SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 /* the netlink family */
  27 static struct genl_family nl80211_fam = {
  28         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  29         .name = "nl80211",      /* have users key off the name instead */
  30         .hdrsize = 0,           /* no private header */
  31         .version = 1,           /* no particular meaning now */
  32         .maxattr = NL80211_ATTR_MAX,
  33         .netnsok = true,
  34 };
  35
  36 /* internal helper: get rdev and dev */
  37 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  38                                        struct cfg80211_registered_device **rdev,
  39                                        struct net_device **dev)
  40 {
  41         struct nlattr **attrs = info->attrs;
  42         int ifindex;
  43
  44         if (!attrs[NL80211_ATTR_IFINDEX])
  45                 return -EINVAL;
  46
  47         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  48         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  49         if (!*dev)
  50                 return -ENODEV;
  51
  52         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  53         if (IS_ERR(*rdev)) {
  54                 dev_put(*dev);
  55                 return PTR_ERR(*rdev);
  56         }
  57
  58         return 0;
  59 }
  60
  61 /* policy for the attributes */
  62 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  63         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  65                                       .len = 20-1 },
  66         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  67         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  69         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  71         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  73         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  74
  75         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  77         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  78
  79         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  81
  82         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  83         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  84                                     .len = WLAN_MAX_KEY_LEN },
  85         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  86         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  87         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  88         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  89
  90         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  91         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  92         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  95                                        .len = IEEE80211_MAX_DATA_LEN },
  96         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  98         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  99         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 100                                                .len = NL80211_MAX_SUPP_RATES },
 101         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 102         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 103         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 104         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 105                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 106         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 107
 108         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 109         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 114         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 115                                            .len = NL80211_MAX_SUPP_RATES },
 116
 117         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 120                                          .len = NL80211_HT_CAPABILITY_LEN },
 121
 122         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 123         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 124                               .len = IEEE80211_MAX_DATA_LEN },
 125         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 126         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 127
 128         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 129                                 .len = IEEE80211_MAX_SSID_LEN },
 130         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 131         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 132         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 134         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 135         [NL80211_ATTR_STA_FLAGS2] = {
 136                 .len = sizeof(struct nl80211_sta_flag_update),
 137         },
 138         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 140         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 141         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 142         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 143         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 144         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 145                                  .len = WLAN_PMKID_LEN },
 146         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 147         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 148         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 149         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 150                                  .len = IEEE80211_MAX_DATA_LEN },
 151         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 152         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 153         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 154         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 155 };
 156
 157 /* policy for the attributes */
 158 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 159         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 160         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 161         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 162         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 163         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 164         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 165 };
 166
 167 /* ifidx get helper */
 168 static int nl80211_get_ifidx(struct netlink_callback *cb)
 169 {
 170         int res;
 171
 172         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 173                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 174                           nl80211_policy);
 175         if (res)
 176                 return res;
 177
 178         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 179                 return -EINVAL;
 180
 181         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 182         if (!res)
 183                 return -EINVAL;
 184         return res;
 185 }
 186
 187 /* IE validation */
 188 static bool is_valid_ie_attr(const struct nlattr *attr)
 189 {
 190         const u8 *pos;
 191         int len;
 192
 193         if (!attr)
 194                 return true;
 195
 196         pos = nla_data(attr);
 197         len = nla_len(attr);
 198
 199         while (len) {
 200                 u8 elemlen;
 201
 202                 if (len < 2)
 203                         return false;
 204                 len -= 2;
 205
 206                 elemlen = pos[1];
 207                 if (elemlen > len)
 208                         return false;
 209
 210                 len -= elemlen;
 211                 pos += 2 + elemlen;
 212         }
 213
 214         return true;
 215 }
 216
 217 /* message building helper */
 218 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 219                                    int flags, u8 cmd)
 220 {
 221         /* since there is no private header just add the generic one */
 222         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 223 }
 224
 225 static int nl80211_msg_put_channel(struct sk_buff *msg,
 226                                    struct ieee80211_channel *chan)
 227 {
 228         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 229                     chan->center_freq);
 230
 231         if (chan->flags & IEEE80211_CHAN_DISABLED)
 232                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 233         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 234                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 235         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 236                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 237         if (chan->flags & IEEE80211_CHAN_RADAR)
 238                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 239
 240         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 241                     DBM_TO_MBM(chan->max_power));
 242
 243         return 0;
 244
 245  nla_put_failure:
 246         return -ENOBUFS;
 247 }
 248
 249 /* netlink command implementations */
 250
 251 struct key_parse {
 252         struct key_params p;
 253         int idx;
 254         bool def, defmgmt;
 255 };
 256
 257 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 258 {
 259         struct nlattr *tb[NL80211_KEY_MAX + 1];
 260         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 261                                    nl80211_key_policy);
 262         if (err)
 263                 return err;
 264
 265         k->def = !!tb[NL80211_KEY_DEFAULT];
 266         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 267
 268         if (tb[NL80211_KEY_IDX])
 269                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 270
 271         if (tb[NL80211_KEY_DATA]) {
 272                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 273                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 274         }
 275
 276         if (tb[NL80211_KEY_SEQ]) {
 277                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 278                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 279         }
 280
 281         if (tb[NL80211_KEY_CIPHER])
 282                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 283
 284         return 0;
 285 }
 286
 287 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 288 {
 289         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 290                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 291                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 292         }
 293
 294         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 295                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 296                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 297         }
 298
 299         if (info->attrs[NL80211_ATTR_KEY_IDX])
 300                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 301
 302         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 303                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 304
 305         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 306         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 307
 308         return 0;
 309 }
 310
 311 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 312 {
 313         int err;
 314
 315         memset(k, 0, sizeof(*k));
 316         k->idx = -1;
 317
 318         if (info->attrs[NL80211_ATTR_KEY])
 319                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 320         else
 321                 err = nl80211_parse_key_old(info, k);
 322
 323         if (err)
 324                 return err;
 325
 326         if (k->def && k->defmgmt)
 327                 return -EINVAL;
 328
 329         if (k->idx != -1) {
 330                 if (k->defmgmt) {
 331                         if (k->idx < 4 || k->idx > 5)
 332                                 return -EINVAL;
 333                 } else if (k->def) {
 334                         if (k->idx < 0 || k->idx > 3)
 335                                 return -EINVAL;
 336                 } else {
 337                         if (k->idx < 0 || k->idx > 5)
 338                                 return -EINVAL;
 339                 }
 340         }
 341
 342         return 0;
 343 }
 344
 345 static struct cfg80211_cached_keys *
 346 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 347                        struct nlattr *keys)
 348 {
 349         struct key_parse parse;
 350         struct nlattr *key;
 351         struct cfg80211_cached_keys *result;
 352         int rem, err, def = 0;
 353
 354         result = kzalloc(sizeof(*result), GFP_KERNEL);
 355         if (!result)
 356                 return ERR_PTR(-ENOMEM);
 357
 358         result->def = -1;
 359         result->defmgmt = -1;
 360
 361         nla_for_each_nested(key, keys, rem) {
 362                 memset(&parse, 0, sizeof(parse));
 363                 parse.idx = -1;
 364
 365                 err = nl80211_parse_key_new(key, &parse);
 366                 if (err)
 367                         goto error;
 368                 err = -EINVAL;
 369                 if (!parse.p.key)
 370                         goto error;
 371                 if (parse.idx < 0 || parse.idx > 4)
 372                         goto error;
 373                 if (parse.def) {
 374                         if (def)
 375                                 goto error;
 376                         def = 1;
 377                         result->def = parse.idx;
 378                 } else if (parse.defmgmt)
 379                         goto error;
 380                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 381                                                      parse.idx, NULL);
 382                 if (err)
 383                         goto error;
 384                 result->params[parse.idx].cipher = parse.p.cipher;
 385                 result->params[parse.idx].key_len = parse.p.key_len;
 386                 result->params[parse.idx].key = result->data[parse.idx];
 387                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 388         }
 389
 390         return result;
 391  error:
 392         kfree(result);
 393         return ERR_PTR(err);
 394 }
 395
 396 static int nl80211_key_allowed(struct wireless_dev *wdev)
 397 {
 398         ASSERT_WDEV_LOCK(wdev);
 399
 400         if (!netif_running(wdev->netdev))
 401                 return -ENETDOWN;
 402
 403         switch (wdev->iftype) {
 404         case NL80211_IFTYPE_AP:
 405         case NL80211_IFTYPE_AP_VLAN:
 406                 break;
 407         case NL80211_IFTYPE_ADHOC:
 408                 if (!wdev->current_bss)
 409                         return -ENOLINK;
 410                 break;
 411         case NL80211_IFTYPE_STATION:
 412                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 413                         return -ENOLINK;
 414                 break;
 415         default:
 416                 return -EINVAL;
 417         }
 418
 419         return 0;
 420 }
 421
 422 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 423                               struct cfg80211_registered_device *dev)
 424 {
 425         void *hdr;
 426         struct nlattr *nl_bands, *nl_band;
 427         struct nlattr *nl_freqs, *nl_freq;
 428         struct nlattr *nl_rates, *nl_rate;
