
4390
4391         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4392
4393         genlmsg_end(msg, hdr);
4394         err = genlmsg_reply(msg, info);
4395         goto out;
4396
4397  nla_put_failure:
4398         err = -ENOBUFS;
4399  free_msg:
4400         nlmsg_free(msg);
4401  out:
4402         cfg80211_unlock_rdev(rdev);
4403         dev_put(dev);
4404  unlock_rtnl:
4405         rtnl_unlock();
4406         return err;
4407 }
4408
4409 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4410                                             struct genl_info *info)
4411 {
4412         struct cfg80211_registered_device *rdev;
4413         struct net_device *dev;
4414         u64 cookie;
4415         int err;
4416
4417         if (!info->attrs[NL80211_ATTR_COOKIE])
4418                 return -EINVAL;
4419
4420         rtnl_lock();
4421
4422         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4423         if (err)
4424                 goto unlock_rtnl;
4425
4426         if (!rdev->ops->cancel_remain_on_channel) {
4427                 err = -EOPNOTSUPP;
4428                 goto out;
4429         }
4430
4431         if (!netif_running(dev)) {
4432                 err = -ENETDOWN;
4433                 goto out;
4434         }
4435
4436         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4437
4438         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4439
4440  out:
4441         cfg80211_unlock_rdev(rdev);
4442         dev_put(dev);
4443  unlock_rtnl:
4444         rtnl_unlock();
4445         return err;
4446 }
4447
4448 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4449                            u8 *rates, u8 rates_len)
4450 {
4451         u8 i;
4452         u32 mask = 0;
4453
4454         for (i = 0; i < rates_len; i++) {
4455                 int rate = (rates[i] & 0x7f) * 5;
4456                 int ridx;
4457                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4458                         struct ieee80211_rate *srate =
4459                                 &sband->bitrates[ridx];
4460                         if (rate == srate->bitrate) {
4461                                 mask |= 1 << ridx;
4462                                 break;
4463                         }
4464                 }
4465                 if (ridx == sband->n_bitrates)
4466                         return 0; /* rate not found */
4467         }
4468
4469         return mask;
4470 }
4471
4472 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4473         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4474                                     .len = NL80211_MAX_SUPP_RATES },
4475 };
4476
4477 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4478                                        struct genl_info *info)
4479 {
4480         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4481         struct cfg80211_registered_device *rdev;
4482         struct cfg80211_bitrate_mask mask;
4483         int err, rem, i;
4484         struct net_device *dev;
4485         struct nlattr *tx_rates;
4486         struct ieee80211_supported_band *sband;
4487
4488         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4489                 return -EINVAL;
4490
4491         rtnl_lock();
4492
4493         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4494         if (err)
4495                 goto unlock_rtnl;
4496
4497         if (!rdev->ops->set_bitrate_mask) {
4498                 err = -EOPNOTSUPP;
4499                 goto unlock;
4500         }
4501
4502         memset(&mask, 0, sizeof(mask));
4503         /* Default to all rates enabled */
4504         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4505                 sband = rdev->wiphy.bands[i];
4506                 mask.control[i].legacy =
4507                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4508         }
4509
4510         /*
4511          * The nested attribute uses enum nl80211_band as the index. This maps
4512          * directly to the enum ieee80211_band values used in cfg80211.
4513          */
4514         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4515         {
4516                 enum ieee80211_band band = nla_type(tx_rates);
4517                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4518                         err = -EINVAL;
4519                         goto unlock;
4520                 }
4521                 sband = rdev->wiphy.bands[band];
4522                 if (sband == NULL) {
4523                         err = -EINVAL;
4524                         goto unlock;
4525                 }
4526                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4527                           nla_len(tx_rates), nl80211_txattr_policy);
4528                 if (tb[NL80211_TXRATE_LEGACY]) {
4529                         mask.control[band].legacy = rateset_to_mask(
4530                                 sband,
4531                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4532                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4533                         if (mask.control[band].legacy == 0) {
4534                                 err = -EINVAL;
4535                                 goto unlock;
4536                         }
4537                 }
4538         }
4539
4540         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4541
4542  unlock:
4543         dev_put(dev);
4544         cfg80211_unlock_rdev(rdev);
4545  unlock_rtnl:
4546         rtnl_unlock();
4547         return err;
4548 }
4549
4550 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4551 {
4552         struct cfg80211_registered_device *rdev;
4553         struct net_device *dev;
4554         int err;
4555
4556         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4557                 return -EINVAL;
4558
4559         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4560                 return -EINVAL;
4561
4562         rtnl_lock();
4563
4564         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4565         if (err)
4566                 goto unlock_rtnl;
4567
4568         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4569                 err = -EOPNOTSUPP;
4570                 goto out;
4571         }
4572
4573         /* not much point in registering if we can't reply */
4574         if (!rdev->ops->action) {
4575                 err = -EOPNOTSUPP;
4576                 goto out;
4577         }
4578
4579         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4580                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4581                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4582  out:
4583         cfg80211_unlock_rdev(rdev);
4584         dev_put(dev);
4585  unlock_rtnl:
4586         rtnl_unlock();
4587         return err;
4588 }
4589
4590 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4591 {
4592         struct cfg80211_registered_device *rdev;
4593         struct net_device *dev;
4594         struct ieee80211_channel *chan;
4595         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4596         u32 freq;
4597         int err;
4598         void *hdr;
4599         u64 cookie;
4600         struct sk_buff *msg;
4601
4602         if (!info->attrs[NL80211_ATTR_FRAME] ||
4603             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4604                 return -EINVAL;
4605
4606         rtnl_lock();
4607
4608         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4609         if (err)
4610                 goto unlock_rtnl;
4611
4612         if (!rdev->ops->action) {
4613                 err = -EOPNOTSUPP;
4614                 goto out;
4615         }
4616
4617         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4618                 err = -EOPNOTSUPP;
4619                 goto out;
4620         }
4621
4622         if (!netif_running(dev)) {
4623                 err = -ENETDOWN;
4624                 goto out;
4625         }
4626
4627         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4628                 channel_type = nla_get_u32(
4629                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4630                 if (channel_type != NL80211_CHAN_NO_HT &&
4631                     channel_type != NL80211_CHAN_HT20 &&
4632                     channel_type != NL80211_CHAN_HT40PLUS &&
4633                     channel_type != NL80211_CHAN_HT40MINUS)
4634                         err = -EINVAL;
4635                         goto out;
4636         }
4637
4638         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4639         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4640         if (chan == NULL) {
4641                 err = -EINVAL;
4642                 goto out;
4643         }
4644
4645         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4646         if (!msg) {
4647                 err = -ENOMEM;
4648                 goto out;
4649         }
4650
4651         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4652                              NL80211_CMD_ACTION);
4653
4654         if (IS_ERR(hdr)) {
4655                 err = PTR_ERR(hdr);
4656                 goto free_msg;
4657         }
4658         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4659                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4660                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4661                                    &cookie);
4662         if (err)
4663                 goto free_msg;
4664
4665         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4666
4667         genlmsg_end(msg, hdr);
4668         err = genlmsg_reply(msg, info);
4669         goto out;
4670
4671  nla_put_failure:
4672         err = -ENOBUFS;
4673  free_msg:
4674         nlmsg_free(msg);
4675  out:
4676         cfg80211_unlock_rdev(rdev);
4677         dev_put(dev);
4678 unlock_rtnl:
4679         rtnl_unlock();
4680         return err;
4681 }
4682
4683 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4684 {
4685         struct cfg80211_registered_device *rdev;
4686         struct wireless_dev *wdev;
4687         struct net_device *dev;
4688         u8 ps_state;
4689         bool state;
4690         int err;
4691
4692         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4693                 err = -EINVAL;
4694                 goto out;
4695         }
4696
4697         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4698
4699         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4700                 err = -EINVAL;
4701                 goto out;
4702         }
4703
4704         rtnl_lock();
4705
4706         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4707         if (err)
4708                 goto unlock_rdev;
4709
4710         wdev = dev->ieee80211_ptr;
4711
4712         if (!rdev->ops->set_power_mgmt) {
4713                 err = -EOPNOTSUPP;
4714                 goto unlock_rdev;
4715         }
4716
4717         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4718
4719         if (state == wdev->ps)
4720                 goto unlock_rdev;
4721
4722         wdev->ps = state;
4723
4724         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4725                                       wdev->ps_timeout))
4726                 /* assume this means it's off */
4727                 wdev->ps = false;
4728
4729 unlock_rdev:
4730         cfg80211_unlock_rdev(rdev);
4731         dev_put(dev);
4732         rtnl_unlock();
4733
4734 out:
4735         return err;
4736 }
4737
4738 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4739 {
4740         struct cfg80211_registered_device *rdev;
4741         enum nl80211_ps_state ps_state;
4742         struct wireless_dev *wdev;
4743         struct net_device *dev;
4744         struct sk_buff *msg;
4745         void *hdr;
4746         int err;
4747
4748         rtnl_lock();
4749
4750         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4751         if (err)
4752                 goto unlock_rtnl;
4753
4754         wdev = dev->ieee80211_ptr;
4755
4756         if (!rdev->ops->set_power_mgmt) {
4757                 err = -EOPNOTSUPP;
4758                 goto out;
4759         }
4760
4761         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4762         if (!msg) {
4763                 err = -ENOMEM;
4764                 goto out;
4765         }
4766
4767         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4768                              NL80211_CMD_GET_POWER_SAVE);
4769         if (!hdr) {
4770                 err = -ENOMEM;
4771                 goto free_msg;
4772         }
4773
4774         if (wdev->ps)
4775                 ps_state = NL80211_PS_ENABLED;
4776         else
4777                 ps_state = NL80211_PS_DISABLED;
4778
4779         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4780
4781         genlmsg_end(msg, hdr);
4782         err = genlmsg_reply(msg, info);
4783         goto out;
4784
4785 nla_put_failure:
4786         err = -ENOBUFS;
4787
4788 free_msg:
4789         nlmsg_free(msg);
4790
4791 out:
4792         cfg80211_unlock_rdev(rdev);
4793         dev_put(dev);
4794
4795 unlock_rtnl:
4796         rtnl_unlock();
4797
4798         return err;
4799 }
4800
4801 static struct nla_policy
4802 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4803         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4804         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4805         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4806 };
4807
4808 static int nl80211_set_cqm_rssi(struct genl_info *info,
4809                                 s32 threshold, u32 hysteresis)
4810 {
4811         struct cfg80211_registered_device *rdev;
4812         struct wireless_dev *wdev;
4813         struct net_device *dev;
4814         int err;
4815
4816         if (threshold > 0)
4817                 return -EINVAL;
4818
4819         rtnl_lock();
4820
4821         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4822         if (err)
4823                 goto unlock_rdev;
4824
4825         wdev = dev->ieee80211_ptr;
4826
4827         if (!rdev->ops->set_cqm_rssi_config) {
4828                 err = -EOPNOTSUPP;
4829                 goto unlock_rdev;
4830         }
4831
4832         if (wdev->iftype != NL80211_IFTYPE_STATION) {
4833                 err = -EOPNOTSUPP;
4834                 goto unlock_rdev;
4835         }
4836
4837         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4838                                              threshold, hysteresis);
4839
4840 unlock_rdev:
4841         cfg80211_unlock_rdev(rdev);
4842         dev_put(dev);
4843         rtnl_unlock();
4844
4845         return err;
4846 }
4847
4848 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4849 {
4850         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4851         struct nlattr *cqm;
4852         int err;
4853
4854         cqm = info->attrs[NL80211_ATTR_CQM];
4855         if (!cqm) {
4856                 err = -EINVAL;
4857                 goto out;
4858         }
4859
4860         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4861                                nl80211_attr_cqm_policy);
4862         if (err)
4863                 goto out;
4864
4865         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4866             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4867                 s32 threshold;
4868                 u32 hysteresis;
4869                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4870                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4871                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4872         } else
4873                 err = -EINVAL;
4874
4875 out:
4876         return err;
4877 }
4878
4879 static struct genl_ops nl80211_ops[] = {
4880         {
4881                 .cmd = NL80211_CMD_GET_WIPHY,
4882                 .doit = nl80211_get_wiphy,
4883                 .dumpit = nl80211_dump_wiphy,
4884                 .policy = nl80211_policy,
4885                 /* can be retrieved by unprivileged users */
4886         },
4887         {
4888                 .cmd = NL80211_CMD_SET_WIPHY,
4889                 .doit = nl80211_set_wiphy,
4890                 .policy = nl80211_policy,
4891                 .flags = GENL_ADMIN_PERM,
4892         },
4893         {
4894                 .cmd = NL80211_CMD_GET_INTERFACE,
4895                 .doit = nl80211_get_interface,
4896                 .dumpit = nl80211_dump_interface,
4897                 .policy = nl80211_policy,
4898                 /* can be retrieved by unprivileged users */
4899         },
4900         {
4901                 .cmd = NL80211_CMD_SET_INTERFACE,
4902                 .doit = nl80211_set_interface,
4903                 .policy = nl80211_policy,
4904                 .flags = GENL_ADMIN_PERM,
4905         },
4906         {
4907                 .cmd = NL80211_CMD_NEW_INTERFACE,
4908                 .doit = nl80211_new_interface,
4909                 .policy = nl80211_policy,
4910                 .flags = GENL_ADMIN_PERM,
4911         },
4912         {
4913                 .cmd = NL80211_CMD_DEL_INTERFACE,
4914                 .doit = nl80211_del_interface,
4915                 .policy = nl80211_policy,
4916                 .flags = GENL_ADMIN_PERM,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_GET_KEY,
4920                 .doit = nl80211_get_key,
4921                 .policy = nl80211_policy,
4922                 .flags = GENL_ADMIN_PERM,
4923         },
4924         {
4925                 .cmd = NL80211_CMD_SET_KEY,
4926                 .doit = nl80211_set_key,
4927                 .policy = nl80211_policy,
4928                 .flags = GENL_ADMIN_PERM,
4929         },
4930         {
4931                 .cmd = NL80211_CMD_NEW_KEY,
4932                 .doit = nl80211_new_key,
4933                 .policy = nl80211_policy,
4934                 .flags = GENL_ADMIN_PERM,
4935         },
4936         {
4937                 .cmd = NL80211_CMD_DEL_KEY,
4938                 .doit = nl80211_del_key,
4939                 .policy = nl80211_policy,
4940                 .flags = GENL_ADMIN_PERM,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_SET_BEACON,
4944                 .policy = nl80211_policy,
4945                 .flags = GENL_ADMIN_PERM,
4946                 .doit = nl80211_addset_beacon,
4947         },
4948         {
4949                 .cmd = NL80211_CMD_NEW_BEACON,
4950                 .policy = nl80211_policy,
4951                 .flags = GENL_ADMIN_PERM,
4952                 .doit = nl80211_addset_beacon,
4953         },
4954         {
4955                 .cmd = NL80211_CMD_DEL_BEACON,
4956                 .policy = nl80211_policy,
4957                 .flags = GENL_ADMIN_PERM,
4958                 .doit = nl80211_del_beacon,
4959         },
4960         {
4961                 .cmd = NL80211_CMD_GET_STATION,
4962                 .doit = nl80211_get_station,
4963                 .dumpit = nl80211_dump_station,
4964                 .policy = nl80211_policy,
4965         },
4966         {
4967                 .cmd = NL80211_CMD_SET_STATION,
4968                 .doit = nl80211_set_station,
4969                 .policy = nl80211_policy,
4970                 .flags = GENL_ADMIN_PERM,
4971         },
4972         {
4973                 .cmd = NL80211_CMD_NEW_STATION,
4974                 .doit = nl80211_new_station,
4975                 .policy = nl80211_policy,
4976                 .flags = GENL_ADMIN_PERM,
4977         },
4978         {
4979                 .cmd = NL80211_CMD_DEL_STATION,
4980                 .doit = nl80211_del_station,
4981                 .policy = nl80211_policy,
4982                 .flags = GENL_ADMIN_PERM,
