net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
  18 #include <net/net_namespace.h>
  19 #endif
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26
  27 /* the netlink family */
  28 static struct genl_family nl80211_fam = {
  29         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  30         .name = "nl80211",      /* have users key off the name instead */
  31         .hdrsize = 0,           /* no private header */
  32         .version = 1,           /* no particular meaning now */
  33         .maxattr = NL80211_ATTR_MAX,
  34 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32))
  35         .netnsok = true,
  36 #endif
  37 };
  38
  39 /* internal helper: get rdev and dev */
  40 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  41                                        struct cfg80211_registered_device **rdev,
  42                                        struct net_device **dev)
  43 {
  44         struct nlattr **attrs = info->attrs;
  45         int ifindex;
  46
  47         if (!attrs[NL80211_ATTR_IFINDEX])
  48                 return -EINVAL;
  49
  50         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  51         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  52         if (!*dev)
  53                 return -ENODEV;
  54
  55         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  56         if (IS_ERR(*rdev)) {
  57                 dev_put(*dev);
  58                 return PTR_ERR(*rdev);
  59         }
  60
  61         return 0;
  62 }
  63
  64 /* policy for the attributes */
  65 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  66         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  68                                       .len = 20-1 },
  69         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  70         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  73         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  74         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  75         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  76         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  77
  78         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  79         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  80         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  81
  82         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  83         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  84
  85         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  86         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  87                                     .len = WLAN_MAX_KEY_LEN },
  88         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  89         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  90         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  91         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  92
  93         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  94         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  95         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  96                                        .len = IEEE80211_MAX_DATA_LEN },
  97         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  98                                        .len = IEEE80211_MAX_DATA_LEN },
  99         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 100         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 101         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 102         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 103                                                .len = NL80211_MAX_SUPP_RATES },
 104         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 105         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 106         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 107         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 108                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 109         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 110
 111         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 112         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 113
 114         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 115         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 116         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 117         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 118                                            .len = NL80211_MAX_SUPP_RATES },
 119
 120         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 121
 122         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 123                                          .len = NL80211_HT_CAPABILITY_LEN },
 124
 125         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 126         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 127                               .len = IEEE80211_MAX_DATA_LEN },
 128         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 129         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 130
 131         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 132                                 .len = IEEE80211_MAX_SSID_LEN },
 133         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 134         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 135         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 136         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 138         [NL80211_ATTR_STA_FLAGS2] = {
 139                 .len = sizeof(struct nl80211_sta_flag_update),
 140         },
 141         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 142         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 143         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 144         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 145         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 146         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 147         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 148                                  .len = WLAN_PMKID_LEN },
 149         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 150         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 151         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 152         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 153                                  .len = IEEE80211_MAX_DATA_LEN },
 154         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 155         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 156 };
 157
 158 /* policy for the attributes */
 159 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 160         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 161         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 162         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 163         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 164         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 165         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 166 };
 167
 168 /* ifidx get helper */
 169 static int nl80211_get_ifidx(struct netlink_callback *cb)
 170 {
 171         int res;
 172
 173         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 174                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 175                           nl80211_policy);
 176         if (res)
 177                 return res;
 178
 179         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 180                 return -EINVAL;
 181
 182         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 183         if (!res)
 184                 return -EINVAL;
 185         return res;
 186 }
 187
 188 /* IE validation */
 189 static bool is_valid_ie_attr(const struct nlattr *attr)
 190 {
 191         const u8 *pos;
 192         int len;
 193
 194         if (!attr)
 195                 return true;
 196
 197         pos = nla_data(attr);
 198         len = nla_len(attr);
 199
 200         while (len) {
 201                 u8 elemlen;
 202
 203                 if (len < 2)
 204                         return false;
 205                 len -= 2;
 206
 207                 elemlen = pos[1];
 208                 if (elemlen > len)
 209                         return false;
 210
 211                 len -= elemlen;
 212                 pos += 2 + elemlen;
 213         }
 214
 215         return true;
 216 }
 217
 218 /* message building helper */
 219 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 220                                    int flags, u8 cmd)
 221 {
 222         /* since there is no private header just add the generic one */
 223         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 224 }
 225
 226 static int nl80211_msg_put_channel(struct sk_buff *msg,
 227                                    struct ieee80211_channel *chan)
 228 {
 229         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 230                     chan->center_freq);
 231
 232         if (chan->flags & IEEE80211_CHAN_DISABLED)
 233                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 234         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 235                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 236         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 237                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 238         if (chan->flags & IEEE80211_CHAN_RADAR)
 239                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 240
 241         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 242                     DBM_TO_MBM(chan->max_power));
 243
 244         return 0;
 245
 246  nla_put_failure:
 247         return -ENOBUFS;
 248 }
 249
 250 /* netlink command implementations */
 251
 252 struct key_parse {
 253         struct key_params p;
 254         int idx;
 255         bool def, defmgmt;
 256 };
 257
 258 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 259 {
 260         struct nlattr *tb[NL80211_KEY_MAX + 1];
 261         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 262                                    nl80211_key_policy);
 263         if (err)
 264                 return err;
 265
 266         k->def = !!tb[NL80211_KEY_DEFAULT];
 267         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 268
 269         if (tb[NL80211_KEY_IDX])
 270                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 271
 272         if (tb[NL80211_KEY_DATA]) {
 273                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 274                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 275         }
 276
 277         if (tb[NL80211_KEY_SEQ]) {
 278                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 279                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 280         }
 281
 282         if (tb[NL80211_KEY_CIPHER])
 283                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 284
 285         return 0;
 286 }
 287
 288 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 289 {
 290         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 291                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 292                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 293         }
 294
 295         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 296                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 297                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 298         }
 299
 300         if (info->attrs[NL80211_ATTR_KEY_IDX])
 301                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 302
 303         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 304                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 305
 306         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 307         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 308
 309         return 0;
 310 }
 311
 312 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 313 {
 314         int err;
 315
 316         memset(k, 0, sizeof(*k));
 317         k->idx = -1;
 318
 319         if (info->attrs[NL80211_ATTR_KEY])
 320                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 321         else
 322                 err = nl80211_parse_key_old(info, k);
 323
 324         if (err)
 325                 return err;
 326
 327         if (k->def && k->defmgmt)
 328                 return -EINVAL;
 329
 330         if (k->idx != -1) {
 331                 if (k->defmgmt) {
 332                         if (k->idx < 4 || k->idx > 5)
 333                                 return -EINVAL;
 334                 } else if (k->def) {
 335                         if (k->idx < 0 || k->idx > 3)
 336                                 return -EINVAL;
 337                 } else {
 338                         if (k->idx < 0 || k->idx > 5)
 339                                 return -EINVAL;
 340                 }
 341         }
 342
 343         return 0;
 344 }
 345
 346 static struct cfg80211_cached_keys *
 347 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 348                        struct nlattr *keys)
 349 {
 350         struct key_parse parse;
 351         struct nlattr *key;
 352         struct cfg80211_cached_keys *result;
 353         int rem, err, def = 0;
 354
 355         result = kzalloc(sizeof(*result), GFP_KERNEL);
 356         if (!result)
 357                 return ERR_PTR(-ENOMEM);
 358
 359         result->def = -1;
 360         result->defmgmt = -1;
 361
 362         nla_for_each_nested(key, keys, rem) {
 363                 memset(&parse, 0, sizeof(parse));
 364                 parse.idx = -1;
 365
 366                 err = nl80211_parse_key_new(key, &parse);
 367                 if (err)
 368                         goto error;
 369                 err = -EINVAL;
 370                 if (!parse.p.key)
 371                         goto error;
 372                 if (parse.idx < 0 || parse.idx > 4)
 373                         goto error;
 374                 if (parse.def) {
 375                         if (def)
 376                                 goto error;
 377                         def = 1;
 378                         result->def = parse.idx;
 379                 } else if (parse.defmgmt)
 380                         goto error;
 381                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 382                                                      parse.idx, NULL);
 383                 if (err)
 384                         goto error;
 385                 result->params[parse.idx].cipher = parse.p.cipher;
 386                 result->params[parse.idx].key_len = parse.p.key_len;
 387                 result->params[parse.idx].key = result->data[parse.idx];
 388                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 389         }
 390
 391         return result;
 392  error:
 393         kfree(result);
 394         return ERR_PTR(err);
 395 }
 396
 397 static int nl80211_key_allowed(struct wireless_dev *wdev)
 398 {
 399         ASSERT_WDEV_LOCK(wdev);
 400
 401         if (!netif_running(wdev->netdev))
 402                 return -ENETDOWN;
 403
 404         switch (wdev->iftype) {
 405         case NL80211_IFTYPE_AP:
 406         case NL80211_IFTYPE_AP_VLAN:
 407                 break;
 408         case NL80211_IFTYPE_ADHOC:
 409                 if (!wdev->current_bss)
 410                         return -ENOLINK;
 411                 break;
 412         case NL80211_IFTYPE_STATION:
 413                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 414                         return -ENOLINK;
 415                 break;
 416         default:
 417                 return -EINVAL;
 418         }
 419
 420         return 0;
 421 }
 422
 423 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 424                               struct cfg80211_registered_device *dev)
 425 {
 426         void *hdr;
 427         struct nlattr *nl_bands, *nl_band;
 428         struct nlattr *nl_freqs, *nl_freq;
 429         struct nlattr *nl_rates, *nl_rate;
 430         struct nlattr *nl_modes;
 431         struct nlattr *nl_cmds;
 432         enum ieee80211_band band;
 433         struct ieee80211_channel *chan;
 434         struct ieee80211_rate *rate;
 435         int i;
 436         u16 ifmodes = dev->wiphy.interface_modes;
 437
 438         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 439         if (!hdr)
 440                 return -1;
 441
 442         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 443         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 444
 445         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 446                     cfg80211_rdev_list_generation);
 447
 448         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 449                    dev->wiphy.retry_short);
 450         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 451                    dev->wiphy.retry_long);
 452         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 453                     dev->wiphy.frag_threshold);
 454         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 455                     dev->wiphy.rts_threshold);
 456         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 457                     dev->wiphy.coverage_class);
 458
 459         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 460                    dev->wiphy.max_scan_ssids);
 461         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 462                     dev->wiphy.max_scan_ie_len);
 463
 464         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 465                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 466                 dev->wiphy.cipher_suites);
 467
 468         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 469                    dev->wiphy.max_num_pmkids);
 470
 471         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 472         if (!nl_modes)
 473                 goto nla_put_failure;
 474
 475         i = 0;
 476         while (ifmodes) {
 477                 if (ifmodes & 1)
 478                         NLA_PUT_FLAG(msg, i);
 479                 ifmodes >>= 1;
 480                 i++;
 481         }
 482
 483         nla_nest_end(msg, nl_modes);
 484
 485         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 486         if (!nl_bands)
 487                 goto nla_put_failure;
 488
 489         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 490                 if (!dev->wiphy.bands[band])
 491                         continue;
 492
 493                 nl_band = nla_nest_start(msg, band);
 494                 if (!nl_band)
 495                         goto nla_put_failure;
 496
 497                 /* add HT info */
 498                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 499                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 500                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 501                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 502                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 503                                 dev->wiphy.bands[band]->ht_cap.cap);
 504                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 505                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 506                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 507                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 508                 }
 509
 510                 /* add frequencies */
 511                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 512                 if (!nl_freqs)
 513                         goto nla_put_failure;
 514
 515                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 516                         nl_freq = nla_nest_start(msg, i);
 517                         if (!nl_freq)
 518                                 goto nla_put_failure;
 519
 520                         chan = &dev->wiphy.bands[band]->channels[i];
 521
 522                         if (nl80211_msg_put_channel(msg, chan))
 523                                 goto nla_put_failure;
 524
 525                         nla_nest_end(msg, nl_freq);
 526                 }
 527
 528                 nla_nest_end(msg, nl_freqs);
 529
 530                 /* add bitrates */
 531                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 532                 if (!nl_rates)
 533                         goto nla_put_failure;
 534
 535                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 536                         nl_rate = nla_nest_start(msg, i);
 537                         if (!nl_rate)
 538                                 goto nla_put_failure;
 539
 540                         rate = &dev->wiphy.bands[band]->bitrates[i];
 541                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 542                                     rate->bitrate);
 543                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 544                                 NLA_PUT_FLAG(msg,
 545                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 546
 547                         nla_nest_end(msg, nl_rate);
 548                 }
 549
 550                 nla_nest_end(msg, nl_rates);
 551
 552                 nla_nest_end(msg, nl_band);
 553         }
 554         nla_nest_end(msg, nl_bands);
 555
 556         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 557         if (!nl_cmds)
 558                 goto nla_put_failure;
 559
 560         i = 0;
 561 #define CMD(op, n)                                              \
 562          do {                                                   \
 563                 if (dev->ops->op) {                             \
 564                         i++;                                    \
 565                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 566                 }                                               \
 567         } while (0)
 568
 569         CMD(add_virtual_intf, NEW_INTERFACE);
 570         CMD(change_virtual_intf, SET_INTERFACE);
 571         CMD(add_key, NEW_KEY);
 572         CMD(add_beacon, NEW_BEACON);
 573         CMD(add_station, NEW_STATION);
 574         CMD(add_mpath, NEW_MPATH);
 575         CMD(set_mesh_params, SET_MESH_PARAMS);
 576         CMD(change_bss, SET_BSS);
 577         CMD(auth, AUTHENTICATE);
 578         CMD(assoc, ASSOCIATE);
 579         CMD(deauth, DEAUTHENTICATE);
 580         CMD(disassoc, DISASSOCIATE);
 581         CMD(join_ibss, JOIN_IBSS);
 582         CMD(set_pmksa, SET_PMKSA);
 583         CMD(del_pmksa, DEL_PMKSA);
 584         CMD(flush_pmksa, FLUSH_PMKSA);
 585         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 586         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 587         CMD(action, ACTION);
 588         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 589                 i++;
 590                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 591         }
 592
 593 #undef CMD
 594
 595         if (dev->ops->connect || dev->ops->auth) {
 596                 i++;
 597                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 598         }
 599
 600         if (dev->ops->disconnect || dev->ops->deauth) {
 601                 i++;
 602                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 603         }
 604
 605         nla_nest_end(msg, nl_cmds);
 606
 607         return genlmsg_end(msg, hdr);
 608
 609  nla_put_failure:
 610         genlmsg_cancel(msg, hdr);
 611         return -EMSGSIZE;
 612 }
 613
 614 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 615 {
 616         int idx = 0;
 617         int start = cb->args[0];
 618         struct cfg80211_registered_device *dev;
 619
 620         mutex_lock(&cfg80211_mutex);
 621         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 622                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 623                         continue;
 624                 if (++idx <= start)
 625                         continue;
 626                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 627                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 628                                        dev) < 0) {
 629                         idx--;
 630                         break;
 631                 }
 632         }
 633         mutex_unlock(&cfg80211_mutex);
 634
 635         cb->args[0] = idx;
 636
 637         return skb->len;
 638 }
 639
 640 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 641 {
 642         struct sk_buff *msg;
 643         struct cfg80211_registered_device *dev;
 644
 645         dev = cfg80211_get_dev_from_info(info);
 646         if (IS_ERR(dev))
 647                 return PTR_ERR(dev);
 648
 649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 650         if (!msg)
 651                 goto out_err;
 652
 653         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 654                 goto out_free;
 655
 656         cfg80211_unlock_rdev(dev);
 657
 658         return genlmsg_reply(msg, info);
 659
 660  out_free:
 661         nlmsg_free(msg);
 662  out_err:
 663         cfg80211_unlock_rdev(dev);
 664         return -ENOBUFS;
 665 }
 666
 667 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 668         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 669         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 670         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 671         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 672         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 673 };
 674
 675 static int parse_txq_params(struct nlattr *tb[],
 676                             struct ieee80211_txq_params *txq_params)
 677 {
 678         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 679             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 680             !tb[NL80211_TXQ_ATTR_AIFS])
 681                 return -EINVAL;
 682
 683         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 684         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 685         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 686         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 687         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 688
 689         return 0;
 690 }
 691
 692 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 693 {
 694         struct cfg80211_registered_device *rdev;
 695         int result = 0, rem_txq_params = 0;
 696         struct nlattr *nl_txq_params;
 697         u32 changed;
 698         u8 retry_short = 0, retry_long = 0;
 699         u32 frag_threshold = 0, rts_threshold = 0;
 700         u8 coverage_class = 0;
 701
 702         rtnl_lock();
 703
 704         mutex_lock(&cfg80211_mutex);
 705
 706         rdev = __cfg80211_rdev_from_info(info);
 707         if (IS_ERR(rdev)) {
 708                 mutex_unlock(&cfg80211_mutex);
 709                 result = PTR_ERR(rdev);
 710                 goto unlock;
 711         }
 712
 713         mutex_lock(&rdev->mtx);
 714
 715         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 716                 result = cfg80211_dev_rename(
 717                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 718
 719         mutex_unlock(&cfg80211_mutex);
 720
 721         if (result)
 722                 goto bad_res;
 723
 724         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 725                 struct ieee80211_txq_params txq_params;
 726                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 727
 728                 if (!rdev->ops->set_txq_params) {
 729                         result = -EOPNOTSUPP;
 730                         goto bad_res;
 731                 }
 732
 733                 nla_for_each_nested(nl_txq_params,
 734                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 735                                     rem_txq_params) {
 736                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 737                                   nla_data(nl_txq_params),
 738                                   nla_len(nl_txq_params),
 739                                   txq_params_policy);
 740                         result = parse_txq_params(tb, &txq_params);
 741                         if (result)
 742                                 goto bad_res;
 743
 744                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 745                                                            &txq_params);
 746                         if (result)
 747                                 goto bad_res;
 748                 }
 749         }
 750
 751         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 752                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 753                 u32 freq;
 754
 755                 result = -EINVAL;
 756
 757                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 758                         channel_type = nla_get_u32(info->attrs[
 759                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 760                         if (channel_type != NL80211_CHAN_NO_HT &&
 761                             channel_type != NL80211_CHAN_HT20 &&
 762                             channel_type != NL80211_CHAN_HT40PLUS &&
 763                             channel_type != NL80211_CHAN_HT40MINUS)
 764                                 goto bad_res;
 765                 }
 766
 767                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 768
 769                 mutex_lock(&rdev->devlist_mtx);
 770                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 771                 mutex_unlock(&rdev->devlist_mtx);
 772                 if (result)
 773                         goto bad_res;
 774         }
 775
 776         changed = 0;
 777
 778         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 779                 retry_short = nla_get_u8(
 780                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 781                 if (retry_short == 0) {
 782                         result = -EINVAL;
 783                         goto bad_res;
 784                 }
 785                 changed |= WIPHY_PARAM_RETRY_SHORT;
 786         }
 787
 788         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 789                 retry_long = nla_get_u8(
 790                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 791                 if (retry_long == 0) {
 792                         result = -EINVAL;
 793                         goto bad_res;
 794                 }
 795                 changed |= WIPHY_PARAM_RETRY_LONG;
 796         }
 797
 798         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 799                 frag_threshold = nla_get_u32(
 800                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 801                 if (frag_threshold < 256) {
 802                         result = -EINVAL;
 803                         goto bad_res;
 804                 }
 805                 if (frag_threshold != (u32) -1) {
 806                         /*
 807                          * Fragments (apart from the last one) are required to
 808                          * have even length. Make the fragmentation code
 809                          * simpler by stripping LSB should someone try to use
 810                          * odd threshold value.