 429         struct nlattr *nl_modes;
 430         struct nlattr *nl_cmds;
 431         enum ieee80211_band band;
 432         struct ieee80211_channel *chan;
 433         struct ieee80211_rate *rate;
 434         int i;
 435         u16 ifmodes = dev->wiphy.interface_modes;
 436
 437         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 438         if (!hdr)
 439                 return -1;
 440
 441         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 442         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 443
 444         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 445                     cfg80211_rdev_list_generation);
 446
 447         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 448                    dev->wiphy.retry_short);
 449         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 450                    dev->wiphy.retry_long);
 451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 452                     dev->wiphy.frag_threshold);
 453         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 454                     dev->wiphy.rts_threshold);
 455         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 456                     dev->wiphy.coverage_class);
 457
 458         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 459                    dev->wiphy.max_scan_ssids);
 460         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 461                     dev->wiphy.max_scan_ie_len);
 462
 463         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 464                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 465                 dev->wiphy.cipher_suites);
 466
 467         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 468                    dev->wiphy.max_num_pmkids);
 469
 470         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 471         if (!nl_modes)
 472                 goto nla_put_failure;
 473
 474         i = 0;
 475         while (ifmodes) {
 476                 if (ifmodes & 1)
 477                         NLA_PUT_FLAG(msg, i);
 478                 ifmodes >>= 1;
 479                 i++;
 480         }
 481
 482         nla_nest_end(msg, nl_modes);
 483
 484         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 485         if (!nl_bands)
 486                 goto nla_put_failure;
 487
 488         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 489                 if (!dev->wiphy.bands[band])
 490                         continue;
 491
 492                 nl_band = nla_nest_start(msg, band);
 493                 if (!nl_band)
 494                         goto nla_put_failure;
 495
 496                 /* add HT info */
 497                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 498                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 499                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 500                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 501                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 502                                 dev->wiphy.bands[band]->ht_cap.cap);
 503                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 504                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 505                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 506                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 507                 }
 508
 509                 /* add frequencies */
 510                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 511                 if (!nl_freqs)
 512                         goto nla_put_failure;
 513
 514                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 515                         nl_freq = nla_nest_start(msg, i);
 516                         if (!nl_freq)
 517                                 goto nla_put_failure;
 518
 519                         chan = &dev->wiphy.bands[band]->channels[i];
 520
 521                         if (nl80211_msg_put_channel(msg, chan))
 522                                 goto nla_put_failure;
 523
 524                         nla_nest_end(msg, nl_freq);
 525                 }
 526
 527                 nla_nest_end(msg, nl_freqs);
 528
 529                 /* add bitrates */
 530                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 531                 if (!nl_rates)
 532                         goto nla_put_failure;
 533
 534                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 535                         nl_rate = nla_nest_start(msg, i);
 536                         if (!nl_rate)
 537                                 goto nla_put_failure;
 538
 539                         rate = &dev->wiphy.bands[band]->bitrates[i];
 540                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 541                                     rate->bitrate);
 542                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 543                                 NLA_PUT_FLAG(msg,
 544                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 545
 546                         nla_nest_end(msg, nl_rate);
 547                 }
 548
 549                 nla_nest_end(msg, nl_rates);
 550
 551                 nla_nest_end(msg, nl_band);
 552         }
 553         nla_nest_end(msg, nl_bands);
 554
 555         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 556         if (!nl_cmds)
 557                 goto nla_put_failure;
 558
 559         i = 0;
 560 #define CMD(op, n)                                              \
 561          do {                                                   \
 562                 if (dev->ops->op) {                             \
 563                         i++;                                    \
 564                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 565                 }                                               \
 566         } while (0)
 567
 568         CMD(add_virtual_intf, NEW_INTERFACE);
 569         CMD(change_virtual_intf, SET_INTERFACE);
 570         CMD(add_key, NEW_KEY);
 571         CMD(add_beacon, NEW_BEACON);
 572         CMD(add_station, NEW_STATION);
 573         CMD(add_mpath, NEW_MPATH);
 574         CMD(set_mesh_params, SET_MESH_PARAMS);
 575         CMD(change_bss, SET_BSS);
 576         CMD(auth, AUTHENTICATE);
 577         CMD(assoc, ASSOCIATE);
 578         CMD(deauth, DEAUTHENTICATE);
 579         CMD(disassoc, DISASSOCIATE);
 580         CMD(join_ibss, JOIN_IBSS);
 581         CMD(set_pmksa, SET_PMKSA);
 582         CMD(del_pmksa, DEL_PMKSA);
 583         CMD(flush_pmksa, FLUSH_PMKSA);
 584         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 585         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 586         CMD(action, ACTION);
 587         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 588                 i++;
 589                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 590         }
 591
 592 #undef CMD
 593
 594         if (dev->ops->connect || dev->ops->auth) {
 595                 i++;
 596                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 597         }
 598
 599         if (dev->ops->disconnect || dev->ops->deauth) {
 600                 i++;
 601                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 602         }
 603
 604         nla_nest_end(msg, nl_cmds);
 605
 606         return genlmsg_end(msg, hdr);
 607
 608  nla_put_failure:
 609         genlmsg_cancel(msg, hdr);
 610         return -EMSGSIZE;
 611 }
 612
 613 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 614 {
 615         int idx = 0;
 616         int start = cb->args[0];
 617         struct cfg80211_registered_device *dev;
 618
 619         mutex_lock(&cfg80211_mutex);
 620         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 621                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 622                         continue;
 623                 if (++idx <= start)
 624                         continue;
 625                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 626                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 627                                        dev) < 0) {
 628                         idx--;
 629                         break;
 630                 }
 631         }
 632         mutex_unlock(&cfg80211_mutex);
 633
 634         cb->args[0] = idx;
 635
 636         return skb->len;
 637 }
 638
 639 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 640 {
 641         struct sk_buff *msg;
 642         struct cfg80211_registered_device *dev;
 643
 644         dev = cfg80211_get_dev_from_info(info);
 645         if (IS_ERR(dev))
 646                 return PTR_ERR(dev);
 647
 648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 649         if (!msg)
 650                 goto out_err;
 651
 652         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 653                 goto out_free;
 654
 655         cfg80211_unlock_rdev(dev);
 656
 657         return genlmsg_reply(msg, info);
 658
 659  out_free:
 660         nlmsg_free(msg);
 661  out_err:
 662         cfg80211_unlock_rdev(dev);
 663         return -ENOBUFS;
 664 }
 665
 666 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 667         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 668         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 669         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 670         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 671         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 672 };
 673
 674 static int parse_txq_params(struct nlattr *tb[],
 675                             struct ieee80211_txq_params *txq_params)
 676 {
 677         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 678             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 679             !tb[NL80211_TXQ_ATTR_AIFS])
 680                 return -EINVAL;
 681
 682         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 683         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 684         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 685         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 686         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 687
 688         return 0;
 689 }
 690
 691 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 692 {
 693         struct cfg80211_registered_device *rdev;
 694         int result = 0, rem_txq_params = 0;
 695         struct nlattr *nl_txq_params;
 696         u32 changed;
 697         u8 retry_short = 0, retry_long = 0;
 698         u32 frag_threshold = 0, rts_threshold = 0;
 699         u8 coverage_class = 0;
 700
 701         rtnl_lock();
 702
 703         mutex_lock(&cfg80211_mutex);
 704
 705         rdev = __cfg80211_rdev_from_info(info);
 706         if (IS_ERR(rdev)) {
 707                 mutex_unlock(&cfg80211_mutex);
 708                 result = PTR_ERR(rdev);
 709                 goto unlock;
 710         }
 711
 712         mutex_lock(&rdev->mtx);
 713
 714         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 715                 result = cfg80211_dev_rename(
 716                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 717
 718         mutex_unlock(&cfg80211_mutex);
 719
 720         if (result)
 721                 goto bad_res;
 722
 723         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 724                 struct ieee80211_txq_params txq_params;
 725                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 726
 727                 if (!rdev->ops->set_txq_params) {
 728                         result = -EOPNOTSUPP;
 729                         goto bad_res;
 730                 }
 731
 732                 nla_for_each_nested(nl_txq_params,
 733                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 734                                     rem_txq_params) {
 735                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 736                                   nla_data(nl_txq_params),
 737                                   nla_len(nl_txq_params),
 738                                   txq_params_policy);
 739                         result = parse_txq_params(tb, &txq_params);
 740                         if (result)
 741                                 goto bad_res;
 742
 743                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 744                                                            &txq_params);
 745                         if (result)
 746                                 goto bad_res;
 747                 }
 748         }
 749
 750         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 751                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 752                 u32 freq;
 753
 754                 result = -EINVAL;
 755
 756                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 757                         channel_type = nla_get_u32(info->attrs[
 758                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 759                         if (channel_type != NL80211_CHAN_NO_HT &&
 760                             channel_type != NL80211_CHAN_HT20 &&
 761                             channel_type != NL80211_CHAN_HT40PLUS &&
 762                             channel_type != NL80211_CHAN_HT40MINUS)
 763                                 goto bad_res;
 764                 }
 765
 766                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 767
 768                 mutex_lock(&rdev->devlist_mtx);
 769                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 770                 mutex_unlock(&rdev->devlist_mtx);
 771                 if (result)
 772                         goto bad_res;
 773         }
 774
 775         changed = 0;
 776
 777         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 778                 retry_short = nla_get_u8(
 779                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 780                 if (retry_short == 0) {
 781                         result = -EINVAL;
 782                         goto bad_res;
 783                 }
 784                 changed |= WIPHY_PARAM_RETRY_SHORT;
 785         }
 786
 787         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 788                 retry_long = nla_get_u8(
 789                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 790                 if (retry_long == 0) {
 791                         result = -EINVAL;
 792                         goto bad_res;
 793                 }
 794                 changed |= WIPHY_PARAM_RETRY_LONG;
 795         }
 796
 797         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 798                 frag_threshold = nla_get_u32(
 799                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 800                 if (frag_threshold < 256) {
 801                         result = -EINVAL;
 802                         goto bad_res;
 803                 }
 804                 if (frag_threshold != (u32) -1) {
 805                         /*
 806                          * Fragments (apart from the last one) are required to
 807                          * have even length. Make the fragmentation code
 808                          * simpler by stripping LSB should someone try to use
 809                          * odd threshold value.