4983         },
4984         {
4985                 .cmd = NL80211_CMD_GET_MPATH,
4986                 .doit = nl80211_get_mpath,
4987                 .dumpit = nl80211_dump_mpath,
4988                 .policy = nl80211_policy,
4989                 .flags = GENL_ADMIN_PERM,
4990         },
4991         {
4992                 .cmd = NL80211_CMD_SET_MPATH,
4993                 .doit = nl80211_set_mpath,
4994                 .policy = nl80211_policy,
4995                 .flags = GENL_ADMIN_PERM,
4996         },
4997         {
4998                 .cmd = NL80211_CMD_NEW_MPATH,
4999                 .doit = nl80211_new_mpath,
5000                 .policy = nl80211_policy,
5001                 .flags = GENL_ADMIN_PERM,
5002         },
5003         {
5004                 .cmd = NL80211_CMD_DEL_MPATH,
5005                 .doit = nl80211_del_mpath,
5006                 .policy = nl80211_policy,
5007                 .flags = GENL_ADMIN_PERM,
5008         },
5009         {
5010                 .cmd = NL80211_CMD_SET_BSS,
5011                 .doit = nl80211_set_bss,
5012                 .policy = nl80211_policy,
5013                 .flags = GENL_ADMIN_PERM,
5014         },
5015         {
5016                 .cmd = NL80211_CMD_GET_REG,
5017                 .doit = nl80211_get_reg,
5018                 .policy = nl80211_policy,
5019                 /* can be retrieved by unprivileged users */
5020         },
5021         {
5022                 .cmd = NL80211_CMD_SET_REG,
5023                 .doit = nl80211_set_reg,
5024                 .policy = nl80211_policy,
5025                 .flags = GENL_ADMIN_PERM,
5026         },
5027         {
5028                 .cmd = NL80211_CMD_REQ_SET_REG,
5029                 .doit = nl80211_req_set_reg,
5030                 .policy = nl80211_policy,
5031                 .flags = GENL_ADMIN_PERM,
5032         },
5033         {
5034                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
5035                 .doit = nl80211_get_mesh_params,
5036                 .policy = nl80211_policy,
5037                 /* can be retrieved by unprivileged users */
5038         },
5039         {
5040                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
5041                 .doit = nl80211_set_mesh_params,
5042                 .policy = nl80211_policy,
5043                 .flags = GENL_ADMIN_PERM,
5044         },
5045         {
5046                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5047                 .doit = nl80211_trigger_scan,
5048                 .policy = nl80211_policy,
5049                 .flags = GENL_ADMIN_PERM,
5050         },
5051         {
5052                 .cmd = NL80211_CMD_GET_SCAN,
5053                 .policy = nl80211_policy,
5054                 .dumpit = nl80211_dump_scan,
5055         },
5056         {
5057                 .cmd = NL80211_CMD_AUTHENTICATE,
5058                 .doit = nl80211_authenticate,
5059                 .policy = nl80211_policy,
5060                 .flags = GENL_ADMIN_PERM,
5061         },
5062         {
5063                 .cmd = NL80211_CMD_ASSOCIATE,
5064                 .doit = nl80211_associate,
5065                 .policy = nl80211_policy,
5066                 .flags = GENL_ADMIN_PERM,
5067         },
5068         {
5069                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5070                 .doit = nl80211_deauthenticate,
5071                 .policy = nl80211_policy,
5072                 .flags = GENL_ADMIN_PERM,
5073         },
5074         {
5075                 .cmd = NL80211_CMD_DISASSOCIATE,
5076                 .doit = nl80211_disassociate,
5077                 .policy = nl80211_policy,
5078                 .flags = GENL_ADMIN_PERM,
5079         },
5080         {
5081                 .cmd = NL80211_CMD_JOIN_IBSS,
5082                 .doit = nl80211_join_ibss,
5083                 .policy = nl80211_policy,
5084                 .flags = GENL_ADMIN_PERM,
5085         },
5086         {
5087                 .cmd = NL80211_CMD_LEAVE_IBSS,
5088                 .doit = nl80211_leave_ibss,
5089                 .policy = nl80211_policy,
5090                 .flags = GENL_ADMIN_PERM,
5091         },
5092 #ifdef CONFIG_NL80211_TESTMODE
5093         {
5094                 .cmd = NL80211_CMD_TESTMODE,
5095                 .doit = nl80211_testmode_do,
5096                 .policy = nl80211_policy,
5097                 .flags = GENL_ADMIN_PERM,
5098         },
5099 #endif
5100         {
5101                 .cmd = NL80211_CMD_CONNECT,
5102                 .doit = nl80211_connect,
5103                 .policy = nl80211_policy,
5104                 .flags = GENL_ADMIN_PERM,
5105         },
5106         {
5107                 .cmd = NL80211_CMD_DISCONNECT,
5108                 .doit = nl80211_disconnect,
5109                 .policy = nl80211_policy,
5110                 .flags = GENL_ADMIN_PERM,
5111         },
5112         {
5113                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5114                 .doit = nl80211_wiphy_netns,
5115                 .policy = nl80211_policy,
5116                 .flags = GENL_ADMIN_PERM,
5117         },
5118         {
5119                 .cmd = NL80211_CMD_GET_SURVEY,
5120                 .policy = nl80211_policy,
5121                 .dumpit = nl80211_dump_survey,
5122         },
5123         {
5124                 .cmd = NL80211_CMD_SET_PMKSA,
5125                 .doit = nl80211_setdel_pmksa,
5126                 .policy = nl80211_policy,
5127                 .flags = GENL_ADMIN_PERM,
5128         },
5129         {
5130                 .cmd = NL80211_CMD_DEL_PMKSA,
5131                 .doit = nl80211_setdel_pmksa,
5132                 .policy = nl80211_policy,
5133                 .flags = GENL_ADMIN_PERM,
5134         },
5135         {
5136                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5137                 .doit = nl80211_flush_pmksa,
5138                 .policy = nl80211_policy,
5139                 .flags = GENL_ADMIN_PERM,
5140         },
5141         {
5142                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5143                 .doit = nl80211_remain_on_channel,
5144                 .policy = nl80211_policy,
5145                 .flags = GENL_ADMIN_PERM,
5146         },
5147         {
5148                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5149                 .doit = nl80211_cancel_remain_on_channel,
5150                 .policy = nl80211_policy,
5151                 .flags = GENL_ADMIN_PERM,
5152         },
5153         {