 811                          */
 812                         frag_threshold &= ~0x1;
 813                 }
 814                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 815         }
 816
 817         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 818                 rts_threshold = nla_get_u32(
 819                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 820                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 821         }
 822
 823         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 824                 coverage_class = nla_get_u8(
 825                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 826                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 827         }
 828
 829         if (changed) {
 830                 u8 old_retry_short, old_retry_long;
 831                 u32 old_frag_threshold, old_rts_threshold;
 832                 u8 old_coverage_class;
 833
 834                 if (!rdev->ops->set_wiphy_params) {
 835                         result = -EOPNOTSUPP;
 836                         goto bad_res;
 837                 }
 838
 839                 old_retry_short = rdev->wiphy.retry_short;
 840                 old_retry_long = rdev->wiphy.retry_long;
 841                 old_frag_threshold = rdev->wiphy.frag_threshold;
 842                 old_rts_threshold = rdev->wiphy.rts_threshold;
 843                 old_coverage_class = rdev->wiphy.coverage_class;
 844
 845                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 846                         rdev->wiphy.retry_short = retry_short;
 847                 if (changed & WIPHY_PARAM_RETRY_LONG)
 848                         rdev->wiphy.retry_long = retry_long;
 849                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 850                         rdev->wiphy.frag_threshold = frag_threshold;
 851                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 852                         rdev->wiphy.rts_threshold = rts_threshold;
 853                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 854                         rdev->wiphy.coverage_class = coverage_class;
 855
 856                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 857                 if (result) {
 858                         rdev->wiphy.retry_short = old_retry_short;
 859                         rdev->wiphy.retry_long = old_retry_long;
 860                         rdev->wiphy.frag_threshold = old_frag_threshold;
 861                         rdev->wiphy.rts_threshold = old_rts_threshold;
 862                         rdev->wiphy.coverage_class = old_coverage_class;
 863                 }
 864         }
 865
 866  bad_res:
 867         mutex_unlock(&rdev->mtx);
 868  unlock:
 869         rtnl_unlock();
 870         return result;
 871 }
 872
 873
 874 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 875                               struct cfg80211_registered_device *rdev,
 876                               struct net_device *dev)
 877 {
 878         void *hdr;
 879
 880         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 881         if (!hdr)
 882                 return -1;
 883
 884         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 885         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 886         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 887         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 888
 889         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 890                     rdev->devlist_generation ^
 891                         (cfg80211_rdev_list_generation << 2));
 892
 893         return genlmsg_end(msg, hdr);
 894
 895  nla_put_failure:
 896         genlmsg_cancel(msg, hdr);
 897         return -EMSGSIZE;
 898 }
 899
 900 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 901 {
 902         int wp_idx = 0;
 903         int if_idx = 0;
 904         int wp_start = cb->args[0];
 905         int if_start = cb->args[1];
 906         struct cfg80211_registered_device *rdev;
 907         struct wireless_dev *wdev;
 908
 909         mutex_lock(&cfg80211_mutex);
 910         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 911                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 912                         continue;
 913                 if (wp_idx < wp_start) {
 914                         wp_idx++;
 915                         continue;
 916                 }
 917                 if_idx = 0;
 918
 919                 mutex_lock(&rdev->devlist_mtx);
 920                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 921                         if (if_idx < if_start) {
 922                                 if_idx++;
 923                                 continue;
 924                         }
 925                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 926                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 927                                                rdev, wdev->netdev) < 0) {
 928                                 mutex_unlock(&rdev->devlist_mtx);
 929                                 goto out;
 930                         }
 931                         if_idx++;
 932                 }
 933                 mutex_unlock(&rdev->devlist_mtx);
 934
 935                 wp_idx++;
 936         }
 937  out:
 938         mutex_unlock(&cfg80211_mutex);
 939
 940         cb->args[0] = wp_idx;
 941         cb->args[1] = if_idx;
 942
 943         return skb->len;
 944 }
 945
 946 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 947 {
 948         struct sk_buff *msg;
 949         struct cfg80211_registered_device *dev;
 950         struct net_device *netdev;
 951         int err;
 952
 953         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 954         if (err)
 955                 return err;
 956
 957         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 958         if (!msg)
 959                 goto out_err;
 960
 961         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 962                                dev, netdev) < 0)
 963                 goto out_free;
 964
 965         dev_put(netdev);
 966         cfg80211_unlock_rdev(dev);
 967
 968         return genlmsg_reply(msg, info);
 969
 970  out_free:
 971         nlmsg_free(msg);
 972  out_err:
 973         dev_put(netdev);
 974         cfg80211_unlock_rdev(dev);
 975         return -ENOBUFS;
 976 }
 977
 978 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 979         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 980         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 981         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 982         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 983         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 984 };
 985
 986 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 987 {
 988         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 989         int flag;
 990
 991         *mntrflags = 0;
 992
 993         if (!nla)
 994                 return -EINVAL;
 995
 996         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 997                              nla, mntr_flags_policy))
 998                 return -EINVAL;
 999
1000         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1001                 if (flags[flag])
1002                         *mntrflags |= (1<<flag);
1003
1004         return 0;
1005 }
1006
1007 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1008                                struct net_device *netdev, u8 use_4addr,
1009                                enum nl80211_iftype iftype)
1010 {
1011         if (!use_4addr) {
1012                 if (netdev && netdev->br_port)
1013                         return -EBUSY;
1014                 return 0;
1015         }
1016
1017         switch (iftype) {
1018         case NL80211_IFTYPE_AP_VLAN:
1019                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1020                         return 0;
1021                 break;
1022         case NL80211_IFTYPE_STATION:
1023                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1024                         return 0;
1025                 break;
1026         default:
1027                 break;
1028         }
1029
1030         return -EOPNOTSUPP;
1031 }
1032
1033 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1034 {
1035         struct cfg80211_registered_device *rdev;
1036         struct vif_params params;
1037         int err;
1038         enum nl80211_iftype otype, ntype;
1039         struct net_device *dev;
1040         u32 _flags, *flags = NULL;
1041         bool change = false;
1042
1043         memset(&params, 0, sizeof(params));
1044
1045         rtnl_lock();
1046
1047         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1048         if (err)
1049                 goto unlock_rtnl;
1050
1051         otype = ntype = dev->ieee80211_ptr->iftype;
1052
1053         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1054                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1055                 if (otype != ntype)
1056                         change = true;
1057                 if (ntype > NL80211_IFTYPE_MAX) {
1058                         err = -EINVAL;
1059                         goto unlock;
1060                 }
1061         }
1062
1063         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1064                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1065                         err = -EINVAL;
1066                         goto unlock;
1067                 }
1068                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1069                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1070                 change = true;
1071         }
1072
1073         if (info->attrs[NL80211_ATTR_4ADDR]) {
1074                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1075                 change = true;
1076                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1077                 if (err)
1078                         goto unlock;
1079         } else {
1080                 params.use_4addr = -1;
1081         }
1082
1083         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1084                 if (ntype != NL80211_IFTYPE_MONITOR) {
1085                         err = -EINVAL;
1086                         goto unlock;
1087                 }
1088                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1089                                           &_flags);
1090                 if (err)
1091                         goto unlock;
1092
1093                 flags = &_flags;
1094                 change = true;
1095         }
1096
1097         if (change)
1098                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1099         else
1100                 err = 0;
1101
1102         if (!err && params.use_4addr != -1)
1103                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1104
1105  unlock:
1106         dev_put(dev);
1107         cfg80211_unlock_rdev(rdev);
1108  unlock_rtnl:
1109         rtnl_unlock();
1110         return err;
1111 }
1112
1113 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1114 {
1115         struct cfg80211_registered_device *rdev;
1116         struct vif_params params;
1117         int err;
1118         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1119         u32 flags;
1120
1121         memset(&params, 0, sizeof(params));
1122
1123         if (!info->attrs[NL80211_ATTR_IFNAME])
1124                 return -EINVAL;
1125
1126         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1127                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1128                 if (type > NL80211_IFTYPE_MAX)
1129                         return -EINVAL;
1130         }
1131
1132         rtnl_lock();
1133
1134         rdev = cfg80211_get_dev_from_info(info);
1135         if (IS_ERR(rdev)) {
1136                 err = PTR_ERR(rdev);
1137                 goto unlock_rtnl;
1138         }
1139
1140         if (!rdev->ops->add_virtual_intf ||
1141             !(rdev->wiphy.interface_modes & (1 << type))) {
1142                 err = -EOPNOTSUPP;
1143                 goto unlock;
1144         }
1145
1146         if (type == NL80211_IFTYPE_MESH_POINT &&
1147             info->attrs[NL80211_ATTR_MESH_ID]) {
1148                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1149                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1150         }
1151
1152         if (info->attrs[NL80211_ATTR_4ADDR]) {
1153                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1154                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1155                 if (err)
1156                         goto unlock;
1157         }
1158
1159         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1160                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1161                                   &flags);
1162         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1163                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1164                 type, err ? NULL : &flags, &params);
1165
1166  unlock:
1167         cfg80211_unlock_rdev(rdev);
1168  unlock_rtnl:
1169         rtnl_unlock();
1170         return err;
1171 }
1172
1173 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1174 {
1175         struct cfg80211_registered_device *rdev;
1176         int err;
1177         struct net_device *dev;
1178
1179         rtnl_lock();
1180
1181         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1182         if (err)
1183                 goto unlock_rtnl;
1184
1185         if (!rdev->ops->del_virtual_intf) {
1186                 err = -EOPNOTSUPP;
1187                 goto out;
1188         }
1189
1190         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1191
1192  out:
1193         cfg80211_unlock_rdev(rdev);
1194         dev_put(dev);
1195  unlock_rtnl:
1196         rtnl_unlock();
1197         return err;
1198 }
1199
1200 struct get_key_cookie {
1201         struct sk_buff *msg;
1202         int error;
1203         int idx;
1204 };
1205
1206 static void get_key_callback(void *c, struct key_params *params)
1207 {
1208         struct nlattr *key;
1209         struct get_key_cookie *cookie = c;
1210
1211         if (params->key)
1212                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1213                         params->key_len, params->key);
1214
1215         if (params->seq)
1216                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1217                         params->seq_len, params->seq);
1218
1219         if (params->cipher)
1220                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1221                             params->cipher);
1222
1223         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1224         if (!key)
1225                 goto nla_put_failure;
1226
1227         if (params->key)
1228                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1229                         params->key_len, params->key);
1230
1231         if (params->seq)
1232                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1233                         params->seq_len, params->seq);
1234
1235         if (params->cipher)
1236                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1237                             params->cipher);
1238
1239         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1240
1241         nla_nest_end(cookie->msg, key);
1242
1243         return;
1244  nla_put_failure:
1245         cookie->error = 1;
1246 }
1247
1248 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1249 {
1250         struct cfg80211_registered_device *rdev;
1251         int err;
1252         struct net_device *dev;
1253         u8 key_idx = 0;
1254         u8 *mac_addr = NULL;
1255         struct get_key_cookie cookie = {
1256                 .error = 0,
1257         };
1258         void *hdr;
1259         struct sk_buff *msg;
1260
1261         if (info->attrs[NL80211_ATTR_KEY_IDX])
1262                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1263
1264         if (key_idx > 5)
1265                 return -EINVAL;
1266
1267         if (info->attrs[NL80211_ATTR_MAC])
1268                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1269
1270         rtnl_lock();
1271
1272         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1273         if (err)
1274                 goto unlock_rtnl;
1275
1276         if (!rdev->ops->get_key) {
1277                 err = -EOPNOTSUPP;
1278                 goto out;
1279         }
1280
1281         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1282         if (!msg) {
1283                 err = -ENOMEM;
1284                 goto out;
1285         }
1286
1287         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1288                              NL80211_CMD_NEW_KEY);
1289
1290         if (IS_ERR(hdr)) {
1291                 err = PTR_ERR(hdr);
1292                 goto free_msg;
1293         }
1294
1295         cookie.msg = msg;
1296         cookie.idx = key_idx;
1297
1298         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1299         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1300         if (mac_addr)
1301                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1302
1303         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1304                                 &cookie, get_key_callback);
1305
1306         if (err)
1307                 goto free_msg;
1308
1309         if (cookie.error)
1310                 goto nla_put_failure;
1311
1312         genlmsg_end(msg, hdr);
1313         err = genlmsg_reply(msg, info);
1314         goto out;
1315
1316  nla_put_failure:
1317         err = -ENOBUFS;
1318  free_msg:
1319         nlmsg_free(msg);
1320  out:
1321         cfg80211_unlock_rdev(rdev);
1322         dev_put(dev);
1323  unlock_rtnl:
1324         rtnl_unlock();
1325
1326         return err;
1327 }
1328
1329 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1330 {
1331         struct cfg80211_registered_device *rdev;
1332         struct key_parse key;
1333         int err;
1334         struct net_device *dev;
1335         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1336                     u8 key_index);
1337
1338         err = nl80211_parse_key(info, &key);
1339         if (err)
1340                 return err;
1341
1342         if (key.idx < 0)
1343                 return -EINVAL;
1344
1345         /* only support setting default key */
1346         if (!key.def && !key.defmgmt)
1347                 return -EINVAL;
1348
1349         rtnl_lock();
1350
1351         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1352         if (err)
1353                 goto unlock_rtnl;
1354
1355         if (key.def)
1356                 func = rdev->ops->set_default_key;
1357         else
1358                 func = rdev->ops->set_default_mgmt_key;
1359
1360         if (!func) {
1361                 err = -EOPNOTSUPP;
1362                 goto out;
1363         }
1364
1365         wdev_lock(dev->ieee80211_ptr);
1366         err = nl80211_key_allowed(dev->ieee80211_ptr);
1367         if (!err)
1368                 err = func(&rdev->wiphy, dev, key.idx);
1369
1370 #ifdef CONFIG_CFG80211_WEXT
1371         if (!err) {
1372                 if (func == rdev->ops->set_default_key)
1373                         dev->ieee80211_ptr->wext.default_key = key.idx;
1374                 else
1375                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1376         }
1377 #endif
1378         wdev_unlock(dev->ieee80211_ptr);
1379
1380  out:
1381         cfg80211_unlock_rdev(rdev);
1382         dev_put(dev);
1383
1384  unlock_rtnl:
1385         rtnl_unlock();
1386
1387         return err;
1388 }
1389
1390 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1391 {
1392         struct cfg80211_registered_device *rdev;
1393         int err;
1394         struct net_device *dev;
1395         struct key_parse key;
1396         u8 *mac_addr = NULL;
1397
1398         err = nl80211_parse_key(info, &key);
1399         if (err)
1400                 return err;
1401
1402         if (!key.p.key)
1403                 return -EINVAL;
1404
1405         if (info->attrs[NL80211_ATTR_MAC])
1406                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1407
1408         rtnl_lock();
1409
1410         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1411         if (err)
1412                 goto unlock_rtnl;
1413
1414         if (!rdev->ops->add_key) {
1415                 err = -EOPNOTSUPP;
1416                 goto out;
1417         }
1418
1419         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1420                 err = -EINVAL;
1421                 goto out;
1422         }
1423
1424         wdev_lock(dev->ieee80211_ptr);
1425         err = nl80211_key_allowed(dev->ieee80211_ptr);
1426         if (!err)
1427                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1428                                          mac_addr, &key.p);
1429         wdev_unlock(dev->ieee80211_ptr);
1430
1431  out:
1432         cfg80211_unlock_rdev(rdev);
1433         dev_put(dev);
1434  unlock_rtnl:
1435         rtnl_unlock();
1436
1437         return err;
1438 }
1439
1440 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1441 {
1442         struct cfg80211_registered_device *rdev;
1443         int err;
1444         struct net_device *dev;
1445         u8 *mac_addr = NULL;
1446         struct key_parse key;
1447
1448         err = nl80211_parse_key(info, &key);
1449         if (err)
1450                 return err;
1451
1452         if (info->attrs[NL80211_ATTR_MAC])
1453                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1454
1455         rtnl_lock();
1456
1457         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1458         if (err)
1459                 goto unlock_rtnl;
1460
1461         if (!rdev->ops->del_key) {
1462                 err = -EOPNOTSUPP;
1463                 goto out;
1464         }
1465
1466         wdev_lock(dev->ieee80211_ptr);
1467         err = nl80211_key_allowed(dev->ieee80211_ptr);
1468         if (!err)
1469                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1470
1471 #ifdef CONFIG_CFG80211_WEXT
1472         if (!err) {
1473                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1474                         dev->ieee80211_ptr->wext.default_key = -1;
1475                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1476                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1477         }
1478 #endif
1479         wdev_unlock(dev->ieee80211_ptr);
1480
1481  out:
1482         cfg80211_unlock_rdev(rdev);
1483         dev_put(dev);
1484
1485  unlock_rtnl:
1486         rtnl_unlock();
1487
1488         return err;
1489 }
1490
1491 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1492 {
1493         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1494                     struct beacon_parameters *info);
1495         struct cfg80211_registered_device *rdev;
1496         int err;
1497         struct net_device *dev;
1498         struct beacon_parameters params;
1499         int haveinfo = 0;
1500
1501         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1502                 return -EINVAL;
1503
1504         rtnl_lock();
1505
1506         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1507         if (err)
1508                 goto unlock_rtnl;
1509
1510         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1511                 err = -EOPNOTSUPP;
1512                 goto out;
1513         }
1514
1515         switch (info->genlhdr->cmd) {
1516         case NL80211_CMD_NEW_BEACON:
1517                 /* these are required for NEW_BEACON */
1518                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1519                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1520                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1521                         err = -EINVAL;
1522                         goto out;
1523                 }
1524
1525                 call = rdev->ops->add_beacon;
1526                 break;
1527         case NL80211_CMD_SET_BEACON:
1528                 call = rdev->ops->set_beacon;
1529                 break;
1530         default:
1531                 WARN_ON(1);
1532                 err = -EOPNOTSUPP;
1533                 goto out;
1534         }
1535
1536         if (!call) {
1537                 err = -EOPNOTSUPP;
1538                 goto out;
1539         }
1540
1541         memset(&params, 0, sizeof(params));
1542
1543         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1544                 params.interval =
1545                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1546                 haveinfo = 1;
1547         }
1548
1549         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1550                 params.dtim_period =
1551                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1552                 haveinfo = 1;
1553         }
1554
1555         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1556                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1557                 params.head_len =
1558                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1559                 haveinfo = 1;
1560         }
1561
1562         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1563                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1564                 params.tail_len =
1565                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1566                 haveinfo = 1;
1567         }
1568
1569         if (!haveinfo) {
1570                 err = -EINVAL;
1571                 goto out;
1572         }
1573
1574         err = call(&rdev->wiphy, dev, &params);
1575
1576  out:
1577         cfg80211_unlock_rdev(rdev);
1578         dev_put(dev);
1579  unlock_rtnl:
1580         rtnl_unlock();
1581
1582         return err;
1583 }
1584
1585 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1586 {
1587         struct cfg80211_registered_device *rdev;
1588         int err;
1589         struct net_device *dev;
1590
1591         rtnl_lock();
1592
1593         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1594         if (err)
1595                 goto unlock_rtnl;
1596
1597         if (!rdev->ops->del_beacon) {
1598                 err = -EOPNOTSUPP;
1599                 goto out;
1600         }
1601
1602         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1603                 err = -EOPNOTSUPP;
1604                 goto out;
1605         }
1606         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1607
1608  out:
1609         cfg80211_unlock_rdev(rdev);
1610         dev_put(dev);
1611  unlock_rtnl:
1612         rtnl_unlock();
1613
1614         return err;
1615 }
1616
1617 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1618         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1619         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1620         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1621         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1622 };
1623
1624 static int parse_station_flags(struct genl_info *info,
1625                                struct station_parameters *params)
1626 {
1627         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1628         struct nlattr *nla;
1629         int flag;
1630
1631         /*
1632          * Try parsing the new attribute first so userspace
1633          * can specify both for older kernels.