 810                          */
 811                         frag_threshold &= ~0x1;
 812                 }
 813                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 814         }
 815
 816         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 817                 rts_threshold = nla_get_u32(
 818                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 819                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 820         }
 821
 822         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 823                 coverage_class = nla_get_u8(
 824                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 825                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 826         }
 827
 828         if (changed) {
 829                 u8 old_retry_short, old_retry_long;
 830                 u32 old_frag_threshold, old_rts_threshold;
 831                 u8 old_coverage_class;
 832
 833                 if (!rdev->ops->set_wiphy_params) {
 834                         result = -EOPNOTSUPP;
 835                         goto bad_res;
 836                 }
 837
 838                 old_retry_short = rdev->wiphy.retry_short;
 839                 old_retry_long = rdev->wiphy.retry_long;
 840                 old_frag_threshold = rdev->wiphy.frag_threshold;
 841                 old_rts_threshold = rdev->wiphy.rts_threshold;
 842                 old_coverage_class = rdev->wiphy.coverage_class;
 843
 844                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 845                         rdev->wiphy.retry_short = retry_short;
 846                 if (changed & WIPHY_PARAM_RETRY_LONG)
 847                         rdev->wiphy.retry_long = retry_long;
 848                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 849                         rdev->wiphy.frag_threshold = frag_threshold;
 850                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 851                         rdev->wiphy.rts_threshold = rts_threshold;
 852                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 853                         rdev->wiphy.coverage_class = coverage_class;
 854
 855                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 856                 if (result) {
 857                         rdev->wiphy.retry_short = old_retry_short;
 858                         rdev->wiphy.retry_long = old_retry_long;
 859                         rdev->wiphy.frag_threshold = old_frag_threshold;
 860                         rdev->wiphy.rts_threshold = old_rts_threshold;
 861                         rdev->wiphy.coverage_class = old_coverage_class;
 862                 }
 863         }
 864
 865  bad_res:
 866         mutex_unlock(&rdev->mtx);
 867  unlock:
 868         rtnl_unlock();
 869         return result;
 870 }
 871
 872
 873 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 874                               struct cfg80211_registered_device *rdev,
 875                               struct net_device *dev)
 876 {
 877         void *hdr;
 878
 879         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 880         if (!hdr)
 881                 return -1;
 882
 883         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 884         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 885         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 886         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 887
 888         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 889                     rdev->devlist_generation ^
 890                         (cfg80211_rdev_list_generation << 2));
 891
 892         return genlmsg_end(msg, hdr);
 893
 894  nla_put_failure:
 895         genlmsg_cancel(msg, hdr);
 896         return -EMSGSIZE;
 897 }
 898
 899 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 900 {
 901         int wp_idx = 0;
 902         int if_idx = 0;
 903         int wp_start = cb->args[0];
 904         int if_start = cb->args[1];
 905         struct cfg80211_registered_device *rdev;
 906         struct wireless_dev *wdev;
 907
 908         mutex_lock(&cfg80211_mutex);
 909         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 910                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 911                         continue;
 912                 if (wp_idx < wp_start) {
 913                         wp_idx++;
 914                         continue;
 915                 }
 916                 if_idx = 0;
 917
 918                 mutex_lock(&rdev->devlist_mtx);
 919                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 920                         if (if_idx < if_start) {
 921                                 if_idx++;
 922                                 continue;
 923                         }
 924                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 925                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 926                                                rdev, wdev->netdev) < 0) {
 927                                 mutex_unlock(&rdev->devlist_mtx);
 928                                 goto out;
 929                         }
 930                         if_idx++;
 931                 }
 932                 mutex_unlock(&rdev->devlist_mtx);
 933
 934                 wp_idx++;
 935         }
 936  out:
 937         mutex_unlock(&cfg80211_mutex);
 938
 939         cb->args[0] = wp_idx;
 940         cb->args[1] = if_idx;
 941
 942         return skb->len;
 943 }
 944
 945 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 946 {
 947         struct sk_buff *msg;
 948         struct cfg80211_registered_device *dev;
 949         struct net_device *netdev;
 950         int err;
 951
 952         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 953         if (err)
 954                 return err;
 955
 956         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 957         if (!msg)
 958                 goto out_err;
 959
 960         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 961                                dev, netdev) < 0)
 962                 goto out_free;
 963
 964         dev_put(netdev);
 965         cfg80211_unlock_rdev(dev);
 966
 967         return genlmsg_reply(msg, info);
 968
 969  out_free:
 970         nlmsg_free(msg);
 971  out_err:
 972         dev_put(netdev);
 973         cfg80211_unlock_rdev(dev);
 974         return -ENOBUFS;
 975 }
 976
 977 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 978         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 979         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 980         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 981         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 982         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 983 };
 984
 985 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 986 {
 987         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 988         int flag;
 989
 990         *mntrflags = 0;
 991
 992         if (!nla)
 993                 return -EINVAL;
 994
 995         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 996                              nla, mntr_flags_policy))
 997                 return -EINVAL;
 998
 999         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1000                 if (flags[flag])
1001                         *mntrflags |= (1<<flag);
1002
1003         return 0;
1004 }
1005
1006 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1007                                struct net_device *netdev, u8 use_4addr,
1008                                enum nl80211_iftype iftype)
1009 {
1010         if (!use_4addr) {
1011                 if (netdev && netdev->br_port)
1012                         return -EBUSY;
1013                 return 0;
1014         }
1015
1016         switch (iftype) {
1017         case NL80211_IFTYPE_AP_VLAN:
1018                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1019                         return 0;
1020                 break;
1021         case NL80211_IFTYPE_STATION:
1022                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1023                         return 0;
1024                 break;
1025         default:
1026                 break;
1027         }
1028
1029         return -EOPNOTSUPP;
1030 }
1031
1032 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1033 {
1034         struct cfg80211_registered_device *rdev;
1035         struct vif_params params;
1036         int err;
1037         enum nl80211_iftype otype, ntype;
1038         struct net_device *dev;
1039         u32 _flags, *flags = NULL;
1040         bool change = false;
1041
1042         memset(&params, 0, sizeof(params));
1043
1044         rtnl_lock();
1045
1046         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1047         if (err)
1048                 goto unlock_rtnl;
1049
1050         otype = ntype = dev->ieee80211_ptr->iftype;
1051
1052         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1053                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1054                 if (otype != ntype)
1055                         change = true;
1056                 if (ntype > NL80211_IFTYPE_MAX) {
1057                         err = -EINVAL;
1058                         goto unlock;
1059                 }
1060         }
1061
1062         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1063                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1064                         err = -EINVAL;
1065                         goto unlock;
1066                 }
1067                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1068                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1069                 change = true;
1070         }
1071
1072         if (info->attrs[NL80211_ATTR_4ADDR]) {
1073                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1074                 change = true;
1075                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1076                 if (err)
1077                         goto unlock;
1078         } else {
1079                 params.use_4addr = -1;
1080         }
1081
1082         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1083                 if (ntype != NL80211_IFTYPE_MONITOR) {
1084                         err = -EINVAL;
1085                         goto unlock;
1086                 }
1087                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1088                                           &_flags);
1089                 if (err)
1090                         goto unlock;
1091
1092                 flags = &_flags;
1093                 change = true;
1094         }
1095
1096         if (change)
1097                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1098         else
1099                 err = 0;
1100
1101         if (!err && params.use_4addr != -1)
1102                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1103
1104  unlock:
1105         dev_put(dev);
1106         cfg80211_unlock_rdev(rdev);
1107  unlock_rtnl:
1108         rtnl_unlock();
1109         return err;
1110 }
1111
1112 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1113 {
1114         struct cfg80211_registered_device *rdev;
1115         struct vif_params params;
1116         int err;
1117         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1118         u32 flags;
1119
1120         memset(&params, 0, sizeof(params));
1121
1122         if (!info->attrs[NL80211_ATTR_IFNAME])
1123                 return -EINVAL;
1124
1125         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1126                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1127                 if (type > NL80211_IFTYPE_MAX)
1128                         return -EINVAL;
1129         }
1130
1131         rtnl_lock();
1132
1133         rdev = cfg80211_get_dev_from_info(info);
1134         if (IS_ERR(rdev)) {
1135                 err = PTR_ERR(rdev);
1136                 goto unlock_rtnl;
1137         }
1138
1139         if (!rdev->ops->add_virtual_intf ||
1140             !(rdev->wiphy.interface_modes & (1 << type))) {
1141                 err = -EOPNOTSUPP;
1142                 goto unlock;
1143         }
1144
1145         if (type == NL80211_IFTYPE_MESH_POINT &&
1146             info->attrs[NL80211_ATTR_MESH_ID]) {
1147                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1148                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1149         }
1150
1151         if (info->attrs[NL80211_ATTR_4ADDR]) {
1152                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1153                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1154                 if (err)
1155                         goto unlock;
1156         }
1157
1158         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1159                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1160                                   &flags);
1161         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1162                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1163                 type, err ? NULL : &flags, &params);
1164
1165  unlock:
1166         cfg80211_unlock_rdev(rdev);
1167  unlock_rtnl:
1168         rtnl_unlock();
1169         return err;
1170 }
1171
1172 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1173 {
1174         struct cfg80211_registered_device *rdev;
1175         int err;
1176         struct net_device *dev;
1177
1178         rtnl_lock();
1179
1180         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1181         if (err)
1182                 goto unlock_rtnl;
1183
1184         if (!rdev->ops->del_virtual_intf) {
1185                 err = -EOPNOTSUPP;
1186                 goto out;
1187         }
1188