5154                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5155                 .doit = nl80211_set_tx_bitrate_mask,
5156                 .policy = nl80211_policy,
5157                 .flags = GENL_ADMIN_PERM,
5158         },
5159         {
5160                 .cmd = NL80211_CMD_REGISTER_ACTION,
5161                 .doit = nl80211_register_action,
5162                 .policy = nl80211_policy,
5163                 .flags = GENL_ADMIN_PERM,
5164         },
5165         {
5166                 .cmd = NL80211_CMD_ACTION,
5167                 .doit = nl80211_action,
5168                 .policy = nl80211_policy,
5169                 .flags = GENL_ADMIN_PERM,
5170         },
5171         {
5172                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5173                 .doit = nl80211_set_power_save,
5174                 .policy = nl80211_policy,
5175                 .flags = GENL_ADMIN_PERM,
5176         },
5177         {
5178                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5179                 .doit = nl80211_get_power_save,
5180                 .policy = nl80211_policy,
5181                 /* can be retrieved by unprivileged users */
5182         },
5183         {
5184                 .cmd = NL80211_CMD_SET_CQM,
5185                 .doit = nl80211_set_cqm,
5186                 .policy = nl80211_policy,
5187                 .flags = GENL_ADMIN_PERM,
5188         },
5189 };
5190
5191 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5192         .name = "mlme",
5193 };
5194
5195 /* multicast groups */
5196 static struct genl_multicast_group nl80211_config_mcgrp = {
5197         .name = "config",
5198 };
5199 static struct genl_multicast_group nl80211_scan_mcgrp = {
5200         .name = "scan",
5201 };
5202 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5203         .name = "regulatory",
5204 };
5205
5206 /* notification functions */
5207
5208 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5209 {
5210         struct sk_buff *msg;
5211
5212         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5213         if (!msg)
5214                 return;
5215
5216         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5217                 nlmsg_free(msg);
5218                 return;
5219         }
5220
5221         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5222                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5223 }
5224
5225 static int nl80211_add_scan_req(struct sk_buff *msg,
5226                                 struct cfg80211_registered_device *rdev)
5227 {
5228         struct cfg80211_scan_request *req = rdev->scan_req;
5229         struct nlattr *nest;
5230         int i;
5231
5232         ASSERT_RDEV_LOCK(rdev);
5233
5234         if (WARN_ON(!req))
5235                 return 0;
5236
5237         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5238         if (!nest)
5239                 goto nla_put_failure;
5240         for (i = 0; i < req->n_ssids; i++)
5241                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5242         nla_nest_end(msg, nest);
5243
5244         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5245         if (!nest)
5246                 goto nla_put_failure;
5247         for (i = 0; i < req->n_channels; i++)
5248                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5249         nla_nest_end(msg, nest);
5250
5251         if (req->ie)
5252                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5253
5254         return 0;
5255  nla_put_failure:
5256         return -ENOBUFS;
5257 }
5258
5259 static int nl80211_send_scan_msg(struct sk_buff *msg,
5260                                  struct cfg80211_registered_device *rdev,
5261                                  struct net_device *netdev,
5262                                  u32 pid, u32 seq, int flags,
5263                                  u32 cmd)
5264 {
5265         void *hdr;
5266
5267         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5268         if (!hdr)
5269                 return -1;
5270
5271         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5272         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5273
5274         /* ignore errors and send incomplete event anyway */
5275         nl80211_add_scan_req(msg, rdev);
5276
5277         return genlmsg_end(msg, hdr);
5278
5279  nla_put_failure:
5280         genlmsg_cancel(msg, hdr);
5281         return -EMSGSIZE;
5282 }
5283
5284 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5285                              struct net_device *netdev)
5286 {
5287         struct sk_buff *msg;
5288
5289         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5290         if (!msg)
5291                 return;
5292
5293         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5294                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5295                 nlmsg_free(msg);
5296                 return;
5297         }
5298
5299         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5300                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5301 }
5302
5303 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5304                             struct net_device *netdev)
5305 {
5306         struct sk_buff *msg;
5307
5308         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5309         if (!msg)
5310                 return;
5311
5312         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5313                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5314                 nlmsg_free(msg);
5315                 return;
5316         }
5317
5318         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5319                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5320 }
5321
5322 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5323                                struct net_device *netdev)
5324 {
5325         struct sk_buff *msg;
5326
5327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5328         if (!msg)
5329                 return;
5330
5331         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5332                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5333                 nlmsg_free(msg);
5334                 return;
5335         }
5336
5337         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5338                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5339 }
5340
5341 /*
5342  * This can happen on global regulatory changes or device specific settings
5343  * based on custom world regulatory domains.