1634          */
1635         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1636         if (nla) {
1637                 struct nl80211_sta_flag_update *sta_flags;
1638
1639                 sta_flags = nla_data(nla);
1640                 params->sta_flags_mask = sta_flags->mask;
1641                 params->sta_flags_set = sta_flags->set;
1642                 if ((params->sta_flags_mask |
1643                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1644                         return -EINVAL;
1645                 return 0;
1646         }
1647
1648         /* if present, parse the old attribute */
1649
1650         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1651         if (!nla)
1652                 return 0;
1653
1654         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1655                              nla, sta_flags_policy))
1656                 return -EINVAL;
1657
1658         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1659         params->sta_flags_mask &= ~1;
1660
1661         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1662                 if (flags[flag])
1663                         params->sta_flags_set |= (1<<flag);
1664
1665         return 0;
1666 }
1667
1668 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1669                                 int flags, struct net_device *dev,
1670                                 const u8 *mac_addr, struct station_info *sinfo)
1671 {
1672         void *hdr;
1673         struct nlattr *sinfoattr, *txrate;
1674         u16 bitrate;
1675
1676         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1677         if (!hdr)
1678                 return -1;
1679
1680         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1681         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1682
1683         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1684
1685         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1686         if (!sinfoattr)
1687                 goto nla_put_failure;
1688         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1689                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1690                             sinfo->inactive_time);
1691         if (sinfo->filled & STATION_INFO_RX_BYTES)
1692                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1693                             sinfo->rx_bytes);
1694         if (sinfo->filled & STATION_INFO_TX_BYTES)
1695                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1696                             sinfo->tx_bytes);
1697         if (sinfo->filled & STATION_INFO_LLID)
1698                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1699                             sinfo->llid);
1700         if (sinfo->filled & STATION_INFO_PLID)
1701                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1702                             sinfo->plid);
1703         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1704                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1705                             sinfo->plink_state);
1706         if (sinfo->filled & STATION_INFO_SIGNAL)
1707                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1708                            sinfo->signal);
1709         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1710                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1711                 if (!txrate)
1712                         goto nla_put_failure;
1713
1714                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1715                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1716                 if (bitrate > 0)
1717                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1718
1719                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1720                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1721                                     sinfo->txrate.mcs);
1722                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1723                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1724                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1725                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1726
1727                 nla_nest_end(msg, txrate);
1728         }
1729         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1730                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1731                             sinfo->rx_packets);
1732         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1733                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1734                             sinfo->tx_packets);
1735         nla_nest_end(msg, sinfoattr);
1736
1737         return genlmsg_end(msg, hdr);
1738
1739  nla_put_failure:
1740         genlmsg_cancel(msg, hdr);
1741         return -EMSGSIZE;
1742 }
1743
1744 static int nl80211_dump_station(struct sk_buff *skb,
1745                                 struct netlink_callback *cb)
1746 {
1747         struct station_info sinfo;
1748         struct cfg80211_registered_device *dev;
1749         struct net_device *netdev;
1750         u8 mac_addr[ETH_ALEN];
1751         int ifidx = cb->args[0];
1752         int sta_idx = cb->args[1];
1753         int err;
1754
1755         if (!ifidx)
1756                 ifidx = nl80211_get_ifidx(cb);
1757         if (ifidx < 0)
1758                 return ifidx;
1759
1760         rtnl_lock();
1761
1762         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1763         if (!netdev) {
1764                 err = -ENODEV;
1765                 goto out_rtnl;
1766         }
1767
1768         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1769         if (IS_ERR(dev)) {
1770                 err = PTR_ERR(dev);
1771                 goto out_rtnl;
1772         }
1773
1774         if (!dev->ops->dump_station) {
1775                 err = -EOPNOTSUPP;
1776                 goto out_err;
1777         }
1778
1779         while (1) {
1780                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1781                                              mac_addr, &sinfo);
1782                 if (err == -ENOENT)
1783                         break;
1784                 if (err)
1785                         goto out_err;
1786
1787                 if (nl80211_send_station(skb,
1788                                 NETLINK_CB(cb->skb).pid,
1789                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1790                                 netdev, mac_addr,
1791                                 &sinfo) < 0)
1792                         goto out;
1793
1794                 sta_idx++;
1795         }
1796
1797
1798  out:
1799         cb->args[1] = sta_idx;
1800         err = skb->len;
1801  out_err:
1802         cfg80211_unlock_rdev(dev);
1803  out_rtnl:
1804         rtnl_unlock();
1805
1806         return err;
1807 }
1808
1809 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1810 {
1811         struct cfg80211_registered_device *rdev;
1812         int err;
1813         struct net_device *dev;
1814         struct station_info sinfo;
1815         struct sk_buff *msg;
1816         u8 *mac_addr = NULL;
1817
1818         memset(&sinfo, 0, sizeof(sinfo));
1819
1820         if (!info->attrs[NL80211_ATTR_MAC])
1821                 return -EINVAL;
1822
1823         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1824
1825         rtnl_lock();
1826
1827         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1828         if (err)
1829                 goto out_rtnl;
1830
1831         if (!rdev->ops->get_station) {
1832                 err = -EOPNOTSUPP;
1833                 goto out;
1834         }
1835
1836         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1837         if (err)
1838                 goto out;
1839
1840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1841         if (!msg)
1842                 goto out;
1843
1844         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1845                                  dev, mac_addr, &sinfo) < 0)
1846                 goto out_free;
1847
1848         err = genlmsg_reply(msg, info);
1849         goto out;
1850
1851  out_free:
1852         nlmsg_free(msg);
1853  out:
1854         cfg80211_unlock_rdev(rdev);
1855         dev_put(dev);
1856  out_rtnl:
1857         rtnl_unlock();
1858
1859         return err;
1860 }
1861
1862 /*
1863  * Get vlan interface making sure it is running and on the right wiphy.
1864  */
1865 static int get_vlan(struct genl_info *info,
1866                     struct cfg80211_registered_device *rdev,
1867                     struct net_device **vlan)
1868 {
1869         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1870         *vlan = NULL;
1871
1872         if (vlanattr) {
1873                 *vlan = dev_get_by_index(genl_info_net(info),
1874                                          nla_get_u32(vlanattr));
1875                 if (!*vlan)
1876                         return -ENODEV;
1877                 if (!(*vlan)->ieee80211_ptr)
1878                         return -EINVAL;
1879                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1880                         return -EINVAL;
1881                 if (!netif_running(*vlan))
1882                         return -ENETDOWN;
1883         }
1884         return 0;
1885 }
1886
1887 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1888 {
1889         struct cfg80211_registered_device *rdev;
1890         int err;
1891         struct net_device *dev;
1892         struct station_parameters params;
1893         u8 *mac_addr = NULL;
1894
1895         memset(&params, 0, sizeof(params));
1896
1897         params.listen_interval = -1;
1898
1899         if (info->attrs[NL80211_ATTR_STA_AID])
1900                 return -EINVAL;
1901
1902         if (!info->attrs[NL80211_ATTR_MAC])
1903                 return -EINVAL;
1904
1905         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1906
1907         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1908                 params.supported_rates =
1909                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1910                 params.supported_rates_len =
1911                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1912         }
1913
1914         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1915                 params.listen_interval =
1916                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1917
1918         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1919                 params.ht_capa =
1920                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1921
1922         if (parse_station_flags(info, &params))
1923                 return -EINVAL;
1924
1925         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1926                 params.plink_action =
1927                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1928
1929         rtnl_lock();
1930
1931         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1932         if (err)
1933                 goto out_rtnl;
1934
1935         err = get_vlan(info, rdev, &params.vlan);
1936         if (err)
1937                 goto out;
1938
1939         /* validate settings */
1940         err = 0;
1941
1942         switch (dev->ieee80211_ptr->iftype) {
1943         case NL80211_IFTYPE_AP:
1944         case NL80211_IFTYPE_AP_VLAN:
1945                 /* disallow mesh-specific things */
1946                 if (params.plink_action)
1947                         err = -EINVAL;
1948                 break;
1949         case NL80211_IFTYPE_STATION:
1950                 /* disallow everything but AUTHORIZED flag */
1951                 if (params.plink_action)
1952                         err = -EINVAL;
1953                 if (params.vlan)
1954                         err = -EINVAL;
1955                 if (params.supported_rates)
1956                         err = -EINVAL;
1957                 if (params.ht_capa)
1958                         err = -EINVAL;
1959                 if (params.listen_interval >= 0)
1960                         err = -EINVAL;
1961                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1962                         err = -EINVAL;
1963                 break;
1964         case NL80211_IFTYPE_MESH_POINT:
1965                 /* disallow things mesh doesn't support */
1966                 if (params.vlan)
1967                         err = -EINVAL;
1968                 if (params.ht_capa)
1969                         err = -EINVAL;
1970                 if (params.listen_interval >= 0)
1971                         err = -EINVAL;
1972                 if (params.supported_rates)
1973                         err = -EINVAL;
1974                 if (params.sta_flags_mask)
1975                         err = -EINVAL;
1976                 break;
1977         default:
1978                 err = -EINVAL;
1979         }
1980
1981         if (err)
1982                 goto out;
1983
1984         if (!rdev->ops->change_station) {
1985                 err = -EOPNOTSUPP;
1986                 goto out;
1987         }
1988
1989         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1990
1991  out:
1992         if (params.vlan)
1993                 dev_put(params.vlan);
1994         cfg80211_unlock_rdev(rdev);
1995         dev_put(dev);
1996  out_rtnl:
1997         rtnl_unlock();
1998
1999         return err;
2000 }
2001
2002 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2003 {
2004         struct cfg80211_registered_device *rdev;
2005         int err;
2006         struct net_device *dev;
2007         struct station_parameters params;
2008         u8 *mac_addr = NULL;
2009
2010         memset(&params, 0, sizeof(params));
2011
2012         if (!info->attrs[NL80211_ATTR_MAC])
2013                 return -EINVAL;
2014
2015         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2016                 return -EINVAL;
2017
2018         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2019                 return -EINVAL;
2020
2021         if (!info->attrs[NL80211_ATTR_STA_AID])
2022                 return -EINVAL;
2023
2024         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2025         params.supported_rates =
2026                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2027         params.supported_rates_len =
2028                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2029         params.listen_interval =
2030                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2031
2032         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2033         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2034                 return -EINVAL;
2035
2036         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2037                 params.ht_capa =
2038                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2039
2040         if (parse_station_flags(info, &params))
2041                 return -EINVAL;
2042
2043         rtnl_lock();
2044
2045         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2046         if (err)
2047                 goto out_rtnl;
2048
2049         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2050             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2051                 err = -EINVAL;
2052                 goto out;
2053         }
2054
2055         err = get_vlan(info, rdev, &params.vlan);
2056         if (err)
2057                 goto out;
2058
2059         /* validate settings */
2060         err = 0;
2061
2062         if (!rdev->ops->add_station) {
2063                 err = -EOPNOTSUPP;
2064                 goto out;
2065         }
2066
2067         if (!netif_running(dev)) {
2068                 err = -ENETDOWN;
2069                 goto out;
2070         }
2071
2072         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2073
2074  out:
2075         if (params.vlan)
2076                 dev_put(params.vlan);
2077         cfg80211_unlock_rdev(rdev);
2078         dev_put(dev);
2079  out_rtnl:
2080         rtnl_unlock();
2081
2082         return err;
2083 }
2084
2085 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2086 {
2087         struct cfg80211_registered_device *rdev;
2088         int err;
2089         struct net_device *dev;
2090         u8 *mac_addr = NULL;
2091
2092         if (info->attrs[NL80211_ATTR_MAC])
2093                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2094
2095         rtnl_lock();
2096
2097         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2098         if (err)
2099                 goto out_rtnl;
2100
2101         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2103                 err = -EINVAL;
2104                 goto out;
2105         }
2106
2107         if (!rdev->ops->del_station) {
2108                 err = -EOPNOTSUPP;
2109                 goto out;
2110         }
2111
2112         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2113
2114  out:
2115         cfg80211_unlock_rdev(rdev);
2116         dev_put(dev);
2117  out_rtnl:
2118         rtnl_unlock();
2119
2120         return err;
2121 }
2122
2123 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2124                                 int flags, struct net_device *dev,
2125                                 u8 *dst, u8 *next_hop,
2126                                 struct mpath_info *pinfo)
2127 {
2128         void *hdr;
2129         struct nlattr *pinfoattr;
2130
2131         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2132         if (!hdr)
2133                 return -1;
2134
2135         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2136         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2137         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2138
2139         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2140
2141         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2142         if (!pinfoattr)
2143                 goto nla_put_failure;
2144         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2145                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2146                             pinfo->frame_qlen);
2147         if (pinfo->filled & MPATH_INFO_SN)
2148                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2149                             pinfo->sn);
2150         if (pinfo->filled & MPATH_INFO_METRIC)
2151                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2152                             pinfo->metric);
2153         if (pinfo->filled & MPATH_INFO_EXPTIME)
2154                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2155                             pinfo->exptime);
2156         if (pinfo->filled & MPATH_INFO_FLAGS)
2157                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2158                             pinfo->flags);
2159         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2160                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2161                             pinfo->discovery_timeout);
2162         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2163                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2164                             pinfo->discovery_retries);
2165
2166         nla_nest_end(msg, pinfoattr);
2167
2168         return genlmsg_end(msg, hdr);
2169
2170  nla_put_failure:
2171         genlmsg_cancel(msg, hdr);
2172         return -EMSGSIZE;
2173 }
2174
2175 static int nl80211_dump_mpath(struct sk_buff *skb,
2176                               struct netlink_callback *cb)
2177 {
2178         struct mpath_info pinfo;
2179         struct cfg80211_registered_device *dev;
2180         struct net_device *netdev;
2181         u8 dst[ETH_ALEN];
2182         u8 next_hop[ETH_ALEN];
2183         int ifidx = cb->args[0];
2184         int path_idx = cb->args[1];
2185         int err;
2186
2187         if (!ifidx)
2188                 ifidx = nl80211_get_ifidx(cb);
2189         if (ifidx < 0)
2190                 return ifidx;
2191
2192         rtnl_lock();
2193
2194         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2195         if (!netdev) {
2196                 err = -ENODEV;
2197                 goto out_rtnl;
2198         }
2199
2200         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2201         if (IS_ERR(dev)) {
2202                 err = PTR_ERR(dev);
2203                 goto out_rtnl;
2204         }
2205
2206         if (!dev->ops->dump_mpath) {
2207                 err = -EOPNOTSUPP;
2208                 goto out_err;
2209         }
2210
2211         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2212                 err = -EOPNOTSUPP;
2213                 goto out_err;
2214         }
2215
2216         while (1) {
2217                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2218                                            dst, next_hop, &pinfo);
2219                 if (err == -ENOENT)
2220                         break;
2221                 if (err)
2222                         goto out_err;
2223
2224                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2225                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2226                                        netdev, dst, next_hop,
2227                                        &pinfo) < 0)
2228                         goto out;
2229
2230                 path_idx++;
2231         }
2232
2233
2234  out:
2235         cb->args[1] = path_idx;
2236         err = skb->len;
2237  out_err:
2238         cfg80211_unlock_rdev(dev);
2239  out_rtnl:
2240         rtnl_unlock();
2241
2242         return err;
2243 }
2244
2245 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2246 {
2247         struct cfg80211_registered_device *rdev;
2248         int err;
2249         struct net_device *dev;
2250         struct mpath_info pinfo;
2251         struct sk_buff *msg;
2252         u8 *dst = NULL;
2253         u8 next_hop[ETH_ALEN];
2254
2255         memset(&pinfo, 0, sizeof(pinfo));
2256
2257         if (!info->attrs[NL80211_ATTR_MAC])
2258                 return -EINVAL;
2259
2260         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2261
2262         rtnl_lock();
2263
2264         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2265         if (err)
2266                 goto out_rtnl;
2267
2268         if (!rdev->ops->get_mpath) {
2269                 err = -EOPNOTSUPP;
2270                 goto out;
2271         }
2272
2273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2274                 err = -EOPNOTSUPP;
2275                 goto out;
2276         }
2277
2278         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2279         if (err)
2280                 goto out;
2281
2282         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2283         if (!msg)
2284                 goto out;
2285
2286         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2287                                  dev, dst, next_hop, &pinfo) < 0)
2288                 goto out_free;
2289
2290         err = genlmsg_reply(msg, info);
2291         goto out;
2292
2293  out_free:
2294         nlmsg_free(msg);
2295  out:
2296         cfg80211_unlock_rdev(rdev);
2297         dev_put(dev);
2298  out_rtnl:
2299         rtnl_unlock();
2300
2301         return err;
2302 }
2303
2304 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2305 {
2306         struct cfg80211_registered_device *rdev;
2307         int err;
2308         struct net_device *dev;
2309         u8 *dst = NULL;
2310         u8 *next_hop = NULL;
2311
2312         if (!info->attrs[NL80211_ATTR_MAC])
2313                 return -EINVAL;
2314
2315         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2316                 return -EINVAL;
2317
2318         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2319         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2320
2321         rtnl_lock();
2322
2323         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2324         if (err)
2325                 goto out_rtnl;
2326
2327         if (!rdev->ops->change_mpath) {
2328                 err = -EOPNOTSUPP;
2329                 goto out;
2330         }
2331
2332         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2333                 err = -EOPNOTSUPP;
2334                 goto out;
2335         }
2336
2337         if (!netif_running(dev)) {
2338                 err = -ENETDOWN;
2339                 goto out;
2340         }
2341
2342         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2343
2344  out:
2345         cfg80211_unlock_rdev(rdev);
2346         dev_put(dev);
2347  out_rtnl:
2348         rtnl_unlock();
2349
2350         return err;
2351 }
2352 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2353 {
2354         struct cfg80211_registered_device *rdev;
2355         int err;
2356         struct net_device *dev;
2357         u8 *dst = NULL;
2358         u8 *next_hop = NULL;
2359
2360         if (!info->attrs[NL80211_ATTR_MAC])
2361                 return -EINVAL;
2362
2363         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2364                 return -EINVAL;
2365
2366         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2367         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2368
2369         rtnl_lock();
2370
2371         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2372         if (err)
2373                 goto out_rtnl;
2374
2375         if (!rdev->ops->add_mpath) {
2376                 err = -EOPNOTSUPP;
2377                 goto out;
2378         }
2379
2380         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2381                 err = -EOPNOTSUPP;
2382                 goto out;
2383         }
2384
2385         if (!netif_running(dev)) {
2386                 err = -ENETDOWN;
2387                 goto out;
2388         }
2389
2390         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2391
2392  out:
2393         cfg80211_unlock_rdev(rdev);
2394         dev_put(dev);
2395  out_rtnl:
2396         rtnl_unlock();
2397
2398         return err;
2399 }
2400
2401 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2402 {
2403         struct cfg80211_registered_device *rdev;
2404         int err;
2405         struct net_device *dev;
2406         u8 *dst = NULL;
2407
2408         if (info->attrs[NL80211_ATTR_MAC])
2409                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2410
2411         rtnl_lock();
2412
2413         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2414         if (err)
2415                 goto out_rtnl;
2416
2417         if (!rdev->ops->del_mpath) {
2418                 err = -EOPNOTSUPP;
2419                 goto out;
2420         }
2421
2422         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2423
2424  out:
2425         cfg80211_unlock_rdev(rdev);
2426         dev_put(dev);
2427  out_rtnl:
2428         rtnl_unlock();
2429
2430         return err;
2431 }
2432
2433 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2434 {
2435         struct cfg80211_registered_device *rdev;
2436         int err;
2437         struct net_device *dev;
2438         struct bss_parameters params;
2439
2440         memset(&params, 0, sizeof(params));
2441         /* default to not changing parameters */
2442         params.use_cts_prot = -1;
2443         params.use_short_preamble = -1;
2444         params.use_short_slot_time = -1;
2445
2446         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2447                 params.use_cts_prot =
2448                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2449         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2450                 params.use_short_preamble =
2451                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2452         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2453                 params.use_short_slot_time =
2454                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2455         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2456                 params.basic_rates =
2457                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2458                 params.basic_rates_len =
2459                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2460         }
2461
2462         rtnl_lock();
2463
2464         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2465         if (err)
2466                 goto out_rtnl;
2467
2468         if (!rdev->ops->change_bss) {
2469                 err = -EOPNOTSUPP;
2470                 goto out;
2471         }
2472
2473         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2474                 err = -EOPNOTSUPP;
2475                 goto out;
2476         }
2477
2478         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2479
2480  out:
2481         cfg80211_unlock_rdev(rdev);
2482         dev_put(dev);
2483  out_rtnl:
2484         rtnl_unlock();
2485
2486         return err;
2487 }
2488
2489 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2490         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2491         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2492         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2493         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2494         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2495         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2496 };
2497
2498 static int parse_reg_rule(struct nlattr *tb[],
2499         struct ieee80211_reg_rule *reg_rule)
2500 {
2501         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2502         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2503
2504         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2505                 return -EINVAL;
2506         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2507                 return -EINVAL;
2508         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2509                 return -EINVAL;
2510         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2511                 return -EINVAL;
2512         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2513                 return -EINVAL;
2514
2515         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2516
2517         freq_range->start_freq_khz =
2518                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2519         freq_range->end_freq_khz =
2520                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2521         freq_range->max_bandwidth_khz =
2522                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2523
2524         power_rule->max_eirp =
2525                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2526
2527         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2528                 power_rule->max_antenna_gain =
2529                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2530
2531         return 0;
2532 }
2533
2534 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2535 {
2536         int r;
2537         char *data = NULL;
2538
2539         /*
2540          * You should only get this when cfg80211 hasn't yet initialized
2541          * completely when built-in to the kernel right between the time
2542          * window between nl80211_init() and regulatory_init(), if that is
2543          * even possible.
