SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  73
  74         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  77
  78         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80
  81         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  82         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  83                                     .len = WLAN_MAX_KEY_LEN },
  84         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  85         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  86         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  87         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  88
  89         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  90         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  91         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  92                                        .len = IEEE80211_MAX_DATA_LEN },
  93         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  94                                        .len = IEEE80211_MAX_DATA_LEN },
  95         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  96         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  97         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  98         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  99                                                .len = NL80211_MAX_SUPP_RATES },
 100         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 101         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 102         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 103         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 104                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 105         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 106
 107         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 108         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 114                                            .len = NL80211_MAX_SUPP_RATES },
 115
 116         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 117
 118         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 119                                          .len = NL80211_HT_CAPABILITY_LEN },
 120
 121         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 122         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 123                               .len = IEEE80211_MAX_DATA_LEN },
 124         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 125         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 126
 127         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 128                                 .len = IEEE80211_MAX_SSID_LEN },
 129         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 130         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 131         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 134         [NL80211_ATTR_STA_FLAGS2] = {
 135                 .len = sizeof(struct nl80211_sta_flag_update),
 136         },
 137         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 140         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 141         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 142         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 143         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 144                                  .len = WLAN_PMKID_LEN },
 145         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 146         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 147         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 148         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 149                                  .len = IEEE80211_MAX_DATA_LEN },
 150         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 151         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 152         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 153 };
 154
 155 /* policy for the attributes */
 156 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 157         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 158         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 159         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 160         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 161         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 162         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 163 };
 164
 165 /* ifidx get helper */
 166 static int nl80211_get_ifidx(struct netlink_callback *cb)
 167 {
 168         int res;
 169
 170         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 171                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 172                           nl80211_policy);
 173         if (res)
 174                 return res;
 175
 176         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 177                 return -EINVAL;
 178
 179         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 180         if (!res)
 181                 return -EINVAL;
 182         return res;
 183 }
 184
 185 /* IE validation */
 186 static bool is_valid_ie_attr(const struct nlattr *attr)
 187 {
 188         const u8 *pos;
 189         int len;
 190
 191         if (!attr)
 192                 return true;
 193
 194         pos = nla_data(attr);
 195         len = nla_len(attr);
 196
 197         while (len) {
 198                 u8 elemlen;
 199
 200                 if (len < 2)
 201                         return false;
 202                 len -= 2;
 203
 204                 elemlen = pos[1];
 205                 if (elemlen > len)
 206                         return false;
 207
 208                 len -= elemlen;
 209                 pos += 2 + elemlen;
 210         }
 211
 212         return true;
 213 }
 214
 215 /* message building helper */
 216 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 217                                    int flags, u8 cmd)
 218 {
 219         /* since there is no private header just add the generic one */
 220         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 221 }
 222
 223 static int nl80211_msg_put_channel(struct sk_buff *msg,
 224                                    struct ieee80211_channel *chan)
 225 {
 226         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 227                     chan->center_freq);
 228
 229         if (chan->flags & IEEE80211_CHAN_DISABLED)
 230                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 231         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 232                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 233         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 234                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 235         if (chan->flags & IEEE80211_CHAN_RADAR)
 236                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 237
 238         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 239                     DBM_TO_MBM(chan->max_power));
 240
 241         return 0;
 242
 243  nla_put_failure:
 244         return -ENOBUFS;
 245 }
 246
 247 /* netlink command implementations */
 248
 249 struct key_parse {
 250         struct key_params p;
 251         int idx;
 252         bool def, defmgmt;
 253 };
 254
 255 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 256 {
 257         struct nlattr *tb[NL80211_KEY_MAX + 1];
 258         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 259                                    nl80211_key_policy);
 260         if (err)
 261                 return err;
 262
 263         k->def = !!tb[NL80211_KEY_DEFAULT];
 264         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 265
 266         if (tb[NL80211_KEY_IDX])
 267                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 268
 269         if (tb[NL80211_KEY_DATA]) {
 270                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 271                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 272         }
 273
 274         if (tb[NL80211_KEY_SEQ]) {
 275                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 276                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 277         }
 278
 279         if (tb[NL80211_KEY_CIPHER])
 280                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 281
 282         return 0;
 283 }
 284
 285 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 286 {
 287         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 288                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 289                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 290         }
 291
 292         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 293                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 294                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 295         }
 296
 297         if (info->attrs[NL80211_ATTR_KEY_IDX])
 298                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 299
 300         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 301                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 302
 303         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 304         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 305
 306         return 0;
 307 }
 308
 309 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 310 {
 311         int err;
 312
 313         memset(k, 0, sizeof(*k));
 314         k->idx = -1;
 315
 316         if (info->attrs[NL80211_ATTR_KEY])
 317                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 318         else
 319                 err = nl80211_parse_key_old(info, k);
 320
 321         if (err)
 322                 return err;
 323
 324         if (k->def && k->defmgmt)
 325                 return -EINVAL;
 326
 327         if (k->idx != -1) {
 328                 if (k->defmgmt) {
 329                         if (k->idx < 4 || k->idx > 5)
 330                                 return -EINVAL;
 331                 } else if (k->def) {
 332                         if (k->idx < 0 || k->idx > 3)
 333                                 return -EINVAL;
 334                 } else {
 335                         if (k->idx < 0 || k->idx > 5)
 336                                 return -EINVAL;
 337                 }
 338         }
 339
 340         return 0;
 341 }
 342
 343 static struct cfg80211_cached_keys *
 344 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 345                        struct nlattr *keys)
 346 {
 347         struct key_parse parse;
 348         struct nlattr *key;
 349         struct cfg80211_cached_keys *result;
 350         int rem, err, def = 0;
 351
 352         result = kzalloc(sizeof(*result), GFP_KERNEL);
 353         if (!result)
 354                 return ERR_PTR(-ENOMEM);
 355
 356         result->def = -1;
 357         result->defmgmt = -1;
 358
 359         nla_for_each_nested(key, keys, rem) {
 360                 memset(&parse, 0, sizeof(parse));
 361                 parse.idx = -1;
 362
 363                 err = nl80211_parse_key_new(key, &parse);
 364                 if (err)
 365                         goto error;
 366                 err = -EINVAL;
 367                 if (!parse.p.key)
 368                         goto error;
 369                 if (parse.idx < 0 || parse.idx > 4)
 370                         goto error;
 371                 if (parse.def) {
 372                         if (def)
 373                                 goto error;
 374                         def = 1;
 375                         result->def = parse.idx;
 376                 } else if (parse.defmgmt)
 377                         goto error;
 378                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 379                                                      parse.idx, NULL);
 380                 if (err)
 381                         goto error;
 382                 result->params[parse.idx].cipher = parse.p.cipher;
 383                 result->params[parse.idx].key_len = parse.p.key_len;
 384                 result->params[parse.idx].key = result->data[parse.idx];
 385                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 386         }
 387
 388         return result;
 389  error:
 390         kfree(result);
 391         return ERR_PTR(err);
 392 }
 393
 394 static int nl80211_key_allowed(struct wireless_dev *wdev)
 395 {
 396         ASSERT_WDEV_LOCK(wdev);
 397
 398         if (!netif_running(wdev->netdev))
 399                 return -ENETDOWN;
 400
 401         switch (wdev->iftype) {
 402         case NL80211_IFTYPE_AP:
 403         case NL80211_IFTYPE_AP_VLAN:
 404                 break;
 405         case NL80211_IFTYPE_ADHOC:
 406                 if (!wdev->current_bss)
 407                         return -ENOLINK;
 408                 break;
 409         case NL80211_IFTYPE_STATION:
 410                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 411                         return -ENOLINK;
 412                 break;
 413         default:
 414                 return -EINVAL;
 415         }
 416
 417         return 0;
 418 }
 419
 420 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 421                               struct cfg80211_registered_device *dev)
 422 {
 423         void *hdr;
 424         struct nlattr *nl_bands, *nl_band;
 425         struct nlattr *nl_freqs, *nl_freq;
 426         struct nlattr *nl_rates, *nl_rate;
 427         struct nlattr *nl_modes;
 428         struct nlattr *nl_cmds;
 429         enum ieee80211_band band;
 430         struct ieee80211_channel *chan;
 431         struct ieee80211_rate *rate;
 432         int i;
 433         u16 ifmodes = dev->wiphy.interface_modes;
 434
 435         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 436         if (!hdr)
 437                 return -1;
 438
 439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 440         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 441
 442         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 443                     cfg80211_rdev_list_generation);
 444
 445         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 446                    dev->wiphy.retry_short);
 447         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 448                    dev->wiphy.retry_long);
 449         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 450                     dev->wiphy.frag_threshold);
 451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 452                     dev->wiphy.rts_threshold);
 453         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 454                     dev->wiphy.coverage_class);
 455
 456         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 457                    dev->wiphy.max_scan_ssids);
 458         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 459                     dev->wiphy.max_scan_ie_len);
 460
 461         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 462                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 463                 dev->wiphy.cipher_suites);
 464
 465         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 466                    dev->wiphy.max_num_pmkids);
 467
 468         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 469         if (!nl_modes)
 470                 goto nla_put_failure;
 471
 472         i = 0;
 473         while (ifmodes) {
 474                 if (ifmodes & 1)
 475                         NLA_PUT_FLAG(msg, i);
 476                 ifmodes >>= 1;
 477                 i++;
 478         }
 479
 480         nla_nest_end(msg, nl_modes);
 481
 482         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 483         if (!nl_bands)
 484                 goto nla_put_failure;
 485
 486         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 487                 if (!dev->wiphy.bands[band])
 488                         continue;
 489
 490                 nl_band = nla_nest_start(msg, band);
 491                 if (!nl_band)
 492                         goto nla_put_failure;
 493
 494                 /* add HT info */
 495                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 496                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 497                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 498                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 499                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 500                                 dev->wiphy.bands[band]->ht_cap.cap);
 501                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 502                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 503                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 504                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 505                 }
 506
 507                 /* add frequencies */
 508                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 509                 if (!nl_freqs)
 510                         goto nla_put_failure;
 511
 512                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 513                         nl_freq = nla_nest_start(msg, i);
 514                         if (!nl_freq)
 515                                 goto nla_put_failure;
 516
 517                         chan = &dev->wiphy.bands[band]->channels[i];
 518
 519                         if (nl80211_msg_put_channel(msg, chan))
 520                                 goto nla_put_failure;
 521
 522                         nla_nest_end(msg, nl_freq);
 523                 }
 524
 525                 nla_nest_end(msg, nl_freqs);
 526
 527                 /* add bitrates */
 528                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 529                 if (!nl_rates)
 530                         goto nla_put_failure;
 531
 532                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 533                         nl_rate = nla_nest_start(msg, i);
 534                         if (!nl_rate)
 535                                 goto nla_put_failure;
 536
 537                         rate = &dev->wiphy.bands[band]->bitrates[i];
 538                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 539                                     rate->bitrate);
 540                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 541                                 NLA_PUT_FLAG(msg,
 542                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 543
 544                         nla_nest_end(msg, nl_rate);
 545                 }
 546
 547                 nla_nest_end(msg, nl_rates);
 548
 549                 nla_nest_end(msg, nl_band);
 550         }
 551         nla_nest_end(msg, nl_bands);
 552
 553         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 554         if (!nl_cmds)
 555                 goto nla_put_failure;
 556
 557         i = 0;
 558 #define CMD(op, n)                                              \
 559          do {                                                   \
 560                 if (dev->ops->op) {                             \
 561                         i++;                                    \
 562                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 563                 }                                               \
 564         } while (0)
 565
 566         CMD(add_virtual_intf, NEW_INTERFACE);
 567         CMD(change_virtual_intf, SET_INTERFACE);
 568         CMD(add_key, NEW_KEY);
 569         CMD(add_beacon, NEW_BEACON);
 570         CMD(add_station, NEW_STATION);
 571         CMD(add_mpath, NEW_MPATH);
 572         CMD(set_mesh_params, SET_MESH_PARAMS);
 573         CMD(change_bss, SET_BSS);
 574         CMD(auth, AUTHENTICATE);
 575         CMD(assoc, ASSOCIATE);
 576         CMD(deauth, DEAUTHENTICATE);
 577         CMD(disassoc, DISASSOCIATE);
 578         CMD(join_ibss, JOIN_IBSS);
 579         CMD(set_pmksa, SET_PMKSA);
 580         CMD(del_pmksa, DEL_PMKSA);
 581         CMD(flush_pmksa, FLUSH_PMKSA);
 582         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 583         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 584         CMD(action, ACTION);
 585         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 586                 i++;
 587                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 588         }
 589
 590 #undef CMD
 591
 592         if (dev->ops->connect || dev->ops->auth) {
 593                 i++;
 594                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 595         }
 596
 597         if (dev->ops->disconnect || dev->ops->deauth) {
 598                 i++;
 599                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 600         }
 601
 602         nla_nest_end(msg, nl_cmds);
 603
 604         return genlmsg_end(msg, hdr);
 605
 606  nla_put_failure:
 607         genlmsg_cancel(msg, hdr);
 608         return -EMSGSIZE;
 609 }
 610
 611 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 612 {
 613         int idx = 0;
 614         int start = cb->args[0];
 615         struct cfg80211_registered_device *dev;
 616
 617         mutex_lock(&cfg80211_mutex);
 618         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 619                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 620                         continue;
 621                 if (++idx <= start)
 622                         continue;
 623                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 624                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 625                                        dev) < 0) {
 626                         idx--;
 627                         break;
 628                 }
 629         }
 630         mutex_unlock(&cfg80211_mutex);
 631
 632         cb->args[0] = idx;
 633
 634         return skb->len;
 635 }
 636
 637 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 638 {
 639         struct sk_buff *msg;
 640         struct cfg80211_registered_device *dev;
 641
 642         dev = cfg80211_get_dev_from_info(info);
 643         if (IS_ERR(dev))
 644                 return PTR_ERR(dev);
 645
 646         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 647         if (!msg)
 648                 goto out_err;
 649
 650         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 651                 goto out_free;
 652
 653         cfg80211_unlock_rdev(dev);
 654
 655         return genlmsg_reply(msg, info);
 656
 657  out_free:
 658         nlmsg_free(msg);
 659  out_err:
 660         cfg80211_unlock_rdev(dev);
 661         return -ENOBUFS;
 662 }
 663
 664 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 665         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 666         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 667         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 668         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 669         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 670 };
 671
 672 static int parse_txq_params(struct nlattr *tb[],
 673                             struct ieee80211_txq_params *txq_params)
 674 {
 675         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 676             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 677             !tb[NL80211_TXQ_ATTR_AIFS])
 678                 return -EINVAL;
 679
 680         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 681         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 682         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 683         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 684         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 685
 686         return 0;
 687 }
 688
 689 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 690 {
 691         struct cfg80211_registered_device *rdev;
 692         int result = 0, rem_txq_params = 0;
 693         struct nlattr *nl_txq_params;
 694         u32 changed;
 695         u8 retry_short = 0, retry_long = 0;
 696         u32 frag_threshold = 0, rts_threshold = 0;
 697         u8 coverage_class = 0;
 698
 699         rtnl_lock();
 700
 701         mutex_lock(&cfg80211_mutex);
 702
 703         rdev = __cfg80211_rdev_from_info(info);
 704         if (IS_ERR(rdev)) {
 705                 mutex_unlock(&cfg80211_mutex);
 706                 result = PTR_ERR(rdev);
 707                 goto unlock;
 708         }
 709
 710         mutex_lock(&rdev->mtx);
 711
 712         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 713                 result = cfg80211_dev_rename(
 714                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 715
 716         mutex_unlock(&cfg80211_mutex);
 717
 718         if (result)
 719                 goto bad_res;
 720
 721         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 722                 struct ieee80211_txq_params txq_params;
 723                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 724
 725                 if (!rdev->ops->set_txq_params) {
 726                         result = -EOPNOTSUPP;
 727                         goto bad_res;
 728                 }
 729
 730                 nla_for_each_nested(nl_txq_params,
 731                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 732                                     rem_txq_params) {
 733                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 734                                   nla_data(nl_txq_params),
 735                                   nla_len(nl_txq_params),
 736                                   txq_params_policy);
 737                         result = parse_txq_params(tb, &txq_params);
 738                         if (result)
 739                                 goto bad_res;
 740
 741                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 742                                                            &txq_params);
 743                         if (result)
 744                                 goto bad_res;
 745                 }
 746         }
 747
 748         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 749                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 750                 u32 freq;
 751
 752                 result = -EINVAL;
 753
 754                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 755                         channel_type = nla_get_u32(info->attrs[
 756                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 757                         if (channel_type != NL80211_CHAN_NO_HT &&
 758                             channel_type != NL80211_CHAN_HT20 &&
 759                             channel_type != NL80211_CHAN_HT40PLUS &&
 760                             channel_type != NL80211_CHAN_HT40MINUS)
 761                                 goto bad_res;
 762                 }
 763
 764                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 765
 766                 mutex_lock(&rdev->devlist_mtx);
 767                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 768                 mutex_unlock(&rdev->devlist_mtx);
 769                 if (result)
 770                         goto bad_res;
 771         }
 772
 773         changed = 0;
 774
 775         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 776                 retry_short = nla_get_u8(
 777                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 778                 if (retry_short == 0) {
 779                         result = -EINVAL;
 780                         goto bad_res;
 781                 }
 782                 changed |= WIPHY_PARAM_RETRY_SHORT;
 783         }
 784
 785         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 786                 retry_long = nla_get_u8(
 787                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 788                 if (retry_long == 0) {
 789                         result = -EINVAL;
 790                         goto bad_res;
 791                 }
 792                 changed |= WIPHY_PARAM_RETRY_LONG;
 793         }
 794
 795         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 796                 frag_threshold = nla_get_u32(
 797                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 798                 if (frag_threshold < 256) {
 799                         result = -EINVAL;
 800                         goto bad_res;
 801                 }
 802                 if (frag_threshold != (u32) -1) {
 803                         /*
 804                          * Fragments (apart from the last one) are required to
 805                          * have even length. Make the fragmentation code
 806                          * simpler by stripping LSB should someone try to use
 807                          * odd threshold value.