5344  */
5345 void nl80211_send_reg_change_event(struct regulatory_request *request)
5346 {
5347         struct sk_buff *msg;
5348         void *hdr;
5349
5350         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5351         if (!msg)
5352                 return;
5353
5354         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5355         if (!hdr) {
5356                 nlmsg_free(msg);
5357                 return;
5358         }
5359
5360         /* Userspace can always count this one always being set */
5361         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5362
5363         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5364                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5365                            NL80211_REGDOM_TYPE_WORLD);
5366         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5367                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5368                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5369         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5370                  request->intersect)
5371                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5372                            NL80211_REGDOM_TYPE_INTERSECTION);
5373         else {
5374                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5375                            NL80211_REGDOM_TYPE_COUNTRY);
5376                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5377         }
5378
5379         if (wiphy_idx_valid(request->wiphy_idx))
5380                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5381
5382         if (genlmsg_end(msg, hdr) < 0) {
5383                 nlmsg_free(msg);
5384                 return;
5385         }
5386
5387         rcu_read_lock();
5388         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5389                                 GFP_ATOMIC);
5390         rcu_read_unlock();
5391
5392         return;
5393
5394 nla_put_failure:
5395         genlmsg_cancel(msg, hdr);
5396         nlmsg_free(msg);
5397 }
5398
5399 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5400                                     struct net_device *netdev,
5401                                     const u8 *buf, size_t len,
5402                                     enum nl80211_commands cmd, gfp_t gfp)
5403 {
5404         struct sk_buff *msg;
5405         void *hdr;
5406
5407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5408         if (!msg)
5409                 return;
5410
5411         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5412         if (!hdr) {
5413                 nlmsg_free(msg);
5414                 return;
5415         }
5416
5417         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5418         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5419         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5420
5421         if (genlmsg_end(msg, hdr) < 0) {
5422                 nlmsg_free(msg);
5423                 return;
5424         }
5425
5426         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5427                                 nl80211_mlme_mcgrp.id, gfp);
5428         return;
5429
5430  nla_put_failure:
5431         genlmsg_cancel(msg, hdr);
5432         nlmsg_free(msg);
5433 }
5434
5435 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5436                           struct net_device *netdev, const u8 *buf,
5437                           size_t len, gfp_t gfp)
5438 {
5439         nl80211_send_mlme_event(rdev, netdev, buf, len,
5440                                 NL80211_CMD_AUTHENTICATE, gfp);
5441 }
5442
5443 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5444                            struct net_device *netdev, const u8 *buf,
5445                            size_t len, gfp_t gfp)
5446 {
5447         nl80211_send_mlme_event(rdev, netdev, buf, len,
5448                                 NL80211_CMD_ASSOCIATE, gfp);
5449 }
5450
5451 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5452                          struct net_device *netdev, const u8 *buf,
5453                          size_t len, gfp_t gfp)
5454 {
5455         nl80211_send_mlme_event(rdev, netdev, buf, len,
5456                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5457 }
5458
5459 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5460                            struct net_device *netdev, const u8 *buf,
5461                            size_t len, gfp_t gfp)
5462 {
5463         nl80211_send_mlme_event(rdev, netdev, buf, len,
5464                                 NL80211_CMD_DISASSOCIATE, gfp);
5465 }
5466
5467 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5468                                       struct net_device *netdev, int cmd,
5469                                       const u8 *addr, gfp_t gfp)
5470 {
5471         struct sk_buff *msg;
5472         void *hdr;
5473
5474         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5475         if (!msg)
5476                 return;
5477
5478         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5479         if (!hdr) {
5480                 nlmsg_free(msg);
5481                 return;
5482         }
5483
5484         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5485         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5486         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5487         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5488
5489         if (genlmsg_end(msg, hdr) < 0) {
5490                 nlmsg_free(msg);
5491                 return;
5492         }
5493
5494         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5495                                 nl80211_mlme_mcgrp.id, gfp);
5496         return;
5497
5498  nla_put_failure:
5499         genlmsg_cancel(msg, hdr);
5500         nlmsg_free(msg);
5501 }
5502
5503 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5504                                struct net_device *netdev, const u8 *addr,
5505                                gfp_t gfp)
5506 {
5507         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5508                                   addr, gfp);
5509 }
5510
5511 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5512                                 struct net_device *netdev, const u8 *addr,
5513                                 gfp_t gfp)
5514 {
5515         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5516                                   addr, gfp);
5517 }
5518
5519 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5520                                  struct net_device *netdev, const u8 *bssid,
5521                                  const u8 *req_ie, size_t req_ie_len,
5522                                  const u8 *resp_ie, size_t resp_ie_len,
5523                                  u16 status, gfp_t gfp)
5524 {
5525         struct sk_buff *msg;
5526         void *hdr;
5527
5528         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5529         if (!msg)
5530                 return;
5531
5532         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5533         if (!hdr) {
5534                 nlmsg_free(msg);
5535                 return;
5536         }
5537
5538         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5539         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5540         if (bssid)
5541                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5542         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5543         if (req_ie)
5544                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5545         if (resp_ie)
5546                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5547
5548         if (genlmsg_end(msg, hdr) < 0) {
5549                 nlmsg_free(msg);
5550                 return;
5551         }
5552
5553         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5554                                 nl80211_mlme_mcgrp.id, gfp);
5555         return;
5556
5557  nla_put_failure:
5558         genlmsg_cancel(msg, hdr);
5559         nlmsg_free(msg);
5560
5561 }
5562
5563 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5564                          struct net_device *netdev, const u8 *bssid,
5565                          const u8 *req_ie, size_t req_ie_len,
5566                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5567 {
5568         struct sk_buff *msg;