2544          */
2545         mutex_lock(&cfg80211_mutex);
2546         if (unlikely(!cfg80211_regdomain)) {
2547                 mutex_unlock(&cfg80211_mutex);
2548                 return -EINPROGRESS;
2549         }
2550         mutex_unlock(&cfg80211_mutex);
2551
2552         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2553                 return -EINVAL;
2554
2555         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2556
2557         r = regulatory_hint_user(data);
2558
2559         return r;
2560 }
2561
2562 static int nl80211_get_mesh_params(struct sk_buff *skb,
2563         struct genl_info *info)
2564 {
2565         struct cfg80211_registered_device *rdev;
2566         struct mesh_config cur_params;
2567         int err;
2568         struct net_device *dev;
2569         void *hdr;
2570         struct nlattr *pinfoattr;
2571         struct sk_buff *msg;
2572
2573         rtnl_lock();
2574
2575         /* Look up our device */
2576         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2577         if (err)
2578                 goto out_rtnl;
2579
2580         if (!rdev->ops->get_mesh_params) {
2581                 err = -EOPNOTSUPP;
2582                 goto out;
2583         }
2584
2585         /* Get the mesh params */
2586         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2587         if (err)
2588                 goto out;
2589
2590         /* Draw up a netlink message to send back */
2591         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2592         if (!msg) {
2593                 err = -ENOBUFS;
2594                 goto out;
2595         }
2596         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2597                              NL80211_CMD_GET_MESH_PARAMS);
2598         if (!hdr)
2599                 goto nla_put_failure;
2600         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2601         if (!pinfoattr)
2602                 goto nla_put_failure;
2603         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2604         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2605                         cur_params.dot11MeshRetryTimeout);
2606         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2607                         cur_params.dot11MeshConfirmTimeout);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2609                         cur_params.dot11MeshHoldingTimeout);
2610         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2611                         cur_params.dot11MeshMaxPeerLinks);
2612         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2613                         cur_params.dot11MeshMaxRetries);
2614         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2615                         cur_params.dot11MeshTTL);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2617                         cur_params.auto_open_plinks);
2618         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2619                         cur_params.dot11MeshHWMPmaxPREQretries);
2620         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2621                         cur_params.path_refresh_time);
2622         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2623                         cur_params.min_discovery_timeout);
2624         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2625                         cur_params.dot11MeshHWMPactivePathTimeout);
2626         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2627                         cur_params.dot11MeshHWMPpreqMinInterval);
2628         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2629                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2630         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2631                         cur_params.dot11MeshHWMPRootMode);
2632         nla_nest_end(msg, pinfoattr);
2633         genlmsg_end(msg, hdr);
2634         err = genlmsg_reply(msg, info);
2635         goto out;
2636
2637  nla_put_failure:
2638         genlmsg_cancel(msg, hdr);
2639         err = -EMSGSIZE;
2640  out:
2641         /* Cleanup */
2642         cfg80211_unlock_rdev(rdev);
2643         dev_put(dev);
2644  out_rtnl:
2645         rtnl_unlock();
2646
2647         return err;
2648 }
2649
2650 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2651 do {\
2652         if (table[attr_num]) {\
2653                 cfg.param = nla_fn(table[attr_num]); \
2654                 mask |= (1 << (attr_num - 1)); \
2655         } \
2656 } while (0);\
2657
2658 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2659         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2661         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2663         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2664         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2665         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2666
2667         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2668         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2669         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2670         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2671         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2672         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2673 };
2674
2675 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2676 {
2677         int err;
2678         u32 mask;
2679         struct cfg80211_registered_device *rdev;
2680         struct net_device *dev;
2681         struct mesh_config cfg;
2682         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2683         struct nlattr *parent_attr;
2684
2685         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2686         if (!parent_attr)
2687                 return -EINVAL;
2688         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2689                         parent_attr, nl80211_meshconf_params_policy))
2690                 return -EINVAL;
2691
2692         rtnl_lock();
2693
2694         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2695         if (err)
2696                 goto out_rtnl;
2697
2698         if (!rdev->ops->set_mesh_params) {
2699                 err = -EOPNOTSUPP;
2700                 goto out;
2701         }
2702
2703         /* This makes sure that there aren't more than 32 mesh config
2704          * parameters (otherwise our bitfield scheme would not work.) */
2705         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2706
2707         /* Fill in the params struct */
2708         mask = 0;
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2710                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2712                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2714                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2716                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2718                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2720                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2722                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2724                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2725                         nla_get_u8);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2727                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2729                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2730                         nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2732                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2733                         nla_get_u32);
2734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2735                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2736                         nla_get_u16);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2738                         dot11MeshHWMPnetDiameterTraversalTime,
2739                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2740                         nla_get_u16);
2741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2742                         dot11MeshHWMPRootMode, mask,
2743                         NL80211_MESHCONF_HWMP_ROOTMODE,
2744                         nla_get_u8);
2745
2746         /* Apply changes */
2747         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2748
2749  out:
2750         /* cleanup */
2751         cfg80211_unlock_rdev(rdev);
2752         dev_put(dev);
2753  out_rtnl:
2754         rtnl_unlock();
2755
2756         return err;
2757 }
2758
2759 #undef FILL_IN_MESH_PARAM_IF_SET
2760
2761 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2762 {
2763         struct sk_buff *msg;
2764         void *hdr = NULL;
2765         struct nlattr *nl_reg_rules;
2766         unsigned int i;
2767         int err = -EINVAL;
2768
2769         mutex_lock(&cfg80211_mutex);
2770
2771         if (!cfg80211_regdomain)
2772                 goto out;
2773
2774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2775         if (!msg) {
2776                 err = -ENOBUFS;
2777                 goto out;
2778         }
2779
2780         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2781                              NL80211_CMD_GET_REG);
2782         if (!hdr)
2783                 goto nla_put_failure;
2784
2785         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2786                 cfg80211_regdomain->alpha2);
2787
2788         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2789         if (!nl_reg_rules)
2790                 goto nla_put_failure;
2791
2792         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2793                 struct nlattr *nl_reg_rule;
2794                 const struct ieee80211_reg_rule *reg_rule;
2795                 const struct ieee80211_freq_range *freq_range;
2796                 const struct ieee80211_power_rule *power_rule;
2797
2798                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2799                 freq_range = &reg_rule->freq_range;
2800                 power_rule = &reg_rule->power_rule;
2801
2802                 nl_reg_rule = nla_nest_start(msg, i);
2803                 if (!nl_reg_rule)
2804                         goto nla_put_failure;
2805
2806                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2807                         reg_rule->flags);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2809                         freq_range->start_freq_khz);
2810                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2811                         freq_range->end_freq_khz);
2812                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2813                         freq_range->max_bandwidth_khz);
2814                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2815                         power_rule->max_antenna_gain);
2816                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2817                         power_rule->max_eirp);
2818
2819                 nla_nest_end(msg, nl_reg_rule);
2820         }
2821
2822         nla_nest_end(msg, nl_reg_rules);
2823
2824         genlmsg_end(msg, hdr);
2825         err = genlmsg_reply(msg, info);
2826         goto out;
2827
2828 nla_put_failure:
2829         genlmsg_cancel(msg, hdr);
2830         err = -EMSGSIZE;
2831 out:
2832         mutex_unlock(&cfg80211_mutex);
2833         return err;
2834 }
2835
2836 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2837 {
2838         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2839         struct nlattr *nl_reg_rule;
2840         char *alpha2 = NULL;
2841         int rem_reg_rules = 0, r = 0;
2842         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2843         struct ieee80211_regdomain *rd = NULL;
2844
2845         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2846                 return -EINVAL;
2847
2848         if (!info->attrs[NL80211_ATTR_REG_RULES])
2849                 return -EINVAL;
2850
2851         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2852
2853         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2854                         rem_reg_rules) {
2855                 num_rules++;
2856                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2857                         return -EINVAL;
2858         }
2859
2860         mutex_lock(&cfg80211_mutex);
2861
2862         if (!reg_is_valid_request(alpha2)) {
2863                 r = -EINVAL;
2864                 goto bad_reg;
2865         }
2866
2867         size_of_regd = sizeof(struct ieee80211_regdomain) +
2868                 (num_rules * sizeof(struct ieee80211_reg_rule));
2869
2870         rd = kzalloc(size_of_regd, GFP_KERNEL);
2871         if (!rd) {
2872                 r = -ENOMEM;
2873                 goto bad_reg;
2874         }
2875
2876         rd->n_reg_rules = num_rules;
2877         rd->alpha2[0] = alpha2[0];
2878         rd->alpha2[1] = alpha2[1];
2879
2880         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2881                         rem_reg_rules) {
2882                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2883                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2884                         reg_rule_policy);
2885                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2886                 if (r)
2887                         goto bad_reg;
2888
2889                 rule_idx++;
2890
2891                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2892                         r = -EINVAL;
2893                         goto bad_reg;
2894                 }
2895         }
2896
2897         BUG_ON(rule_idx != num_rules);
2898
2899         r = set_regdom(rd);
2900
2901         mutex_unlock(&cfg80211_mutex);
2902
2903         return r;
2904
2905  bad_reg:
2906         mutex_unlock(&cfg80211_mutex);
2907         kfree(rd);
2908         return r;
2909 }
2910
2911 static int validate_scan_freqs(struct nlattr *freqs)
2912 {
2913         struct nlattr *attr1, *attr2;
2914         int n_channels = 0, tmp1, tmp2;
2915
2916         nla_for_each_nested(attr1, freqs, tmp1) {
2917                 n_channels++;
2918                 /*
2919                  * Some hardware has a limited channel list for
2920                  * scanning, and it is pretty much nonsensical
2921                  * to scan for a channel twice, so disallow that
2922                  * and don't require drivers to check that the
2923                  * channel list they get isn't longer than what
2924                  * they can scan, as long as they can scan all
2925                  * the channels they registered at once.