 808                          */
 809                         frag_threshold &= ~0x1;
 810                 }
 811                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 812         }
 813
 814         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 815                 rts_threshold = nla_get_u32(
 816                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 817                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 818         }
 819
 820         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 821                 coverage_class = nla_get_u8(
 822                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 823                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 824         }
 825
 826         if (changed) {
 827                 u8 old_retry_short, old_retry_long;
 828                 u32 old_frag_threshold, old_rts_threshold;
 829                 u8 old_coverage_class;
 830
 831                 if (!rdev->ops->set_wiphy_params) {
 832                         result = -EOPNOTSUPP;
 833                         goto bad_res;
 834                 }
 835
 836                 old_retry_short = rdev->wiphy.retry_short;
 837                 old_retry_long = rdev->wiphy.retry_long;
 838                 old_frag_threshold = rdev->wiphy.frag_threshold;
 839                 old_rts_threshold = rdev->wiphy.rts_threshold;
 840                 old_coverage_class = rdev->wiphy.coverage_class;
 841
 842                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 843                         rdev->wiphy.retry_short = retry_short;
 844                 if (changed & WIPHY_PARAM_RETRY_LONG)
 845                         rdev->wiphy.retry_long = retry_long;
 846                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 847                         rdev->wiphy.frag_threshold = frag_threshold;
 848                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 849                         rdev->wiphy.rts_threshold = rts_threshold;
 850                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 851                         rdev->wiphy.coverage_class = coverage_class;
 852
 853                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 854                 if (result) {
 855                         rdev->wiphy.retry_short = old_retry_short;
 856                         rdev->wiphy.retry_long = old_retry_long;
 857                         rdev->wiphy.frag_threshold = old_frag_threshold;
 858                         rdev->wiphy.rts_threshold = old_rts_threshold;
 859                         rdev->wiphy.coverage_class = old_coverage_class;
 860                 }
 861         }
 862
 863  bad_res:
 864         mutex_unlock(&rdev->mtx);
 865  unlock:
 866         rtnl_unlock();
 867         return result;
 868 }
 869
 870
 871 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 872                               struct cfg80211_registered_device *rdev,
 873                               struct net_device *dev)
 874 {
 875         void *hdr;
 876
 877         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 878         if (!hdr)
 879                 return -1;
 880
 881         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 882         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 883         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 884         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 885
 886         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 887                     rdev->devlist_generation ^
 888                         (cfg80211_rdev_list_generation << 2));
 889
 890         return genlmsg_end(msg, hdr);
 891
 892  nla_put_failure:
 893         genlmsg_cancel(msg, hdr);
 894         return -EMSGSIZE;
 895 }
 896
 897 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 898 {
 899         int wp_idx = 0;
 900         int if_idx = 0;
 901         int wp_start = cb->args[0];
 902         int if_start = cb->args[1];
 903         struct cfg80211_registered_device *rdev;
 904         struct wireless_dev *wdev;
 905
 906         mutex_lock(&cfg80211_mutex);
 907         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 908                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 909                         continue;
 910                 if (wp_idx < wp_start) {
 911                         wp_idx++;
 912                         continue;
 913                 }
 914                 if_idx = 0;
 915
 916                 mutex_lock(&rdev->devlist_mtx);
 917                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 918                         if (if_idx < if_start) {
 919                                 if_idx++;
 920                                 continue;
 921                         }
 922                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 923                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 924                                                rdev, wdev->netdev) < 0) {
 925                                 mutex_unlock(&rdev->devlist_mtx);
 926                                 goto out;
 927                         }
 928                         if_idx++;
 929                 }
 930                 mutex_unlock(&rdev->devlist_mtx);
 931
 932                 wp_idx++;
 933         }
 934  out:
 935         mutex_unlock(&cfg80211_mutex);
 936
 937         cb->args[0] = wp_idx;
 938         cb->args[1] = if_idx;
 939
 940         return skb->len;
 941 }
 942
 943 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 944 {
 945         struct sk_buff *msg;
 946         struct cfg80211_registered_device *dev;
 947         struct net_device *netdev;
 948         int err;
 949
 950         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 951         if (err)
 952                 return err;
 953
 954         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 955         if (!msg)
 956                 goto out_err;
 957
 958         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 959                                dev, netdev) < 0)
 960                 goto out_free;
 961
 962         dev_put(netdev);
 963         cfg80211_unlock_rdev(dev);
 964
 965         return genlmsg_reply(msg, info);
 966
 967  out_free:
 968         nlmsg_free(msg);
 969  out_err:
 970         dev_put(netdev);
 971         cfg80211_unlock_rdev(dev);
 972         return -ENOBUFS;
 973 }
 974
 975 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 976         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 977         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 978         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 979         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 980         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 981 };
 982
 983 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 984 {
 985         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 986         int flag;
 987
 988         *mntrflags = 0;
 989
 990         if (!nla)
 991                 return -EINVAL;
 992
 993         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 994                              nla, mntr_flags_policy))
 995                 return -EINVAL;
 996
 997         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 998                 if (flags[flag])
 999                         *mntrflags |= (1<<flag);
1000
1001         return 0;
1002 }
1003
1004 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1005                                struct net_device *netdev, u8 use_4addr,
1006                                enum nl80211_iftype iftype)
1007 {
1008         if (!use_4addr) {
1009                 if (netdev && netdev->br_port)
1010                         return -EBUSY;
1011                 return 0;
1012         }
1013
1014         switch (iftype) {
1015         case NL80211_IFTYPE_AP_VLAN:
1016                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1017                         return 0;
1018                 break;
1019         case NL80211_IFTYPE_STATION:
1020                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1021                         return 0;
1022                 break;
1023         default:
1024                 break;
1025         }
1026
1027         return -EOPNOTSUPP;
1028 }
1029
1030 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1031 {
1032         struct cfg80211_registered_device *rdev;
1033         struct vif_params params;
1034         int err;
1035         enum nl80211_iftype otype, ntype;
1036         struct net_device *dev;
1037         u32 _flags, *flags = NULL;
1038         bool change = false;
1039
1040         memset(&params, 0, sizeof(params));
1041
1042         rtnl_lock();
1043
1044         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1045         if (err)
1046                 goto unlock_rtnl;
1047
1048         otype = ntype = dev->ieee80211_ptr->iftype;
1049
1050         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1051                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1052                 if (otype != ntype)
1053                         change = true;
1054                 if (ntype > NL80211_IFTYPE_MAX) {
1055                         err = -EINVAL;
1056                         goto unlock;
1057                 }
1058         }
1059
1060         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1061                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1062                         err = -EINVAL;
1063                         goto unlock;
1064                 }
1065                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1066                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1067                 change = true;
1068         }
1069
1070         if (info->attrs[NL80211_ATTR_4ADDR]) {
1071                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1072                 change = true;
1073                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1074                 if (err)
1075                         goto unlock;
1076         } else {
1077                 params.use_4addr = -1;
1078         }
1079
1080         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1081                 if (ntype != NL80211_IFTYPE_MONITOR) {
1082                         err = -EINVAL;
1083                         goto unlock;
1084                 }
1085                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1086                                           &_flags);
1087                 if (err)
1088                         goto unlock;
1089
1090                 flags = &_flags;
1091                 change = true;
1092         }
1093
1094         if (change)
1095                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1096         else
1097                 err = 0;
1098
1099         if (!err && params.use_4addr != -1)
1100                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1101
1102  unlock:
1103         dev_put(dev);
1104         cfg80211_unlock_rdev(rdev);
1105  unlock_rtnl:
1106         rtnl_unlock();
1107         return err;
1108 }
1109
1110 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1111 {
1112         struct cfg80211_registered_device *rdev;
1113         struct vif_params params;
1114         int err;
1115         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1116         u32 flags;
1117
1118         memset(&params, 0, sizeof(params));
1119
1120         if (!info->attrs[NL80211_ATTR_IFNAME])
1121                 return -EINVAL;
1122
1123         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1124                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1125                 if (type > NL80211_IFTYPE_MAX)
1126                         return -EINVAL;
1127         }
1128
1129         rtnl_lock();
1130
1131         rdev = cfg80211_get_dev_from_info(info);
1132         if (IS_ERR(rdev)) {
1133                 err = PTR_ERR(rdev);
1134                 goto unlock_rtnl;
1135         }
1136
1137         if (!rdev->ops->add_virtual_intf ||
1138             !(rdev->wiphy.interface_modes & (1 << type))) {
1139                 err = -EOPNOTSUPP;
1140                 goto unlock;
1141         }
1142
1143         if (type == NL80211_IFTYPE_MESH_POINT &&
1144             info->attrs[NL80211_ATTR_MESH_ID]) {
1145                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1146                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1147         }
1148
1149         if (info->attrs[NL80211_ATTR_4ADDR]) {
1150                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1151                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1152                 if (err)
1153                         goto unlock;
1154         }
1155
1156         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1157                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1158                                   &flags);
1159         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1160                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1161                 type, err ? NULL : &flags, &params);
1162
1163  unlock:
1164         cfg80211_unlock_rdev(rdev);
1165  unlock_rtnl:
1166         rtnl_unlock();
1167         return err;
1168 }
1169
1170 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1171 {
1172         struct cfg80211_registered_device *rdev;
1173         int err;
1174         struct net_device *dev;
1175
1176         rtnl_lock();
1177
1178         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1179         if (err)
1180                 goto unlock_rtnl;
1181
1182         if (!rdev->ops->del_virtual_intf) {
1183                 err = -EOPNOTSUPP;
1184                 goto out;
1185         }
1186
1187         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1188
1189  out:
1190         cfg80211_unlock_rdev(rdev);
1191         dev_put(dev);
1192  unlock_rtnl:
1193         rtnl_unlock();
1194         return err;
1195 }
1196
1197 struct get_key_cookie {
1198         struct sk_buff *msg;
1199         int error;
1200         int idx;
1201 };
1202
1203 static void get_key_callback(void *c, struct key_params *params)
1204 {
1205         struct nlattr *key;
1206         struct get_key_cookie *cookie = c;
1207
1208         if (params->key)
1209                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1210                         params->key_len, params->key);
1211
1212         if (params->seq)
1213                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1214                         params->seq_len, params->seq);
1215
1216         if (params->cipher)
1217                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1218                             params->cipher);
1219
1220         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1221         if (!key)
1222                 goto nla_put_failure;
1223
1224         if (params->key)
1225                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1226                         params->key_len, params->key);
1227
1228         if (params->seq)
1229                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1230                         params->seq_len, params->seq);
1231
1232         if (params->cipher)
1233                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1234                             params->cipher);
1235
1236         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1237
1238         nla_nest_end(cookie->msg, key);
1239
1240         return;
1241  nla_put_failure:
1242         cookie->error = 1;
1243 }
1244
1245 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1246 {
1247         struct cfg80211_registered_device *rdev;
1248         int err;
1249         struct net_device *dev;
1250         u8 key_idx = 0;
1251         u8 *mac_addr = NULL;
1252         struct get_key_cookie cookie = {
1253                 .error = 0,
1254         };
1255         void *hdr;
1256         struct sk_buff *msg;
1257
1258         if (info->attrs[NL80211_ATTR_KEY_IDX])
1259                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1260
1261         if (key_idx > 5)
1262                 return -EINVAL;
1263
1264         if (info->attrs[NL80211_ATTR_MAC])
1265                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1266
1267         rtnl_lock();
1268
1269         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1270         if (err)
1271                 goto unlock_rtnl;
1272
1273         if (!rdev->ops->get_key) {
1274                 err = -EOPNOTSUPP;
1275                 goto out;
1276         }
1277
1278         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1279         if (!msg) {
1280                 err = -ENOMEM;
1281                 goto out;
1282         }
1283
1284         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1285                              NL80211_CMD_NEW_KEY);
1286
1287         if (IS_ERR(hdr)) {
1288                 err = PTR_ERR(hdr);
1289                 goto free_msg;
1290         }
1291
1292         cookie.msg = msg;
1293         cookie.idx = key_idx;
1294
1295         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1296         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1297         if (mac_addr)
1298                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1299
1300         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1301                                 &cookie, get_key_callback);
1302
1303         if (err)
1304                 goto free_msg;
1305
1306         if (cookie.error)
1307                 goto nla_put_failure;
1308
1309         genlmsg_end(msg, hdr);
1310         err = genlmsg_reply(msg, info);
1311         goto out;
1312
1313  nla_put_failure:
1314         err = -ENOBUFS;
1315  free_msg:
1316         nlmsg_free(msg);
1317  out:
1318         cfg80211_unlock_rdev(rdev);
1319         dev_put(dev);
1320  unlock_rtnl:
1321         rtnl_unlock();
1322
1323         return err;
1324 }
1325
1326 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1327 {
1328         struct cfg80211_registered_device *rdev;
1329         struct key_parse key;
1330         int err;
1331         struct net_device *dev;
1332         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1333                     u8 key_index);
1334
1335         err = nl80211_parse_key(info, &key);
1336         if (err)
1337                 return err;
1338
1339         if (key.idx < 0)
1340                 return -EINVAL;
1341
1342         /* only support setting default key */
1343         if (!key.def && !key.defmgmt)
1344                 return -EINVAL;
1345
1346         rtnl_lock();
1347
1348         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1349         if (err)
1350                 goto unlock_rtnl;
1351
1352         if (key.def)
1353                 func = rdev->ops->set_default_key;
1354         else
1355                 func = rdev->ops->set_default_mgmt_key;
1356
1357         if (!func) {
1358                 err = -EOPNOTSUPP;
1359                 goto out;
1360         }
1361
1362         wdev_lock(dev->ieee80211_ptr);
1363         err = nl80211_key_allowed(dev->ieee80211_ptr);
1364         if (!err)
1365                 err = func(&rdev->wiphy, dev, key.idx);
1366
1367 #ifdef CONFIG_CFG80211_WEXT
1368         if (!err) {
1369                 if (func == rdev->ops->set_default_key)
1370                         dev->ieee80211_ptr->wext.default_key = key.idx;
1371                 else
1372                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1373         }
1374 #endif
1375         wdev_unlock(dev->ieee80211_ptr);
1376
1377  out:
1378         cfg80211_unlock_rdev(rdev);
1379         dev_put(dev);
1380
1381  unlock_rtnl:
1382         rtnl_unlock();
1383
1384         return err;
1385 }
1386
1387 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1388 {
1389         struct cfg80211_registered_device *rdev;
1390         int err;
1391         struct net_device *dev;
1392         struct key_parse key;
1393         u8 *mac_addr = NULL;
1394
1395         err = nl80211_parse_key(info, &key);
1396         if (err)
1397                 return err;
1398
1399         if (!key.p.key)
1400                 return -EINVAL;
1401
1402         if (info->attrs[NL80211_ATTR_MAC])
1403                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1404
1405         rtnl_lock();
1406
1407         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1408         if (err)
1409                 goto unlock_rtnl;
1410
1411         if (!rdev->ops->add_key) {
1412                 err = -EOPNOTSUPP;
1413                 goto out;
1414         }
1415
1416         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1417                 err = -EINVAL;
1418                 goto out;
1419         }
1420
1421         wdev_lock(dev->ieee80211_ptr);
1422         err = nl80211_key_allowed(dev->ieee80211_ptr);
1423         if (!err)
1424                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1425                                          mac_addr, &key.p);
1426         wdev_unlock(dev->ieee80211_ptr);
1427
1428  out:
1429         cfg80211_unlock_rdev(rdev);
1430         dev_put(dev);
1431  unlock_rtnl:
1432         rtnl_unlock();
1433
1434         return err;
1435 }
1436
1437 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1438 {
1439         struct cfg80211_registered_device *rdev;
1440         int err;
1441         struct net_device *dev;
1442         u8 *mac_addr = NULL;
1443         struct key_parse key;
1444
1445         err = nl80211_parse_key(info, &key);
1446         if (err)
1447                 return err;
1448
1449         if (info->attrs[NL80211_ATTR_MAC])
1450                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1451
1452         rtnl_lock();
1453
1454         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1455         if (err)
1456                 goto unlock_rtnl;
1457
1458         if (!rdev->ops->del_key) {
1459                 err = -EOPNOTSUPP;
1460                 goto out;
1461         }
1462
1463         wdev_lock(dev->ieee80211_ptr);
1464         err = nl80211_key_allowed(dev->ieee80211_ptr);
1465         if (!err)
1466                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1467
1468 #ifdef CONFIG_CFG80211_WEXT
1469         if (!err) {
1470                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1471                         dev->ieee80211_ptr->wext.default_key = -1;
1472                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1473                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1474         }
1475 #endif
1476         wdev_unlock(dev->ieee80211_ptr);
1477
1478  out:
1479         cfg80211_unlock_rdev(rdev);
1480         dev_put(dev);
1481
1482  unlock_rtnl:
1483         rtnl_unlock();
1484
1485         return err;
1486 }
1487
1488 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1489 {
1490         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1491                     struct beacon_parameters *info);
1492         struct cfg80211_registered_device *rdev;
1493         int err;
1494         struct net_device *dev;
1495         struct beacon_parameters params;
1496         int haveinfo = 0;
1497
1498         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1499                 return -EINVAL;
1500
1501         rtnl_lock();
1502
1503         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1504         if (err)
1505                 goto unlock_rtnl;
1506
1507         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1508                 err = -EOPNOTSUPP;
1509                 goto out;
1510         }
1511
1512         switch (info->genlhdr->cmd) {
1513         case NL80211_CMD_NEW_BEACON:
1514                 /* these are required for NEW_BEACON */
1515                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1516                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1517                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1518                         err = -EINVAL;
1519                         goto out;
1520                 }
1521
1522                 call = rdev->ops->add_beacon;
1523                 break;
1524         case NL80211_CMD_SET_BEACON:
1525                 call = rdev->ops->set_beacon;
1526                 break;
1527         default:
1528                 WARN_ON(1);
1529                 err = -EOPNOTSUPP;
1530                 goto out;
1531         }
1532
1533         if (!call) {
1534                 err = -EOPNOTSUPP;
1535                 goto out;
1536         }
1537
1538         memset(&params, 0, sizeof(params));
1539
1540         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1541                 params.interval =
1542                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1543                 haveinfo = 1;
1544         }
1545
1546         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1547                 params.dtim_period =
1548                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1549                 haveinfo = 1;
1550         }
1551
1552         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1553                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1554                 params.head_len =
1555                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1556                 haveinfo = 1;
1557         }
1558
1559         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1560                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1561                 params.tail_len =
1562                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1563                 haveinfo = 1;
1564         }
1565
1566         if (!haveinfo) {
1567                 err = -EINVAL;
1568                 goto out;
1569         }
1570
1571         err = call(&rdev->wiphy, dev, &params);
1572
1573  out:
1574         cfg80211_unlock_rdev(rdev);
1575         dev_put(dev);
1576  unlock_rtnl:
1577         rtnl_unlock();
1578
1579         return err;
1580 }
1581
1582 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1583 {
1584         struct cfg80211_registered_device *rdev;
1585         int err;
1586         struct net_device *dev;
1587
1588         rtnl_lock();
1589
1590         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1591         if (err)
1592                 goto unlock_rtnl;
1593
1594         if (!rdev->ops->del_beacon) {
1595                 err = -EOPNOTSUPP;
1596                 goto out;
1597         }
1598
1599         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1600                 err = -EOPNOTSUPP;
1601                 goto out;
1602         }
1603         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1604
1605  out:
1606         cfg80211_unlock_rdev(rdev);
1607         dev_put(dev);
1608  unlock_rtnl:
1609         rtnl_unlock();
1610
1611         return err;
1612 }
1613
1614 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1615         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1616         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1617         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1618         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1619 };
1620
1621 static int parse_station_flags(struct genl_info *info,
1622                                struct station_parameters *params)
1623 {
1624         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1625         struct nlattr *nla;
1626         int flag;
1627
1628         /*
1629          * Try parsing the new attribute first so userspace
1630          * can specify both for older kernels.