1189         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1190
1191  out:
1192         cfg80211_unlock_rdev(rdev);
1193         dev_put(dev);
1194  unlock_rtnl:
1195         rtnl_unlock();
1196         return err;
1197 }
1198
1199 struct get_key_cookie {
1200         struct sk_buff *msg;
1201         int error;
1202         int idx;
1203 };
1204
1205 static void get_key_callback(void *c, struct key_params *params)
1206 {
1207         struct nlattr *key;
1208         struct get_key_cookie *cookie = c;
1209
1210         if (params->key)
1211                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1212                         params->key_len, params->key);
1213
1214         if (params->seq)
1215                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1216                         params->seq_len, params->seq);
1217
1218         if (params->cipher)
1219                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1220                             params->cipher);
1221
1222         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1223         if (!key)
1224                 goto nla_put_failure;
1225
1226         if (params->key)
1227                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1228                         params->key_len, params->key);
1229
1230         if (params->seq)
1231                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1232                         params->seq_len, params->seq);
1233
1234         if (params->cipher)
1235                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1236                             params->cipher);
1237
1238         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1239
1240         nla_nest_end(cookie->msg, key);
1241
1242         return;
1243  nla_put_failure:
1244         cookie->error = 1;
1245 }
1246
1247 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1248 {
1249         struct cfg80211_registered_device *rdev;
1250         int err;
1251         struct net_device *dev;
1252         u8 key_idx = 0;
1253         u8 *mac_addr = NULL;
1254         struct get_key_cookie cookie = {
1255                 .error = 0,
1256         };
1257         void *hdr;
1258         struct sk_buff *msg;
1259
1260         if (info->attrs[NL80211_ATTR_KEY_IDX])
1261                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1262
1263         if (key_idx > 5)
1264                 return -EINVAL;
1265
1266         if (info->attrs[NL80211_ATTR_MAC])
1267                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1268
1269         rtnl_lock();
1270
1271         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1272         if (err)
1273                 goto unlock_rtnl;
1274
1275         if (!rdev->ops->get_key) {
1276                 err = -EOPNOTSUPP;
1277                 goto out;
1278         }
1279
1280         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1281         if (!msg) {
1282                 err = -ENOMEM;
1283                 goto out;
1284         }
1285
1286         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1287                              NL80211_CMD_NEW_KEY);
1288
1289         if (IS_ERR(hdr)) {
1290                 err = PTR_ERR(hdr);
1291                 goto free_msg;
1292         }
1293
1294         cookie.msg = msg;
1295         cookie.idx = key_idx;
1296
1297         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1298         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1299         if (mac_addr)
1300                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1301
1302         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1303                                 &cookie, get_key_callback);
1304
1305         if (err)
1306                 goto free_msg;
1307
1308         if (cookie.error)
1309                 goto nla_put_failure;
1310
1311         genlmsg_end(msg, hdr);
1312         err = genlmsg_reply(msg, info);
1313         goto out;
1314
1315  nla_put_failure:
1316         err = -ENOBUFS;
1317  free_msg:
1318         nlmsg_free(msg);
1319  out:
1320         cfg80211_unlock_rdev(rdev);
1321         dev_put(dev);
1322  unlock_rtnl:
1323         rtnl_unlock();
1324
1325         return err;
1326 }
1327
1328 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1329 {
1330         struct cfg80211_registered_device *rdev;
1331         struct key_parse key;
1332         int err;
1333         struct net_device *dev;
1334         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1335                     u8 key_index);
1336
1337         err = nl80211_parse_key(info, &key);
1338         if (err)
1339                 return err;
1340
1341         if (key.idx < 0)
1342                 return -EINVAL;
1343
1344         /* only support setting default key */
1345         if (!key.def && !key.defmgmt)
1346                 return -EINVAL;
1347
1348         rtnl_lock();
1349
1350         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1351         if (err)
1352                 goto unlock_rtnl;
1353
1354         if (key.def)
1355                 func = rdev->ops->set_default_key;
1356         else
1357                 func = rdev->ops->set_default_mgmt_key;
1358
1359         if (!func) {
1360                 err = -EOPNOTSUPP;
1361                 goto out;
1362         }
1363
1364         wdev_lock(dev->ieee80211_ptr);
1365         err = nl80211_key_allowed(dev->ieee80211_ptr);
1366         if (!err)
1367                 err = func(&rdev->wiphy, dev, key.idx);
1368
1369 #ifdef CONFIG_CFG80211_WEXT
1370         if (!err) {
1371                 if (func == rdev->ops->set_default_key)
1372                         dev->ieee80211_ptr->wext.default_key = key.idx;
1373                 else
1374                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1375         }
1376 #endif
1377         wdev_unlock(dev->ieee80211_ptr);
1378
1379  out:
1380         cfg80211_unlock_rdev(rdev);
1381         dev_put(dev);
1382
1383  unlock_rtnl:
1384         rtnl_unlock();
1385
1386         return err;
1387 }
1388
1389 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1390 {
1391         struct cfg80211_registered_device *rdev;
1392         int err;
1393         struct net_device *dev;
1394         struct key_parse key;
1395         u8 *mac_addr = NULL;
1396
1397         err = nl80211_parse_key(info, &key);
1398         if (err)
1399                 return err;
1400
1401         if (!key.p.key)
1402                 return -EINVAL;
1403
1404         if (info->attrs[NL80211_ATTR_MAC])
1405                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1406
1407         rtnl_lock();
1408
1409         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1410         if (err)
1411                 goto unlock_rtnl;
1412
1413         if (!rdev->ops->add_key) {
1414                 err = -EOPNOTSUPP;
1415                 goto out;
1416         }
1417
1418         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1419                 err = -EINVAL;
1420                 goto out;
1421         }
1422
1423         wdev_lock(dev->ieee80211_ptr);
1424         err = nl80211_key_allowed(dev->ieee80211_ptr);
1425         if (!err)
1426                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1427                                          mac_addr, &key.p);
1428         wdev_unlock(dev->ieee80211_ptr);
1429
1430  out:
1431         cfg80211_unlock_rdev(rdev);
1432         dev_put(dev);
1433  unlock_rtnl:
1434         rtnl_unlock();
1435
1436         return err;
1437 }
1438
1439 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1440 {
1441         struct cfg80211_registered_device *rdev;
1442         int err;
1443         struct net_device *dev;
1444         u8 *mac_addr = NULL;
1445         struct key_parse key;
1446
1447         err = nl80211_parse_key(info, &key);
1448         if (err)
1449                 return err;
1450
1451         if (info->attrs[NL80211_ATTR_MAC])
1452                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1453
1454         rtnl_lock();
1455
1456         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1457         if (err)
1458                 goto unlock_rtnl;
1459
1460         if (!rdev->ops->del_key) {
1461                 err = -EOPNOTSUPP;
1462                 goto out;
1463         }
1464
1465         wdev_lock(dev->ieee80211_ptr);
1466         err = nl80211_key_allowed(dev->ieee80211_ptr);
1467         if (!err)
1468                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1469
1470 #ifdef CONFIG_CFG80211_WEXT
1471         if (!err) {
1472                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1473                         dev->ieee80211_ptr->wext.default_key = -1;
1474                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1475                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1476         }
1477 #endif
1478         wdev_unlock(dev->ieee80211_ptr);
1479
1480  out:
1481         cfg80211_unlock_rdev(rdev);
1482         dev_put(dev);
1483
1484  unlock_rtnl:
1485         rtnl_unlock();
1486
1487         return err;
1488 }
1489
1490 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1491 {
1492         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1493                     struct beacon_parameters *info);
1494         struct cfg80211_registered_device *rdev;
1495         int err;
1496         struct net_device *dev;
1497         struct beacon_parameters params;
1498         int haveinfo = 0;
1499
1500         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1501                 return -EINVAL;
1502
1503         rtnl_lock();
1504
1505         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1506         if (err)
1507                 goto unlock_rtnl;
1508
1509         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1510                 err = -EOPNOTSUPP;
1511                 goto out;
1512         }
1513
1514         switch (info->genlhdr->cmd) {
1515         case NL80211_CMD_NEW_BEACON:
1516                 /* these are required for NEW_BEACON */
1517                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1518                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1519                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1520                         err = -EINVAL;
1521                         goto out;
1522                 }
1523
1524                 call = rdev->ops->add_beacon;
1525                 break;
1526         case NL80211_CMD_SET_BEACON:
1527                 call = rdev->ops->set_beacon;
1528                 break;
1529         default:
1530                 WARN_ON(1);
1531                 err = -EOPNOTSUPP;
1532                 goto out;
1533         }
1534
1535         if (!call) {
1536                 err = -EOPNOTSUPP;
1537                 goto out;
1538         }
1539
1540         memset(&params, 0, sizeof(params));
1541
1542         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1543                 params.interval =
1544                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1545                 haveinfo = 1;
1546         }
1547
1548         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1549                 params.dtim_period =
1550                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1551                 haveinfo = 1;
1552         }
1553
1554         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1555                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1556                 params.head_len =
1557                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1558                 haveinfo = 1;
1559         }
1560
1561         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1562                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1563                 params.tail_len =
1564                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1565                 haveinfo = 1;
1566         }
1567
1568         if (!haveinfo) {
1569                 err = -EINVAL;
1570                 goto out;
1571         }
1572
1573         err = call(&rdev->wiphy, dev, &params);
1574
1575  out:
1576         cfg80211_unlock_rdev(rdev);
1577         dev_put(dev);
1578  unlock_rtnl:
1579         rtnl_unlock();
1580
1581         return err;
1582 }
1583
1584 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1585 {
1586         struct cfg80211_registered_device *rdev;
1587         int err;
1588         struct net_device *dev;
1589
1590         rtnl_lock();
1591
1592         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1593         if (err)
1594                 goto unlock_rtnl;
1595
1596         if (!rdev->ops->del_beacon) {
1597                 err = -EOPNOTSUPP;
1598                 goto out;
1599         }
1600
1601         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1602                 err = -EOPNOTSUPP;
1603                 goto out;
1604         }
1605         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1606
1607  out:
1608         cfg80211_unlock_rdev(rdev);
1609         dev_put(dev);
1610  unlock_rtnl:
1611         rtnl_unlock();
1612
1613         return err;
1614 }
1615
1616 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1617         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1618         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1619         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1620         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1621 };
1622
1623 static int parse_station_flags(struct genl_info *info,
1624                                struct station_parameters *params)
1625 {
1626         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1627         struct nlattr *nla;
1628         int flag;
1629
1630         /*
1631          * Try parsing the new attribute first so userspace
1632          * can specify both for older kernels.