5569         void *hdr;
5570
5571         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5572         if (!msg)
5573                 return;
5574
5575         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5576         if (!hdr) {
5577                 nlmsg_free(msg);
5578                 return;
5579         }
5580
5581         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5582         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5583         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5584         if (req_ie)
5585                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5586         if (resp_ie)
5587                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5588
5589         if (genlmsg_end(msg, hdr) < 0) {
5590                 nlmsg_free(msg);
5591                 return;
5592         }
5593
5594         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5595                                 nl80211_mlme_mcgrp.id, gfp);
5596         return;
5597
5598  nla_put_failure:
5599         genlmsg_cancel(msg, hdr);
5600         nlmsg_free(msg);
5601
5602 }
5603
5604 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5605                                struct net_device *netdev, u16 reason,
5606                                const u8 *ie, size_t ie_len, bool from_ap)
5607 {
5608         struct sk_buff *msg;
5609         void *hdr;
5610
5611         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5612         if (!msg)
5613                 return;
5614
5615         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5616         if (!hdr) {
5617                 nlmsg_free(msg);
5618                 return;
5619         }
5620
5621         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5622         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5623         if (from_ap && reason)
5624                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5625         if (from_ap)
5626                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5627         if (ie)
5628                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5629
5630         if (genlmsg_end(msg, hdr) < 0) {
5631                 nlmsg_free(msg);
5632                 return;
5633         }
5634
5635         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5636                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5637         return;
5638
5639  nla_put_failure:
5640         genlmsg_cancel(msg, hdr);
5641         nlmsg_free(msg);
5642
5643 }
5644
5645 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5646                              struct net_device *netdev, const u8 *bssid,
5647                              gfp_t gfp)
5648 {
5649         struct sk_buff *msg;
5650         void *hdr;
5651
5652         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5653         if (!msg)
5654                 return;
5655
5656         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5657         if (!hdr) {
5658                 nlmsg_free(msg);
5659                 return;
5660         }
5661
5662         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5663         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5664         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5665
5666         if (genlmsg_end(msg, hdr) < 0) {
5667                 nlmsg_free(msg);
5668                 return;
5669         }
5670
5671         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5672                                 nl80211_mlme_mcgrp.id, gfp);
5673         return;
5674
5675  nla_put_failure:
5676         genlmsg_cancel(msg, hdr);
5677         nlmsg_free(msg);
5678 }
5679
5680 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5681                                  struct net_device *netdev, const u8 *addr,
5682                                  enum nl80211_key_type key_type, int key_id,
5683                                  const u8 *tsc, gfp_t gfp)
5684 {
5685         struct sk_buff *msg;
5686         void *hdr;
5687
5688         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5689         if (!msg)
5690                 return;
5691
5692         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5693         if (!hdr) {
5694                 nlmsg_free(msg);
5695                 return;
5696         }
5697
5698         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5699         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5700         if (addr)
5701                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5702         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5703         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5704         if (tsc)
5705                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5706
5707         if (genlmsg_end(msg, hdr) < 0) {
5708                 nlmsg_free(msg);
5709                 return;
5710         }
5711
5712         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5713                                 nl80211_mlme_mcgrp.id, gfp);
5714         return;
5715
5716  nla_put_failure:
5717         genlmsg_cancel(msg, hdr);
5718         nlmsg_free(msg);
5719 }
5720
5721 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5722                                     struct ieee80211_channel *channel_before,
5723                                     struct ieee80211_channel *channel_after)
5724 {
5725         struct sk_buff *msg;
5726         void *hdr;
5727         struct nlattr *nl_freq;
5728
5729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5730         if (!msg)
5731                 return;
5732
5733         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5734         if (!hdr) {
5735                 nlmsg_free(msg);
5736                 return;
5737         }
5738
5739         /*
5740          * Since we are applying the beacon hint to a wiphy we know its
5741          * wiphy_idx is valid
5742          */
5743         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5744
5745         /* Before */
5746         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5747         if (!nl_freq)
5748                 goto nla_put_failure;
5749         if (nl80211_msg_put_channel(msg, channel_before))
5750                 goto nla_put_failure;
5751         nla_nest_end(msg, nl_freq);
5752
5753         /* After */
5754         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5755         if (!nl_freq)
5756                 goto nla_put_failure;
5757         if (nl80211_msg_put_channel(msg, channel_after))
5758                 goto nla_put_failure;
5759         nla_nest_end(msg, nl_freq);
5760
5761         if (genlmsg_end(msg, hdr) < 0) {
5762                 nlmsg_free(msg);
5763                 return;
5764         }
5765
5766         rcu_read_lock();
5767         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5768                                 GFP_ATOMIC);
5769         rcu_read_unlock();
5770
5771         return;
5772
5773 nla_put_failure:
5774         genlmsg_cancel(msg, hdr);
5775         nlmsg_free(msg);
5776 }
5777
5778 static void nl80211_send_remain_on_chan_event(
5779         int cmd, struct cfg80211_registered_device *rdev,
5780         struct net_device *netdev, u64 cookie,
5781         struct ieee80211_channel *chan,
5782         enum nl80211_channel_type channel_type,
5783         unsigned int duration, gfp_t gfp)
5784 {
5785         struct sk_buff *msg;
5786         void *hdr;
5787
5788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5789         if (!msg)
5790                 return;
5791
5792         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5793         if (!hdr) {
5794                 nlmsg_free(msg);
5795                 return;
5796         }
5797
5798         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5799         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5800         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5801         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5802         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5803
5804         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5805                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5806
5807         if (genlmsg_end(msg, hdr) < 0) {
5808                 nlmsg_free(msg);
5809                 return;
5810         }
5811