1631          */
1632         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1633         if (nla) {
1634                 struct nl80211_sta_flag_update *sta_flags;
1635
1636                 sta_flags = nla_data(nla);
1637                 params->sta_flags_mask = sta_flags->mask;
1638                 params->sta_flags_set = sta_flags->set;
1639                 if ((params->sta_flags_mask |
1640                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1641                         return -EINVAL;
1642                 return 0;
1643         }
1644
1645         /* if present, parse the old attribute */
1646
1647         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1648         if (!nla)
1649                 return 0;
1650
1651         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1652                              nla, sta_flags_policy))
1653                 return -EINVAL;
1654
1655         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1656         params->sta_flags_mask &= ~1;
1657
1658         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1659                 if (flags[flag])
1660                         params->sta_flags_set |= (1<<flag);
1661
1662         return 0;
1663 }
1664
1665 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1666                                 int flags, struct net_device *dev,
1667                                 const u8 *mac_addr, struct station_info *sinfo)
1668 {
1669         void *hdr;
1670         struct nlattr *sinfoattr, *txrate;
1671         u16 bitrate;
1672
1673         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1674         if (!hdr)
1675                 return -1;
1676
1677         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1678         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1679
1680         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1681
1682         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1683         if (!sinfoattr)
1684                 goto nla_put_failure;
1685         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1686                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1687                             sinfo->inactive_time);
1688         if (sinfo->filled & STATION_INFO_RX_BYTES)
1689                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1690                             sinfo->rx_bytes);
1691         if (sinfo->filled & STATION_INFO_TX_BYTES)
1692                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1693                             sinfo->tx_bytes);
1694         if (sinfo->filled & STATION_INFO_LLID)
1695                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1696                             sinfo->llid);
1697         if (sinfo->filled & STATION_INFO_PLID)
1698                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1699                             sinfo->plid);
1700         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1701                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1702                             sinfo->plink_state);
1703         if (sinfo->filled & STATION_INFO_SIGNAL)
1704                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1705                            sinfo->signal);
1706         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1707                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1708                 if (!txrate)
1709                         goto nla_put_failure;
1710
1711                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1712                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1713                 if (bitrate > 0)
1714                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1715
1716                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1717                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1718                                     sinfo->txrate.mcs);
1719                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1720                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1721                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1722                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1723
1724                 nla_nest_end(msg, txrate);
1725         }
1726         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1727                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1728                             sinfo->rx_packets);
1729         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1730                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1731                             sinfo->tx_packets);
1732         nla_nest_end(msg, sinfoattr);
1733
1734         return genlmsg_end(msg, hdr);
1735
1736  nla_put_failure:
1737         genlmsg_cancel(msg, hdr);
1738         return -EMSGSIZE;
1739 }
1740
1741 static int nl80211_dump_station(struct sk_buff *skb,
1742                                 struct netlink_callback *cb)
1743 {
1744         struct station_info sinfo;
1745         struct cfg80211_registered_device *dev;
1746         struct net_device *netdev;
1747         u8 mac_addr[ETH_ALEN];
1748         int ifidx = cb->args[0];
1749         int sta_idx = cb->args[1];
1750         int err;
1751
1752         if (!ifidx)
1753                 ifidx = nl80211_get_ifidx(cb);
1754         if (ifidx < 0)
1755                 return ifidx;
1756
1757         rtnl_lock();
1758
1759         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1760         if (!netdev) {
1761                 err = -ENODEV;
1762                 goto out_rtnl;
1763         }
1764
1765         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1766         if (IS_ERR(dev)) {
1767                 err = PTR_ERR(dev);
1768                 goto out_rtnl;
1769         }
1770
1771         if (!dev->ops->dump_station) {
1772                 err = -EOPNOTSUPP;
1773                 goto out_err;
1774         }
1775
1776         while (1) {
1777                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1778                                              mac_addr, &sinfo);
1779                 if (err == -ENOENT)
1780                         break;
1781                 if (err)
1782                         goto out_err;
1783
1784                 if (nl80211_send_station(skb,
1785                                 NETLINK_CB(cb->skb).pid,
1786                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1787                                 netdev, mac_addr,
1788                                 &sinfo) < 0)
1789                         goto out;
1790
1791                 sta_idx++;
1792         }
1793
1794
1795  out:
1796         cb->args[1] = sta_idx;
1797         err = skb->len;
1798  out_err:
1799         cfg80211_unlock_rdev(dev);
1800  out_rtnl:
1801         rtnl_unlock();
1802
1803         return err;
1804 }
1805
1806 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1807 {
1808         struct cfg80211_registered_device *rdev;
1809         int err;
1810         struct net_device *dev;
1811         struct station_info sinfo;
1812         struct sk_buff *msg;
1813         u8 *mac_addr = NULL;
1814
1815         memset(&sinfo, 0, sizeof(sinfo));
1816
1817         if (!info->attrs[NL80211_ATTR_MAC])
1818                 return -EINVAL;
1819
1820         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1821
1822         rtnl_lock();
1823
1824         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1825         if (err)
1826                 goto out_rtnl;
1827
1828         if (!rdev->ops->get_station) {
1829                 err = -EOPNOTSUPP;
1830                 goto out;
1831         }
1832
1833         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1834         if (err)
1835                 goto out;
1836
1837         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1838         if (!msg)
1839                 goto out;
1840
1841         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1842                                  dev, mac_addr, &sinfo) < 0)
1843                 goto out_free;
1844
1845         err = genlmsg_reply(msg, info);
1846         goto out;
1847
1848  out_free:
1849         nlmsg_free(msg);
1850  out:
1851         cfg80211_unlock_rdev(rdev);
1852         dev_put(dev);
1853  out_rtnl:
1854         rtnl_unlock();
1855
1856         return err;
1857 }
1858
1859 /*
1860  * Get vlan interface making sure it is running and on the right wiphy.
1861  */
1862 static int get_vlan(struct genl_info *info,
1863                     struct cfg80211_registered_device *rdev,
1864                     struct net_device **vlan)
1865 {
1866         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1867         *vlan = NULL;
1868
1869         if (vlanattr) {
1870                 *vlan = dev_get_by_index(genl_info_net(info),
1871                                          nla_get_u32(vlanattr));
1872                 if (!*vlan)
1873                         return -ENODEV;
1874                 if (!(*vlan)->ieee80211_ptr)
1875                         return -EINVAL;
1876                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1877                         return -EINVAL;
1878                 if (!netif_running(*vlan))
1879                         return -ENETDOWN;
1880         }
1881         return 0;
1882 }
1883
1884 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1885 {
1886         struct cfg80211_registered_device *rdev;
1887         int err;
1888         struct net_device *dev;
1889         struct station_parameters params;
1890         u8 *mac_addr = NULL;
1891
1892         memset(&params, 0, sizeof(params));
1893
1894         params.listen_interval = -1;
1895
1896         if (info->attrs[NL80211_ATTR_STA_AID])
1897                 return -EINVAL;
1898
1899         if (!info->attrs[NL80211_ATTR_MAC])
1900                 return -EINVAL;
1901
1902         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1903
1904         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1905                 params.supported_rates =
1906                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1907                 params.supported_rates_len =
1908                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1909         }
1910
1911         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1912                 params.listen_interval =
1913                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1914
1915         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1916                 params.ht_capa =
1917                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1918
1919         if (parse_station_flags(info, &params))
1920                 return -EINVAL;
1921
1922         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1923                 params.plink_action =
1924                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1925
1926         rtnl_lock();
1927
1928         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1929         if (err)
1930                 goto out_rtnl;
1931
1932         err = get_vlan(info, rdev, &params.vlan);
1933         if (err)
1934                 goto out;
1935
1936         /* validate settings */
1937         err = 0;
1938
1939         switch (dev->ieee80211_ptr->iftype) {
1940         case NL80211_IFTYPE_AP:
1941         case NL80211_IFTYPE_AP_VLAN:
1942                 /* disallow mesh-specific things */
1943                 if (params.plink_action)
1944                         err = -EINVAL;
1945                 break;
1946         case NL80211_IFTYPE_STATION:
1947                 /* disallow everything but AUTHORIZED flag */
1948                 if (params.plink_action)
1949                         err = -EINVAL;
1950                 if (params.vlan)
1951                         err = -EINVAL;
1952                 if (params.supported_rates)
1953                         err = -EINVAL;
1954                 if (params.ht_capa)
1955                         err = -EINVAL;
1956                 if (params.listen_interval >= 0)
1957                         err = -EINVAL;
1958                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1959                         err = -EINVAL;
1960                 break;
1961         case NL80211_IFTYPE_MESH_POINT:
1962                 /* disallow things mesh doesn't support */
1963                 if (params.vlan)
1964                         err = -EINVAL;
1965                 if (params.ht_capa)
1966                         err = -EINVAL;
1967                 if (params.listen_interval >= 0)
1968                         err = -EINVAL;
1969                 if (params.supported_rates)
1970                         err = -EINVAL;
1971                 if (params.sta_flags_mask)
1972                         err = -EINVAL;
1973                 break;
1974         default:
1975                 err = -EINVAL;
1976         }
1977
1978         if (err)
1979                 goto out;
1980
1981         if (!rdev->ops->change_station) {
1982                 err = -EOPNOTSUPP;
1983                 goto out;
1984         }
1985
1986         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1987
1988  out:
1989         if (params.vlan)
1990                 dev_put(params.vlan);
1991         cfg80211_unlock_rdev(rdev);
1992         dev_put(dev);
1993  out_rtnl:
1994         rtnl_unlock();
1995
1996         return err;
1997 }
1998
1999 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2000 {
2001         struct cfg80211_registered_device *rdev;
2002         int err;
2003         struct net_device *dev;
2004         struct station_parameters params;
2005         u8 *mac_addr = NULL;
2006
2007         memset(&params, 0, sizeof(params));
2008
2009         if (!info->attrs[NL80211_ATTR_MAC])
2010                 return -EINVAL;
2011
2012         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2013                 return -EINVAL;
2014
2015         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2016                 return -EINVAL;
2017
2018         if (!info->attrs[NL80211_ATTR_STA_AID])
2019                 return -EINVAL;
2020
2021         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2022         params.supported_rates =
2023                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2024         params.supported_rates_len =
2025                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2026         params.listen_interval =
2027                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2028
2029         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2030         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2031                 return -EINVAL;
2032
2033         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2034                 params.ht_capa =
2035                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2036
2037         if (parse_station_flags(info, &params))
2038                 return -EINVAL;
2039
2040         rtnl_lock();
2041
2042         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2043         if (err)
2044                 goto out_rtnl;
2045
2046         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2047             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2048                 err = -EINVAL;
2049                 goto out;
2050         }
2051
2052         err = get_vlan(info, rdev, &params.vlan);
2053         if (err)
2054                 goto out;
2055
2056         /* validate settings */
2057         err = 0;
2058
2059         if (!rdev->ops->add_station) {
2060                 err = -EOPNOTSUPP;
2061                 goto out;
2062         }
2063
2064         if (!netif_running(dev)) {
2065                 err = -ENETDOWN;
2066                 goto out;
2067         }
2068
2069         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2070
2071  out:
2072         if (params.vlan)
2073                 dev_put(params.vlan);
2074         cfg80211_unlock_rdev(rdev);
2075         dev_put(dev);
2076  out_rtnl:
2077         rtnl_unlock();
2078
2079         return err;
2080 }
2081
2082 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2083 {
2084         struct cfg80211_registered_device *rdev;
2085         int err;
2086         struct net_device *dev;
2087         u8 *mac_addr = NULL;
2088
2089         if (info->attrs[NL80211_ATTR_MAC])
2090                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2091
2092         rtnl_lock();
2093
2094         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2095         if (err)
2096                 goto out_rtnl;
2097
2098         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2099             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2100             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2101                 err = -EINVAL;
2102                 goto out;
2103         }
2104
2105         if (!rdev->ops->del_station) {
2106                 err = -EOPNOTSUPP;
2107                 goto out;
2108         }
2109
2110         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2111
2112  out:
2113         cfg80211_unlock_rdev(rdev);
2114         dev_put(dev);
2115  out_rtnl:
2116         rtnl_unlock();
2117
2118         return err;
2119 }
2120
2121 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2122                                 int flags, struct net_device *dev,
2123                                 u8 *dst, u8 *next_hop,
2124                                 struct mpath_info *pinfo)
2125 {
2126         void *hdr;
2127         struct nlattr *pinfoattr;
2128
2129         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2130         if (!hdr)
2131                 return -1;
2132
2133         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2134         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2135         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2136
2137         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2138
2139         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2140         if (!pinfoattr)
2141                 goto nla_put_failure;
2142         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2143                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2144                             pinfo->frame_qlen);
2145         if (pinfo->filled & MPATH_INFO_SN)
2146                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2147                             pinfo->sn);
2148         if (pinfo->filled & MPATH_INFO_METRIC)
2149                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2150                             pinfo->metric);
2151         if (pinfo->filled & MPATH_INFO_EXPTIME)
2152                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2153                             pinfo->exptime);
2154         if (pinfo->filled & MPATH_INFO_FLAGS)
2155                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2156                             pinfo->flags);
2157         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2158                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2159                             pinfo->discovery_timeout);
2160         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2161                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2162                             pinfo->discovery_retries);
2163
2164         nla_nest_end(msg, pinfoattr);
2165
2166         return genlmsg_end(msg, hdr);
2167
2168  nla_put_failure:
2169         genlmsg_cancel(msg, hdr);
2170         return -EMSGSIZE;
2171 }
2172
2173 static int nl80211_dump_mpath(struct sk_buff *skb,
2174                               struct netlink_callback *cb)
2175 {
2176         struct mpath_info pinfo;
2177         struct cfg80211_registered_device *dev;
2178         struct net_device *netdev;
2179         u8 dst[ETH_ALEN];
2180         u8 next_hop[ETH_ALEN];
2181         int ifidx = cb->args[0];
2182         int path_idx = cb->args[1];
2183         int err;
2184
2185         if (!ifidx)
2186                 ifidx = nl80211_get_ifidx(cb);
2187         if (ifidx < 0)
2188                 return ifidx;
2189
2190         rtnl_lock();
2191
2192         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2193         if (!netdev) {
2194                 err = -ENODEV;
2195                 goto out_rtnl;
2196         }
2197
2198         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2199         if (IS_ERR(dev)) {
2200                 err = PTR_ERR(dev);
2201                 goto out_rtnl;
2202         }
2203
2204         if (!dev->ops->dump_mpath) {
2205                 err = -EOPNOTSUPP;
2206                 goto out_err;
2207         }
2208
2209         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2210                 err = -EOPNOTSUPP;
2211                 goto out_err;
2212         }
2213
2214         while (1) {
2215                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2216                                            dst, next_hop, &pinfo);
2217                 if (err == -ENOENT)
2218                         break;
2219                 if (err)
2220                         goto out_err;
2221
2222                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2223                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2224                                        netdev, dst, next_hop,
2225                                        &pinfo) < 0)
2226                         goto out;
2227
2228                 path_idx++;
2229         }
2230
2231
2232  out:
2233         cb->args[1] = path_idx;
2234         err = skb->len;
2235  out_err:
2236         cfg80211_unlock_rdev(dev);
2237  out_rtnl:
2238         rtnl_unlock();
2239
2240         return err;
2241 }
2242
2243 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2244 {
2245         struct cfg80211_registered_device *rdev;
2246         int err;
2247         struct net_device *dev;
2248         struct mpath_info pinfo;
2249         struct sk_buff *msg;
2250         u8 *dst = NULL;
2251         u8 next_hop[ETH_ALEN];
2252
2253         memset(&pinfo, 0, sizeof(pinfo));
2254
2255         if (!info->attrs[NL80211_ATTR_MAC])
2256                 return -EINVAL;
2257
2258         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2259
2260         rtnl_lock();
2261
2262         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2263         if (err)
2264                 goto out_rtnl;
2265
2266         if (!rdev->ops->get_mpath) {
2267                 err = -EOPNOTSUPP;
2268                 goto out;
2269         }
2270
2271         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2272                 err = -EOPNOTSUPP;
2273                 goto out;
2274         }
2275
2276         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2277         if (err)
2278                 goto out;
2279
2280         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2281         if (!msg)
2282                 goto out;
2283
2284         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2285                                  dev, dst, next_hop, &pinfo) < 0)
2286                 goto out_free;
2287
2288         err = genlmsg_reply(msg, info);
2289         goto out;
2290
2291  out_free:
2292         nlmsg_free(msg);
2293  out:
2294         cfg80211_unlock_rdev(rdev);
2295         dev_put(dev);
2296  out_rtnl:
2297         rtnl_unlock();
2298
2299         return err;
2300 }
2301
2302 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2303 {
2304         struct cfg80211_registered_device *rdev;
2305         int err;
2306         struct net_device *dev;
2307         u8 *dst = NULL;
2308         u8 *next_hop = NULL;
2309
2310         if (!info->attrs[NL80211_ATTR_MAC])
2311                 return -EINVAL;
2312
2313         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2314                 return -EINVAL;
2315
2316         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2317         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2318
2319         rtnl_lock();
2320
2321         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2322         if (err)
2323                 goto out_rtnl;
2324
2325         if (!rdev->ops->change_mpath) {
2326                 err = -EOPNOTSUPP;
2327                 goto out;
2328         }
2329
2330         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2331                 err = -EOPNOTSUPP;
2332                 goto out;
2333         }
2334
2335         if (!netif_running(dev)) {
2336                 err = -ENETDOWN;
2337                 goto out;
2338         }
2339
2340         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2341
2342  out:
2343         cfg80211_unlock_rdev(rdev);
2344         dev_put(dev);
2345  out_rtnl:
2346         rtnl_unlock();
2347
2348         return err;
2349 }
2350 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2351 {
2352         struct cfg80211_registered_device *rdev;
2353         int err;
2354         struct net_device *dev;
2355         u8 *dst = NULL;
2356         u8 *next_hop = NULL;
2357
2358         if (!info->attrs[NL80211_ATTR_MAC])
2359                 return -EINVAL;
2360
2361         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2362                 return -EINVAL;
2363
2364         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2365         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2366
2367         rtnl_lock();
2368
2369         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2370         if (err)
2371                 goto out_rtnl;
2372
2373         if (!rdev->ops->add_mpath) {
2374                 err = -EOPNOTSUPP;
2375                 goto out;
2376         }
2377
2378         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2379                 err = -EOPNOTSUPP;
2380                 goto out;
2381         }
2382
2383         if (!netif_running(dev)) {
2384                 err = -ENETDOWN;
2385                 goto out;
2386         }
2387
2388         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2389
2390  out:
2391         cfg80211_unlock_rdev(rdev);
2392         dev_put(dev);
2393  out_rtnl:
2394         rtnl_unlock();
2395
2396         return err;
2397 }
2398
2399 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2400 {
2401         struct cfg80211_registered_device *rdev;
2402         int err;
2403         struct net_device *dev;
2404         u8 *dst = NULL;
2405
2406         if (info->attrs[NL80211_ATTR_MAC])
2407                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2408
2409         rtnl_lock();
2410
2411         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2412         if (err)
2413                 goto out_rtnl;
2414
2415         if (!rdev->ops->del_mpath) {
2416                 err = -EOPNOTSUPP;
2417                 goto out;
2418         }
2419
2420         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2421
2422  out:
2423         cfg80211_unlock_rdev(rdev);
2424         dev_put(dev);
2425  out_rtnl:
2426         rtnl_unlock();
2427
2428         return err;
2429 }
2430
2431 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2432 {
2433         struct cfg80211_registered_device *rdev;
2434         int err;
2435         struct net_device *dev;
2436         struct bss_parameters params;
2437
2438         memset(&params, 0, sizeof(params));
2439         /* default to not changing parameters */
2440         params.use_cts_prot = -1;
2441         params.use_short_preamble = -1;
2442         params.use_short_slot_time = -1;
2443
2444         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2445                 params.use_cts_prot =
2446                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2447         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2448                 params.use_short_preamble =
2449                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2450         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2451                 params.use_short_slot_time =
2452                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2453         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2454                 params.basic_rates =
2455                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2456                 params.basic_rates_len =
2457                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2458         }
2459
2460         rtnl_lock();
2461
2462         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2463         if (err)
2464                 goto out_rtnl;
2465
2466         if (!rdev->ops->change_bss) {
2467                 err = -EOPNOTSUPP;
2468                 goto out;
2469         }
2470
2471         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2472                 err = -EOPNOTSUPP;
2473                 goto out;
2474         }
2475
2476         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2477
2478  out:
2479         cfg80211_unlock_rdev(rdev);
2480         dev_put(dev);
2481  out_rtnl:
2482         rtnl_unlock();
2483
2484         return err;
2485 }
2486
2487 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2488         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2489         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2490         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2491         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2492         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2493         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2494 };
2495
2496 static int parse_reg_rule(struct nlattr *tb[],
2497         struct ieee80211_reg_rule *reg_rule)
2498 {
2499         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2500         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2501
2502         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2503                 return -EINVAL;
2504         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2505                 return -EINVAL;
2506         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2507                 return -EINVAL;
2508         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2509                 return -EINVAL;
2510         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2511                 return -EINVAL;
2512
2513         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2514
2515         freq_range->start_freq_khz =
2516                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2517         freq_range->end_freq_khz =
2518                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2519         freq_range->max_bandwidth_khz =
2520                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2521
2522         power_rule->max_eirp =
2523                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2524
2525         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2526                 power_rule->max_antenna_gain =
2527                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2528
2529         return 0;
2530 }
2531
2532 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2533 {
2534         int r;
2535         char *data = NULL;
2536
2537         /*
2538          * You should only get this when cfg80211 hasn't yet initialized
2539          * completely when built-in to the kernel right between the time
2540          * window between nl80211_init() and regulatory_init(), if that is
2541          * even possible.