1633          */
1634         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1635         if (nla) {
1636                 struct nl80211_sta_flag_update *sta_flags;
1637
1638                 sta_flags = nla_data(nla);
1639                 params->sta_flags_mask = sta_flags->mask;
1640                 params->sta_flags_set = sta_flags->set;
1641                 if ((params->sta_flags_mask |
1642                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1643                         return -EINVAL;
1644                 return 0;
1645         }
1646
1647         /* if present, parse the old attribute */
1648
1649         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1650         if (!nla)
1651                 return 0;
1652
1653         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1654                              nla, sta_flags_policy))
1655                 return -EINVAL;
1656
1657         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1658         params->sta_flags_mask &= ~1;
1659
1660         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1661                 if (flags[flag])
1662                         params->sta_flags_set |= (1<<flag);
1663
1664         return 0;
1665 }
1666
1667 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1668                                 int flags, struct net_device *dev,
1669                                 const u8 *mac_addr, struct station_info *sinfo)
1670 {
1671         void *hdr;
1672         struct nlattr *sinfoattr, *txrate;
1673         u16 bitrate;
1674
1675         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1676         if (!hdr)
1677                 return -1;
1678
1679         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1680         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1681
1682         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1683
1684         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1685         if (!sinfoattr)
1686                 goto nla_put_failure;
1687         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1688                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1689                             sinfo->inactive_time);
1690         if (sinfo->filled & STATION_INFO_RX_BYTES)
1691                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1692                             sinfo->rx_bytes);
1693         if (sinfo->filled & STATION_INFO_TX_BYTES)
1694                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1695                             sinfo->tx_bytes);
1696         if (sinfo->filled & STATION_INFO_LLID)
1697                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1698                             sinfo->llid);
1699         if (sinfo->filled & STATION_INFO_PLID)
1700                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1701                             sinfo->plid);
1702         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1703                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1704                             sinfo->plink_state);
1705         if (sinfo->filled & STATION_INFO_SIGNAL)
1706                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1707                            sinfo->signal);
1708         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1709                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1710                 if (!txrate)
1711                         goto nla_put_failure;
1712
1713                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1714                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1715                 if (bitrate > 0)
1716                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1717
1718                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1719                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1720                                     sinfo->txrate.mcs);
1721                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1722                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1723                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1724                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1725
1726                 nla_nest_end(msg, txrate);
1727         }
1728         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1729                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1730                             sinfo->rx_packets);
1731         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1732                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1733                             sinfo->tx_packets);
1734         nla_nest_end(msg, sinfoattr);
1735
1736         return genlmsg_end(msg, hdr);
1737
1738  nla_put_failure:
1739         genlmsg_cancel(msg, hdr);
1740         return -EMSGSIZE;
1741 }
1742
1743 static int nl80211_dump_station(struct sk_buff *skb,
1744                                 struct netlink_callback *cb)
1745 {
1746         struct station_info sinfo;
1747         struct cfg80211_registered_device *dev;
1748         struct net_device *netdev;
1749         u8 mac_addr[ETH_ALEN];
1750         int ifidx = cb->args[0];
1751         int sta_idx = cb->args[1];
1752         int err;
1753
1754         if (!ifidx)
1755                 ifidx = nl80211_get_ifidx(cb);
1756         if (ifidx < 0)
1757                 return ifidx;
1758
1759         rtnl_lock();
1760
1761         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1762         if (!netdev) {
1763                 err = -ENODEV;
1764                 goto out_rtnl;
1765         }
1766
1767         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1768         if (IS_ERR(dev)) {
1769                 err = PTR_ERR(dev);
1770                 goto out_rtnl;
1771         }
1772
1773         if (!dev->ops->dump_station) {
1774                 err = -EOPNOTSUPP;
1775                 goto out_err;
1776         }
1777
1778         while (1) {
1779                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1780                                              mac_addr, &sinfo);
1781                 if (err == -ENOENT)
1782                         break;
1783                 if (err)
1784                         goto out_err;
1785
1786                 if (nl80211_send_station(skb,
1787                                 NETLINK_CB(cb->skb).pid,
1788                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1789                                 netdev, mac_addr,
1790                                 &sinfo) < 0)
1791                         goto out;
1792
1793                 sta_idx++;
1794         }
1795
1796
1797  out:
1798         cb->args[1] = sta_idx;
1799         err = skb->len;
1800  out_err:
1801         cfg80211_unlock_rdev(dev);
1802  out_rtnl:
1803         rtnl_unlock();
1804
1805         return err;
1806 }
1807
1808 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1809 {
1810         struct cfg80211_registered_device *rdev;
1811         int err;
1812         struct net_device *dev;
1813         struct station_info sinfo;
1814         struct sk_buff *msg;
1815         u8 *mac_addr = NULL;
1816
1817         memset(&sinfo, 0, sizeof(sinfo));
1818
1819         if (!info->attrs[NL80211_ATTR_MAC])
1820                 return -EINVAL;
1821
1822         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1823
1824         rtnl_lock();
1825
1826         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1827         if (err)
1828                 goto out_rtnl;
1829
1830         if (!rdev->ops->get_station) {
1831                 err = -EOPNOTSUPP;
1832                 goto out;
1833         }
1834
1835         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1836         if (err)
1837                 goto out;
1838
1839         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1840         if (!msg)
1841                 goto out;
1842
1843         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1844                                  dev, mac_addr, &sinfo) < 0)
1845                 goto out_free;
1846
1847         err = genlmsg_reply(msg, info);
1848         goto out;
1849
1850  out_free:
1851         nlmsg_free(msg);
1852  out:
1853         cfg80211_unlock_rdev(rdev);
1854         dev_put(dev);
1855  out_rtnl:
1856         rtnl_unlock();
1857
1858         return err;
1859 }
1860
1861 /*
1862  * Get vlan interface making sure it is running and on the right wiphy.
1863  */
1864 static int get_vlan(struct genl_info *info,
1865                     struct cfg80211_registered_device *rdev,
1866                     struct net_device **vlan)
1867 {
1868         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1869         *vlan = NULL;
1870
1871         if (vlanattr) {
1872                 *vlan = dev_get_by_index(genl_info_net(info),
1873                                          nla_get_u32(vlanattr));
1874                 if (!*vlan)
1875                         return -ENODEV;
1876                 if (!(*vlan)->ieee80211_ptr)
1877                         return -EINVAL;
1878                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1879                         return -EINVAL;
1880                 if (!netif_running(*vlan))
1881                         return -ENETDOWN;
1882         }
1883         return 0;
1884 }
1885
1886 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1887 {
1888         struct cfg80211_registered_device *rdev;
1889         int err;
1890         struct net_device *dev;
1891         struct station_parameters params;
1892         u8 *mac_addr = NULL;
1893
1894         memset(&params, 0, sizeof(params));
1895
1896         params.listen_interval = -1;
1897
1898         if (info->attrs[NL80211_ATTR_STA_AID])
1899                 return -EINVAL;
1900
1901         if (!info->attrs[NL80211_ATTR_MAC])
1902                 return -EINVAL;
1903
1904         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1905
1906         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1907                 params.supported_rates =
1908                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1909                 params.supported_rates_len =
1910                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1911         }
1912
1913         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1914                 params.listen_interval =
1915                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1916
1917         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1918                 params.ht_capa =
1919                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1920
1921         if (parse_station_flags(info, &params))
1922                 return -EINVAL;
1923
1924         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1925                 params.plink_action =
1926                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1927
1928         rtnl_lock();
1929
1930         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1931         if (err)
1932                 goto out_rtnl;
1933
1934         err = get_vlan(info, rdev, &params.vlan);
1935         if (err)
1936                 goto out;
1937
1938         /* validate settings */
1939         err = 0;
1940
1941         switch (dev->ieee80211_ptr->iftype) {
1942         case NL80211_IFTYPE_AP:
1943         case NL80211_IFTYPE_AP_VLAN:
1944                 /* disallow mesh-specific things */
1945                 if (params.plink_action)
1946                         err = -EINVAL;
1947                 break;
1948         case NL80211_IFTYPE_STATION:
1949                 /* disallow everything but AUTHORIZED flag */
1950                 if (params.plink_action)
1951                         err = -EINVAL;
1952                 if (params.vlan)
1953                         err = -EINVAL;
1954                 if (params.supported_rates)
1955                         err = -EINVAL;
1956                 if (params.ht_capa)
1957                         err = -EINVAL;
1958                 if (params.listen_interval >= 0)
1959                         err = -EINVAL;
1960                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1961                         err = -EINVAL;
1962                 break;
1963         case NL80211_IFTYPE_MESH_POINT:
1964                 /* disallow things mesh doesn't support */
1965                 if (params.vlan)
1966                         err = -EINVAL;
1967                 if (params.ht_capa)
1968                         err = -EINVAL;
1969                 if (params.listen_interval >= 0)
1970                         err = -EINVAL;
1971                 if (params.supported_rates)
1972                         err = -EINVAL;
1973                 if (params.sta_flags_mask)
1974                         err = -EINVAL;
1975                 break;
1976         default:
1977                 err = -EINVAL;
1978         }
1979
1980         if (err)
1981                 goto out;
1982
1983         if (!rdev->ops->change_station) {
1984                 err = -EOPNOTSUPP;
1985                 goto out;
1986         }
1987
1988         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1989
1990  out:
1991         if (params.vlan)
1992                 dev_put(params.vlan);
1993         cfg80211_unlock_rdev(rdev);
1994         dev_put(dev);
1995  out_rtnl:
1996         rtnl_unlock();
1997
1998         return err;
1999 }
2000
2001 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2002 {
2003         struct cfg80211_registered_device *rdev;
2004         int err;
2005         struct net_device *dev;
2006         struct station_parameters params;
2007         u8 *mac_addr = NULL;
2008