2926                  */
2927                 nla_for_each_nested(attr2, freqs, tmp2)
2928                         if (attr1 != attr2 &&
2929                             nla_get_u32(attr1) == nla_get_u32(attr2))
2930                                 return 0;
2931         }
2932
2933         return n_channels;
2934 }
2935
2936 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2937 {
2938         struct cfg80211_registered_device *rdev;
2939         struct net_device *dev;
2940         struct cfg80211_scan_request *request;
2941         struct cfg80211_ssid *ssid;
2942         struct ieee80211_channel *channel;
2943         struct nlattr *attr;
2944         struct wiphy *wiphy;
2945         int err, tmp, n_ssids = 0, n_channels, i;
2946         enum ieee80211_band band;
2947         size_t ie_len;
2948
2949         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2950                 return -EINVAL;
2951
2952         rtnl_lock();
2953
2954         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2955         if (err)
2956                 goto out_rtnl;
2957
2958         wiphy = &rdev->wiphy;
2959
2960         if (!rdev->ops->scan) {
2961                 err = -EOPNOTSUPP;
2962                 goto out;
2963         }
2964
2965         if (!netif_running(dev)) {
2966                 err = -ENETDOWN;
2967                 goto out;
2968         }
2969
2970         if (rdev->scan_req) {
2971                 err = -EBUSY;
2972                 goto out;
2973         }
2974
2975         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2976                 n_channels = validate_scan_freqs(
2977                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2978                 if (!n_channels) {
2979                         err = -EINVAL;
2980                         goto out;
2981                 }
2982         } else {
2983                 n_channels = 0;
2984
2985                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2986                         if (wiphy->bands[band])
2987                                 n_channels += wiphy->bands[band]->n_channels;
2988         }
2989
2990         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2991                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2992                         n_ssids++;
2993
2994         if (n_ssids > wiphy->max_scan_ssids) {
2995                 err = -EINVAL;
2996                 goto out;
2997         }
2998
2999         if (info->attrs[NL80211_ATTR_IE])
3000                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3001         else
3002                 ie_len = 0;
3003
3004         if (ie_len > wiphy->max_scan_ie_len) {
3005                 err = -EINVAL;
3006                 goto out;
3007         }
3008
3009         request = kzalloc(sizeof(*request)
3010                         + sizeof(*ssid) * n_ssids
3011                         + sizeof(channel) * n_channels
3012                         + ie_len, GFP_KERNEL);
3013         if (!request) {
3014                 err = -ENOMEM;
3015                 goto out;
3016         }
3017
3018         if (n_ssids)
3019                 request->ssids = (void *)&request->channels[n_channels];
3020         request->n_ssids = n_ssids;
3021         if (ie_len) {
3022                 if (request->ssids)
3023                         request->ie = (void *)(request->ssids + n_ssids);
3024                 else
3025                         request->ie = (void *)(request->channels + n_channels);
3026         }
3027
3028         i = 0;
3029         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3030                 /* user specified, bail out if channel not found */
3031                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3032                         struct ieee80211_channel *chan;
3033
3034                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3035
3036                         if (!chan) {
3037                                 err = -EINVAL;
3038                                 goto out_free;
3039                         }
3040
3041                         /* ignore disabled channels */
3042                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3043                                 continue;
3044
3045                         request->channels[i] = chan;
3046                         i++;
3047                 }
3048         } else {
3049                 /* all channels */
3050                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3051                         int j;
3052                         if (!wiphy->bands[band])
3053                                 continue;
3054                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3055                                 struct ieee80211_channel *chan;
3056
3057                                 chan = &wiphy->bands[band]->channels[j];
3058
3059                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3060                                         continue;
3061
3062                                 request->channels[i] = chan;
3063                                 i++;
3064                         }
3065                 }
3066         }
3067
3068         if (!i) {
3069                 err = -EINVAL;
3070                 goto out_free;
3071         }
3072
3073         request->n_channels = i;
3074
3075         i = 0;
3076         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3077                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3078                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3079                                 err = -EINVAL;
3080                                 goto out_free;
3081                         }
3082                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3083                         request->ssids[i].ssid_len = nla_len(attr);
3084                         i++;
3085                 }
3086         }
3087
3088         if (info->attrs[NL80211_ATTR_IE]) {
3089                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3090                 memcpy((void *)request->ie,
3091                        nla_data(info->attrs[NL80211_ATTR_IE]),
3092                        request->ie_len);
3093         }
3094
3095         request->dev = dev;
3096         request->wiphy = &rdev->wiphy;
3097
3098         rdev->scan_req = request;
3099         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3100
3101         if (!err) {
3102                 nl80211_send_scan_start(rdev, dev);
3103                 dev_hold(dev);
3104         }
3105
3106  out_free:
3107         if (err) {
3108                 rdev->scan_req = NULL;
3109                 kfree(request);
3110         }
3111  out:
3112         cfg80211_unlock_rdev(rdev);
3113         dev_put(dev);
3114  out_rtnl:
3115         rtnl_unlock();
3116
3117         return err;
3118 }
3119
3120 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3121                             struct cfg80211_registered_device *rdev,
3122                             struct wireless_dev *wdev,
3123                             struct cfg80211_internal_bss *intbss)
3124 {
3125         struct cfg80211_bss *res = &intbss->pub;
3126         void *hdr;
3127         struct nlattr *bss;
3128         int i;
3129
3130         ASSERT_WDEV_LOCK(wdev);
3131
3132         hdr = nl80211hdr_put(msg, pid, seq, flags,
3133                              NL80211_CMD_NEW_SCAN_RESULTS);
3134         if (!hdr)
3135                 return -1;
3136
3137         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3138         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3139
3140         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3141         if (!bss)
3142                 goto nla_put_failure;
3143         if (!is_zero_ether_addr(res->bssid))
3144                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3145         if (res->information_elements && res->len_information_elements)
3146                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3147                         res->len_information_elements,
3148                         res->information_elements);
3149         if (res->beacon_ies && res->len_beacon_ies &&
3150             res->beacon_ies != res->information_elements)
3151                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3152                         res->len_beacon_ies, res->beacon_ies);
3153         if (res->tsf)
3154                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3155         if (res->beacon_interval)
3156                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3157         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3158         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3159         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3160                 jiffies_to_msecs(jiffies - intbss->ts));
3161
3162         switch (rdev->wiphy.signal_type) {
3163         case CFG80211_SIGNAL_TYPE_MBM:
3164                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3165                 break;
3166         case CFG80211_SIGNAL_TYPE_UNSPEC:
3167                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3168                 break;
3169         default:
3170                 break;
3171         }
3172
3173         switch (wdev->iftype) {
3174         case NL80211_IFTYPE_STATION:
3175                 if (intbss == wdev->current_bss)
3176                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3177                                     NL80211_BSS_STATUS_ASSOCIATED);
3178                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3179                         if (intbss != wdev->auth_bsses[i])
3180                                 continue;
3181                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3182                                     NL80211_BSS_STATUS_AUTHENTICATED);
3183                         break;
3184                 }
3185                 break;
3186         case NL80211_IFTYPE_ADHOC:
3187                 if (intbss == wdev->current_bss)
3188                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3189                                     NL80211_BSS_STATUS_IBSS_JOINED);
3190                 break;
3191         default:
3192                 break;
3193         }
3194
3195         nla_nest_end(msg, bss);
3196
3197         return genlmsg_end(msg, hdr);
3198
3199  nla_put_failure:
3200         genlmsg_cancel(msg, hdr);
3201         return -EMSGSIZE;
3202 }
3203
3204 static int nl80211_dump_scan(struct sk_buff *skb,
3205                              struct netlink_callback *cb)
3206 {
3207         struct cfg80211_registered_device *rdev;
3208         struct net_device *dev;
3209         struct cfg80211_internal_bss *scan;
3210         struct wireless_dev *wdev;
3211         int ifidx = cb->args[0];
3212         int start = cb->args[1], idx = 0;
3213         int err;
3214
3215         if (!ifidx)
3216                 ifidx = nl80211_get_ifidx(cb);
3217         if (ifidx < 0)
3218                 return ifidx;
3219         cb->args[0] = ifidx;
3220
3221         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3222         if (!dev)
3223                 return -ENODEV;
3224
3225         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3226         if (IS_ERR(rdev)) {
3227                 err = PTR_ERR(rdev);
3228                 goto out_put_netdev;
3229         }
3230
3231         wdev = dev->ieee80211_ptr;
3232
3233         wdev_lock(wdev);
3234         spin_lock_bh(&rdev->bss_lock);
3235         cfg80211_bss_expire(rdev);
3236
3237         list_for_each_entry(scan, &rdev->bss_list, list) {
3238                 if (++idx <= start)
3239                         continue;
3240                 if (nl80211_send_bss(skb,
3241                                 NETLINK_CB(cb->skb).pid,
3242                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3243                                 rdev, wdev, scan) < 0) {
3244                         idx--;
3245                         goto out;
3246                 }
3247         }
3248
3249  out:
3250         spin_unlock_bh(&rdev->bss_lock);
3251         wdev_unlock(wdev);
3252
3253         cb->args[1] = idx;
3254         err = skb->len;
3255         cfg80211_unlock_rdev(rdev);
3256  out_put_netdev:
3257         dev_put(dev);
3258
3259         return err;
3260 }
3261
3262 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3263                                 int flags, struct net_device *dev,
3264                                 struct survey_info *survey)
3265 {
3266         void *hdr;
3267         struct nlattr *infoattr;
3268
3269         /* Survey without a channel doesn't make sense */
3270         if (!survey->channel)
3271                 return -EINVAL;
3272
3273         hdr = nl80211hdr_put(msg, pid, seq, flags,
3274                              NL80211_CMD_NEW_SURVEY_RESULTS);
3275         if (!hdr)
3276                 return -ENOMEM;
3277
3278         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3279
3280         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3281         if (!infoattr)
3282                 goto nla_put_failure;
3283
3284         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3285                     survey->channel->center_freq);
3286         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3287                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3288                             survey->noise);
3289
3290         nla_nest_end(msg, infoattr);
3291
3292         return genlmsg_end(msg, hdr);
3293
3294  nla_put_failure:
3295         genlmsg_cancel(msg, hdr);
3296         return -EMSGSIZE;
3297 }
3298
3299 static int nl80211_dump_survey(struct sk_buff *skb,
3300                         struct netlink_callback *cb)
3301 {
3302         struct survey_info survey;
3303         struct cfg80211_registered_device *dev;
3304         struct net_device *netdev;
3305         int ifidx = cb->args[0];
3306         int survey_idx = cb->args[1];
3307         int res;
3308
3309         if (!ifidx)
3310                 ifidx = nl80211_get_ifidx(cb);
3311         if (ifidx < 0)
3312                 return ifidx;
3313         cb->args[0] = ifidx;
3314
3315         rtnl_lock();
3316
3317         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3318         if (!netdev) {
3319                 res = -ENODEV;
3320                 goto out_rtnl;
3321         }
3322
3323         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3324         if (IS_ERR(dev)) {
3325                 res = PTR_ERR(dev);
3326                 goto out_rtnl;
3327         }
3328
3329         if (!dev->ops->dump_survey) {
3330                 res = -EOPNOTSUPP;
3331                 goto out_err;
3332         }
3333
3334         while (1) {
3335                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3336                                             &survey);
3337                 if (res == -ENOENT)
3338                         break;
3339                 if (res)
3340                         goto out_err;
3341
3342                 if (nl80211_send_survey(skb,
3343                                 NETLINK_CB(cb->skb).pid,
3344                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3345                                 netdev,
3346                                 &survey) < 0)
3347                         goto out;
3348                 survey_idx++;
3349         }
3350
3351  out:
3352         cb->args[1] = survey_idx;
3353         res = skb->len;
3354  out_err:
3355         cfg80211_unlock_rdev(dev);
3356  out_rtnl:
3357         rtnl_unlock();
3358
3359         return res;
3360 }
3361
3362 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3363 {
3364         return auth_type <= NL80211_AUTHTYPE_MAX;
3365 }
3366
3367 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3368 {
3369         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3370                                   NL80211_WPA_VERSION_2));
3371 }
3372
3373 static bool nl80211_valid_akm_suite(u32 akm)
3374 {
3375         return akm == WLAN_AKM_SUITE_8021X ||
3376                 akm == WLAN_AKM_SUITE_PSK;
3377 }
3378
3379 static bool nl80211_valid_cipher_suite(u32 cipher)
3380 {
3381         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3382                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3383                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3384                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3385                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3386 }
3387
3388
3389 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3390 {
3391         struct cfg80211_registered_device *rdev;
3392         struct net_device *dev;
3393         struct ieee80211_channel *chan;
3394         const u8 *bssid, *ssid, *ie = NULL;
3395         int err, ssid_len, ie_len = 0;
3396         enum nl80211_auth_type auth_type;
3397         struct key_parse key;
3398
3399         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3400                 return -EINVAL;
3401
3402         if (!info->attrs[NL80211_ATTR_MAC])
3403                 return -EINVAL;
3404
3405         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3406                 return -EINVAL;
3407
3408         if (!info->attrs[NL80211_ATTR_SSID])
3409                 return -EINVAL;
3410
3411         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3412                 return -EINVAL;
3413
3414         err = nl80211_parse_key(info, &key);
3415         if (err)
3416                 return err;
3417
3418         if (key.idx >= 0) {
3419                 if (!key.p.key || !key.p.key_len)
3420                         return -EINVAL;
3421                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3422                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3423                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3424                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3425                         return -EINVAL;
3426                 if (key.idx > 4)
3427                         return -EINVAL;
3428         } else {
3429                 key.p.key_len = 0;
3430                 key.p.key = NULL;
3431         }
3432
3433         rtnl_lock();
3434
3435         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3436         if (err)
3437                 goto unlock_rtnl;
3438
3439         if (!rdev->ops->auth) {
3440                 err = -EOPNOTSUPP;
3441                 goto out;
3442         }
3443
3444         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3445                 err = -EOPNOTSUPP;
3446                 goto out;
3447         }
3448
3449         if (!netif_running(dev)) {
3450                 err = -ENETDOWN;
3451                 goto out;
3452         }
3453
3454         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3455         chan = ieee80211_get_channel(&rdev->wiphy,
3456                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3457         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3458                 err = -EINVAL;
3459                 goto out;
3460         }
3461
3462         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3463         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3464
3465         if (info->attrs[NL80211_ATTR_IE]) {
3466                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3467                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3468         }
3469
3470         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3471         if (!nl80211_valid_auth_type(auth_type)) {
3472                 err = -EINVAL;
3473                 goto out;
3474         }
3475
3476         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3477                                  ssid, ssid_len, ie, ie_len,
3478                                  key.p.key, key.p.key_len, key.idx);
3479
3480 out:
3481         cfg80211_unlock_rdev(rdev);
3482         dev_put(dev);
3483 unlock_rtnl:
3484         rtnl_unlock();
3485         return err;
3486 }
3487
3488 static int nl80211_crypto_settings(struct genl_info *info,
3489                                    struct cfg80211_crypto_settings *settings,
3490                                    int cipher_limit)
3491 {
3492         memset(settings, 0, sizeof(*settings));
3493
3494         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3495
3496         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3497                 void *data;
3498                 int len, i;
3499
3500                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3501                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3502                 settings->n_ciphers_pairwise = len / sizeof(u32);
3503
3504                 if (len % sizeof(u32))
3505                         return -EINVAL;
3506
3507                 if (settings->n_ciphers_pairwise > cipher_limit)
3508                         return -EINVAL;
3509
3510                 memcpy(settings->ciphers_pairwise, data, len);
3511
3512                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3513                         if (!nl80211_valid_cipher_suite(
3514                                         settings->ciphers_pairwise[i]))
3515                                 return -EINVAL;
3516         }
3517
3518         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3519                 settings->cipher_group =
3520                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3521                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3522                         return -EINVAL;
3523         }
3524
3525         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3526                 settings->wpa_versions =
3527                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3528                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3529                         return -EINVAL;
3530         }
3531
3532         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3533                 void *data;
3534                 int len, i;
3535
3536                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3537                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3538                 settings->n_akm_suites = len / sizeof(u32);
3539
3540                 if (len % sizeof(u32))
3541                         return -EINVAL;
3542
3543                 memcpy(settings->akm_suites, data, len);
3544
3545                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3546                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3547                                 return -EINVAL;
3548         }
3549
3550         return 0;
3551 }
3552
3553 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3554 {
3555         struct cfg80211_registered_device *rdev;
3556         struct net_device *dev;
3557         struct wireless_dev *wdev;
3558         struct cfg80211_crypto_settings crypto;
3559         struct ieee80211_channel *chan, *fixedchan;
3560         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3561         int err, ssid_len, ie_len = 0;
3562         bool use_mfp = false;
3563
3564         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3565                 return -EINVAL;
3566
3567         if (!info->attrs[NL80211_ATTR_MAC] ||
3568             !info->attrs[NL80211_ATTR_SSID] ||
3569             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3570                 return -EINVAL;
3571
3572         rtnl_lock();
3573
3574         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3575         if (err)
3576                 goto unlock_rtnl;
3577
3578         if (!rdev->ops->assoc) {
3579                 err = -EOPNOTSUPP;
3580                 goto out;
3581         }
3582
3583         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3584                 err = -EOPNOTSUPP;
3585                 goto out;
3586         }
3587
3588         if (!netif_running(dev)) {
3589                 err = -ENETDOWN;
3590                 goto out;
3591         }
3592
3593         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3594
3595         chan = ieee80211_get_channel(&rdev->wiphy,
3596                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3597         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3598                 err = -EINVAL;
3599                 goto out;
3600         }
3601
3602         mutex_lock(&rdev->devlist_mtx);
3603         wdev = dev->ieee80211_ptr;
3604         fixedchan = rdev_fixed_channel(rdev, wdev);
3605         if (fixedchan && chan != fixedchan) {
3606                 err = -EBUSY;
3607                 mutex_unlock(&rdev->devlist_mtx);
3608                 goto out;
3609         }
3610         mutex_unlock(&rdev->devlist_mtx);
3611
3612         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3613         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3614
3615         if (info->attrs[NL80211_ATTR_IE]) {
3616                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3617                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3618         }
3619
3620         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3621                 enum nl80211_mfp mfp =
3622                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3623                 if (mfp == NL80211_MFP_REQUIRED)
3624                         use_mfp = true;
3625                 else if (mfp != NL80211_MFP_NO) {
3626                         err = -EINVAL;
3627                         goto out;
3628                 }
3629         }
3630
3631         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3632                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3633
3634         err = nl80211_crypto_settings(info, &crypto, 1);
3635         if (!err)
3636                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3637                                           ssid, ssid_len, ie, ie_len, use_mfp,
3638                                           &crypto);
3639
3640 out:
3641         cfg80211_unlock_rdev(rdev);
3642         dev_put(dev);
3643 unlock_rtnl:
3644         rtnl_unlock();
3645         return err;
3646 }
3647
3648 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3649 {
3650         struct cfg80211_registered_device *rdev;
3651         struct net_device *dev;
3652         const u8 *ie = NULL, *bssid;
3653         int err, ie_len = 0;
3654         u16 reason_code;
3655
3656         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3657                 return -EINVAL;
3658
3659         if (!info->attrs[NL80211_ATTR_MAC])
3660                 return -EINVAL;
3661
3662         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3663                 return -EINVAL;
3664
3665         rtnl_lock();
3666
3667         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3668         if (err)