2542          */
2543         mutex_lock(&cfg80211_mutex);
2544         if (unlikely(!cfg80211_regdomain)) {
2545                 mutex_unlock(&cfg80211_mutex);
2546                 return -EINPROGRESS;
2547         }
2548         mutex_unlock(&cfg80211_mutex);
2549
2550         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2551                 return -EINVAL;
2552
2553         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2554
2555         r = regulatory_hint_user(data);
2556
2557         return r;
2558 }
2559
2560 static int nl80211_get_mesh_params(struct sk_buff *skb,
2561         struct genl_info *info)
2562 {
2563         struct cfg80211_registered_device *rdev;
2564         struct mesh_config cur_params;
2565         int err;
2566         struct net_device *dev;
2567         void *hdr;
2568         struct nlattr *pinfoattr;
2569         struct sk_buff *msg;
2570
2571         rtnl_lock();
2572
2573         /* Look up our device */
2574         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2575         if (err)
2576                 goto out_rtnl;
2577
2578         if (!rdev->ops->get_mesh_params) {
2579                 err = -EOPNOTSUPP;
2580                 goto out;
2581         }
2582
2583         /* Get the mesh params */
2584         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2585         if (err)
2586                 goto out;
2587
2588         /* Draw up a netlink message to send back */
2589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2590         if (!msg) {
2591                 err = -ENOBUFS;
2592                 goto out;
2593         }
2594         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2595                              NL80211_CMD_GET_MESH_PARAMS);
2596         if (!hdr)
2597                 goto nla_put_failure;
2598         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2599         if (!pinfoattr)
2600                 goto nla_put_failure;
2601         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2602         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2603                         cur_params.dot11MeshRetryTimeout);
2604         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2605                         cur_params.dot11MeshConfirmTimeout);
2606         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2607                         cur_params.dot11MeshHoldingTimeout);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2609                         cur_params.dot11MeshMaxPeerLinks);
2610         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2611                         cur_params.dot11MeshMaxRetries);
2612         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2613                         cur_params.dot11MeshTTL);
2614         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2615                         cur_params.auto_open_plinks);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2617                         cur_params.dot11MeshHWMPmaxPREQretries);
2618         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2619                         cur_params.path_refresh_time);
2620         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2621                         cur_params.min_discovery_timeout);
2622         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2623                         cur_params.dot11MeshHWMPactivePathTimeout);
2624         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2625                         cur_params.dot11MeshHWMPpreqMinInterval);
2626         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2627                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2628         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2629                         cur_params.dot11MeshHWMPRootMode);
2630         nla_nest_end(msg, pinfoattr);
2631         genlmsg_end(msg, hdr);
2632         err = genlmsg_reply(msg, info);
2633         goto out;
2634
2635  nla_put_failure:
2636         genlmsg_cancel(msg, hdr);
2637         err = -EMSGSIZE;
2638  out:
2639         /* Cleanup */
2640         cfg80211_unlock_rdev(rdev);
2641         dev_put(dev);
2642  out_rtnl:
2643         rtnl_unlock();
2644
2645         return err;
2646 }
2647
2648 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2649 do {\
2650         if (table[attr_num]) {\
2651                 cfg.param = nla_fn(table[attr_num]); \
2652                 mask |= (1 << (attr_num - 1)); \
2653         } \
2654 } while (0);\
2655
2656 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2657         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2658         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2659         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2661         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2662         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2663         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2664
2665         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2666         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2667         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2668         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2669         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2670         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2671 };
2672
2673 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2674 {
2675         int err;
2676         u32 mask;
2677         struct cfg80211_registered_device *rdev;
2678         struct net_device *dev;
2679         struct mesh_config cfg;
2680         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2681         struct nlattr *parent_attr;
2682
2683         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2684         if (!parent_attr)
2685                 return -EINVAL;
2686         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2687                         parent_attr, nl80211_meshconf_params_policy))
2688                 return -EINVAL;
2689
2690         rtnl_lock();
2691
2692         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2693         if (err)
2694                 goto out_rtnl;
2695
2696         if (!rdev->ops->set_mesh_params) {
2697                 err = -EOPNOTSUPP;
2698                 goto out;
2699         }
2700
2701         /* This makes sure that there aren't more than 32 mesh config
2702          * parameters (otherwise our bitfield scheme would not work.) */
2703         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2704
2705         /* Fill in the params struct */
2706         mask = 0;
2707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2708                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2710                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2712                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2714                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2716                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2718                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2720                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2722                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2723                         nla_get_u8);
2724         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2725                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2727                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2728                         nla_get_u16);
2729         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2730                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2731                         nla_get_u32);
2732         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2733                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2734                         nla_get_u16);
2735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2736                         dot11MeshHWMPnetDiameterTraversalTime,
2737                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2738                         nla_get_u16);
2739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2740                         dot11MeshHWMPRootMode, mask,
2741                         NL80211_MESHCONF_HWMP_ROOTMODE,
2742                         nla_get_u8);
2743
2744         /* Apply changes */
2745         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2746
2747  out:
2748         /* cleanup */
2749         cfg80211_unlock_rdev(rdev);
2750         dev_put(dev);
2751  out_rtnl:
2752         rtnl_unlock();
2753
2754         return err;
2755 }
2756
2757 #undef FILL_IN_MESH_PARAM_IF_SET
2758
2759 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2760 {
2761         struct sk_buff *msg;
2762         void *hdr = NULL;
2763         struct nlattr *nl_reg_rules;
2764         unsigned int i;
2765         int err = -EINVAL;
2766
2767         mutex_lock(&cfg80211_mutex);
2768
2769         if (!cfg80211_regdomain)
2770                 goto out;
2771
2772         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2773         if (!msg) {
2774                 err = -ENOBUFS;
2775                 goto out;
2776         }
2777
2778         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2779                              NL80211_CMD_GET_REG);
2780         if (!hdr)
2781                 goto nla_put_failure;
2782
2783         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2784                 cfg80211_regdomain->alpha2);
2785
2786         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2787         if (!nl_reg_rules)
2788                 goto nla_put_failure;
2789
2790         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2791                 struct nlattr *nl_reg_rule;
2792                 const struct ieee80211_reg_rule *reg_rule;
2793                 const struct ieee80211_freq_range *freq_range;
2794                 const struct ieee80211_power_rule *power_rule;
2795
2796                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2797                 freq_range = &reg_rule->freq_range;
2798                 power_rule = &reg_rule->power_rule;
2799
2800                 nl_reg_rule = nla_nest_start(msg, i);
2801                 if (!nl_reg_rule)
2802                         goto nla_put_failure;
2803
2804                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2805                         reg_rule->flags);
2806                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2807                         freq_range->start_freq_khz);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2809                         freq_range->end_freq_khz);
2810                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2811                         freq_range->max_bandwidth_khz);
2812                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2813                         power_rule->max_antenna_gain);
2814                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2815                         power_rule->max_eirp);
2816
2817                 nla_nest_end(msg, nl_reg_rule);
2818         }
2819
2820         nla_nest_end(msg, nl_reg_rules);
2821
2822         genlmsg_end(msg, hdr);
2823         err = genlmsg_reply(msg, info);
2824         goto out;
2825
2826 nla_put_failure:
2827         genlmsg_cancel(msg, hdr);
2828         err = -EMSGSIZE;
2829 out:
2830         mutex_unlock(&cfg80211_mutex);
2831         return err;
2832 }
2833
2834 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2835 {
2836         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2837         struct nlattr *nl_reg_rule;
2838         char *alpha2 = NULL;
2839         int rem_reg_rules = 0, r = 0;
2840         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2841         struct ieee80211_regdomain *rd = NULL;
2842
2843         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2844                 return -EINVAL;
2845
2846         if (!info->attrs[NL80211_ATTR_REG_RULES])
2847                 return -EINVAL;
2848
2849         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2850
2851         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2852                         rem_reg_rules) {
2853                 num_rules++;
2854                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2855                         return -EINVAL;
2856         }
2857
2858         mutex_lock(&cfg80211_mutex);
2859
2860         if (!reg_is_valid_request(alpha2)) {
2861                 r = -EINVAL;
2862                 goto bad_reg;
2863         }
2864
2865         size_of_regd = sizeof(struct ieee80211_regdomain) +
2866                 (num_rules * sizeof(struct ieee80211_reg_rule));
2867
2868         rd = kzalloc(size_of_regd, GFP_KERNEL);
2869         if (!rd) {
2870                 r = -ENOMEM;
2871                 goto bad_reg;
2872         }
2873
2874         rd->n_reg_rules = num_rules;
2875         rd->alpha2[0] = alpha2[0];
2876         rd->alpha2[1] = alpha2[1];
2877
2878         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2879                         rem_reg_rules) {
2880                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2881                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2882                         reg_rule_policy);
2883                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2884                 if (r)
2885                         goto bad_reg;
2886
2887                 rule_idx++;
2888
2889                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2890                         r = -EINVAL;
2891                         goto bad_reg;
2892                 }
2893         }
2894
2895         BUG_ON(rule_idx != num_rules);
2896
2897         r = set_regdom(rd);
2898
2899         mutex_unlock(&cfg80211_mutex);
2900
2901         return r;
2902
2903  bad_reg:
2904         mutex_unlock(&cfg80211_mutex);
2905         kfree(rd);
2906         return r;
2907 }
2908
2909 static int validate_scan_freqs(struct nlattr *freqs)
2910 {
2911         struct nlattr *attr1, *attr2;
2912         int n_channels = 0, tmp1, tmp2;
2913
2914         nla_for_each_nested(attr1, freqs, tmp1) {
2915                 n_channels++;
2916                 /*
2917                  * Some hardware has a limited channel list for
2918                  * scanning, and it is pretty much nonsensical
2919                  * to scan for a channel twice, so disallow that
2920                  * and don't require drivers to check that the
2921                  * channel list they get isn't longer than what
2922                  * they can scan, as long as they can scan all
2923                  * the channels they registered at once.