5812         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5813                                 nl80211_mlme_mcgrp.id, gfp);
5814         return;
5815
5816  nla_put_failure:
5817         genlmsg_cancel(msg, hdr);
5818         nlmsg_free(msg);
5819 }
5820
5821 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5822                                     struct net_device *netdev, u64 cookie,
5823                                     struct ieee80211_channel *chan,
5824                                     enum nl80211_channel_type channel_type,
5825                                     unsigned int duration, gfp_t gfp)
5826 {
5827         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5828                                           rdev, netdev, cookie, chan,
5829                                           channel_type, duration, gfp);
5830 }
5831
5832 void nl80211_send_remain_on_channel_cancel(
5833         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5834         u64 cookie, struct ieee80211_channel *chan,
5835         enum nl80211_channel_type channel_type, gfp_t gfp)
5836 {
5837         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5838                                           rdev, netdev, cookie, chan,
5839                                           channel_type, 0, gfp);
5840 }
5841
5842 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5843                             struct net_device *dev, const u8 *mac_addr,
5844                             struct station_info *sinfo, gfp_t gfp)
5845 {
5846         struct sk_buff *msg;
5847
5848         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5849         if (!msg)
5850                 return;
5851
5852         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5853                 nlmsg_free(msg);
5854                 return;
5855         }
5856
5857         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5858                                 nl80211_mlme_mcgrp.id, gfp);
5859 }
5860
5861 int nl80211_send_action(struct cfg80211_registered_device *rdev,
5862                         struct net_device *netdev, u32 nlpid,
5863                         int freq, const u8 *buf, size_t len, gfp_t gfp)
5864 {
5865         struct sk_buff *msg;
5866         void *hdr;
5867         int err;
5868
5869         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5870         if (!msg)
5871                 return -ENOMEM;
5872
5873         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
5874         if (!hdr) {
5875                 nlmsg_free(msg);
5876                 return -ENOMEM;
5877         }
5878
5879         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5880         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5881         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5882         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5883
5884         err = genlmsg_end(msg, hdr);
5885         if (err < 0) {
5886                 nlmsg_free(msg);
5887                 return err;
5888         }
5889
5890         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5891         if (err < 0)
5892                 return err;
5893         return 0;
5894
5895  nla_put_failure:
5896         genlmsg_cancel(msg, hdr);
5897         nlmsg_free(msg);
5898         return -ENOBUFS;
5899 }
5900
5901 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
5902                                    struct net_device *netdev, u64 cookie,
5903                                    const u8 *buf, size_t len, bool ack,
5904                                    gfp_t gfp)
5905 {
5906         struct sk_buff *msg;
5907         void *hdr;
5908
5909         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5910         if (!msg)
5911                 return;
5912
5913         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
5914         if (!hdr) {
5915                 nlmsg_free(msg);
5916                 return;
5917         }
5918
5919         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5920         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5921         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5922         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5923         if (ack)
5924                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5925
5926         if (genlmsg_end(msg, hdr) < 0) {
5927                 nlmsg_free(msg);
5928                 return;
5929         }
5930
5931         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5932         return;
5933
5934  nla_put_failure:
5935         genlmsg_cancel(msg, hdr);
5936         nlmsg_free(msg);
5937 }
5938
5939 void
5940 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
5941                              struct net_device *netdev,
5942                              enum nl80211_cqm_rssi_threshold_event rssi_event,
5943                              gfp_t gfp)
5944 {
5945         struct sk_buff *msg;
5946         struct nlattr *pinfoattr;
5947         void *hdr;
5948
5949         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5950         if (!msg)
5951                 return;
5952
5953         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5954         if (!hdr) {
5955                 nlmsg_free(msg);
5956                 return;
5957         }
5958
5959         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5960         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5961
5962         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5963         if (!pinfoattr)
5964                 goto nla_put_failure;
5965
5966         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
5967                     rssi_event);
5968
5969         nla_nest_end(msg, pinfoattr);
5970
5971         if (genlmsg_end(msg, hdr) < 0) {
5972                 nlmsg_free(msg);
5973                 return;
5974         }
5975
5976         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5977                                 nl80211_mlme_mcgrp.id, gfp);
5978         return;
5979
5980  nla_put_failure:
5981         genlmsg_cancel(msg, hdr);
5982         nlmsg_free(msg);
5983 }
5984
5985 static int nl80211_netlink_notify(struct notifier_block * nb,
5986                                   unsigned long state,
5987                                   void *_notify)
5988 {
5989         struct netlink_notify *notify = _notify;
5990         struct cfg80211_registered_device *rdev;
5991         struct wireless_dev *wdev;
5992
5993         if (state != NETLINK_URELEASE)
5994                 return NOTIFY_DONE;
5995
5996         rcu_read_lock();
5997
5998         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5999                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
6000                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
6001
6002         rcu_read_unlock();
6003
6004         return NOTIFY_DONE;
6005 }
6006
6007 static struct notifier_block nl80211_netlink_notifier = {
6008         .notifier_call = nl80211_netlink_notify,
6009 };
6010
6011 /* initialisation/exit functions */
6012
6013 int nl80211_init(void)
6014 {
6015         int err;
6016
6017         err = genl_register_family_with_ops(&nl80211_fam,
6018                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6019         if (err)
6020                 return err;
6021
6022         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6023         if (err)
6024                 goto err_out;
6025
6026         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6027         if (err)
6028                 goto err_out;
6029
6030         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6031         if (err)
6032                 goto err_out;
6033
6034         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6035         if (err)
6036                 goto err_out;
6037
6038 #ifdef CONFIG_NL80211_TESTMODE
6039         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6040         if (err)
6041                 goto err_out;
6042 #endif
6043
6044         err = netlink_register_notifier(&nl80211_netlink_notifier);
6045         if (err)
6046                 goto err_out;
6047
6048         return 0;
6049  err_out:
6050         genl_unregister_family(&nl80211_fam);
6051         return err;
6052 }
6053
6054 void nl80211_exit(void)
6055 {
6056         netlink_unregister_notifier(&nl80211_netlink_notifier);
6057         genl_unregister_family(&nl80211_fam);
6058 }