3669                 goto unlock_rtnl;
3670
3671         if (!rdev->ops->deauth) {
3672                 err = -EOPNOTSUPP;
3673                 goto out;
3674         }
3675
3676         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3677                 err = -EOPNOTSUPP;
3678                 goto out;
3679         }
3680
3681         if (!netif_running(dev)) {
3682                 err = -ENETDOWN;
3683                 goto out;
3684         }
3685
3686         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3687
3688         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3689         if (reason_code == 0) {
3690                 /* Reason Code 0 is reserved */
3691                 err = -EINVAL;
3692                 goto out;
3693         }
3694
3695         if (info->attrs[NL80211_ATTR_IE]) {
3696                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3697                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3698         }
3699
3700         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3701
3702 out:
3703         cfg80211_unlock_rdev(rdev);
3704         dev_put(dev);
3705 unlock_rtnl:
3706         rtnl_unlock();
3707         return err;
3708 }
3709
3710 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3711 {
3712         struct cfg80211_registered_device *rdev;
3713         struct net_device *dev;
3714         const u8 *ie = NULL, *bssid;
3715         int err, ie_len = 0;
3716         u16 reason_code;
3717
3718         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3719                 return -EINVAL;
3720
3721         if (!info->attrs[NL80211_ATTR_MAC])
3722                 return -EINVAL;
3723
3724         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3725                 return -EINVAL;
3726
3727         rtnl_lock();
3728
3729         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3730         if (err)
3731                 goto unlock_rtnl;
3732
3733         if (!rdev->ops->disassoc) {
3734                 err = -EOPNOTSUPP;
3735                 goto out;
3736         }
3737
3738         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3739                 err = -EOPNOTSUPP;
3740                 goto out;
3741         }
3742
3743         if (!netif_running(dev)) {
3744                 err = -ENETDOWN;
3745                 goto out;
3746         }
3747
3748         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3749
3750         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3751         if (reason_code == 0) {
3752                 /* Reason Code 0 is reserved */
3753                 err = -EINVAL;
3754                 goto out;
3755         }
3756
3757         if (info->attrs[NL80211_ATTR_IE]) {
3758                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3759                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3760         }
3761
3762         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3763
3764 out:
3765         cfg80211_unlock_rdev(rdev);
3766         dev_put(dev);
3767 unlock_rtnl:
3768         rtnl_unlock();
3769         return err;
3770 }
3771
3772 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3773 {
3774         struct cfg80211_registered_device *rdev;
3775         struct net_device *dev;
3776         struct cfg80211_ibss_params ibss;
3777         struct wiphy *wiphy;
3778         struct cfg80211_cached_keys *connkeys = NULL;
3779         int err;
3780
3781         memset(&ibss, 0, sizeof(ibss));
3782
3783         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3784                 return -EINVAL;
3785
3786         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3787             !info->attrs[NL80211_ATTR_SSID] ||
3788             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3789                 return -EINVAL;
3790
3791         ibss.beacon_interval = 100;
3792
3793         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3794                 ibss.beacon_interval =
3795                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3796                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3797                         return -EINVAL;
3798         }
3799
3800         rtnl_lock();
3801
3802         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3803         if (err)
3804                 goto unlock_rtnl;
3805
3806         if (!rdev->ops->join_ibss) {
3807                 err = -EOPNOTSUPP;
3808                 goto out;
3809         }
3810
3811         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3812                 err = -EOPNOTSUPP;
3813                 goto out;
3814         }
3815
3816         if (!netif_running(dev)) {
3817                 err = -ENETDOWN;
3818                 goto out;
3819         }
3820
3821         wiphy = &rdev->wiphy;
3822
3823         if (info->attrs[NL80211_ATTR_MAC])
3824                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3825         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3826         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3827
3828         if (info->attrs[NL80211_ATTR_IE]) {
3829                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3830                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3831         }
3832
3833         ibss.channel = ieee80211_get_channel(wiphy,
3834                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3835         if (!ibss.channel ||
3836             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3837             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3838                 err = -EINVAL;
3839                 goto out;
3840         }
3841
3842         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3843         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3844
3845         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3846                 connkeys = nl80211_parse_connkeys(rdev,
3847                                         info->attrs[NL80211_ATTR_KEYS]);
3848                 if (IS_ERR(connkeys)) {
3849                         err = PTR_ERR(connkeys);
3850                         connkeys = NULL;
3851                         goto out;
3852                 }
3853         }
3854
3855         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3856
3857 out:
3858         cfg80211_unlock_rdev(rdev);
3859         dev_put(dev);
3860 unlock_rtnl:
3861         if (err)
3862                 kfree(connkeys);
3863         rtnl_unlock();
3864         return err;
3865 }
3866
3867 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3868 {
3869         struct cfg80211_registered_device *rdev;
3870         struct net_device *dev;
3871         int err;
3872
3873         rtnl_lock();
3874
3875         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3876         if (err)
3877                 goto unlock_rtnl;
3878
3879         if (!rdev->ops->leave_ibss) {
3880                 err = -EOPNOTSUPP;
3881                 goto out;
3882         }
3883
3884         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3885                 err = -EOPNOTSUPP;
3886                 goto out;
3887         }
3888
3889         if (!netif_running(dev)) {
3890                 err = -ENETDOWN;
3891                 goto out;
3892         }
3893
3894         err = cfg80211_leave_ibss(rdev, dev, false);
3895
3896 out:
3897         cfg80211_unlock_rdev(rdev);
3898         dev_put(dev);
3899 unlock_rtnl:
3900         rtnl_unlock();
3901         return err;
3902 }
3903
3904 #ifdef CONFIG_NL80211_TESTMODE
3905 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3906         .name = "testmode",
3907 };
3908
3909 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3910 {
3911         struct cfg80211_registered_device *rdev;
3912         int err;
3913
3914         if (!info->attrs[NL80211_ATTR_TESTDATA])
3915                 return -EINVAL;
3916
3917         rtnl_lock();
3918
3919         rdev = cfg80211_get_dev_from_info(info);
3920         if (IS_ERR(rdev)) {
3921                 err = PTR_ERR(rdev);
3922                 goto unlock_rtnl;
3923         }
3924
3925         err = -EOPNOTSUPP;
3926         if (rdev->ops->testmode_cmd) {
3927                 rdev->testmode_info = info;
3928                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3929                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3930                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3931                 rdev->testmode_info = NULL;
3932         }
3933
3934         cfg80211_unlock_rdev(rdev);
3935
3936  unlock_rtnl:
3937         rtnl_unlock();
3938         return err;
3939 }
3940
3941 static struct sk_buff *
3942 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3943                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3944 {
3945         struct sk_buff *skb;
3946         void *hdr;
3947         struct nlattr *data;
3948
3949         skb = nlmsg_new(approxlen + 100, gfp);
3950         if (!skb)
3951                 return NULL;
3952
3953         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3954         if (!hdr) {
3955                 kfree_skb(skb);
3956                 return NULL;
3957         }
3958
3959         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3960         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3961
3962         ((void **)skb->cb)[0] = rdev;
3963         ((void **)skb->cb)[1] = hdr;
3964         ((void **)skb->cb)[2] = data;
3965
3966         return skb;
3967
3968  nla_put_failure:
3969         kfree_skb(skb);
3970         return NULL;
3971 }
3972
3973 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3974                                                   int approxlen)
3975 {
3976         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3977
3978         if (WARN_ON(!rdev->testmode_info))
3979                 return NULL;
3980
3981         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3982                                 rdev->testmode_info->snd_pid,
3983                                 rdev->testmode_info->snd_seq,
3984                                 GFP_KERNEL);
3985 }
3986 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3987
3988 int cfg80211_testmode_reply(struct sk_buff *skb)
3989 {
3990         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3991         void *hdr = ((void **)skb->cb)[1];
3992         struct nlattr *data = ((void **)skb->cb)[2];
3993
3994         if (WARN_ON(!rdev->testmode_info)) {
3995                 kfree_skb(skb);
3996                 return -EINVAL;
3997         }
3998
3999         nla_nest_end(skb, data);
4000         genlmsg_end(skb, hdr);
4001         return genlmsg_reply(skb, rdev->testmode_info);
4002 }
4003 EXPORT_SYMBOL(cfg80211_testmode_reply);
4004
4005 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4006                                                   int approxlen, gfp_t gfp)
4007 {
4008         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4009
4010         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4011 }
4012 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4013
4014 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4015 {
4016         void *hdr = ((void **)skb->cb)[1];
4017         struct nlattr *data = ((void **)skb->cb)[2];
4018
4019         nla_nest_end(skb, data);
4020         genlmsg_end(skb, hdr);
4021         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4022 }
4023 EXPORT_SYMBOL(cfg80211_testmode_event);
4024 #endif
4025
4026 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4027 {
4028         struct cfg80211_registered_device *rdev;
4029         struct net_device *dev;
4030         struct cfg80211_connect_params connect;
4031         struct wiphy *wiphy;
4032         struct cfg80211_cached_keys *connkeys = NULL;
4033         int err;
4034
4035         memset(&connect, 0, sizeof(connect));
4036
4037         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4038                 return -EINVAL;
4039
4040         if (!info->attrs[NL80211_ATTR_SSID] ||
4041             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4042                 return -EINVAL;
4043
4044         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4045                 connect.auth_type =
4046                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4047                 if (!nl80211_valid_auth_type(connect.auth_type))
4048                         return -EINVAL;
4049         } else
4050                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4051
4052         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4053
4054         err = nl80211_crypto_settings(info, &connect.crypto,
4055                                       NL80211_MAX_NR_CIPHER_SUITES);
4056         if (err)
4057                 return err;
4058         rtnl_lock();
4059
4060         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4061         if (err)
4062                 goto unlock_rtnl;
4063
4064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4065                 err = -EOPNOTSUPP;
4066                 goto out;
4067         }
4068
4069         if (!netif_running(dev)) {
4070                 err = -ENETDOWN;
4071                 goto out;
4072         }
4073
4074         wiphy = &rdev->wiphy;
4075
4076         if (info->attrs[NL80211_ATTR_MAC])
4077                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4078         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4079         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4080
4081         if (info->attrs[NL80211_ATTR_IE]) {
4082                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4083                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4084         }
4085
4086         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4087                 connect.channel =
4088                         ieee80211_get_channel(wiphy,
4089                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4090                 if (!connect.channel ||
4091                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4092                         err = -EINVAL;
4093                         goto out;
4094                 }
4095         }
4096
4097         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4098                 connkeys = nl80211_parse_connkeys(rdev,
4099                                         info->attrs[NL80211_ATTR_KEYS]);
4100                 if (IS_ERR(connkeys)) {
4101                         err = PTR_ERR(connkeys);
4102                         connkeys = NULL;
4103                         goto out;
4104                 }
4105         }
4106
4107         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4108
4109 out:
4110         cfg80211_unlock_rdev(rdev);
4111         dev_put(dev);
4112 unlock_rtnl:
4113         if (err)
4114                 kfree(connkeys);
4115         rtnl_unlock();
4116         return err;
4117 }
4118
4119 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4120 {
4121         struct cfg80211_registered_device *rdev;
4122         struct net_device *dev;
4123         int err;
4124         u16 reason;
4125
4126         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4127                 reason = WLAN_REASON_DEAUTH_LEAVING;
4128         else
4129                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4130
4131         if (reason == 0)
4132                 return -EINVAL;
4133
4134         rtnl_lock();
4135
4136         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4137         if (err)
4138                 goto unlock_rtnl;
4139
4140         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4141                 err = -EOPNOTSUPP;
4142                 goto out;
4143         }
4144
4145         if (!netif_running(dev)) {
4146                 err = -ENETDOWN;
4147                 goto out;
4148         }
4149
4150         err = cfg80211_disconnect(rdev, dev, reason, true);
4151
4152 out:
4153         cfg80211_unlock_rdev(rdev);
4154         dev_put(dev);
4155 unlock_rtnl:
4156         rtnl_unlock();
4157         return err;
4158 }
4159
4160 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4161 {
4162         struct cfg80211_registered_device *rdev;
4163         struct net *net;
4164         int err;
4165         u32 pid;
4166
4167         if (!info->attrs[NL80211_ATTR_PID])
4168                 return -EINVAL;
4169
4170         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4171
4172         rtnl_lock();
4173
4174         rdev = cfg80211_get_dev_from_info(info);
4175         if (IS_ERR(rdev)) {
4176                 err = PTR_ERR(rdev);
4177                 goto out_rtnl;
4178         }
4179
4180         net = get_net_ns_by_pid(pid);
4181         if (IS_ERR(net)) {
4182                 err = PTR_ERR(net);
4183                 goto out;
4184         }
4185
4186         err = 0;
4187
4188         /* check if anything to do */
4189         if (net_eq(wiphy_net(&rdev->wiphy), net))
4190                 goto out_put_net;
4191
4192         err = cfg80211_switch_netns(rdev, net);
4193  out_put_net:
4194 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
4195         put_net(net);
4196 #endif
4197  out:
4198         cfg80211_unlock_rdev(rdev);
4199  out_rtnl:
4200         rtnl_unlock();
4201         return err;
4202 }
4203
4204 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4205 {
4206         struct cfg80211_registered_device *rdev;
4207         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4208                         struct cfg80211_pmksa *pmksa) = NULL;
4209         int err;
4210         struct net_device *dev;
4211         struct cfg80211_pmksa pmksa;
4212
4213         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4214
4215         if (!info->attrs[NL80211_ATTR_MAC])
4216                 return -EINVAL;
4217
4218         if (!info->attrs[NL80211_ATTR_PMKID])
4219                 return -EINVAL;
4220
4221         rtnl_lock();
4222
4223         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4224         if (err)
4225                 goto out_rtnl;
4226
4227         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4228         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4229
4230         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4231                 err = -EOPNOTSUPP;
4232                 goto out;
4233         }
4234
4235         switch (info->genlhdr->cmd) {
4236         case NL80211_CMD_SET_PMKSA:
4237                 rdev_ops = rdev->ops->set_pmksa;
4238                 break;
4239         case NL80211_CMD_DEL_PMKSA:
4240                 rdev_ops = rdev->ops->del_pmksa;
4241                 break;
4242         default:
4243                 WARN_ON(1);
4244                 break;
4245         }
4246
4247         if (!rdev_ops) {
4248                 err = -EOPNOTSUPP;
4249                 goto out;
4250         }
4251
4252         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4253
4254  out:
4255         cfg80211_unlock_rdev(rdev);
4256         dev_put(dev);
4257  out_rtnl:
4258         rtnl_unlock();
4259
4260         return err;
4261 }
4262
4263 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4264 {
4265         struct cfg80211_registered_device *rdev;
4266         int err;
4267         struct net_device *dev;
4268
4269         rtnl_lock();
4270
4271         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4272         if (err)
4273                 goto out_rtnl;
4274
4275         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4276                 err = -EOPNOTSUPP;
4277                 goto out;
4278         }
4279
4280         if (!rdev->ops->flush_pmksa) {
4281                 err = -EOPNOTSUPP;
4282                 goto out;
4283         }
4284
4285         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4286
4287  out:
4288         cfg80211_unlock_rdev(rdev);
4289         dev_put(dev);
4290  out_rtnl:
4291         rtnl_unlock();
4292
4293         return err;
4294
4295 }
4296
4297 static int nl80211_remain_on_channel(struct sk_buff *skb,
4298                                      struct genl_info *info)
4299 {
4300         struct cfg80211_registered_device *rdev;
4301         struct net_device *dev;
4302         struct ieee80211_channel *chan;
4303         struct sk_buff *msg;
4304         void *hdr;
4305         u64 cookie;
4306         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4307         u32 freq, duration;
4308         int err;
4309
4310         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4311             !info->attrs[NL80211_ATTR_DURATION])
4312                 return -EINVAL;
4313
4314         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4315
4316         /*
4317          * We should be on that channel for at least one jiffie,
4318          * and more than 5 seconds seems excessive.
4319          */
4320         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4321                 return -EINVAL;
4322
4323         rtnl_lock();
4324
4325         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4326         if (err)
4327                 goto unlock_rtnl;
4328
4329         if (!rdev->ops->remain_on_channel) {
4330                 err = -EOPNOTSUPP;
4331                 goto out;
4332         }
4333
4334         if (!netif_running(dev)) {
4335                 err = -ENETDOWN;
4336                 goto out;
4337         }
4338
4339         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4340                 channel_type = nla_get_u32(
4341                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4342                 if (channel_type != NL80211_CHAN_NO_HT &&
4343                     channel_type != NL80211_CHAN_HT20 &&
4344                     channel_type != NL80211_CHAN_HT40PLUS &&
4345                     channel_type != NL80211_CHAN_HT40MINUS)
4346                         err = -EINVAL;
4347                         goto out;
4348         }
4349
4350         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4351         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4352         if (chan == NULL) {
4353                 err = -EINVAL;
4354                 goto out;
4355         }
4356
4357         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4358         if (!msg) {
4359                 err = -ENOMEM;
4360                 goto out;
4361         }
4362
4363         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4364                              NL80211_CMD_REMAIN_ON_CHANNEL);
4365
4366         if (IS_ERR(hdr)) {
4367                 err = PTR_ERR(hdr);
4368                 goto free_msg;
4369         }
4370
4371         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4372                                            channel_type, duration, &cookie);
4373
4374         if (err)
4375                 goto free_msg;
4376
4377         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4378
4379         genlmsg_end(msg, hdr);
4380         err = genlmsg_reply(msg, info);
4381         goto out;
4382
4383  nla_put_failure:
4384         err = -ENOBUFS;
4385  free_msg:
4386         nlmsg_free(msg);
4387  out:
4388         cfg80211_unlock_rdev(rdev);
4389         dev_put(dev);
4390  unlock_rtnl:
4391         rtnl_unlock();
4392         return err;
4393 }
4394
4395 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4396                                             struct genl_info *info)
4397 {
4398         struct cfg80211_registered_device *rdev;
4399         struct net_device *dev;
4400         u64 cookie;
4401         int err;
4402
4403         if (!info->attrs[NL80211_ATTR_COOKIE])
4404                 return -EINVAL;
4405
4406         rtnl_lock();
4407
4408         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4409         if (err)
4410                 goto unlock_rtnl;
4411
4412         if (!rdev->ops->cancel_remain_on_channel) {
4413                 err = -EOPNOTSUPP;
4414                 goto out;
4415         }
4416
4417         if (!netif_running(dev)) {
4418                 err = -ENETDOWN;
4419                 goto out;
4420         }
4421
4422         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4423
4424         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4425
4426  out:
4427         cfg80211_unlock_rdev(rdev);
4428         dev_put(dev);
4429  unlock_rtnl:
4430         rtnl_unlock();
4431         return err;
4432 }
4433
4434 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4435                            u8 *rates, u8 rates_len)
4436 {
4437         u8 i;
4438         u32 mask = 0;
4439
4440         for (i = 0; i < rates_len; i++) {
4441                 int rate = (rates[i] & 0x7f) * 5;
4442                 int ridx;
4443                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4444                         struct ieee80211_rate *srate =
4445                                 &sband->bitrates[ridx];
4446                         if (rate == srate->bitrate) {
4447                                 mask |= 1 << ridx;
4448                                 break;
4449                         }
4450                 }
4451                 if (ridx == sband->n_bitrates)
4452                         return 0; /* rate not found */
4453         }
4454
4455         return mask;
4456 }
4457
4458 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4459         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4460                                     .len = NL80211_MAX_SUPP_RATES },
4461 };
4462
4463 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4464                                        struct genl_info *info)
4465 {
4466         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4467         struct cfg80211_registered_device *rdev;
4468         struct cfg80211_bitrate_mask mask;
4469         int err, rem, i;
4470         struct net_device *dev;
4471         struct nlattr *tx_rates;
4472         struct ieee80211_supported_band *sband;
4473
4474         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4475                 return -EINVAL;
4476
4477         rtnl_lock();
4478
4479         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4480         if (err)
4481                 goto unlock_rtnl;
4482
4483         if (!rdev->ops->set_bitrate_mask) {
4484                 err = -EOPNOTSUPP;
4485                 goto unlock;
4486         }
4487
4488         memset(&mask, 0, sizeof(mask));
4489         /* Default to all rates enabled */
4490         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4491                 sband = rdev->wiphy.bands[i];
4492                 mask.control[i].legacy =
4493                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4494         }
4495
4496         /*
4497          * The nested attribute uses enum nl80211_band as the index. This maps
4498          * directly to the enum ieee80211_band values used in cfg80211.