2924                  */
2925                 nla_for_each_nested(attr2, freqs, tmp2)
2926                         if (attr1 != attr2 &&
2927                             nla_get_u32(attr1) == nla_get_u32(attr2))
2928                                 return 0;
2929         }
2930
2931         return n_channels;
2932 }
2933
2934 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2935 {
2936         struct cfg80211_registered_device *rdev;
2937         struct net_device *dev;
2938         struct cfg80211_scan_request *request;
2939         struct cfg80211_ssid *ssid;
2940         struct ieee80211_channel *channel;
2941         struct nlattr *attr;
2942         struct wiphy *wiphy;
2943         int err, tmp, n_ssids = 0, n_channels, i;
2944         enum ieee80211_band band;
2945         size_t ie_len;
2946
2947         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2948                 return -EINVAL;
2949
2950         rtnl_lock();
2951
2952         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2953         if (err)
2954                 goto out_rtnl;
2955
2956         wiphy = &rdev->wiphy;
2957
2958         if (!rdev->ops->scan) {
2959                 err = -EOPNOTSUPP;
2960                 goto out;
2961         }
2962
2963         if (!netif_running(dev)) {
2964                 err = -ENETDOWN;
2965                 goto out;
2966         }
2967
2968         if (rdev->scan_req) {
2969                 err = -EBUSY;
2970                 goto out;
2971         }
2972
2973         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2974                 n_channels = validate_scan_freqs(
2975                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2976                 if (!n_channels) {
2977                         err = -EINVAL;
2978                         goto out;
2979                 }
2980         } else {
2981                 n_channels = 0;
2982
2983                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2984                         if (wiphy->bands[band])
2985                                 n_channels += wiphy->bands[band]->n_channels;
2986         }
2987
2988         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2989                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2990                         n_ssids++;
2991
2992         if (n_ssids > wiphy->max_scan_ssids) {
2993                 err = -EINVAL;
2994                 goto out;
2995         }
2996
2997         if (info->attrs[NL80211_ATTR_IE])
2998                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2999         else
3000                 ie_len = 0;
3001
3002         if (ie_len > wiphy->max_scan_ie_len) {
3003                 err = -EINVAL;
3004                 goto out;
3005         }
3006
3007         request = kzalloc(sizeof(*request)
3008                         + sizeof(*ssid) * n_ssids
3009                         + sizeof(channel) * n_channels
3010                         + ie_len, GFP_KERNEL);
3011         if (!request) {
3012                 err = -ENOMEM;
3013                 goto out;
3014         }
3015
3016         if (n_ssids)
3017                 request->ssids = (void *)&request->channels[n_channels];
3018         request->n_ssids = n_ssids;
3019         if (ie_len) {
3020                 if (request->ssids)
3021                         request->ie = (void *)(request->ssids + n_ssids);
3022                 else
3023                         request->ie = (void *)(request->channels + n_channels);
3024         }
3025
3026         i = 0;
3027         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3028                 /* user specified, bail out if channel not found */
3029                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3030                         struct ieee80211_channel *chan;
3031
3032                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3033
3034                         if (!chan) {
3035                                 err = -EINVAL;
3036                                 goto out_free;
3037                         }
3038
3039                         /* ignore disabled channels */
3040                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3041                                 continue;
3042
3043                         request->channels[i] = chan;
3044                         i++;
3045                 }
3046         } else {
3047                 /* all channels */
3048                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3049                         int j;
3050                         if (!wiphy->bands[band])
3051                                 continue;
3052                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3053                                 struct ieee80211_channel *chan;
3054
3055                                 chan = &wiphy->bands[band]->channels[j];
3056
3057                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3058                                         continue;
3059
3060                                 request->channels[i] = chan;
3061                                 i++;
3062                         }
3063                 }
3064         }
3065
3066         if (!i) {
3067                 err = -EINVAL;
3068                 goto out_free;
3069         }
3070
3071         request->n_channels = i;
3072
3073         i = 0;
3074         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3075                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3076                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3077                                 err = -EINVAL;
3078                                 goto out_free;
3079                         }
3080                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3081                         request->ssids[i].ssid_len = nla_len(attr);
3082                         i++;
3083                 }
3084         }
3085
3086         if (info->attrs[NL80211_ATTR_IE]) {
3087                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3088                 memcpy((void *)request->ie,
3089                        nla_data(info->attrs[NL80211_ATTR_IE]),
3090                        request->ie_len);
3091         }
3092
3093         request->dev = dev;
3094         request->wiphy = &rdev->wiphy;
3095
3096         rdev->scan_req = request;
3097         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3098
3099         if (!err) {
3100                 nl80211_send_scan_start(rdev, dev);
3101                 dev_hold(dev);
3102         }
3103
3104  out_free:
3105         if (err) {
3106                 rdev->scan_req = NULL;
3107                 kfree(request);
3108         }
3109  out:
3110         cfg80211_unlock_rdev(rdev);
3111         dev_put(dev);
3112  out_rtnl:
3113         rtnl_unlock();
3114
3115         return err;
3116 }
3117
3118 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3119                             struct cfg80211_registered_device *rdev,
3120                             struct wireless_dev *wdev,
3121                             struct cfg80211_internal_bss *intbss)
3122 {
3123         struct cfg80211_bss *res = &intbss->pub;
3124         void *hdr;
3125         struct nlattr *bss;
3126         int i;
3127
3128         ASSERT_WDEV_LOCK(wdev);
3129
3130         hdr = nl80211hdr_put(msg, pid, seq, flags,
3131                              NL80211_CMD_NEW_SCAN_RESULTS);
3132         if (!hdr)
3133                 return -1;
3134
3135         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3136         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3137
3138         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3139         if (!bss)
3140                 goto nla_put_failure;
3141         if (!is_zero_ether_addr(res->bssid))
3142                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3143         if (res->information_elements && res->len_information_elements)
3144                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3145                         res->len_information_elements,
3146                         res->information_elements);
3147         if (res->beacon_ies && res->len_beacon_ies &&
3148             res->beacon_ies != res->information_elements)
3149                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3150                         res->len_beacon_ies, res->beacon_ies);
3151         if (res->tsf)
3152                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3153         if (res->beacon_interval)
3154                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3155         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3156         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3157         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3158                 jiffies_to_msecs(jiffies - intbss->ts));
3159
3160         switch (rdev->wiphy.signal_type) {
3161         case CFG80211_SIGNAL_TYPE_MBM:
3162                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3163                 break;
3164         case CFG80211_SIGNAL_TYPE_UNSPEC:
3165                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3166                 break;
3167         default:
3168                 break;
3169         }
3170
3171         switch (wdev->iftype) {
3172         case NL80211_IFTYPE_STATION:
3173                 if (intbss == wdev->current_bss)
3174                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3175                                     NL80211_BSS_STATUS_ASSOCIATED);
3176                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3177                         if (intbss != wdev->auth_bsses[i])
3178                                 continue;
3179                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3180                                     NL80211_BSS_STATUS_AUTHENTICATED);
3181                         break;
3182                 }
3183                 break;
3184         case NL80211_IFTYPE_ADHOC:
3185                 if (intbss == wdev->current_bss)
3186                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3187                                     NL80211_BSS_STATUS_IBSS_JOINED);
3188                 break;
3189         default:
3190                 break;
3191         }
3192
3193         nla_nest_end(msg, bss);
3194
3195         return genlmsg_end(msg, hdr);
3196
3197  nla_put_failure:
3198         genlmsg_cancel(msg, hdr);
3199         return -EMSGSIZE;
3200 }
3201
3202 static int nl80211_dump_scan(struct sk_buff *skb,
3203                              struct netlink_callback *cb)
3204 {
3205         struct cfg80211_registered_device *rdev;
3206         struct net_device *dev;
3207         struct cfg80211_internal_bss *scan;
3208         struct wireless_dev *wdev;
3209         int ifidx = cb->args[0];
3210         int start = cb->args[1], idx = 0;
3211         int err;
3212
3213         if (!ifidx)
3214                 ifidx = nl80211_get_ifidx(cb);
3215         if (ifidx < 0)
3216                 return ifidx;
3217         cb->args[0] = ifidx;
3218
3219         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3220         if (!dev)
3221                 return -ENODEV;
3222
3223         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3224         if (IS_ERR(rdev)) {
3225                 err = PTR_ERR(rdev);
3226                 goto out_put_netdev;
3227         }
3228
3229         wdev = dev->ieee80211_ptr;
3230
3231         wdev_lock(wdev);
3232         spin_lock_bh(&rdev->bss_lock);
3233         cfg80211_bss_expire(rdev);
3234
3235         list_for_each_entry(scan, &rdev->bss_list, list) {
3236                 if (++idx <= start)
3237                         continue;
3238                 if (nl80211_send_bss(skb,
3239                                 NETLINK_CB(cb->skb).pid,
3240                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3241                                 rdev, wdev, scan) < 0) {
3242                         idx--;
3243                         goto out;
3244                 }
3245         }
3246
3247  out:
3248         spin_unlock_bh(&rdev->bss_lock);
3249         wdev_unlock(wdev);
3250
3251         cb->args[1] = idx;
3252         err = skb->len;
3253         cfg80211_unlock_rdev(rdev);
3254  out_put_netdev:
3255         dev_put(dev);
3256
3257         return err;
3258 }
3259
3260 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3261                                 int flags, struct net_device *dev,
3262                                 struct survey_info *survey)
3263 {
3264         void *hdr;
3265         struct nlattr *infoattr;
3266
3267         /* Survey without a channel doesn't make sense */
3268         if (!survey->channel)
3269                 return -EINVAL;
3270
3271         hdr = nl80211hdr_put(msg, pid, seq, flags,
3272                              NL80211_CMD_NEW_SURVEY_RESULTS);
3273         if (!hdr)
3274                 return -ENOMEM;
3275
3276         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3277
3278         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3279         if (!infoattr)
3280                 goto nla_put_failure;
3281
3282         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3283                     survey->channel->center_freq);
3284         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3285                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3286                             survey->noise);
3287
3288         nla_nest_end(msg, infoattr);
3289
3290         return genlmsg_end(msg, hdr);
3291
3292  nla_put_failure:
3293         genlmsg_cancel(msg, hdr);
3294         return -EMSGSIZE;
3295 }
3296
3297 static int nl80211_dump_survey(struct sk_buff *skb,
3298                         struct netlink_callback *cb)
3299 {
3300         struct survey_info survey;
3301         struct cfg80211_registered_device *dev;
3302         struct net_device *netdev;
3303         int ifidx = cb->args[0];
3304         int survey_idx = cb->args[1];
3305         int res;
3306
3307         if (!ifidx)
3308                 ifidx = nl80211_get_ifidx(cb);
3309         if (ifidx < 0)
3310                 return ifidx;
3311         cb->args[0] = ifidx;
3312
3313         rtnl_lock();
3314
3315         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3316         if (!netdev) {
3317                 res = -ENODEV;
3318                 goto out_rtnl;
3319         }
3320
3321         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3322         if (IS_ERR(dev)) {
3323                 res = PTR_ERR(dev);
3324                 goto out_rtnl;
3325         }
3326
3327         if (!dev->ops->dump_survey) {
3328                 res = -EOPNOTSUPP;
3329                 goto out_err;
3330         }
3331
3332         while (1) {
3333                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3334                                             &survey);
3335                 if (res == -ENOENT)
3336                         break;
3337                 if (res)
3338                         goto out_err;
3339
3340                 if (nl80211_send_survey(skb,
3341                                 NETLINK_CB(cb->skb).pid,
3342                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3343                                 netdev,
3344                                 &survey) < 0)
3345                         goto out;
3346                 survey_idx++;
3347         }
3348
3349  out:
3350         cb->args[1] = survey_idx;
3351         res = skb->len;
3352  out_err:
3353         cfg80211_unlock_rdev(dev);
3354  out_rtnl:
3355         rtnl_unlock();
3356
3357         return res;
3358 }
3359
3360 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3361 {
3362         return auth_type <= NL80211_AUTHTYPE_MAX;
3363 }
3364
3365 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3366 {
3367         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3368                                   NL80211_WPA_VERSION_2));
3369 }
3370
3371 static bool nl80211_valid_akm_suite(u32 akm)
3372 {
3373         return akm == WLAN_AKM_SUITE_8021X ||
3374                 akm == WLAN_AKM_SUITE_PSK;
3375 }
3376
3377 static bool nl80211_valid_cipher_suite(u32 cipher)
3378 {
3379         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3380                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3381                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3382                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3383                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3384 }
3385
3386
3387 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3388 {
3389         struct cfg80211_registered_device *rdev;
3390         struct net_device *dev;
3391         struct ieee80211_channel *chan;
3392         const u8 *bssid, *ssid, *ie = NULL;
3393         int err, ssid_len, ie_len = 0;
3394         enum nl80211_auth_type auth_type;
3395         struct key_parse key;
3396
3397         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3398                 return -EINVAL;
3399
3400         if (!info->attrs[NL80211_ATTR_MAC])
3401                 return -EINVAL;
3402
3403         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3404                 return -EINVAL;
3405
3406         if (!info->attrs[NL80211_ATTR_SSID])
3407                 return -EINVAL;
3408
3409         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3410                 return -EINVAL;
3411
3412         err = nl80211_parse_key(info, &key);
3413         if (err)
3414                 return err;
3415
3416         if (key.idx >= 0) {
3417                 if (!key.p.key || !key.p.key_len)
3418                         return -EINVAL;
3419                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3420                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3421                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3422                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3423                         return -EINVAL;
3424                 if (key.idx > 4)
3425                         return -EINVAL;
3426         } else {
3427                 key.p.key_len = 0;
3428                 key.p.key = NULL;
3429         }
3430
3431         rtnl_lock();
3432
3433         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3434         if (err)
3435                 goto unlock_rtnl;
3436
3437         if (!rdev->ops->auth) {
3438                 err = -EOPNOTSUPP;
3439                 goto out;
3440         }
3441
3442         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3443                 err = -EOPNOTSUPP;
3444                 goto out;
3445         }
3446
3447         if (!netif_running(dev)) {
3448                 err = -ENETDOWN;
3449                 goto out;
3450         }
3451
3452         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3453         chan = ieee80211_get_channel(&rdev->wiphy,
3454                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3455         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3456                 err = -EINVAL;
3457                 goto out;
3458         }
3459
3460         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3461         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3462
3463         if (info->attrs[NL80211_ATTR_IE]) {
3464                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3465                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3466         }
3467
3468         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3469         if (!nl80211_valid_auth_type(auth_type)) {
3470                 err = -EINVAL;
3471                 goto out;
3472         }
3473
3474         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3475                                  ssid, ssid_len, ie, ie_len,
3476                                  key.p.key, key.p.key_len, key.idx);
3477
3478 out:
3479         cfg80211_unlock_rdev(rdev);
3480         dev_put(dev);
3481 unlock_rtnl:
3482         rtnl_unlock();
3483         return err;
3484 }
3485
3486 static int nl80211_crypto_settings(struct genl_info *info,
3487                                    struct cfg80211_crypto_settings *settings,
3488                                    int cipher_limit)
3489 {
3490         memset(settings, 0, sizeof(*settings));
3491
3492         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3493
3494         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3495                 void *data;
3496                 int len, i;
3497
3498                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3499                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3500                 settings->n_ciphers_pairwise = len / sizeof(u32);
3501
3502                 if (len % sizeof(u32))
3503                         return -EINVAL;
3504
3505                 if (settings->n_ciphers_pairwise > cipher_limit)
3506                         return -EINVAL;
3507
3508                 memcpy(settings->ciphers_pairwise, data, len);
3509
3510                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3511                         if (!nl80211_valid_cipher_suite(
3512                                         settings->ciphers_pairwise[i]))
3513                                 return -EINVAL;
3514         }
3515
3516         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3517                 settings->cipher_group =
3518                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3519                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3520                         return -EINVAL;
3521         }
3522
3523         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3524                 settings->wpa_versions =
3525                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3526                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3527                         return -EINVAL;
3528         }
3529
3530         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3531                 void *data;
3532                 int len, i;
3533
3534                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3535                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3536                 settings->n_akm_suites = len / sizeof(u32);
3537
3538                 if (len % sizeof(u32))
3539                         return -EINVAL;
3540
3541                 memcpy(settings->akm_suites, data, len);
3542
3543                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3544                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3545                                 return -EINVAL;
3546         }
3547
3548         return 0;
3549 }
3550
3551 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3552 {
3553         struct cfg80211_registered_device *rdev;
3554         struct net_device *dev;
3555         struct wireless_dev *wdev;
3556         struct cfg80211_crypto_settings crypto;
3557         struct ieee80211_channel *chan, *fixedchan;
3558         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3559         int err, ssid_len, ie_len = 0;
3560         bool use_mfp = false;
3561
3562         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3563                 return -EINVAL;
3564
3565         if (!info->attrs[NL80211_ATTR_MAC] ||
3566             !info->attrs[NL80211_ATTR_SSID] ||
3567             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3568                 return -EINVAL;
3569
3570         rtnl_lock();
3571
3572         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3573         if (err)
3574                 goto unlock_rtnl;
3575
3576         if (!rdev->ops->assoc) {
3577                 err = -EOPNOTSUPP;
3578                 goto out;
3579         }
3580
3581         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3582                 err = -EOPNOTSUPP;
3583                 goto out;
3584         }
3585
3586         if (!netif_running(dev)) {
3587                 err = -ENETDOWN;
3588                 goto out;
3589         }
3590
3591         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3592
3593         chan = ieee80211_get_channel(&rdev->wiphy,
3594                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3595         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3596                 err = -EINVAL;
3597                 goto out;
3598         }
3599
3600         mutex_lock(&rdev->devlist_mtx);
3601         wdev = dev->ieee80211_ptr;
3602         fixedchan = rdev_fixed_channel(rdev, wdev);
3603         if (fixedchan && chan != fixedchan) {
3604                 err = -EBUSY;
3605                 mutex_unlock(&rdev->devlist_mtx);
3606                 goto out;
3607         }
3608         mutex_unlock(&rdev->devlist_mtx);
3609
3610         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3611         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3612
3613         if (info->attrs[NL80211_ATTR_IE]) {
3614                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3615                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3616         }
3617
3618         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3619                 enum nl80211_mfp mfp =
3620                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3621                 if (mfp == NL80211_MFP_REQUIRED)
3622                         use_mfp = true;
3623                 else if (mfp != NL80211_MFP_NO) {
3624                         err = -EINVAL;
3625                         goto out;
3626                 }
3627         }
3628
3629         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3630                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3631
3632         err = nl80211_crypto_settings(info, &crypto, 1);
3633         if (!err)
3634                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3635                                           ssid, ssid_len, ie, ie_len, use_mfp,
3636                                           &crypto);
3637
3638 out:
3639         cfg80211_unlock_rdev(rdev);
3640         dev_put(dev);
3641 unlock_rtnl:
3642         rtnl_unlock();
3643         return err;
3644 }
3645
3646 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3647 {
3648         struct cfg80211_registered_device *rdev;
3649         struct net_device *dev;
3650         const u8 *ie = NULL, *bssid;
3651         int err, ie_len = 0;
3652         u16 reason_code;
3653
3654         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3655                 return -EINVAL;
3656
3657         if (!info->attrs[NL80211_ATTR_MAC])
3658                 return -EINVAL;
3659
3660         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3661                 return -EINVAL;
3662
3663         rtnl_lock();
3664