2009         memset(&params, 0, sizeof(params));
2010
2011         if (!info->attrs[NL80211_ATTR_MAC])
2012                 return -EINVAL;
2013
2014         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2015                 return -EINVAL;
2016
2017         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2018                 return -EINVAL;
2019
2020         if (!info->attrs[NL80211_ATTR_STA_AID])
2021                 return -EINVAL;
2022
2023         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2024         params.supported_rates =
2025                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2026         params.supported_rates_len =
2027                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2028         params.listen_interval =
2029                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2030
2031         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2032         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2033                 return -EINVAL;
2034
2035         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2036                 params.ht_capa =
2037                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2038
2039         if (parse_station_flags(info, &params))
2040                 return -EINVAL;
2041
2042         rtnl_lock();
2043
2044         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2045         if (err)
2046                 goto out_rtnl;
2047
2048         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2049             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2050                 err = -EINVAL;
2051                 goto out;
2052         }
2053
2054         err = get_vlan(info, rdev, &params.vlan);
2055         if (err)
2056                 goto out;
2057
2058         /* validate settings */
2059         err = 0;
2060
2061         if (!rdev->ops->add_station) {
2062                 err = -EOPNOTSUPP;
2063                 goto out;
2064         }
2065
2066         if (!netif_running(dev)) {
2067                 err = -ENETDOWN;
2068                 goto out;
2069         }
2070
2071         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2072
2073  out:
2074         if (params.vlan)
2075                 dev_put(params.vlan);
2076         cfg80211_unlock_rdev(rdev);
2077         dev_put(dev);
2078  out_rtnl:
2079         rtnl_unlock();
2080
2081         return err;
2082 }
2083
2084 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2085 {
2086         struct cfg80211_registered_device *rdev;
2087         int err;
2088         struct net_device *dev;
2089         u8 *mac_addr = NULL;
2090
2091         if (info->attrs[NL80211_ATTR_MAC])
2092                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2093
2094         rtnl_lock();
2095
2096         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2097         if (err)
2098                 goto out_rtnl;
2099
2100         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2101             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2103                 err = -EINVAL;
2104                 goto out;
2105         }
2106
2107         if (!rdev->ops->del_station) {
2108                 err = -EOPNOTSUPP;
2109                 goto out;
2110         }
2111
2112         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2113
2114  out:
2115         cfg80211_unlock_rdev(rdev);
2116         dev_put(dev);
2117  out_rtnl:
2118         rtnl_unlock();
2119
2120         return err;
2121 }
2122
2123 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2124                                 int flags, struct net_device *dev,
2125                                 u8 *dst, u8 *next_hop,
2126                                 struct mpath_info *pinfo)
2127 {
2128         void *hdr;
2129         struct nlattr *pinfoattr;
2130
2131         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2132         if (!hdr)
2133                 return -1;
2134
2135         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2136         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2137         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2138
2139         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2140
2141         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2142         if (!pinfoattr)
2143                 goto nla_put_failure;
2144         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2145                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2146                             pinfo->frame_qlen);
2147         if (pinfo->filled & MPATH_INFO_SN)
2148                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2149                             pinfo->sn);
2150         if (pinfo->filled & MPATH_INFO_METRIC)
2151                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2152                             pinfo->metric);
2153         if (pinfo->filled & MPATH_INFO_EXPTIME)
2154                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2155                             pinfo->exptime);
2156         if (pinfo->filled & MPATH_INFO_FLAGS)
2157                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2158                             pinfo->flags);
2159         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2160                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2161                             pinfo->discovery_timeout);
2162         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2163                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2164                             pinfo->discovery_retries);
2165
2166         nla_nest_end(msg, pinfoattr);
2167
2168         return genlmsg_end(msg, hdr);
2169
2170  nla_put_failure:
2171         genlmsg_cancel(msg, hdr);
2172         return -EMSGSIZE;
2173 }
2174
2175 static int nl80211_dump_mpath(struct sk_buff *skb,
2176                               struct netlink_callback *cb)
2177 {
2178         struct mpath_info pinfo;
2179         struct cfg80211_registered_device *dev;
2180         struct net_device *netdev;
2181         u8 dst[ETH_ALEN];
2182         u8 next_hop[ETH_ALEN];
2183         int ifidx = cb->args[0];
2184         int path_idx = cb->args[1];
2185         int err;
2186
2187         if (!ifidx)
2188                 ifidx = nl80211_get_ifidx(cb);
2189         if (ifidx < 0)
2190                 return ifidx;
2191
2192         rtnl_lock();
2193
2194         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2195         if (!netdev) {
2196                 err = -ENODEV;
2197                 goto out_rtnl;
2198         }
2199
2200         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2201         if (IS_ERR(dev)) {
2202                 err = PTR_ERR(dev);
2203                 goto out_rtnl;
2204         }
2205
2206         if (!dev->ops->dump_mpath) {
2207                 err = -EOPNOTSUPP;
2208                 goto out_err;
2209         }
2210
2211         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2212                 err = -EOPNOTSUPP;
2213                 goto out_err;
2214         }
2215
2216         while (1) {
2217                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2218                                            dst, next_hop, &pinfo);
2219                 if (err == -ENOENT)
2220                         break;
2221                 if (err)
2222                         goto out_err;
2223
2224                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2225                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2226                                        netdev, dst, next_hop,
2227                                        &pinfo) < 0)
2228                         goto out;
2229
2230                 path_idx++;
2231         }
2232
2233
2234  out:
2235         cb->args[1] = path_idx;
2236         err = skb->len;
2237  out_err:
2238         cfg80211_unlock_rdev(dev);
2239  out_rtnl:
2240         rtnl_unlock();
2241
2242         return err;
2243 }
2244
2245 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2246 {
2247         struct cfg80211_registered_device *rdev;
2248         int err;
2249         struct net_device *dev;
2250         struct mpath_info pinfo;
2251         struct sk_buff *msg;
2252         u8 *dst = NULL;
2253         u8 next_hop[ETH_ALEN];
2254
2255         memset(&pinfo, 0, sizeof(pinfo));
2256
2257         if (!info->attrs[NL80211_ATTR_MAC])
2258                 return -EINVAL;
2259
2260         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2261
2262         rtnl_lock();
2263
2264         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2265         if (err)
2266                 goto out_rtnl;
2267
2268         if (!rdev->ops->get_mpath) {
2269                 err = -EOPNOTSUPP;
2270                 goto out;
2271         }
2272
2273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2274                 err = -EOPNOTSUPP;
2275                 goto out;
2276         }
2277
2278         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2279         if (err)
2280                 goto out;
2281
2282         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2283         if (!msg)
2284                 goto out;
2285
2286         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2287                                  dev, dst, next_hop, &pinfo) < 0)
2288                 goto out_free;
2289
2290         err = genlmsg_reply(msg, info);
2291         goto out;
2292
2293  out_free:
2294         nlmsg_free(msg);
2295  out:
2296         cfg80211_unlock_rdev(rdev);
2297         dev_put(dev);
2298  out_rtnl:
2299         rtnl_unlock();
2300
2301         return err;
2302 }
2303
2304 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2305 {
2306         struct cfg80211_registered_device *rdev;
2307         int err;
2308         struct net_device *dev;
2309         u8 *dst = NULL;
2310         u8 *next_hop = NULL;
2311
2312         if (!info->attrs[NL80211_ATTR_MAC])
2313                 return -EINVAL;
2314
2315         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2316                 return -EINVAL;
2317
2318         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2319         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2320
2321         rtnl_lock();
2322
2323         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2324         if (err)
2325                 goto out_rtnl;
2326
2327         if (!rdev->ops->change_mpath) {
2328                 err = -EOPNOTSUPP;
2329                 goto out;
2330         }
2331
2332         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2333                 err = -EOPNOTSUPP;
2334                 goto out;
2335         }
2336
2337         if (!netif_running(dev)) {
2338                 err = -ENETDOWN;
2339                 goto out;
2340         }
2341
2342         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2343
2344  out:
2345         cfg80211_unlock_rdev(rdev);
2346         dev_put(dev);
2347  out_rtnl:
2348         rtnl_unlock();
2349
2350         return err;
2351 }
2352 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2353 {
2354         struct cfg80211_registered_device *rdev;
2355         int err;
2356         struct net_device *dev;
2357         u8 *dst = NULL;
2358         u8 *next_hop = NULL;
2359
2360         if (!info->attrs[NL80211_ATTR_MAC])
2361                 return -EINVAL;
2362
2363         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2364                 return -EINVAL;
2365
2366         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2367         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2368
2369         rtnl_lock();
2370
2371         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2372         if (err)
2373                 goto out_rtnl;
2374
2375         if (!rdev->ops->add_mpath) {
2376                 err = -EOPNOTSUPP;
2377                 goto out;
2378         }
2379
2380         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2381                 err = -EOPNOTSUPP;
2382                 goto out;
2383         }
2384
2385         if (!netif_running(dev)) {
2386                 err = -ENETDOWN;
2387                 goto out;
2388         }
2389
2390         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2391
2392  out:
2393         cfg80211_unlock_rdev(rdev);
2394         dev_put(dev);
2395  out_rtnl:
2396         rtnl_unlock();
2397
2398         return err;
2399 }
2400
2401 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2402 {
2403         struct cfg80211_registered_device *rdev;
2404         int err;
2405         struct net_device *dev;
2406         u8 *dst = NULL;
2407
2408         if (info->attrs[NL80211_ATTR_MAC])
2409                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2410
2411         rtnl_lock();
2412
2413         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2414         if (err)
2415                 goto out_rtnl;
2416
2417         if (!rdev->ops->del_mpath) {
2418                 err = -EOPNOTSUPP;
2419                 goto out;
2420         }
2421
2422         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2423
2424  out:
2425         cfg80211_unlock_rdev(rdev);
2426         dev_put(dev);
2427  out_rtnl:
2428         rtnl_unlock();
2429
2430         return err;
2431 }
2432
2433 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2434 {
2435         struct cfg80211_registered_device *rdev;
2436         int err;
2437         struct net_device *dev;
2438         struct bss_parameters params;
2439
2440         memset(&params, 0, sizeof(params));
2441         /* default to not changing parameters */
2442         params.use_cts_prot = -1;