4499          */
4500         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4501         {
4502                 enum ieee80211_band band = nla_type(tx_rates);
4503                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4504                         err = -EINVAL;
4505                         goto unlock;
4506                 }
4507                 sband = rdev->wiphy.bands[band];
4508                 if (sband == NULL) {
4509                         err = -EINVAL;
4510                         goto unlock;
4511                 }
4512                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4513                           nla_len(tx_rates), nl80211_txattr_policy);
4514                 if (tb[NL80211_TXRATE_LEGACY]) {
4515                         mask.control[band].legacy = rateset_to_mask(
4516                                 sband,
4517                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4518                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4519                         if (mask.control[band].legacy == 0) {
4520                                 err = -EINVAL;
4521                                 goto unlock;
4522                         }
4523                 }
4524         }
4525
4526         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4527
4528  unlock:
4529         dev_put(dev);
4530         cfg80211_unlock_rdev(rdev);
4531  unlock_rtnl:
4532         rtnl_unlock();
4533         return err;
4534 }
4535
4536 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4537 {
4538         struct cfg80211_registered_device *rdev;
4539         struct net_device *dev;
4540         int err;
4541
4542         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4543                 return -EINVAL;
4544
4545         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4546                 return -EINVAL;
4547
4548         rtnl_lock();
4549
4550         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4551         if (err)
4552                 goto unlock_rtnl;
4553
4554         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4555                 err = -EOPNOTSUPP;
4556                 goto out;
4557         }
4558
4559         /* not much point in registering if we can't reply */
4560         if (!rdev->ops->action) {
4561                 err = -EOPNOTSUPP;
4562                 goto out;
4563         }
4564
4565         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4566                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4567                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4568  out:
4569         cfg80211_unlock_rdev(rdev);
4570         dev_put(dev);
4571  unlock_rtnl:
4572         rtnl_unlock();
4573         return err;
4574 }
4575
4576 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4577 {
4578         struct cfg80211_registered_device *rdev;
4579         struct net_device *dev;
4580         struct ieee80211_channel *chan;
4581         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4582         u32 freq;
4583         int err;
4584         void *hdr;
4585         u64 cookie;
4586         struct sk_buff *msg;
4587
4588         if (!info->attrs[NL80211_ATTR_FRAME] ||
4589             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4590                 return -EINVAL;
4591
4592         rtnl_lock();
4593
4594         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4595         if (err)
4596                 goto unlock_rtnl;
4597
4598         if (!rdev->ops->action) {
4599                 err = -EOPNOTSUPP;
4600                 goto out;
4601         }
4602
4603         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4604                 err = -EOPNOTSUPP;
4605                 goto out;
4606         }
4607
4608         if (!netif_running(dev)) {
4609                 err = -ENETDOWN;
4610                 goto out;
4611         }
4612
4613         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4614                 channel_type = nla_get_u32(
4615                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4616                 if (channel_type != NL80211_CHAN_NO_HT &&
4617                     channel_type != NL80211_CHAN_HT20 &&
4618                     channel_type != NL80211_CHAN_HT40PLUS &&
4619                     channel_type != NL80211_CHAN_HT40MINUS)
4620                         err = -EINVAL;
4621                         goto out;
4622         }
4623
4624         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4625         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4626         if (chan == NULL) {
4627                 err = -EINVAL;
4628                 goto out;
4629         }
4630
4631         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4632         if (!msg) {
4633                 err = -ENOMEM;
4634                 goto out;
4635         }
4636
4637         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4638                              NL80211_CMD_ACTION);
4639
4640         if (IS_ERR(hdr)) {
4641                 err = PTR_ERR(hdr);
4642                 goto free_msg;
4643         }
4644         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4645                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4646                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4647                                    &cookie);
4648         if (err)
4649                 goto free_msg;
4650
4651         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4652
4653         genlmsg_end(msg, hdr);
4654         err = genlmsg_reply(msg, info);
4655         goto out;
4656
4657  nla_put_failure:
4658         err = -ENOBUFS;
4659  free_msg:
4660         nlmsg_free(msg);
4661  out:
4662         cfg80211_unlock_rdev(rdev);
4663         dev_put(dev);
4664 unlock_rtnl:
4665         rtnl_unlock();
4666         return err;
4667 }
4668
4669 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4670 {
4671         struct cfg80211_registered_device *rdev;
4672         struct wireless_dev *wdev;
4673         struct net_device *dev;
4674         u8 ps_state;
4675         bool state;
4676         int err;
4677
4678         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4679                 err = -EINVAL;
4680                 goto out;
4681         }
4682
4683         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4684
4685         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4686                 err = -EINVAL;
4687                 goto out;
4688         }
4689
4690         rtnl_lock();
4691
4692         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4693         if (err)
4694                 goto unlock_rdev;
4695
4696         wdev = dev->ieee80211_ptr;
4697
4698         if (!rdev->ops->set_power_mgmt) {
4699                 err = -EOPNOTSUPP;
4700                 goto unlock_rdev;
4701         }
4702
4703         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4704
4705         if (state == wdev->ps)
4706                 goto unlock_rdev;
4707
4708         wdev->ps = state;
4709
4710         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4711                                       wdev->ps_timeout))
4712                 /* assume this means it's off */
4713                 wdev->ps = false;
4714
4715 unlock_rdev:
4716         cfg80211_unlock_rdev(rdev);
4717         dev_put(dev);
4718         rtnl_unlock();
4719
4720 out:
4721         return err;
4722 }
4723
4724 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4725 {
4726         struct cfg80211_registered_device *rdev;
4727         enum nl80211_ps_state ps_state;
4728         struct wireless_dev *wdev;
4729         struct net_device *dev;
4730         struct sk_buff *msg;
4731         void *hdr;
4732         int err;
4733
4734         rtnl_lock();
4735
4736         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4737         if (err)
4738                 goto unlock_rtnl;
4739
4740         wdev = dev->ieee80211_ptr;
4741
4742         if (!rdev->ops->set_power_mgmt) {
4743                 err = -EOPNOTSUPP;
4744                 goto out;
4745         }
4746
4747         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4748         if (!msg) {
4749                 err = -ENOMEM;
4750                 goto out;
4751         }
4752
4753         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4754                              NL80211_CMD_GET_POWER_SAVE);
4755         if (!hdr) {
4756                 err = -ENOMEM;
4757                 goto free_msg;
4758         }
4759
4760         if (wdev->ps)
4761                 ps_state = NL80211_PS_ENABLED;
4762         else
4763                 ps_state = NL80211_PS_DISABLED;
4764
4765         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4766
4767         genlmsg_end(msg, hdr);
4768         err = genlmsg_reply(msg, info);
4769         goto out;
4770
4771 nla_put_failure:
4772         err = -ENOBUFS;
4773
4774 free_msg:
4775         nlmsg_free(msg);
4776
4777 out:
4778         cfg80211_unlock_rdev(rdev);
4779         dev_put(dev);
4780
4781 unlock_rtnl:
4782         rtnl_unlock();
4783
4784         return err;
4785 }
4786
4787 static struct genl_ops nl80211_ops[] = {
4788         {
4789                 .cmd = NL80211_CMD_GET_WIPHY,
4790                 .doit = nl80211_get_wiphy,
4791                 .dumpit = nl80211_dump_wiphy,
4792                 .policy = nl80211_policy,
4793                 /* can be retrieved by unprivileged users */
4794         },
4795         {
4796                 .cmd = NL80211_CMD_SET_WIPHY,
4797                 .doit = nl80211_set_wiphy,
4798                 .policy = nl80211_policy,
4799                 .flags = GENL_ADMIN_PERM,
4800         },
4801         {
4802                 .cmd = NL80211_CMD_GET_INTERFACE,
4803                 .doit = nl80211_get_interface,
4804                 .dumpit = nl80211_dump_interface,
4805                 .policy = nl80211_policy,
4806                 /* can be retrieved by unprivileged users */
4807         },
4808         {
4809                 .cmd = NL80211_CMD_SET_INTERFACE,
4810                 .doit = nl80211_set_interface,
4811                 .policy = nl80211_policy,
4812                 .flags = GENL_ADMIN_PERM,
4813         },
4814         {
4815                 .cmd = NL80211_CMD_NEW_INTERFACE,
4816                 .doit = nl80211_new_interface,
4817                 .policy = nl80211_policy,
4818                 .flags = GENL_ADMIN_PERM,
4819         },
4820         {
4821                 .cmd = NL80211_CMD_DEL_INTERFACE,
4822                 .doit = nl80211_del_interface,
4823                 .policy = nl80211_policy,
4824                 .flags = GENL_ADMIN_PERM,
4825         },
4826         {
4827                 .cmd = NL80211_CMD_GET_KEY,
4828                 .doit = nl80211_get_key,
4829                 .policy = nl80211_policy,
4830                 .flags = GENL_ADMIN_PERM,
4831         },
4832         {
4833                 .cmd = NL80211_CMD_SET_KEY,
4834                 .doit = nl80211_set_key,
4835                 .policy = nl80211_policy,
4836                 .flags = GENL_ADMIN_PERM,
4837         },
4838         {
4839                 .cmd = NL80211_CMD_NEW_KEY,
4840                 .doit = nl80211_new_key,
4841                 .policy = nl80211_policy,
4842                 .flags = GENL_ADMIN_PERM,
4843         },
4844         {
4845                 .cmd = NL80211_CMD_DEL_KEY,
4846                 .doit = nl80211_del_key,
4847                 .policy = nl80211_policy,
4848                 .flags = GENL_ADMIN_PERM,
4849         },
4850         {
4851                 .cmd = NL80211_CMD_SET_BEACON,
4852                 .policy = nl80211_policy,
4853                 .flags = GENL_ADMIN_PERM,
4854                 .doit = nl80211_addset_beacon,
4855         },
4856         {
4857                 .cmd = NL80211_CMD_NEW_BEACON,
4858                 .policy = nl80211_policy,
4859                 .flags = GENL_ADMIN_PERM,
4860                 .doit = nl80211_addset_beacon,
4861         },
4862         {
4863                 .cmd = NL80211_CMD_DEL_BEACON,
4864                 .policy = nl80211_policy,
4865                 .flags = GENL_ADMIN_PERM,
4866                 .doit = nl80211_del_beacon,
4867         },
4868         {
4869                 .cmd = NL80211_CMD_GET_STATION,
4870                 .doit = nl80211_get_station,
4871                 .dumpit = nl80211_dump_station,
4872                 .policy = nl80211_policy,
4873         },
4874         {
4875                 .cmd = NL80211_CMD_SET_STATION,
4876                 .doit = nl80211_set_station,
4877                 .policy = nl80211_policy,
4878                 .flags = GENL_ADMIN_PERM,
4879         },
4880         {
4881                 .cmd = NL80211_CMD_NEW_STATION,
4882                 .doit = nl80211_new_station,
4883                 .policy = nl80211_policy,
4884                 .flags = GENL_ADMIN_PERM,
4885         },
4886         {
4887                 .cmd = NL80211_CMD_DEL_STATION,
4888                 .doit = nl80211_del_station,
4889                 .policy = nl80211_policy,
4890                 .flags = GENL_ADMIN_PERM,
4891         },
4892         {
4893                 .cmd = NL80211_CMD_GET_MPATH,
4894                 .doit = nl80211_get_mpath,
4895                 .dumpit = nl80211_dump_mpath,
4896                 .policy = nl80211_policy,
4897                 .flags = GENL_ADMIN_PERM,
4898         },
4899         {
4900                 .cmd = NL80211_CMD_SET_MPATH,
4901                 .doit = nl80211_set_mpath,
4902                 .policy = nl80211_policy,
4903                 .flags = GENL_ADMIN_PERM,
4904         },
4905         {
4906                 .cmd = NL80211_CMD_NEW_MPATH,
4907                 .doit = nl80211_new_mpath,
4908                 .policy = nl80211_policy,
4909                 .flags = GENL_ADMIN_PERM,
4910         },
4911         {
4912                 .cmd = NL80211_CMD_DEL_MPATH,
4913                 .doit = nl80211_del_mpath,
4914                 .policy = nl80211_policy,
4915                 .flags = GENL_ADMIN_PERM,
4916         },
4917         {
4918                 .cmd = NL80211_CMD_SET_BSS,
4919                 .doit = nl80211_set_bss,
4920                 .policy = nl80211_policy,
4921                 .flags = GENL_ADMIN_PERM,
4922         },
4923         {
4924                 .cmd = NL80211_CMD_GET_REG,
4925                 .doit = nl80211_get_reg,
4926                 .policy = nl80211_policy,
4927                 /* can be retrieved by unprivileged users */
4928         },
4929         {
4930                 .cmd = NL80211_CMD_SET_REG,
4931                 .doit = nl80211_set_reg,
4932                 .policy = nl80211_policy,
4933                 .flags = GENL_ADMIN_PERM,
4934         },
4935         {
4936                 .cmd = NL80211_CMD_REQ_SET_REG,
4937                 .doit = nl80211_req_set_reg,
4938                 .policy = nl80211_policy,
4939                 .flags = GENL_ADMIN_PERM,
4940         },
4941         {
4942                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4943                 .doit = nl80211_get_mesh_params,
4944                 .policy = nl80211_policy,
4945                 /* can be retrieved by unprivileged users */
4946         },
4947         {
4948                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4949                 .doit = nl80211_set_mesh_params,
4950                 .policy = nl80211_policy,
4951                 .flags = GENL_ADMIN_PERM,
4952         },
4953         {
4954                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4955                 .doit = nl80211_trigger_scan,
4956                 .policy = nl80211_policy,
4957                 .flags = GENL_ADMIN_PERM,
4958         },
4959         {
4960                 .cmd = NL80211_CMD_GET_SCAN,
4961                 .policy = nl80211_policy,
4962                 .dumpit = nl80211_dump_scan,
4963         },
4964         {
4965                 .cmd = NL80211_CMD_AUTHENTICATE,
4966                 .doit = nl80211_authenticate,
4967                 .policy = nl80211_policy,
4968                 .flags = GENL_ADMIN_PERM,
4969         },
4970         {
4971                 .cmd = NL80211_CMD_ASSOCIATE,
4972                 .doit = nl80211_associate,
4973                 .policy = nl80211_policy,
4974                 .flags = GENL_ADMIN_PERM,
4975         },
4976         {
4977                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4978                 .doit = nl80211_deauthenticate,
4979                 .policy = nl80211_policy,
4980                 .flags = GENL_ADMIN_PERM,
4981         },
4982         {
4983                 .cmd = NL80211_CMD_DISASSOCIATE,
4984                 .doit = nl80211_disassociate,
4985                 .policy = nl80211_policy,
4986                 .flags = GENL_ADMIN_PERM,
4987         },
4988         {
4989                 .cmd = NL80211_CMD_JOIN_IBSS,
4990                 .doit = nl80211_join_ibss,
4991                 .policy = nl80211_policy,
4992                 .flags = GENL_ADMIN_PERM,
4993         },
4994         {
4995                 .cmd = NL80211_CMD_LEAVE_IBSS,
4996                 .doit = nl80211_leave_ibss,
4997                 .policy = nl80211_policy,
4998                 .flags = GENL_ADMIN_PERM,
4999         },
5000 #ifdef CONFIG_NL80211_TESTMODE
5001         {
5002                 .cmd = NL80211_CMD_TESTMODE,
5003                 .doit = nl80211_testmode_do,
5004                 .policy = nl80211_policy,
5005                 .flags = GENL_ADMIN_PERM,
5006         },
5007 #endif
5008         {
5009                 .cmd = NL80211_CMD_CONNECT,
5010                 .doit = nl80211_connect,
5011                 .policy = nl80211_policy,
5012                 .flags = GENL_ADMIN_PERM,
5013         },
5014         {
5015                 .cmd = NL80211_CMD_DISCONNECT,
5016                 .doit = nl80211_disconnect,
5017                 .policy = nl80211_policy,
5018                 .flags = GENL_ADMIN_PERM,
5019         },
5020         {
5021                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5022                 .doit = nl80211_wiphy_netns,
5023                 .policy = nl80211_policy,
5024                 .flags = GENL_ADMIN_PERM,
5025         },
5026         {
5027                 .cmd = NL80211_CMD_GET_SURVEY,
5028                 .policy = nl80211_policy,
5029                 .dumpit = nl80211_dump_survey,
5030         },
5031         {
5032                 .cmd = NL80211_CMD_SET_PMKSA,
5033                 .doit = nl80211_setdel_pmksa,
5034                 .policy = nl80211_policy,
5035                 .flags = GENL_ADMIN_PERM,
5036         },
5037         {
5038                 .cmd = NL80211_CMD_DEL_PMKSA,
5039                 .doit = nl80211_setdel_pmksa,
5040                 .policy = nl80211_policy,
5041                 .flags = GENL_ADMIN_PERM,
5042         },
5043         {
5044                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5045                 .doit = nl80211_flush_pmksa,
5046                 .policy = nl80211_policy,
5047                 .flags = GENL_ADMIN_PERM,
5048         },
5049         {
5050                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5051                 .doit = nl80211_remain_on_channel,
5052                 .policy = nl80211_policy,
5053                 .flags = GENL_ADMIN_PERM,
5054         },
5055         {
5056                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5057                 .doit = nl80211_cancel_remain_on_channel,
5058                 .policy = nl80211_policy,
5059                 .flags = GENL_ADMIN_PERM,
5060         },
5061         {
5062                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5063                 .doit = nl80211_set_tx_bitrate_mask,
5064                 .policy = nl80211_policy,
5065                 .flags = GENL_ADMIN_PERM,
5066         },
5067         {
5068                 .cmd = NL80211_CMD_REGISTER_ACTION,
5069                 .doit = nl80211_register_action,
5070                 .policy = nl80211_policy,
5071                 .flags = GENL_ADMIN_PERM,
5072         },
5073         {
5074                 .cmd = NL80211_CMD_ACTION,
5075                 .doit = nl80211_action,
5076                 .policy = nl80211_policy,
5077                 .flags = GENL_ADMIN_PERM,
5078         },
5079         {
5080                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5081                 .doit = nl80211_set_power_save,
5082                 .policy = nl80211_policy,
5083                 .flags = GENL_ADMIN_PERM,
5084         },
5085         {
5086                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5087                 .doit = nl80211_get_power_save,
5088                 .policy = nl80211_policy,
5089                 /* can be retrieved by unprivileged users */
5090         },
5091 };
5092
5093 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5094         .name = "mlme",
5095 };
5096
5097 /* multicast groups */
5098 static struct genl_multicast_group nl80211_config_mcgrp = {
5099         .name = "config",
5100 };
5101 static struct genl_multicast_group nl80211_scan_mcgrp = {
5102         .name = "scan",
5103 };
5104 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5105         .name = "regulatory",
5106 };
5107
5108 /* notification functions */
5109
5110 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5111 {
5112         struct sk_buff *msg;
5113
5114         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5115         if (!msg)
5116                 return;
5117
5118         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5119                 nlmsg_free(msg);
5120                 return;
5121         }
5122
5123         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5124                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5125 }
5126
5127 static int nl80211_add_scan_req(struct sk_buff *msg,
5128                                 struct cfg80211_registered_device *rdev)
5129 {
5130         struct cfg80211_scan_request *req = rdev->scan_req;
5131         struct nlattr *nest;
5132         int i;
5133
5134         ASSERT_RDEV_LOCK(rdev);
5135
5136         if (WARN_ON(!req))
5137                 return 0;
5138
5139         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5140         if (!nest)
5141                 goto nla_put_failure;
5142         for (i = 0; i < req->n_ssids; i++)
5143                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5144         nla_nest_end(msg, nest);
5145
5146         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5147         if (!nest)
5148                 goto nla_put_failure;
5149         for (i = 0; i < req->n_channels; i++)
5150                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5151         nla_nest_end(msg, nest);
5152
5153         if (req->ie)
5154                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5155
5156         return 0;
5157  nla_put_failure:
5158         return -ENOBUFS;
5159 }
5160
5161 static int nl80211_send_scan_msg(struct sk_buff *msg,
5162                                  struct cfg80211_registered_device *rdev,
5163                                  struct net_device *netdev,
5164                                  u32 pid, u32 seq, int flags,
5165                                  u32 cmd)
5166 {
5167         void *hdr;
5168
5169         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5170         if (!hdr)
5171                 return -1;
5172
5173         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5174         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5175
5176         /* ignore errors and send incomplete event anyway */
5177         nl80211_add_scan_req(msg, rdev);
5178
5179         return genlmsg_end(msg, hdr);
5180
5181  nla_put_failure:
5182         genlmsg_cancel(msg, hdr);
5183         return -EMSGSIZE;
5184 }
5185
5186 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5187                              struct net_device *netdev)
5188 {
5189         struct sk_buff *msg;
5190
5191         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5192         if (!msg)
5193                 return;
5194
5195         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5196                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5197                 nlmsg_free(msg);
5198                 return;
5199         }
5200
5201         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5202                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5203 }
5204
5205 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5206                             struct net_device *netdev)
5207 {
5208         struct sk_buff *msg;
5209
5210         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5211         if (!msg)
5212                 return;
5213
5214         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5215                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5216                 nlmsg_free(msg);
5217                 return;
5218         }
5219
5220         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5221                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5222 }
5223
5224 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5225                                struct net_device *netdev)
5226 {
5227         struct sk_buff *msg;
5228
5229         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5230         if (!msg)
5231                 return;
5232
5233         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5234                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5235                 nlmsg_free(msg);
5236                 return;
5237         }
5238
5239         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5240                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5241 }
5242
5243 /*
5244  * This can happen on global regulatory changes or device specific settings
5245  * based on custom world regulatory domains.