3665         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3666         if (err)
3667                 goto unlock_rtnl;
3668
3669         if (!rdev->ops->deauth) {
3670                 err = -EOPNOTSUPP;
3671                 goto out;
3672         }
3673
3674         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3675                 err = -EOPNOTSUPP;
3676                 goto out;
3677         }
3678
3679         if (!netif_running(dev)) {
3680                 err = -ENETDOWN;
3681                 goto out;
3682         }
3683
3684         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3685
3686         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3687         if (reason_code == 0) {
3688                 /* Reason Code 0 is reserved */
3689                 err = -EINVAL;
3690                 goto out;
3691         }
3692
3693         if (info->attrs[NL80211_ATTR_IE]) {
3694                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3695                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3696         }
3697
3698         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3699
3700 out:
3701         cfg80211_unlock_rdev(rdev);
3702         dev_put(dev);
3703 unlock_rtnl:
3704         rtnl_unlock();
3705         return err;
3706 }
3707
3708 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3709 {
3710         struct cfg80211_registered_device *rdev;
3711         struct net_device *dev;
3712         const u8 *ie = NULL, *bssid;
3713         int err, ie_len = 0;
3714         u16 reason_code;
3715
3716         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3717                 return -EINVAL;
3718
3719         if (!info->attrs[NL80211_ATTR_MAC])
3720                 return -EINVAL;
3721
3722         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3723                 return -EINVAL;
3724
3725         rtnl_lock();
3726
3727         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3728         if (err)
3729                 goto unlock_rtnl;
3730
3731         if (!rdev->ops->disassoc) {
3732                 err = -EOPNOTSUPP;
3733                 goto out;
3734         }
3735
3736         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3737                 err = -EOPNOTSUPP;
3738                 goto out;
3739         }
3740
3741         if (!netif_running(dev)) {
3742                 err = -ENETDOWN;
3743                 goto out;
3744         }
3745
3746         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3747
3748         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3749         if (reason_code == 0) {
3750                 /* Reason Code 0 is reserved */
3751                 err = -EINVAL;
3752                 goto out;
3753         }
3754
3755         if (info->attrs[NL80211_ATTR_IE]) {
3756                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3757                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3758         }
3759
3760         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3761
3762 out:
3763         cfg80211_unlock_rdev(rdev);
3764         dev_put(dev);
3765 unlock_rtnl:
3766         rtnl_unlock();
3767         return err;
3768 }
3769
3770 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3771 {
3772         struct cfg80211_registered_device *rdev;
3773         struct net_device *dev;
3774         struct cfg80211_ibss_params ibss;
3775         struct wiphy *wiphy;
3776         struct cfg80211_cached_keys *connkeys = NULL;
3777         int err;
3778
3779         memset(&ibss, 0, sizeof(ibss));
3780
3781         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3782                 return -EINVAL;
3783
3784         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3785             !info->attrs[NL80211_ATTR_SSID] ||
3786             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3787                 return -EINVAL;
3788
3789         ibss.beacon_interval = 100;
3790
3791         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3792                 ibss.beacon_interval =
3793                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3794                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3795                         return -EINVAL;
3796         }
3797
3798         rtnl_lock();
3799
3800         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3801         if (err)
3802                 goto unlock_rtnl;
3803
3804         if (!rdev->ops->join_ibss) {
3805                 err = -EOPNOTSUPP;
3806                 goto out;
3807         }
3808
3809         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3810                 err = -EOPNOTSUPP;
3811                 goto out;
3812         }
3813
3814         if (!netif_running(dev)) {
3815                 err = -ENETDOWN;
3816                 goto out;
3817         }
3818
3819         wiphy = &rdev->wiphy;
3820
3821         if (info->attrs[NL80211_ATTR_MAC])
3822                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3823         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3824         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3825
3826         if (info->attrs[NL80211_ATTR_IE]) {
3827                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3828                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3829         }
3830
3831         ibss.channel = ieee80211_get_channel(wiphy,
3832                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3833         if (!ibss.channel ||
3834             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3835             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3836                 err = -EINVAL;
3837                 goto out;
3838         }
3839
3840         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3841         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3842
3843         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3844                 connkeys = nl80211_parse_connkeys(rdev,
3845                                         info->attrs[NL80211_ATTR_KEYS]);
3846                 if (IS_ERR(connkeys)) {
3847                         err = PTR_ERR(connkeys);
3848                         connkeys = NULL;
3849                         goto out;
3850                 }
3851         }
3852
3853         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3854
3855 out:
3856         cfg80211_unlock_rdev(rdev);
3857         dev_put(dev);
3858 unlock_rtnl:
3859         if (err)
3860                 kfree(connkeys);
3861         rtnl_unlock();
3862         return err;
3863 }
3864
3865 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3866 {
3867         struct cfg80211_registered_device *rdev;
3868         struct net_device *dev;
3869         int err;
3870
3871         rtnl_lock();
3872
3873         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3874         if (err)
3875                 goto unlock_rtnl;
3876
3877         if (!rdev->ops->leave_ibss) {
3878                 err = -EOPNOTSUPP;
3879                 goto out;
3880         }
3881
3882         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3883                 err = -EOPNOTSUPP;
3884                 goto out;
3885         }
3886
3887         if (!netif_running(dev)) {
3888                 err = -ENETDOWN;
3889                 goto out;
3890         }
3891
3892         err = cfg80211_leave_ibss(rdev, dev, false);
3893
3894 out:
3895         cfg80211_unlock_rdev(rdev);
3896         dev_put(dev);
3897 unlock_rtnl:
3898         rtnl_unlock();
3899         return err;
3900 }
3901
3902 #ifdef CONFIG_NL80211_TESTMODE
3903 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3904         .name = "testmode",
3905 };
3906
3907 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3908 {
3909         struct cfg80211_registered_device *rdev;
3910         int err;
3911
3912         if (!info->attrs[NL80211_ATTR_TESTDATA])
3913                 return -EINVAL;
3914
3915         rtnl_lock();
3916
3917         rdev = cfg80211_get_dev_from_info(info);
3918         if (IS_ERR(rdev)) {
3919                 err = PTR_ERR(rdev);
3920                 goto unlock_rtnl;
3921         }
3922
3923         err = -EOPNOTSUPP;
3924         if (rdev->ops->testmode_cmd) {
3925                 rdev->testmode_info = info;
3926                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3927                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3928                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3929                 rdev->testmode_info = NULL;
3930         }
3931
3932         cfg80211_unlock_rdev(rdev);
3933
3934  unlock_rtnl:
3935         rtnl_unlock();
3936         return err;
3937 }
3938
3939 static struct sk_buff *
3940 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3941                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3942 {
3943         struct sk_buff *skb;
3944         void *hdr;
3945         struct nlattr *data;
3946
3947         skb = nlmsg_new(approxlen + 100, gfp);
3948         if (!skb)
3949                 return NULL;
3950
3951         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3952         if (!hdr) {
3953                 kfree_skb(skb);
3954                 return NULL;
3955         }
3956
3957         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3958         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3959
3960         ((void **)skb->cb)[0] = rdev;
3961         ((void **)skb->cb)[1] = hdr;
3962         ((void **)skb->cb)[2] = data;
3963
3964         return skb;
3965
3966  nla_put_failure:
3967         kfree_skb(skb);
3968         return NULL;
3969 }
3970
3971 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3972                                                   int approxlen)
3973 {
3974         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3975
3976         if (WARN_ON(!rdev->testmode_info))
3977                 return NULL;
3978
3979         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3980                                 rdev->testmode_info->snd_pid,
3981                                 rdev->testmode_info->snd_seq,
3982                                 GFP_KERNEL);
3983 }
3984 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3985
3986 int cfg80211_testmode_reply(struct sk_buff *skb)
3987 {
3988         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3989         void *hdr = ((void **)skb->cb)[1];
3990         struct nlattr *data = ((void **)skb->cb)[2];
3991
3992         if (WARN_ON(!rdev->testmode_info)) {
3993                 kfree_skb(skb);
3994                 return -EINVAL;
3995         }
3996
3997         nla_nest_end(skb, data);
3998         genlmsg_end(skb, hdr);
3999         return genlmsg_reply(skb, rdev->testmode_info);
4000 }
4001 EXPORT_SYMBOL(cfg80211_testmode_reply);
4002
4003 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4004                                                   int approxlen, gfp_t gfp)
4005 {
4006         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4007
4008         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4009 }
4010 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4011
4012 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4013 {
4014         void *hdr = ((void **)skb->cb)[1];
4015         struct nlattr *data = ((void **)skb->cb)[2];
4016
4017         nla_nest_end(skb, data);
4018         genlmsg_end(skb, hdr);
4019         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4020 }
4021 EXPORT_SYMBOL(cfg80211_testmode_event);
4022 #endif
4023
4024 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4025 {
4026         struct cfg80211_registered_device *rdev;
4027         struct net_device *dev;
4028         struct cfg80211_connect_params connect;
4029         struct wiphy *wiphy;
4030         struct cfg80211_cached_keys *connkeys = NULL;
4031         int err;
4032
4033         memset(&connect, 0, sizeof(connect));
4034
4035         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4036                 return -EINVAL;
4037
4038         if (!info->attrs[NL80211_ATTR_SSID] ||
4039             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4040                 return -EINVAL;
4041
4042         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4043                 connect.auth_type =
4044                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4045                 if (!nl80211_valid_auth_type(connect.auth_type))
4046                         return -EINVAL;
4047         } else
4048                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4049
4050         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4051
4052         err = nl80211_crypto_settings(info, &connect.crypto,
4053                                       NL80211_MAX_NR_CIPHER_SUITES);
4054         if (err)
4055                 return err;
4056         rtnl_lock();
4057
4058         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4059         if (err)
4060                 goto unlock_rtnl;
4061
4062         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4063                 err = -EOPNOTSUPP;
4064                 goto out;
4065         }
4066
4067         if (!netif_running(dev)) {
4068                 err = -ENETDOWN;
4069                 goto out;
4070         }
4071
4072         wiphy = &rdev->wiphy;
4073
4074         if (info->attrs[NL80211_ATTR_MAC])
4075                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4076         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4077         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4078
4079         if (info->attrs[NL80211_ATTR_IE]) {
4080                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4081                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4082         }
4083
4084         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4085                 connect.channel =
4086                         ieee80211_get_channel(wiphy,
4087                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4088                 if (!connect.channel ||
4089                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4090                         err = -EINVAL;
4091                         goto out;
4092                 }
4093         }
4094
4095         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4096                 connkeys = nl80211_parse_connkeys(rdev,
4097                                         info->attrs[NL80211_ATTR_KEYS]);
4098                 if (IS_ERR(connkeys)) {
4099                         err = PTR_ERR(connkeys);
4100                         connkeys = NULL;
4101                         goto out;
4102                 }
4103         }
4104
4105         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4106
4107 out:
4108         cfg80211_unlock_rdev(rdev);
4109         dev_put(dev);
4110 unlock_rtnl:
4111         if (err)
4112                 kfree(connkeys);
4113         rtnl_unlock();
4114         return err;
4115 }
4116
4117 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4118 {
4119         struct cfg80211_registered_device *rdev;
4120         struct net_device *dev;
4121         int err;
4122         u16 reason;
4123
4124         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4125                 reason = WLAN_REASON_DEAUTH_LEAVING;
4126         else
4127                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4128
4129         if (reason == 0)
4130                 return -EINVAL;
4131
4132         rtnl_lock();
4133
4134         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4135         if (err)
4136                 goto unlock_rtnl;
4137
4138         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4139                 err = -EOPNOTSUPP;
4140                 goto out;
4141         }
4142
4143         if (!netif_running(dev)) {
4144                 err = -ENETDOWN;
4145                 goto out;
4146         }
4147
4148         err = cfg80211_disconnect(rdev, dev, reason, true);
4149
4150 out:
4151         cfg80211_unlock_rdev(rdev);
4152         dev_put(dev);
4153 unlock_rtnl:
4154         rtnl_unlock();
4155         return err;
4156 }
4157
4158 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4159 {
4160         struct cfg80211_registered_device *rdev;
4161         struct net *net;
4162         int err;
4163         u32 pid;
4164
4165         if (!info->attrs[NL80211_ATTR_PID])
4166                 return -EINVAL;
4167
4168         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4169
4170         rtnl_lock();
4171
4172         rdev = cfg80211_get_dev_from_info(info);
4173         if (IS_ERR(rdev)) {
4174                 err = PTR_ERR(rdev);
4175                 goto out_rtnl;
4176         }
4177
4178         net = get_net_ns_by_pid(pid);
4179         if (IS_ERR(net)) {
4180                 err = PTR_ERR(net);
4181                 goto out;
4182         }
4183
4184         err = 0;
4185
4186         /* check if anything to do */
4187         if (net_eq(wiphy_net(&rdev->wiphy), net))
4188                 goto out_put_net;
4189
4190         err = cfg80211_switch_netns(rdev, net);
4191  out_put_net:
4192         put_net(net);
4193  out:
4194         cfg80211_unlock_rdev(rdev);
4195  out_rtnl:
4196         rtnl_unlock();
4197         return err;
4198 }
4199
4200 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4201 {
4202         struct cfg80211_registered_device *rdev;
4203         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4204                         struct cfg80211_pmksa *pmksa) = NULL;
4205         int err;
4206         struct net_device *dev;
4207         struct cfg80211_pmksa pmksa;
4208
4209         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4210
4211         if (!info->attrs[NL80211_ATTR_MAC])
4212                 return -EINVAL;
4213
4214         if (!info->attrs[NL80211_ATTR_PMKID])
4215                 return -EINVAL;
4216
4217         rtnl_lock();
4218
4219         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4220         if (err)
4221                 goto out_rtnl;
4222
4223         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4224         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4225
4226         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4227                 err = -EOPNOTSUPP;
4228                 goto out;
4229         }
4230
4231         switch (info->genlhdr->cmd) {
4232         case NL80211_CMD_SET_PMKSA:
4233                 rdev_ops = rdev->ops->set_pmksa;
4234                 break;
4235         case NL80211_CMD_DEL_PMKSA:
4236                 rdev_ops = rdev->ops->del_pmksa;
4237                 break;
4238         default:
4239                 WARN_ON(1);
4240                 break;
4241         }
4242
4243         if (!rdev_ops) {
4244                 err = -EOPNOTSUPP;
4245                 goto out;
4246         }
4247
4248         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4249
4250  out:
4251         cfg80211_unlock_rdev(rdev);
4252         dev_put(dev);
4253  out_rtnl:
4254         rtnl_unlock();
4255
4256         return err;
4257 }
4258
4259 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4260 {
4261         struct cfg80211_registered_device *rdev;
4262         int err;
4263         struct net_device *dev;
4264
4265         rtnl_lock();
4266
4267         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4268         if (err)
4269                 goto out_rtnl;
4270
4271         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4272                 err = -EOPNOTSUPP;
4273                 goto out;
4274         }
4275
4276         if (!rdev->ops->flush_pmksa) {
4277                 err = -EOPNOTSUPP;
4278                 goto out;
4279         }
4280
4281         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4282
4283  out:
4284         cfg80211_unlock_rdev(rdev);
4285         dev_put(dev);
4286  out_rtnl:
4287         rtnl_unlock();
4288
4289         return err;
4290
4291 }
4292
4293 static int nl80211_remain_on_channel(struct sk_buff *skb,
4294                                      struct genl_info *info)
4295 {
4296         struct cfg80211_registered_device *rdev;
4297         struct net_device *dev;
4298         struct ieee80211_channel *chan;
4299         struct sk_buff *msg;
4300         void *hdr;
4301         u64 cookie;
4302         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4303         u32 freq, duration;
4304         int err;
4305
4306         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4307             !info->attrs[NL80211_ATTR_DURATION])
4308                 return -EINVAL;
4309
4310         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4311
4312         /*
4313          * We should be on that channel for at least one jiffie,
4314          * and more than 5 seconds seems excessive.
4315          */
4316         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4317                 return -EINVAL;
4318
4319         rtnl_lock();
4320
4321         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4322         if (err)
4323                 goto unlock_rtnl;
4324
4325         if (!rdev->ops->remain_on_channel) {
4326                 err = -EOPNOTSUPP;
4327                 goto out;
4328         }
4329
4330         if (!netif_running(dev)) {
4331                 err = -ENETDOWN;
4332                 goto out;
4333         }
4334
4335         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4336                 channel_type = nla_get_u32(
4337                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4338                 if (channel_type != NL80211_CHAN_NO_HT &&
4339                     channel_type != NL80211_CHAN_HT20 &&
4340                     channel_type != NL80211_CHAN_HT40PLUS &&
4341                     channel_type != NL80211_CHAN_HT40MINUS)
4342                         err = -EINVAL;
4343                         goto out;
4344         }
4345
4346         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4347         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4348         if (chan == NULL) {
4349                 err = -EINVAL;
4350                 goto out;
4351         }
4352
4353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4354         if (!msg) {
4355                 err = -ENOMEM;
4356                 goto out;
4357         }
4358
4359         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4360                              NL80211_CMD_REMAIN_ON_CHANNEL);
4361
4362         if (IS_ERR(hdr)) {
4363                 err = PTR_ERR(hdr);
4364                 goto free_msg;
4365         }
4366
4367         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4368                                            channel_type, duration, &cookie);
4369
4370         if (err)
4371                 goto free_msg;
4372
4373         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4374
4375         genlmsg_end(msg, hdr);
4376         err = genlmsg_reply(msg, info);
4377         goto out;
4378
4379  nla_put_failure:
4380         err = -ENOBUFS;
4381  free_msg:
4382         nlmsg_free(msg);
4383  out:
4384         cfg80211_unlock_rdev(rdev);
4385         dev_put(dev);
4386  unlock_rtnl:
4387         rtnl_unlock();
4388         return err;
4389 }
4390
4391 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4392                                             struct genl_info *info)
4393 {
4394         struct cfg80211_registered_device *rdev;
4395         struct net_device *dev;
4396         u64 cookie;
4397         int err;
4398
4399         if (!info->attrs[NL80211_ATTR_COOKIE])
4400                 return -EINVAL;
4401
4402         rtnl_lock();
4403
4404         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4405         if (err)
4406                 goto unlock_rtnl;
4407
4408         if (!rdev->ops->cancel_remain_on_channel) {
4409                 err = -EOPNOTSUPP;
4410                 goto out;
4411         }
4412
4413         if (!netif_running(dev)) {
4414                 err = -ENETDOWN;
4415                 goto out;
4416         }
4417
4418         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4419
4420         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4421
4422  out:
4423         cfg80211_unlock_rdev(rdev);
4424         dev_put(dev);
4425  unlock_rtnl:
4426         rtnl_unlock();
4427         return err;
4428 }
4429
4430 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4431                            u8 *rates, u8 rates_len)
4432 {
4433         u8 i;
4434         u32 mask = 0;
4435
4436         for (i = 0; i < rates_len; i++) {
4437                 int rate = (rates[i] & 0x7f) * 5;
4438                 int ridx;
4439                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4440                         struct ieee80211_rate *srate =
4441                                 &sband->bitrates[ridx];
4442                         if (rate == srate->bitrate) {
4443                                 mask |= 1 << ridx;
4444                                 break;
4445                         }
4446                 }
4447                 if (ridx == sband->n_bitrates)
4448                         return 0; /* rate not found */
4449         }
4450
4451         return mask;
4452 }
4453
4454 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4455         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4456                                     .len = NL80211_MAX_SUPP_RATES },
4457 };
4458
4459 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4460                                        struct genl_info *info)
4461 {
4462         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4463         struct cfg80211_registered_device *rdev;
4464         struct cfg80211_bitrate_mask mask;
4465         int err, rem, i;
4466         struct net_device *dev;
4467         struct nlattr *tx_rates;
4468         struct ieee80211_supported_band *sband;
4469
4470         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4471                 return -EINVAL;
4472
4473         rtnl_lock();
4474
4475         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4476         if (err)
4477                 goto unlock_rtnl;
4478
4479         if (!rdev->ops->set_bitrate_mask) {
4480                 err = -EOPNOTSUPP;
4481                 goto unlock;
4482         }
4483
4484         memset(&mask, 0, sizeof(mask));
4485         /* Default to all rates enabled */
4486         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4487                 sband = rdev->wiphy.bands[i];
4488                 mask.control[i].legacy =
4489                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4490         }
4491
4492         /*
4493          * The nested attribute uses enum nl80211_band as the index. This maps
4494          * directly to the enum ieee80211_band values used in cfg80211.