2443         params.use_short_preamble = -1;
2444         params.use_short_slot_time = -1;
2445
2446         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2447                 params.use_cts_prot =
2448                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2449         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2450                 params.use_short_preamble =
2451                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2452         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2453                 params.use_short_slot_time =
2454                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2455         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2456                 params.basic_rates =
2457                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2458                 params.basic_rates_len =
2459                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2460         }
2461
2462         rtnl_lock();
2463
2464         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2465         if (err)
2466                 goto out_rtnl;
2467
2468         if (!rdev->ops->change_bss) {
2469                 err = -EOPNOTSUPP;
2470                 goto out;
2471         }
2472
2473         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2474                 err = -EOPNOTSUPP;
2475                 goto out;
2476         }
2477
2478         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2479
2480  out:
2481         cfg80211_unlock_rdev(rdev);
2482         dev_put(dev);
2483  out_rtnl:
2484         rtnl_unlock();
2485
2486         return err;
2487 }
2488
2489 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2490         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2491         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2492         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2493         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2494         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2495         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2496 };
2497
2498 static int parse_reg_rule(struct nlattr *tb[],
2499         struct ieee80211_reg_rule *reg_rule)
2500 {
2501         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2502         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2503
2504         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2505                 return -EINVAL;
2506         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2507                 return -EINVAL;
2508         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2509                 return -EINVAL;
2510         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2511                 return -EINVAL;
2512         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2513                 return -EINVAL;
2514
2515         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2516
2517         freq_range->start_freq_khz =
2518                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2519         freq_range->end_freq_khz =
2520                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2521         freq_range->max_bandwidth_khz =
2522                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2523
2524         power_rule->max_eirp =
2525                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2526
2527         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2528                 power_rule->max_antenna_gain =
2529                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2530
2531         return 0;
2532 }
2533
2534 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2535 {
2536         int r;
2537         char *data = NULL;
2538
2539         /*
2540          * You should only get this when cfg80211 hasn't yet initialized
2541          * completely when built-in to the kernel right between the time
2542          * window between nl80211_init() and regulatory_init(), if that is
2543          * even possible.
2544          */
2545         mutex_lock(&cfg80211_mutex);
2546         if (unlikely(!cfg80211_regdomain)) {
2547                 mutex_unlock(&cfg80211_mutex);
2548                 return -EINPROGRESS;
2549         }
2550         mutex_unlock(&cfg80211_mutex);
2551
2552         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2553                 return -EINVAL;
2554
2555         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2556
2557         r = regulatory_hint_user(data);
2558
2559         return r;
2560 }
2561
2562 static int nl80211_get_mesh_params(struct sk_buff *skb,
2563         struct genl_info *info)
2564 {
2565         struct cfg80211_registered_device *rdev;
2566         struct mesh_config cur_params;
2567         int err;
2568         struct net_device *dev;
2569         void *hdr;
2570         struct nlattr *pinfoattr;
2571         struct sk_buff *msg;
2572
2573         rtnl_lock();
2574
2575         /* Look up our device */
2576         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2577         if (err)
2578                 goto out_rtnl;
2579
2580         if (!rdev->ops->get_mesh_params) {
2581                 err = -EOPNOTSUPP;
2582                 goto out;
2583         }
2584
2585         /* Get the mesh params */
2586         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2587         if (err)
2588                 goto out;
2589
2590         /* Draw up a netlink message to send back */
2591         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2592         if (!msg) {
2593                 err = -ENOBUFS;
2594                 goto out;
2595         }
2596         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2597                              NL80211_CMD_GET_MESH_PARAMS);
2598         if (!hdr)
2599                 goto nla_put_failure;
2600         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2601         if (!pinfoattr)
2602                 goto nla_put_failure;
2603         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2604         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2605                         cur_params.dot11MeshRetryTimeout);
2606         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2607                         cur_params.dot11MeshConfirmTimeout);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2609                         cur_params.dot11MeshHoldingTimeout);
2610         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2611                         cur_params.dot11MeshMaxPeerLinks);
2612         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2613                         cur_params.dot11MeshMaxRetries);
2614         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2615                         cur_params.dot11MeshTTL);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2617                         cur_params.auto_open_plinks);
2618         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2619                         cur_params.dot11MeshHWMPmaxPREQretries);
2620         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2621                         cur_params.path_refresh_time);
2622         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2623                         cur_params.min_discovery_timeout);
2624         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2625                         cur_params.dot11MeshHWMPactivePathTimeout);
2626         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2627                         cur_params.dot11MeshHWMPpreqMinInterval);
2628         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2629                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2630         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2631                         cur_params.dot11MeshHWMPRootMode);
2632         nla_nest_end(msg, pinfoattr);
2633         genlmsg_end(msg, hdr);
2634         err = genlmsg_reply(msg, info);
2635         goto out;
2636
2637  nla_put_failure:
2638         genlmsg_cancel(msg, hdr);
2639         err = -EMSGSIZE;
2640  out:
2641         /* Cleanup */
2642         cfg80211_unlock_rdev(rdev);
2643         dev_put(dev);
2644  out_rtnl:
2645         rtnl_unlock();
2646
2647         return err;
2648 }
2649
2650 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2651 do {\
2652         if (table[attr_num]) {\
2653                 cfg.param = nla_fn(table[attr_num]); \
2654                 mask |= (1 << (attr_num - 1)); \
2655         } \
2656 } while (0);\
2657
2658 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2659         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2661         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2663         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2664         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2665         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2666
2667         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2668         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2669         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2670         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2671         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2672         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2673 };
2674
2675 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2676 {
2677         int err;
2678         u32 mask;
2679         struct cfg80211_registered_device *rdev;
2680         struct net_device *dev;
2681         struct mesh_config cfg;
2682         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2683         struct nlattr *parent_attr;
2684
2685         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2686         if (!parent_attr)
2687                 return -EINVAL;
2688         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2689                         parent_attr, nl80211_meshconf_params_policy))
2690                 return -EINVAL;
2691
2692         rtnl_lock();
2693
2694         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2695         if (err)
2696                 goto out_rtnl;
2697
2698         if (!rdev->ops->set_mesh_params) {
2699                 err = -EOPNOTSUPP;
2700                 goto out;
2701         }
2702
2703         /* This makes sure that there aren't more than 32 mesh config
2704          * parameters (otherwise our bitfield scheme would not work.) */
2705         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2706
2707         /* Fill in the params struct */
2708         mask = 0;
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2710                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2712                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2714                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2716                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2718                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2720                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2722                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2724                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2725                         nla_get_u8);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2727                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2729                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2730                         nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2732                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2733                         nla_get_u32);
2734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2735                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2736                         nla_get_u16);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2738                         dot11MeshHWMPnetDiameterTraversalTime,
2739                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2740                         nla_get_u16);
2741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2742                         dot11MeshHWMPRootMode, mask,
2743                         NL80211_MESHCONF_HWMP_ROOTMODE,
2744                         nla_get_u8);
2745
2746         /* Apply changes */
2747         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2748
2749  out:
2750         /* cleanup */
2751         cfg80211_unlock_rdev(rdev);
2752         dev_put(dev);
2753  out_rtnl:
2754         rtnl_unlock();
2755
2756         return err;
2757 }
2758
2759 #undef FILL_IN_MESH_PARAM_IF_SET
2760
2761 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2762 {
2763         struct sk_buff *msg;
2764         void *hdr = NULL;
2765         struct nlattr *nl_reg_rules;
2766         unsigned int i;
2767         int err = -EINVAL;
2768
2769         mutex_lock(&cfg80211_mutex);
2770
2771         if (!cfg80211_regdomain)
2772                 goto out;
2773
2774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2775         if (!msg) {
2776                 err = -ENOBUFS;
2777                 goto out;
2778         }
2779
2780         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2781                              NL80211_CMD_GET_REG);
2782         if (!hdr)
2783                 goto nla_put_failure;
2784
2785         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2786                 cfg80211_regdomain->alpha2);
2787
2788         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2789         if (!nl_reg_rules)
2790                 goto nla_put_failure;
2791
2792         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2793                 struct nlattr *nl_reg_rule;
2794                 const struct ieee80211_reg_rule *reg_rule;