5246  */
5247 void nl80211_send_reg_change_event(struct regulatory_request *request)
5248 {
5249         struct sk_buff *msg;
5250         void *hdr;
5251
5252         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5253         if (!msg)
5254                 return;
5255
5256         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5257         if (!hdr) {
5258                 nlmsg_free(msg);
5259                 return;
5260         }
5261
5262         /* Userspace can always count this one always being set */
5263         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5264
5265         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5266                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5267                            NL80211_REGDOM_TYPE_WORLD);
5268         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5269                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5270                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5271         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5272                  request->intersect)
5273                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5274                            NL80211_REGDOM_TYPE_INTERSECTION);
5275         else {
5276                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5277                            NL80211_REGDOM_TYPE_COUNTRY);
5278                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5279         }
5280
5281         if (wiphy_idx_valid(request->wiphy_idx))
5282                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5283
5284         if (genlmsg_end(msg, hdr) < 0) {
5285                 nlmsg_free(msg);
5286                 return;
5287         }
5288
5289         rcu_read_lock();
5290         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5291                                 GFP_ATOMIC);
5292         rcu_read_unlock();
5293
5294         return;
5295
5296 nla_put_failure:
5297         genlmsg_cancel(msg, hdr);
5298         nlmsg_free(msg);
5299 }
5300
5301 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5302                                     struct net_device *netdev,
5303                                     const u8 *buf, size_t len,
5304                                     enum nl80211_commands cmd, gfp_t gfp)
5305 {
5306         struct sk_buff *msg;
5307         void *hdr;
5308
5309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5310         if (!msg)
5311                 return;
5312
5313         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5314         if (!hdr) {
5315                 nlmsg_free(msg);
5316                 return;
5317         }
5318
5319         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5320         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5321         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5322
5323         if (genlmsg_end(msg, hdr) < 0) {
5324                 nlmsg_free(msg);
5325                 return;
5326         }
5327
5328         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5329                                 nl80211_mlme_mcgrp.id, gfp);
5330         return;
5331
5332  nla_put_failure:
5333         genlmsg_cancel(msg, hdr);
5334         nlmsg_free(msg);
5335 }
5336
5337 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5338                           struct net_device *netdev, const u8 *buf,
5339                           size_t len, gfp_t gfp)
5340 {
5341         nl80211_send_mlme_event(rdev, netdev, buf, len,
5342                                 NL80211_CMD_AUTHENTICATE, gfp);
5343 }
5344
5345 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5346                            struct net_device *netdev, const u8 *buf,
5347                            size_t len, gfp_t gfp)
5348 {
5349         nl80211_send_mlme_event(rdev, netdev, buf, len,
5350                                 NL80211_CMD_ASSOCIATE, gfp);
5351 }
5352
5353 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5354                          struct net_device *netdev, const u8 *buf,
5355                          size_t len, gfp_t gfp)
5356 {
5357         nl80211_send_mlme_event(rdev, netdev, buf, len,
5358                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5359 }
5360
5361 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5362                            struct net_device *netdev, const u8 *buf,
5363                            size_t len, gfp_t gfp)
5364 {
5365         nl80211_send_mlme_event(rdev, netdev, buf, len,
5366                                 NL80211_CMD_DISASSOCIATE, gfp);
5367 }
5368
5369 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5370                                       struct net_device *netdev, int cmd,
5371                                       const u8 *addr, gfp_t gfp)
5372 {
5373         struct sk_buff *msg;
5374         void *hdr;
5375
5376         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5377         if (!msg)
5378                 return;
5379
5380         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5381         if (!hdr) {
5382                 nlmsg_free(msg);
5383                 return;
5384         }
5385
5386         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5387         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5388         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5389         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5390
5391         if (genlmsg_end(msg, hdr) < 0) {
5392                 nlmsg_free(msg);
5393                 return;
5394         }
5395
5396         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5397                                 nl80211_mlme_mcgrp.id, gfp);
5398         return;
5399
5400  nla_put_failure:
5401         genlmsg_cancel(msg, hdr);
5402         nlmsg_free(msg);
5403 }
5404
5405 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5406                                struct net_device *netdev, const u8 *addr,
5407                                gfp_t gfp)
5408 {
5409         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5410                                   addr, gfp);
5411 }
5412
5413 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5414                                 struct net_device *netdev, const u8 *addr,
5415                                 gfp_t gfp)
5416 {
5417         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5418                                   addr, gfp);
5419 }
5420
5421 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5422                                  struct net_device *netdev, const u8 *bssid,
5423                                  const u8 *req_ie, size_t req_ie_len,
5424                                  const u8 *resp_ie, size_t resp_ie_len,
5425                                  u16 status, gfp_t gfp)
5426 {
5427         struct sk_buff *msg;
5428         void *hdr;
5429
5430         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5431         if (!msg)
5432                 return;
5433
5434         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5435         if (!hdr) {
5436                 nlmsg_free(msg);
5437                 return;
5438         }
5439
5440         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5441         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5442         if (bssid)
5443                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5444         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5445         if (req_ie)
5446                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5447         if (resp_ie)
5448                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5449
5450         if (genlmsg_end(msg, hdr) < 0) {
5451                 nlmsg_free(msg);
5452                 return;
5453         }
5454
5455         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5456                                 nl80211_mlme_mcgrp.id, gfp);
5457         return;
5458
5459  nla_put_failure:
5460         genlmsg_cancel(msg, hdr);
5461         nlmsg_free(msg);
5462
5463 }
5464
5465 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5466                          struct net_device *netdev, const u8 *bssid,
5467                          const u8 *req_ie, size_t req_ie_len,
5468                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5469 {
5470         struct sk_buff *msg;
5471         void *hdr;
5472
5473         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5474         if (!msg)
5475                 return;
5476
5477         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5478         if (!hdr) {
5479                 nlmsg_free(msg);
5480                 return;
5481         }
5482
5483         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5484         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5485         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5486         if (req_ie)
5487                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5488         if (resp_ie)
5489                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5490
5491         if (genlmsg_end(msg, hdr) < 0) {
5492                 nlmsg_free(msg);
5493                 return;
5494         }
5495
5496         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5497                                 nl80211_mlme_mcgrp.id, gfp);
5498         return;
5499
5500  nla_put_failure:
5501         genlmsg_cancel(msg, hdr);
5502         nlmsg_free(msg);
5503
5504 }
5505
5506 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5507                                struct net_device *netdev, u16 reason,
5508                                const u8 *ie, size_t ie_len, bool from_ap)
5509 {
5510         struct sk_buff *msg;
5511         void *hdr;
5512
5513         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5514         if (!msg)
5515                 return;
5516
5517         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5518         if (!hdr) {
5519                 nlmsg_free(msg);
5520                 return;
5521         }
5522
5523         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5524         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5525         if (from_ap && reason)
5526                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5527         if (from_ap)
5528                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5529         if (ie)
5530                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5531
5532         if (genlmsg_end(msg, hdr) < 0) {
5533                 nlmsg_free(msg);
5534                 return;
5535         }
5536
5537         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5538                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5539         return;
5540
5541  nla_put_failure:
5542         genlmsg_cancel(msg, hdr);
5543         nlmsg_free(msg);
5544
5545 }
5546
5547 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5548                              struct net_device *netdev, const u8 *bssid,
5549                              gfp_t gfp)
5550 {
5551         struct sk_buff *msg;
5552         void *hdr;
5553
5554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5555         if (!msg)
5556                 return;
5557
5558         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5559         if (!hdr) {
5560                 nlmsg_free(msg);
5561                 return;
5562         }
5563
5564         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5565         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5566         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5567
5568         if (genlmsg_end(msg, hdr) < 0) {
5569                 nlmsg_free(msg);
5570                 return;
5571         }
5572
5573         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5574                                 nl80211_mlme_mcgrp.id, gfp);
5575         return;
5576
5577  nla_put_failure:
5578         genlmsg_cancel(msg, hdr);
5579         nlmsg_free(msg);
5580 }
5581
5582 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5583                                  struct net_device *netdev, const u8 *addr,
5584                                  enum nl80211_key_type key_type, int key_id,
5585                                  const u8 *tsc, gfp_t gfp)
5586 {
5587         struct sk_buff *msg;
5588         void *hdr;
5589
5590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5591         if (!msg)
5592                 return;
5593
5594         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5595         if (!hdr) {
5596                 nlmsg_free(msg);
5597                 return;
5598         }
5599
5600         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5601         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5602         if (addr)
5603                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5604         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5605         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5606         if (tsc)
5607                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5608
5609         if (genlmsg_end(msg, hdr) < 0) {
5610                 nlmsg_free(msg);
5611                 return;
5612         }
5613
5614         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5615                                 nl80211_mlme_mcgrp.id, gfp);
5616         return;
5617
5618  nla_put_failure:
5619         genlmsg_cancel(msg, hdr);
5620         nlmsg_free(msg);
5621 }
5622
5623 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5624                                     struct ieee80211_channel *channel_before,
5625                                     struct ieee80211_channel *channel_after)
5626 {
5627         struct sk_buff *msg;
5628         void *hdr;
5629         struct nlattr *nl_freq;
5630
5631         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5632         if (!msg)
5633                 return;
5634
5635         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5636         if (!hdr) {
5637                 nlmsg_free(msg);
5638                 return;
5639         }
5640
5641         /*
5642          * Since we are applying the beacon hint to a wiphy we know its
5643          * wiphy_idx is valid
5644          */
5645         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5646
5647         /* Before */
5648         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5649         if (!nl_freq)
5650                 goto nla_put_failure;
5651         if (nl80211_msg_put_channel(msg, channel_before))
5652                 goto nla_put_failure;
5653         nla_nest_end(msg, nl_freq);
5654
5655         /* After */
5656         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5657         if (!nl_freq)
5658                 goto nla_put_failure;
5659         if (nl80211_msg_put_channel(msg, channel_after))
5660                 goto nla_put_failure;
5661         nla_nest_end(msg, nl_freq);
5662
5663         if (genlmsg_end(msg, hdr) < 0) {
5664                 nlmsg_free(msg);
5665                 return;
5666         }
5667
5668         rcu_read_lock();
5669         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5670                                 GFP_ATOMIC);
5671         rcu_read_unlock();
5672
5673         return;
5674
5675 nla_put_failure:
5676         genlmsg_cancel(msg, hdr);
5677         nlmsg_free(msg);
5678 }
5679
5680 static void nl80211_send_remain_on_chan_event(
5681         int cmd, struct cfg80211_registered_device *rdev,
5682         struct net_device *netdev, u64 cookie,
5683         struct ieee80211_channel *chan,
5684         enum nl80211_channel_type channel_type,
5685         unsigned int duration, gfp_t gfp)
5686 {
5687         struct sk_buff *msg;
5688         void *hdr;
5689
5690         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5691         if (!msg)
5692                 return;
5693
5694         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5695         if (!hdr) {
5696                 nlmsg_free(msg);
5697                 return;
5698         }
5699
5700         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5701         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5702         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5703         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5704         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5705
5706         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5707                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5708
5709         if (genlmsg_end(msg, hdr) < 0) {
5710                 nlmsg_free(msg);
5711                 return;
5712         }
5713
5714         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5715                                 nl80211_mlme_mcgrp.id, gfp);
5716         return;
5717
5718  nla_put_failure:
5719         genlmsg_cancel(msg, hdr);
5720         nlmsg_free(msg);
5721 }
5722
5723 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5724                                     struct net_device *netdev, u64 cookie,
5725                                     struct ieee80211_channel *chan,
5726                                     enum nl80211_channel_type channel_type,
5727                                     unsigned int duration, gfp_t gfp)
5728 {
5729         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5730                                           rdev, netdev, cookie, chan,
5731                                           channel_type, duration, gfp);
5732 }
5733
5734 void nl80211_send_remain_on_channel_cancel(
5735         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5736         u64 cookie, struct ieee80211_channel *chan,
5737         enum nl80211_channel_type channel_type, gfp_t gfp)
5738 {
5739         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5740                                           rdev, netdev, cookie, chan,
5741                                           channel_type, 0, gfp);
5742 }
5743
5744 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5745                             struct net_device *dev, const u8 *mac_addr,
5746                             struct station_info *sinfo, gfp_t gfp)
5747 {
5748         struct sk_buff *msg;
5749
5750         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5751         if (!msg)
5752                 return;
5753
5754         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5755                 nlmsg_free(msg);
5756                 return;
5757         }
5758
5759         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5760                                 nl80211_mlme_mcgrp.id, gfp);
5761 }
5762
5763 int nl80211_send_action(struct cfg80211_registered_device *rdev,
5764                         struct net_device *netdev, u32 nlpid,
5765                         int freq, const u8 *buf, size_t len, gfp_t gfp)
5766 {
5767         struct sk_buff *msg;
5768         void *hdr;
5769         int err;
5770
5771         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5772         if (!msg)
5773                 return -ENOMEM;
5774
5775         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
5776         if (!hdr) {
5777                 nlmsg_free(msg);
5778                 return -ENOMEM;
5779         }
5780
5781         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5782         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5783         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5784         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5785
5786         err = genlmsg_end(msg, hdr);
5787         if (err < 0) {
5788                 nlmsg_free(msg);
5789                 return err;
5790         }
5791
5792         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5793         if (err < 0)
5794                 return err;
5795         return 0;
5796
5797  nla_put_failure:
5798         genlmsg_cancel(msg, hdr);
5799         nlmsg_free(msg);
5800         return -ENOBUFS;
5801 }
5802
5803 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
5804                                    struct net_device *netdev, u64 cookie,
5805                                    const u8 *buf, size_t len, bool ack,
5806                                    gfp_t gfp)
5807 {
5808         struct sk_buff *msg;
5809         void *hdr;
5810
5811         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5812         if (!msg)
5813                 return;
5814
5815         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
5816         if (!hdr) {
5817                 nlmsg_free(msg);
5818                 return;
5819         }
5820
5821         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5822         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5823         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5824         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5825         if (ack)
5826                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5827
5828         if (genlmsg_end(msg, hdr) < 0) {
5829                 nlmsg_free(msg);
5830                 return;
5831         }
5832
5833         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5834         return;
5835
5836  nla_put_failure:
5837         genlmsg_cancel(msg, hdr);
5838         nlmsg_free(msg);
5839 }
5840
5841 static int nl80211_netlink_notify(struct notifier_block * nb,
5842                                   unsigned long state,
5843                                   void *_notify)
5844 {
5845         struct netlink_notify *notify = _notify;
5846         struct cfg80211_registered_device *rdev;
5847         struct wireless_dev *wdev;
5848
5849         if (state != NETLINK_URELEASE)
5850                 return NOTIFY_DONE;
5851
5852         rcu_read_lock();
5853
5854         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5855                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5856                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
5857
5858         rcu_read_unlock();
5859
5860         return NOTIFY_DONE;
5861 }
5862
5863 static struct notifier_block nl80211_netlink_notifier = {
5864         .notifier_call = nl80211_netlink_notify,
5865 };
5866
5867 /* initialisation/exit functions */
5868
5869 int nl80211_init(void)
5870 {
5871         int err;
5872
5873         err = genl_register_family_with_ops(&nl80211_fam,
5874                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5875         if (err)
5876                 return err;
5877
5878         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5879         if (err)
5880                 goto err_out;
5881
5882         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5883         if (err)
5884                 goto err_out;
5885
5886         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5887         if (err)
5888                 goto err_out;
5889
5890         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5891         if (err)
5892                 goto err_out;
5893
5894 #ifdef CONFIG_NL80211_TESTMODE
5895         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5896         if (err)
5897                 goto err_out;
5898 #endif
5899
5900         err = netlink_register_notifier(&nl80211_netlink_notifier);
5901         if (err)
5902                 goto err_out;
5903
5904         return 0;
5905  err_out:
5906         genl_unregister_family(&nl80211_fam);
5907         return err;
5908 }
5909
5910 void nl80211_exit(void)
5911 {
5912         netlink_unregister_notifier(&nl80211_netlink_notifier);
5913         genl_unregister_family(&nl80211_fam);
5914 }