4495          */
4496         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4497         {
4498                 enum ieee80211_band band = nla_type(tx_rates);
4499                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4500                         err = -EINVAL;
4501                         goto unlock;
4502                 }
4503                 sband = rdev->wiphy.bands[band];
4504                 if (sband == NULL) {
4505                         err = -EINVAL;
4506                         goto unlock;
4507                 }
4508                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4509                           nla_len(tx_rates), nl80211_txattr_policy);
4510                 if (tb[NL80211_TXRATE_LEGACY]) {
4511                         mask.control[band].legacy = rateset_to_mask(
4512                                 sband,
4513                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4514                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4515                         if (mask.control[band].legacy == 0) {
4516                                 err = -EINVAL;
4517                                 goto unlock;
4518                         }
4519                 }
4520         }
4521
4522         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4523
4524  unlock:
4525         dev_put(dev);
4526         cfg80211_unlock_rdev(rdev);
4527  unlock_rtnl:
4528         rtnl_unlock();
4529         return err;
4530 }
4531
4532 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4533 {
4534         struct cfg80211_registered_device *rdev;
4535         struct net_device *dev;
4536         int err;
4537
4538         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4539                 return -EINVAL;
4540
4541         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4542                 return -EINVAL;
4543
4544         rtnl_lock();
4545
4546         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4547         if (err)
4548                 goto unlock_rtnl;
4549
4550         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4551                 err = -EOPNOTSUPP;
4552                 goto out;
4553         }
4554
4555         /* not much point in registering if we can't reply */
4556         if (!rdev->ops->action) {
4557                 err = -EOPNOTSUPP;
4558                 goto out;
4559         }
4560
4561         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4562                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4563                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4564  out:
4565         cfg80211_unlock_rdev(rdev);
4566         dev_put(dev);
4567  unlock_rtnl:
4568         rtnl_unlock();
4569         return err;
4570 }
4571
4572 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4573 {
4574         struct cfg80211_registered_device *rdev;
4575         struct net_device *dev;
4576         struct ieee80211_channel *chan;
4577         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4578         u32 freq;
4579         int err;
4580         void *hdr;
4581         u64 cookie;
4582         struct sk_buff *msg;
4583
4584         if (!info->attrs[NL80211_ATTR_FRAME] ||
4585             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4586                 return -EINVAL;
4587
4588         rtnl_lock();
4589
4590         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4591         if (err)
4592                 goto unlock_rtnl;
4593
4594         if (!rdev->ops->action) {
4595                 err = -EOPNOTSUPP;
4596                 goto out;
4597         }
4598
4599         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4600                 err = -EOPNOTSUPP;
4601                 goto out;
4602         }
4603
4604         if (!netif_running(dev)) {
4605                 err = -ENETDOWN;
4606                 goto out;
4607         }
4608
4609         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4610                 channel_type = nla_get_u32(
4611                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4612                 if (channel_type != NL80211_CHAN_NO_HT &&
4613                     channel_type != NL80211_CHAN_HT20 &&
4614                     channel_type != NL80211_CHAN_HT40PLUS &&
4615                     channel_type != NL80211_CHAN_HT40MINUS)
4616                         err = -EINVAL;
4617                         goto out;
4618         }
4619
4620         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4621         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4622         if (chan == NULL) {
4623                 err = -EINVAL;
4624                 goto out;
4625         }
4626
4627         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4628         if (!msg) {
4629                 err = -ENOMEM;
4630                 goto out;
4631         }
4632
4633         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4634                              NL80211_CMD_ACTION);
4635
4636         if (IS_ERR(hdr)) {
4637                 err = PTR_ERR(hdr);
4638                 goto free_msg;
4639         }
4640         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4641                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4642                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4643                                    &cookie);
4644         if (err)
4645                 goto free_msg;
4646
4647         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4648
4649         genlmsg_end(msg, hdr);
4650         err = genlmsg_reply(msg, info);
4651         goto out;
4652
4653  nla_put_failure:
4654         err = -ENOBUFS;
4655  free_msg:
4656         nlmsg_free(msg);
4657  out:
4658         cfg80211_unlock_rdev(rdev);
4659         dev_put(dev);
4660 unlock_rtnl:
4661         rtnl_unlock();
4662         return err;
4663 }
4664
4665 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4666 {
4667         struct cfg80211_registered_device *rdev;
4668         struct wireless_dev *wdev;
4669         struct net_device *dev;
4670         u8 ps_state;
4671         bool state;
4672         int err;
4673
4674         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4675                 err = -EINVAL;
4676                 goto out;
4677         }
4678
4679         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4680
4681         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4682                 err = -EINVAL;
4683                 goto out;
4684         }
4685
4686         rtnl_lock();
4687
4688         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4689         if (err)
4690                 goto unlock_rdev;
4691
4692         wdev = dev->ieee80211_ptr;
4693
4694         if (!rdev->ops->set_power_mgmt) {
4695                 err = -EOPNOTSUPP;
4696                 goto unlock_rdev;
4697         }
4698
4699         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4700
4701         if (state == wdev->ps)
4702                 goto unlock_rdev;
4703
4704         wdev->ps = state;
4705
4706         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4707                                       wdev->ps_timeout))
4708                 /* assume this means it's off */
4709                 wdev->ps = false;
4710
4711 unlock_rdev:
4712         cfg80211_unlock_rdev(rdev);
4713         dev_put(dev);
4714         rtnl_unlock();
4715
4716 out:
4717         return err;
4718 }
4719
4720 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4721 {
4722         struct cfg80211_registered_device *rdev;
4723         enum nl80211_ps_state ps_state;
4724         struct wireless_dev *wdev;
4725         struct net_device *dev;
4726         struct sk_buff *msg;
4727         void *hdr;
4728         int err;
4729
4730         rtnl_lock();
4731
4732         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4733         if (err)
4734                 goto unlock_rtnl;
4735
4736         wdev = dev->ieee80211_ptr;
4737
4738         if (!rdev->ops->set_power_mgmt) {
4739                 err = -EOPNOTSUPP;
4740                 goto out;
4741         }
4742
4743         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4744         if (!msg) {
4745                 err = -ENOMEM;
4746                 goto out;
4747         }
4748
4749         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4750                              NL80211_CMD_GET_POWER_SAVE);
4751         if (!hdr) {
4752                 err = -ENOMEM;
4753                 goto free_msg;
4754         }
4755
4756         if (wdev->ps)
4757                 ps_state = NL80211_PS_ENABLED;
4758         else
4759                 ps_state = NL80211_PS_DISABLED;
4760
4761         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4762
4763         genlmsg_end(msg, hdr);
4764         err = genlmsg_reply(msg, info);
4765         goto out;
4766
4767 nla_put_failure:
4768         err = -ENOBUFS;
4769
4770 free_msg:
4771         nlmsg_free(msg);
4772
4773 out:
4774         cfg80211_unlock_rdev(rdev);
4775         dev_put(dev);
4776
4777 unlock_rtnl:
4778         rtnl_unlock();
4779
4780         return err;
4781 }
4782
4783 static struct nla_policy
4784 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4785         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4786         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4787         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4788 };
4789
4790 static int nl80211_set_cqm_rssi(struct genl_info *info,
4791                                 s32 threshold, u32 hysteresis)
4792 {
4793         struct cfg80211_registered_device *rdev;
4794         struct wireless_dev *wdev;
4795         struct net_device *dev;
4796         int err;
4797
4798         if (threshold > 0)
4799                 return -EINVAL;
4800
4801         rtnl_lock();
4802
4803         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4804         if (err)
4805                 goto unlock_rdev;
4806
4807         wdev = dev->ieee80211_ptr;
4808
4809         if (!rdev->ops->set_cqm_rssi_config) {
4810                 err = -EOPNOTSUPP;
4811                 goto unlock_rdev;
4812         }
4813
4814         if (wdev->iftype != NL80211_IFTYPE_STATION) {
4815                 err = -EOPNOTSUPP;
4816                 goto unlock_rdev;
4817         }
4818
4819         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4820                                              threshold, hysteresis);
4821
4822 unlock_rdev:
4823         cfg80211_unlock_rdev(rdev);
4824         dev_put(dev);
4825         rtnl_unlock();
4826
4827         return err;
4828 }
4829
4830 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4831 {
4832         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4833         struct nlattr *cqm;
4834         int err;
4835
4836         cqm = info->attrs[NL80211_ATTR_CQM];
4837         if (!cqm) {
4838                 err = -EINVAL;
4839                 goto out;
4840         }
4841
4842         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4843                                nl80211_attr_cqm_policy);
4844         if (err)
4845                 goto out;
4846
4847         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4848             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4849                 s32 threshold;
4850                 u32 hysteresis;
4851                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4852                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4853                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4854         } else
4855                 err = -EINVAL;
4856
4857 out:
4858         return err;
4859 }
4860
4861 static struct genl_ops nl80211_ops[] = {
4862         {
4863                 .cmd = NL80211_CMD_GET_WIPHY,
4864                 .doit = nl80211_get_wiphy,
4865                 .dumpit = nl80211_dump_wiphy,
4866                 .policy = nl80211_policy,
4867                 /* can be retrieved by unprivileged users */
4868         },
4869         {
4870                 .cmd = NL80211_CMD_SET_WIPHY,
4871                 .doit = nl80211_set_wiphy,
4872                 .policy = nl80211_policy,
4873                 .flags = GENL_ADMIN_PERM,
4874         },
4875         {
4876                 .cmd = NL80211_CMD_GET_INTERFACE,
4877                 .doit = nl80211_get_interface,
4878                 .dumpit = nl80211_dump_interface,
4879                 .policy = nl80211_policy,
4880                 /* can be retrieved by unprivileged users */
4881         },
4882         {
4883                 .cmd = NL80211_CMD_SET_INTERFACE,
4884                 .doit = nl80211_set_interface,
4885                 .policy = nl80211_policy,
4886                 .flags = GENL_ADMIN_PERM,
4887         },
4888         {
4889                 .cmd = NL80211_CMD_NEW_INTERFACE,
4890                 .doit = nl80211_new_interface,
4891                 .policy = nl80211_policy,
4892                 .flags = GENL_ADMIN_PERM,
4893         },
4894         {
4895                 .cmd = NL80211_CMD_DEL_INTERFACE,
4896                 .doit = nl80211_del_interface,
4897                 .policy = nl80211_policy,
4898                 .flags = GENL_ADMIN_PERM,
4899         },
4900         {
4901                 .cmd = NL80211_CMD_GET_KEY,
4902                 .doit = nl80211_get_key,
4903                 .policy = nl80211_policy,
4904                 .flags = GENL_ADMIN_PERM,
4905         },
4906         {
4907                 .cmd = NL80211_CMD_SET_KEY,
4908                 .doit = nl80211_set_key,
4909                 .policy = nl80211_policy,
4910                 .flags = GENL_ADMIN_PERM,
4911         },
4912         {
4913                 .cmd = NL80211_CMD_NEW_KEY,
4914                 .doit = nl80211_new_key,
4915                 .policy = nl80211_policy,
4916                 .flags = GENL_ADMIN_PERM,
4917         },
4918         {
4919                 .cmd = NL80211_CMD_DEL_KEY,
4920                 .doit = nl80211_del_key,
4921                 .policy = nl80211_policy,
4922                 .flags = GENL_ADMIN_PERM,
4923         },
4924         {
4925                 .cmd = NL80211_CMD_SET_BEACON,
4926                 .policy = nl80211_policy,
4927                 .flags = GENL_ADMIN_PERM,
4928                 .doit = nl80211_addset_beacon,
4929         },
4930         {
4931                 .cmd = NL80211_CMD_NEW_BEACON,
4932                 .policy = nl80211_policy,
4933                 .flags = GENL_ADMIN_PERM,
4934                 .doit = nl80211_addset_beacon,
4935         },
4936         {
4937                 .cmd = NL80211_CMD_DEL_BEACON,
4938                 .policy = nl80211_policy,
4939                 .flags = GENL_ADMIN_PERM,
4940                 .doit = nl80211_del_beacon,
4941         },
4942         {
4943                 .cmd = NL80211_CMD_GET_STATION,
4944                 .doit = nl80211_get_station,
4945                 .dumpit = nl80211_dump_station,
4946                 .policy = nl80211_policy,
4947         },
4948         {
4949                 .cmd = NL80211_CMD_SET_STATION,
4950                 .doit = nl80211_set_station,
4951                 .policy = nl80211_policy,
4952                 .flags = GENL_ADMIN_PERM,
4953         },
4954         {
4955                 .cmd = NL80211_CMD_NEW_STATION,
4956                 .doit = nl80211_new_station,
4957                 .policy = nl80211_policy,
4958                 .flags = GENL_ADMIN_PERM,
4959         },
4960         {
4961                 .cmd = NL80211_CMD_DEL_STATION,
4962                 .doit = nl80211_del_station,
4963                 .policy = nl80211_policy,
4964                 .flags = GENL_ADMIN_PERM,
4965         },
4966         {
4967                 .cmd = NL80211_CMD_GET_MPATH,
4968                 .doit = nl80211_get_mpath,
4969                 .dumpit = nl80211_dump_mpath,
4970                 .policy = nl80211_policy,
4971                 .flags = GENL_ADMIN_PERM,
4972         },
4973         {
4974                 .cmd = NL80211_CMD_SET_MPATH,
4975                 .doit = nl80211_set_mpath,
4976                 .policy = nl80211_policy,
4977                 .flags = GENL_ADMIN_PERM,
4978         },
4979         {
4980                 .cmd = NL80211_CMD_NEW_MPATH,
4981                 .doit = nl80211_new_mpath,
4982                 .policy = nl80211_policy,
4983                 .flags = GENL_ADMIN_PERM,
4984         },
4985         {
4986                 .cmd = NL80211_CMD_DEL_MPATH,
4987                 .doit = nl80211_del_mpath,
4988                 .policy = nl80211_policy,
4989                 .flags = GENL_ADMIN_PERM,
4990         },
4991         {
4992                 .cmd = NL80211_CMD_SET_BSS,
4993                 .doit = nl80211_set_bss,
4994                 .policy = nl80211_policy,
4995                 .flags = GENL_ADMIN_PERM,
4996         },
4997         {
4998                 .cmd = NL80211_CMD_GET_REG,
4999                 .doit = nl80211_get_reg,
5000                 .policy = nl80211_policy,
5001                 /* can be retrieved by unprivileged users */
5002         },
5003         {
5004                 .cmd = NL80211_CMD_SET_REG,
5005                 .doit = nl80211_set_reg,
5006                 .policy = nl80211_policy,
5007                 .flags = GENL_ADMIN_PERM,
5008         },
5009         {
5010                 .cmd = NL80211_CMD_REQ_SET_REG,
5011                 .doit = nl80211_req_set_reg,
5012                 .policy = nl80211_policy,
5013                 .flags = GENL_ADMIN_PERM,
5014         },
5015         {
5016                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
5017                 .doit = nl80211_get_mesh_params,
5018                 .policy = nl80211_policy,
5019                 /* can be retrieved by unprivileged users */
5020         },
5021         {
5022                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
5023                 .doit = nl80211_set_mesh_params,
5024                 .policy = nl80211_policy,
5025                 .flags = GENL_ADMIN_PERM,
5026         },
5027         {
5028                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5029                 .doit = nl80211_trigger_scan,
5030                 .policy = nl80211_policy,
5031                 .flags = GENL_ADMIN_PERM,
5032         },
5033         {
5034                 .cmd = NL80211_CMD_GET_SCAN,
5035                 .policy = nl80211_policy,
5036                 .dumpit = nl80211_dump_scan,
5037         },
5038         {
5039                 .cmd = NL80211_CMD_AUTHENTICATE,
5040                 .doit = nl80211_authenticate,
5041                 .policy = nl80211_policy,
5042                 .flags = GENL_ADMIN_PERM,
5043         },
5044         {
5045                 .cmd = NL80211_CMD_ASSOCIATE,
5046                 .doit = nl80211_associate,
5047                 .policy = nl80211_policy,
5048                 .flags = GENL_ADMIN_PERM,
5049         },
5050         {
5051                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5052                 .doit = nl80211_deauthenticate,
5053                 .policy = nl80211_policy,
5054                 .flags = GENL_ADMIN_PERM,
5055         },
5056         {
5057                 .cmd = NL80211_CMD_DISASSOCIATE,
5058                 .doit = nl80211_disassociate,
5059                 .policy = nl80211_policy,
5060                 .flags = GENL_ADMIN_PERM,
5061         },
5062         {
5063                 .cmd = NL80211_CMD_JOIN_IBSS,
5064                 .doit = nl80211_join_ibss,
5065                 .policy = nl80211_policy,
5066                 .flags = GENL_ADMIN_PERM,
5067         },
5068         {
5069                 .cmd = NL80211_CMD_LEAVE_IBSS,
5070                 .doit = nl80211_leave_ibss,
5071                 .policy = nl80211_policy,
5072                 .flags = GENL_ADMIN_PERM,
5073         },
5074 #ifdef CONFIG_NL80211_TESTMODE
5075         {
5076                 .cmd = NL80211_CMD_TESTMODE,
5077                 .doit = nl80211_testmode_do,
5078                 .policy = nl80211_policy,
5079                 .flags = GENL_ADMIN_PERM,
5080         },
5081 #endif
5082         {
5083                 .cmd = NL80211_CMD_CONNECT,
5084                 .doit = nl80211_connect,
5085                 .policy = nl80211_policy,
5086                 .flags = GENL_ADMIN_PERM,
5087         },
5088         {
5089                 .cmd = NL80211_CMD_DISCONNECT,
5090                 .doit = nl80211_disconnect,
5091                 .policy = nl80211_policy,
5092                 .flags = GENL_ADMIN_PERM,
5093         },
5094         {
5095                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5096                 .doit = nl80211_wiphy_netns,
5097                 .policy = nl80211_policy,
5098                 .flags = GENL_ADMIN_PERM,
5099         },
5100         {
5101                 .cmd = NL80211_CMD_GET_SURVEY,
5102                 .policy = nl80211_policy,
5103                 .dumpit = nl80211_dump_survey,
5104         },
5105         {
5106                 .cmd = NL80211_CMD_SET_PMKSA,
5107                 .doit = nl80211_setdel_pmksa,
5108                 .policy = nl80211_policy,
5109                 .flags = GENL_ADMIN_PERM,
5110         },
5111         {
5112                 .cmd = NL80211_CMD_DEL_PMKSA,
5113                 .doit = nl80211_setdel_pmksa,
5114                 .policy = nl80211_policy,
5115                 .flags = GENL_ADMIN_PERM,
5116         },
5117         {
5118                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5119                 .doit = nl80211_flush_pmksa,
5120                 .policy = nl80211_policy,
5121                 .flags = GENL_ADMIN_PERM,
5122         },
5123         {
5124                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5125                 .doit = nl80211_remain_on_channel,
5126                 .policy = nl80211_policy,
5127                 .flags = GENL_ADMIN_PERM,
5128         },
5129         {
5130                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5131                 .doit = nl80211_cancel_remain_on_channel,
5132                 .policy = nl80211_policy,
5133                 .flags = GENL_ADMIN_PERM,
5134         },
5135         {
5136                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5137                 .doit = nl80211_set_tx_bitrate_mask,
5138                 .policy = nl80211_policy,
5139                 .flags = GENL_ADMIN_PERM,
5140         },
5141         {
5142                 .cmd = NL80211_CMD_REGISTER_ACTION,
5143                 .doit = nl80211_register_action,
5144                 .policy = nl80211_policy,
5145                 .flags = GENL_ADMIN_PERM,
5146         },
5147         {
5148                 .cmd = NL80211_CMD_ACTION,
5149                 .doit = nl80211_action,
5150                 .policy = nl80211_policy,
5151                 .flags = GENL_ADMIN_PERM,
5152         },
5153         {
5154                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5155                 .doit = nl80211_set_power_save,
5156                 .policy = nl80211_policy,
5157                 .flags = GENL_ADMIN_PERM,
5158         },
5159         {
5160                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5161                 .doit = nl80211_get_power_save,
5162                 .policy = nl80211_policy,
5163                 /* can be retrieved by unprivileged users */
5164         },
5165         {
5166                 .cmd = NL80211_CMD_SET_CQM,
5167                 .doit = nl80211_set_cqm,
5168                 .policy = nl80211_policy,
5169                 .flags = GENL_ADMIN_PERM,
5170         },
5171 };
5172
5173 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5174         .name = "mlme",
5175 };
5176
5177 /* multicast groups */
5178 static struct genl_multicast_group nl80211_config_mcgrp = {
5179         .name = "config",
5180 };
5181 static struct genl_multicast_group nl80211_scan_mcgrp = {
5182         .name = "scan",
5183 };
5184 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5185         .name = "regulatory",
5186 };
5187
5188 /* notification functions */
5189
5190 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5191 {
5192         struct sk_buff *msg;
5193
5194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5195         if (!msg)
5196                 return;
5197
5198         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5199                 nlmsg_free(msg);
5200                 return;
5201         }
5202
5203         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5204                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5205 }
5206
5207 static int nl80211_add_scan_req(struct sk_buff *msg,
5208                                 struct cfg80211_registered_device *rdev)
5209 {
5210         struct cfg80211_scan_request *req = rdev->scan_req;
5211         struct nlattr *nest;
5212         int i;
5213
5214         ASSERT_RDEV_LOCK(rdev);
5215
5216         if (WARN_ON(!req))
5217                 return 0;
5218
5219         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5220         if (!nest)
5221                 goto nla_put_failure;
5222         for (i = 0; i < req->n_ssids; i++)
5223                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5224         nla_nest_end(msg, nest);
5225
5226         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5227         if (!nest)
5228                 goto nla_put_failure;
5229         for (i = 0; i < req->n_channels; i++)
5230                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5231         nla_nest_end(msg, nest);
5232
5233         if (req->ie)
5234                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5235
5236         return 0;
5237  nla_put_failure:
5238         return -ENOBUFS;
5239 }
5240
5241 static int nl80211_send_scan_msg(struct sk_buff *msg,
5242                                  struct cfg80211_registered_device *rdev,
5243                                  struct net_device *netdev,
5244                                  u32 pid, u32 seq, int flags,
5245                                  u32 cmd)
5246 {
5247         void *hdr;
5248
5249         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5250         if (!hdr)
5251                 return -1;
5252
5253         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5254         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5255
5256         /* ignore errors and send incomplete event anyway */
5257         nl80211_add_scan_req(msg, rdev);
5258
5259         return genlmsg_end(msg, hdr);
5260
5261  nla_put_failure:
5262         genlmsg_cancel(msg, hdr);
5263         return -EMSGSIZE;
5264 }
5265
5266 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5267                              struct net_device *netdev)
5268 {
5269         struct sk_buff *msg;
5270
5271         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5272         if (!msg)
5273                 return;
5274
5275         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5276                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5277                 nlmsg_free(msg);
5278                 return;
5279         }
5280
5281         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5282                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5283 }
5284
5285 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5286                             struct net_device *netdev)
5287 {
5288         struct sk_buff *msg;
5289
5290         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5291         if (!msg)
5292                 return;
5293
5294         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5295                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5296                 nlmsg_free(msg);
5297                 return;
5298         }
5299
5300         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5301                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5302 }
5303
5304 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5305                                struct net_device *netdev)
5306 {
5307         struct sk_buff *msg;
5308
5309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5310         if (!msg)
5311                 return;
5312
5313         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5314                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5315                 nlmsg_free(msg);
5316                 return;
5317         }
5318
5319         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5320                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5321 }
5322
5323 /*
5324  * This can happen on global regulatory changes or device specific settings
5325  * based on custom world regulatory domains.
5326  */
5327 void nl80211_send_reg_change_event(struct regulatory_request *request)
5328 {
5329         struct sk_buff *msg;
5330         void *hdr;
5331
5332         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5333         if (!msg)
5334                 return;
5335
5336         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5337         if (!hdr) {
5338                 nlmsg_free(msg);
5339                 return;
5340         }
5341
5342         /* Userspace can always count this one always being set */
5343         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5344
5345         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5346                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5347                            NL80211_REGDOM_TYPE_WORLD);
5348         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5349                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5350                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5351         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5352                  request->intersect)
5353                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5354                            NL80211_REGDOM_TYPE_INTERSECTION);
5355         else {
5356                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5357                            NL80211_REGDOM_TYPE_COUNTRY);
5358                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5359         }
5360
5361         if (wiphy_idx_valid(request->wiphy_idx))
5362                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5363
5364         if (genlmsg_end(msg, hdr) < 0) {
5365                 nlmsg_free(msg);
5366                 return;
5367         }
5368
5369         rcu_read_lock();
5370         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5371                                 GFP_ATOMIC);
5372         rcu_read_unlock();
5373
5374         return;
5375
5376 nla_put_failure:
5377         genlmsg_cancel(msg, hdr);
5378         nlmsg_free(msg);
5379 }
5380
5381 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5382                                     struct net_device *netdev,
5383                                     const u8 *buf, size_t len,
5384                                     enum nl80211_commands cmd, gfp_t gfp)
5385 {
5386         struct sk_buff *msg;
5387         void *hdr;
5388
5389         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5390         if (!msg)
5391                 return;
5392
5393         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5394         if (!hdr) {
5395                 nlmsg_free(msg);
5396                 return;
5397         }
5398
5399         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5400         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5401         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5402
5403         if (genlmsg_end(msg, hdr) < 0) {
5404                 nlmsg_free(msg);
5405                 return;
5406         }
5407
5408         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5409                                 nl80211_mlme_mcgrp.id, gfp);
5410         return;
5411
5412  nla_put_failure:
5413         genlmsg_cancel(msg, hdr);
5414         nlmsg_free(msg);
5415 }
5416
5417 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5418                           struct net_device *netdev, const u8 *buf,
5419                           size_t len, gfp_t gfp)
5420 {
5421         nl80211_send_mlme_event(rdev, netdev, buf, len,
5422                                 NL80211_CMD_AUTHENTICATE, gfp);
5423 }
5424
5425 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5426                            struct net_device *netdev, const u8 *buf,
5427                            size_t len, gfp_t gfp)
5428 {
5429         nl80211_send_mlme_event(rdev, netdev, buf, len,
5430                                 NL80211_CMD_ASSOCIATE, gfp);
5431 }
5432
5433 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5434                          struct net_device *netdev, const u8 *buf,
5435                          size_t len, gfp_t gfp)
5436 {
5437         nl80211_send_mlme_event(rdev, netdev, buf, len,
5438                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5439 }
5440
5441 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5442                            struct net_device *netdev, const u8 *buf,
5443                            size_t len, gfp_t gfp)
5444 {
5445         nl80211_send_mlme_event(rdev, netdev, buf, len,
5446                                 NL80211_CMD_DISASSOCIATE, gfp);
5447 }
5448
5449 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5450                                       struct net_device *netdev, int cmd,
5451                                       const u8 *addr, gfp_t gfp)
5452 {
5453         struct sk_buff *msg;
5454         void *hdr;
5455
5456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5457         if (!msg)
5458                 return;
5459
5460         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5461         if (!hdr) {
5462                 nlmsg_free(msg);
5463                 return;
5464         }
5465
5466         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5467         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5468         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5469         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5470
5471         if (genlmsg_end(msg, hdr) < 0) {
5472                 nlmsg_free(msg);
5473                 return;
5474         }
5475
5476         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5477                                 nl80211_mlme_mcgrp.id, gfp);
5478         return;
5479
5480  nla_put_failure:
5481         genlmsg_cancel(msg, hdr);
5482         nlmsg_free(msg);
5483 }
5484
5485 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5486                                struct net_device *netdev, const u8 *addr,
5487                                gfp_t gfp)
5488 {
5489         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5490                                   addr, gfp);
5491 }
5492
5493 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5494                                 struct net_device *netdev, const u8 *addr,
5495                                 gfp_t gfp)
5496 {
5497         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5498                                   addr, gfp);
5499 }
5500
5501 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5502                                  struct net_device *netdev, const u8 *bssid,
5503                                  const u8 *req_ie, size_t req_ie_len,
5504                                  const u8 *resp_ie, size_t resp_ie_len,
5505                                  u16 status, gfp_t gfp)
5506 {
5507         struct sk_buff *msg;
5508         void *hdr;
5509
5510         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5511         if (!msg)
5512                 return;
5513
5514         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5515         if (!hdr) {
5516                 nlmsg_free(msg);
5517                 return;
5518         }
5519
5520         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5521         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5522         if (bssid)
5523                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5524         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5525         if (req_ie)
5526                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5527         if (resp_ie)
5528                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5529
5530         if (genlmsg_end(msg, hdr) < 0) {
5531                 nlmsg_free(msg);
5532                 return;
5533         }
5534
5535         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5536                                 nl80211_mlme_mcgrp.id, gfp);
5537         return;
5538
5539  nla_put_failure:
5540         genlmsg_cancel(msg, hdr);
5541         nlmsg_free(msg);
5542
5543 }
5544
5545 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5546                          struct net_device *netdev, const u8 *bssid,
5547                          const u8 *req_ie, size_t req_ie_len,
5548                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5549 {
5550         struct sk_buff *msg;
5551         void *hdr;
5552
5553         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5554         if (!msg)
5555                 return;
5556
5557         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5558         if (!hdr) {
5559                 nlmsg_free(msg);
5560                 return;
5561         }
5562
5563         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5564         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5565         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5566         if (req_ie)
5567                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5568         if (resp_ie)
5569                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5570
5571         if (genlmsg_end(msg, hdr) < 0) {
5572                 nlmsg_free(msg);
5573                 return;
5574         }
5575
5576         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5577                                 nl80211_mlme_mcgrp.id, gfp);
5578         return;
5579
5580  nla_put_failure:
5581         genlmsg_cancel(msg, hdr);
5582         nlmsg_free(msg);
5583
5584 }
5585
5586 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5587                                struct net_device *netdev, u16 reason,
5588                                const u8 *ie, size_t ie_len, bool from_ap)
5589 {
5590         struct sk_buff *msg;
5591         void *hdr;
5592
5593         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5594         if (!msg)
5595                 return;
5596
5597         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5598         if (!hdr) {
5599                 nlmsg_free(msg);
5600                 return;
5601         }
5602
5603         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5604         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5605         if (from_ap && reason)
5606                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5607         if (from_ap)
5608                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5609         if (ie)
5610                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5611
5612         if (genlmsg_end(msg, hdr) < 0) {
5613                 nlmsg_free(msg);
5614                 return;
5615         }
5616
5617         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5618                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5619         return;
5620
5621  nla_put_failure:
5622         genlmsg_cancel(msg, hdr);
5623         nlmsg_free(msg);
5624
5625 }
5626
5627 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5628                              struct net_device *netdev, const u8 *bssid,
5629                              gfp_t gfp)
5630 {
5631         struct sk_buff *msg;
5632         void *hdr;
5633
5634         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5635         if (!msg)
5636                 return;
5637
5638         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5639         if (!hdr) {
5640                 nlmsg_free(msg);
5641                 return;
5642         }
5643
5644         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5645         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5646         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5647
5648         if (genlmsg_end(msg, hdr) < 0) {
5649                 nlmsg_free(msg);
5650                 return;
5651         }
5652
5653         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5654                                 nl80211_mlme_mcgrp.id, gfp);
5655         return;
5656
5657  nla_put_failure:
5658         genlmsg_cancel(msg, hdr);
5659         nlmsg_free(msg);
5660 }
5661
5662 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5663                                  struct net_device *netdev, const u8 *addr,
5664                                  enum nl80211_key_type key_type, int key_id,
5665                                  const u8 *tsc, gfp_t gfp)
5666 {
5667         struct sk_buff *msg;
5668         void *hdr;
5669
5670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5671         if (!msg)
5672                 return;
5673
5674         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5675         if (!hdr) {
5676                 nlmsg_free(msg);
5677                 return;
5678         }
5679
5680         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5681         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5682         if (addr)
5683                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5684         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5685         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5686         if (tsc)
5687                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5688
5689         if (genlmsg_end(msg, hdr) < 0) {
5690                 nlmsg_free(msg);
5691                 return;
5692         }
5693
5694         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5695                                 nl80211_mlme_mcgrp.id, gfp);
5696         return;
5697
5698  nla_put_failure:
5699         genlmsg_cancel(msg, hdr);
5700         nlmsg_free(msg);
5701 }
5702
5703 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5704                                     struct ieee80211_channel *channel_before,
5705                                     struct ieee80211_channel *channel_after)
5706 {
5707         struct sk_buff *msg;
5708         void *hdr;
5709         struct nlattr *nl_freq;
5710
5711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5712         if (!msg)
5713                 return;
5714
5715         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5716         if (!hdr) {
5717                 nlmsg_free(msg);
5718                 return;
5719         }
5720
5721         /*
5722          * Since we are applying the beacon hint to a wiphy we know its
5723          * wiphy_idx is valid
5724          */
5725         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5726
5727         /* Before */
5728         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5729         if (!nl_freq)
5730                 goto nla_put_failure;
5731         if (nl80211_msg_put_channel(msg, channel_before))
5732                 goto nla_put_failure;
5733         nla_nest_end(msg, nl_freq);
5734
5735         /* After */
5736         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5737         if (!nl_freq)
5738                 goto nla_put_failure;
5739         if (nl80211_msg_put_channel(msg, channel_after))
5740                 goto nla_put_failure;
5741         nla_nest_end(msg, nl_freq);
5742
5743         if (genlmsg_end(msg, hdr) < 0) {
5744                 nlmsg_free(msg);
5745                 return;
5746         }
5747
5748         rcu_read_lock();
5749         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5750                                 GFP_ATOMIC);
5751         rcu_read_unlock();
5752
5753         return;
5754
5755 nla_put_failure:
5756         genlmsg_cancel(msg, hdr);
5757         nlmsg_free(msg);
5758 }
5759
5760 static void nl80211_send_remain_on_chan_event(
5761         int cmd, struct cfg80211_registered_device *rdev,
5762         struct net_device *netdev, u64 cookie,
5763         struct ieee80211_channel *chan,
5764         enum nl80211_channel_type channel_type,
5765         unsigned int duration, gfp_t gfp)
5766 {
5767         struct sk_buff *msg;
5768         void *hdr;
5769
5770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5771         if (!msg)
5772                 return;
5773
5774         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5775         if (!hdr) {
5776                 nlmsg_free(msg);
5777                 return;
5778         }
5779
5780         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5781         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5782         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5783         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5784         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5785
5786         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5787                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5788
5789         if (genlmsg_end(msg, hdr) < 0) {
5790                 nlmsg_free(msg);
5791                 return;
5792         }
5793
5794         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5795                                 nl80211_mlme_mcgrp.id, gfp);
5796         return;
5797
5798  nla_put_failure:
5799         genlmsg_cancel(msg, hdr);
5800         nlmsg_free(msg);
5801 }
5802
5803 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5804                                     struct net_device *netdev, u64 cookie,
5805                                     struct ieee80211_channel *chan,
5806                                     enum nl80211_channel_type channel_type,
5807                                     unsigned int duration, gfp_t gfp)
5808 {
5809         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5810                                           rdev, netdev, cookie, chan,
5811                                           channel_type, duration, gfp);
5812 }
5813
5814 void nl80211_send_remain_on_channel_cancel(
5815         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5816         u64 cookie, struct ieee80211_channel *chan,
5817         enum nl80211_channel_type channel_type, gfp_t gfp)
5818 {
5819         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5820                                           rdev, netdev, cookie, chan,
5821                                           channel_type, 0, gfp);
5822 }
5823
5824 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5825                             struct net_device *dev, const u8 *mac_addr,
5826                             struct station_info *sinfo, gfp_t gfp)
5827 {
5828         struct sk_buff *msg;
5829
5830         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5831         if (!msg)
5832                 return;
5833
5834         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5835                 nlmsg_free(msg);
5836                 return;
5837         }
5838
5839         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5840                                 nl80211_mlme_mcgrp.id, gfp);
5841 }
5842
5843 int nl80211_send_action(struct cfg80211_registered_device *rdev,
5844                         struct net_device *netdev, u32 nlpid,
5845                         int freq, const u8 *buf, size_t len, gfp_t gfp)
5846 {
5847         struct sk_buff *msg;
5848         void *hdr;
5849         int err;
5850
5851         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5852         if (!msg)
5853                 return -ENOMEM;
5854
5855         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
5856         if (!hdr) {
5857                 nlmsg_free(msg);
5858                 return -ENOMEM;
5859         }
5860
5861         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5862         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5863         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5864         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5865
5866         err = genlmsg_end(msg, hdr);
5867         if (err < 0) {
5868                 nlmsg_free(msg);
5869                 return err;
5870         }
5871
5872         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5873         if (err < 0)
5874                 return err;
5875         return 0;
5876
5877  nla_put_failure:
5878         genlmsg_cancel(msg, hdr);
5879         nlmsg_free(msg);
5880         return -ENOBUFS;
5881 }
5882
5883 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
5884                                    struct net_device *netdev, u64 cookie,
5885                                    const u8 *buf, size_t len, bool ack,
5886                                    gfp_t gfp)
5887 {
5888         struct sk_buff *msg;
5889         void *hdr;
5890
5891         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5892         if (!msg)
5893                 return;
5894
5895         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
5896         if (!hdr) {
5897                 nlmsg_free(msg);
5898                 return;
5899         }
5900
5901         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5902         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5903         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5904         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5905         if (ack)
5906                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5907
5908         if (genlmsg_end(msg, hdr) < 0) {
5909                 nlmsg_free(msg);
5910                 return;
5911         }
5912
5913         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5914         return;
5915
5916  nla_put_failure:
5917         genlmsg_cancel(msg, hdr);
5918         nlmsg_free(msg);
5919 }
5920
5921 void
5922 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
5923                              struct net_device *netdev,
5924                              enum nl80211_cqm_rssi_threshold_event rssi_event,
5925                              gfp_t gfp)
5926 {
5927         struct sk_buff *msg;
5928         struct nlattr *pinfoattr;
5929         void *hdr;
5930
5931         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5932         if (!msg)
5933                 return;
5934
5935         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5936         if (!hdr) {
5937                 nlmsg_free(msg);
5938                 return;
5939         }
5940
5941         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5942         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5943
5944         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5945         if (!pinfoattr)
5946                 goto nla_put_failure;
5947
5948         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
5949                     rssi_event);
5950
5951         nla_nest_end(msg, pinfoattr);
5952
5953         if (genlmsg_end(msg, hdr) < 0) {
5954                 nlmsg_free(msg);
5955                 return;
5956         }
5957
5958         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5959                                 nl80211_mlme_mcgrp.id, gfp);
5960         return;
5961
5962  nla_put_failure:
5963         genlmsg_cancel(msg, hdr);
5964         nlmsg_free(msg);
5965 }
5966
5967 static int nl80211_netlink_notify(struct notifier_block * nb,
5968                                   unsigned long state,
5969                                   void *_notify)
5970 {
5971         struct netlink_notify *notify = _notify;
5972         struct cfg80211_registered_device *rdev;
5973         struct wireless_dev *wdev;
5974
5975         if (state != NETLINK_URELEASE)
5976                 return NOTIFY_DONE;
5977
5978         rcu_read_lock();
5979
5980         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5981                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5982                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
5983
5984         rcu_read_unlock();
5985
5986         return NOTIFY_DONE;
5987 }
5988
5989 static struct notifier_block nl80211_netlink_notifier = {
5990         .notifier_call = nl80211_netlink_notify,
5991 };
5992
5993 /* initialisation/exit functions */
5994
5995 int nl80211_init(void)
5996 {
5997         int err;
5998
5999         err = genl_register_family_with_ops(&nl80211_fam,
6000                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6001         if (err)
6002                 return err;
6003
6004         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6005         if (err)
6006                 goto err_out;
6007
6008         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6009         if (err)
6010                 goto err_out;
6011
6012         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6013         if (err)
6014                 goto err_out;
6015
6016         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6017         if (err)
6018                 goto err_out;
6019
6020 #ifdef CONFIG_NL80211_TESTMODE
6021         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6022         if (err)
6023                 goto err_out;
6024 #endif
6025
6026         err = netlink_register_notifier(&nl80211_netlink_notifier);
6027         if (err)
6028                 goto err_out;
6029
6030         return 0;
6031  err_out:
6032         genl_unregister_family(&nl80211_fam);
6033         return err;
6034 }
6035
6036 void nl80211_exit(void)
6037 {
6038         netlink_unregister_notifier(&nl80211_netlink_notifier);
6039         genl_unregister_family(&nl80211_fam);
6040 }