2795                 const struct ieee80211_freq_range *freq_range;
2796                 const struct ieee80211_power_rule *power_rule;
2797
2798                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2799                 freq_range = &reg_rule->freq_range;
2800                 power_rule = &reg_rule->power_rule;
2801
2802                 nl_reg_rule = nla_nest_start(msg, i);
2803                 if (!nl_reg_rule)
2804                         goto nla_put_failure;
2805
2806                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2807                         reg_rule->flags);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2809                         freq_range->start_freq_khz);
2810                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2811                         freq_range->end_freq_khz);
2812                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2813                         freq_range->max_bandwidth_khz);
2814                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2815                         power_rule->max_antenna_gain);
2816                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2817                         power_rule->max_eirp);
2818
2819                 nla_nest_end(msg, nl_reg_rule);
2820         }
2821
2822         nla_nest_end(msg, nl_reg_rules);
2823
2824         genlmsg_end(msg, hdr);
2825         err = genlmsg_reply(msg, info);
2826         goto out;
2827
2828 nla_put_failure:
2829         genlmsg_cancel(msg, hdr);
2830         err = -EMSGSIZE;
2831 out:
2832         mutex_unlock(&cfg80211_mutex);
2833         return err;
2834 }
2835
2836 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2837 {
2838         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2839         struct nlattr *nl_reg_rule;
2840         char *alpha2 = NULL;
2841         int rem_reg_rules = 0, r = 0;
2842         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2843         struct ieee80211_regdomain *rd = NULL;
2844
2845         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2846                 return -EINVAL;
2847
2848         if (!info->attrs[NL80211_ATTR_REG_RULES])
2849                 return -EINVAL;
2850
2851         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2852
2853         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2854                         rem_reg_rules) {
2855                 num_rules++;
2856                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2857                         return -EINVAL;
2858         }
2859
2860         mutex_lock(&cfg80211_mutex);
2861
2862         if (!reg_is_valid_request(alpha2)) {
2863                 r = -EINVAL;
2864                 goto bad_reg;
2865         }
2866
2867         size_of_regd = sizeof(struct ieee80211_regdomain) +
2868                 (num_rules * sizeof(struct ieee80211_reg_rule));
2869
2870         rd = kzalloc(size_of_regd, GFP_KERNEL);
2871         if (!rd) {
2872                 r = -ENOMEM;
2873                 goto bad_reg;
2874         }
2875
2876         rd->n_reg_rules = num_rules;
2877         rd->alpha2[0] = alpha2[0];
2878         rd->alpha2[1] = alpha2[1];
2879
2880         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2881                         rem_reg_rules) {
2882                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2883                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2884                         reg_rule_policy);
2885                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2886                 if (r)
2887                         goto bad_reg;
2888
2889                 rule_idx++;
2890
2891                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2892                         r = -EINVAL;
2893                         goto bad_reg;
2894                 }
2895         }
2896
2897         BUG_ON(rule_idx != num_rules);
2898
2899         r = set_regdom(rd);
2900
2901         mutex_unlock(&cfg80211_mutex);
2902
2903         return r;
2904
2905  bad_reg:
2906         mutex_unlock(&cfg80211_mutex);
2907         kfree(rd);
2908         return r;
2909 }
2910
2911 static int validate_scan_freqs(struct nlattr *freqs)
2912 {
2913         struct nlattr *attr1, *attr2;
2914         int n_channels = 0, tmp1, tmp2;
2915
2916         nla_for_each_nested(attr1, freqs, tmp1) {
2917                 n_channels++;
2918                 /*
2919                  * Some hardware has a limited channel list for
2920                  * scanning, and it is pretty much nonsensical
2921                  * to scan for a channel twice, so disallow that
2922                  * and don't require drivers to check that the
2923                  * channel list they get isn't longer than what
2924                  * they can scan, as long as they can scan all
2925                  * the channels they registered at once.
2926                  */
2927                 nla_for_each_nested(attr2, freqs, tmp2)
2928                         if (attr1 != attr2 &&
2929                             nla_get_u32(attr1) == nla_get_u32(attr2))
2930                                 return 0;
2931         }
2932
2933         return n_channels;
2934 }
2935
2936 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2937 {
2938         struct cfg80211_registered_device *rdev;
2939         struct net_device *dev;
2940         struct cfg80211_scan_request *request;
2941         struct cfg80211_ssid *ssid;
2942         struct ieee80211_channel *channel;
2943         struct nlattr *attr;
2944         struct wiphy *wiphy;
2945         int err, tmp, n_ssids = 0, n_channels, i;
2946         enum ieee80211_band band;
2947         size_t ie_len;
2948
2949         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2950                 return -EINVAL;
2951
2952         rtnl_lock();
2953
2954         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2955         if (err)
2956                 goto out_rtnl;
2957
2958         wiphy = &rdev->wiphy;
2959
2960         if (!rdev->ops->scan) {
2961                 err = -EOPNOTSUPP;
2962                 goto out;
2963         }
2964
2965         if (!netif_running(dev)) {
2966                 err = -ENETDOWN;
2967                 goto out;
2968         }
2969
2970         if (rdev->scan_req) {
2971                 err = -EBUSY;
2972                 goto out;
2973         }
2974
2975         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2976                 n_channels = validate_scan_freqs(
2977                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2978                 if (!n_channels) {
2979                         err = -EINVAL;
2980                         goto out;
2981                 }
2982         } else {
2983                 n_channels = 0;
2984
2985                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2986                         if (wiphy->bands[band])
2987                                 n_channels += wiphy->bands[band]->n_channels;
2988         }
2989
2990         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2991                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2992                         n_ssids++;
2993
2994         if (n_ssids > wiphy->max_scan_ssids) {
2995                 err = -EINVAL;
2996                 goto out;
2997         }
2998
2999         if (info->attrs[NL80211_ATTR_IE])
3000                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3001         else
3002                 ie_len = 0;
3003
3004         if (ie_len > wiphy->max_scan_ie_len) {
3005                 err = -EINVAL;
3006                 goto out;
3007         }
3008
3009         request = kzalloc(sizeof(*request)
3010                         + sizeof(*ssid) * n_ssids
3011                         + sizeof(channel) * n_channels
3012                         + ie_len, GFP_KERNEL);
3013         if (!request) {
3014                 err = -ENOMEM;
3015                 goto out;
3016         }
3017
3018         if (n_ssids)
3019                 request->ssids = (void *)&request->channels[n_channels];
3020         request->n_ssids = n_ssids;
3021         if (ie_len) {
3022                 if (request->ssids)
3023                         request->ie = (void *)(request->ssids + n_ssids);
3024                 else
3025                         request->ie = (void *)(request->channels + n_channels);
3026         }
3027
3028         i = 0;
3029         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3030                 /* user specified, bail out if channel not found */
3031                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3032                         struct ieee80211_channel *chan;
3033
3034                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3035
3036                         if (!chan) {
3037                                 err = -EINVAL;
3038                                 goto out_free;
3039                         }
3040
3041                         /* ignore disabled channels */
3042                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3043                                 continue;
3044
3045                         request->channels[i] = chan;
3046                         i++;
3047                 }
3048         } else {
3049                 /* all channels */
3050                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3051                         int j;
3052                         if (!wiphy->bands[band])
3053                                 continue;
3054                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3055                                 struct ieee80211_channel *chan;
3056
3057                                 chan = &wiphy->bands[band]->channels[j];
3058
3059                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3060                                         continue;
3061
3062                                 request->channels[i] = chan;
3063                                 i++;
3064                         }
3065                 }
3066         }
3067
3068         if (!i) {
3069                 err = -EINVAL;
3070                 goto out_free;
3071         }
3072
3073         request->n_channels = i;
3074
3075         i = 0;
3076         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3077                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3078                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3079                                 err = -EINVAL;
3080                                 goto out_free;
3081                         }
3082                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3083                         request->ssids[i].ssid_len = nla_len(attr);
3084                         i++;
3085                 }
3086         }
3087
3088         if (info->attrs[NL80211_ATTR_IE]) {
3089                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3090                 memcpy((void *)request->ie,
3091                        nla_data(info->attrs[NL80211_ATTR_IE]),
3092                        request->ie_len);
3093         }
3094
3095         request->dev = dev;
3096         request->wiphy = &rdev->wiphy;
3097
3098         rdev->scan_req = request;
3099         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3100
3101         if (!err) {
3102                 nl80211_send_scan_start(rdev, dev);
3103                 dev_hold(dev);
3104         }
3105
3106  out_free:
3107         if (err) {
3108                 rdev->scan_req = NULL;
3109                 kfree(request);
3110         }
3111  out:
3112         cfg80211_unlock_rdev(rdev);
3113         dev_put(dev);
3114  out_rtnl:
3115         rtnl_unlock();
3116
3117         return err;
3118 }
3119
3120 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3121                             struct cfg80211_registered_device *rdev,
3122                             struct wireless_dev *wdev,
3123                             struct cfg80211_internal_bss *intbss)
3124 {
3125         struct cfg80211_bss *res = &intbss->pub;
3126         void *hdr;
3127         struct nlattr *bss;
3128         int i;
3129
3130         ASSERT_WDEV_LOCK(wdev);
3131
3132         hdr = nl80211hdr_put(msg, pid, seq, flags,
3133                              NL80211_CMD_NEW_SCAN_RESULTS);
3134         if (!hdr)
3135                 return -1;
3136
3137         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3138         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3139
3140         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3141         if (!bss)
3142                 goto nla_put_failure;
3143         if (!is_zero_ether_addr(res->bssid))
3144                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3145         if (res->information_elements && res->len_information_elements)
3146                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3147                         res->len_information_elements,
3148                         res->information_elements);
3149         if (res->beacon_ies && res->len_beacon_ies &&
3150             res->beacon_ies != res->information_elements)
3151                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3152                         res->len_beacon_ies, res->beacon_ies);
3153         if (res->tsf)
3154                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3155         if (res->beacon_interval)
3156                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3157         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3158         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3159         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3160                 jiffies_to_msecs(jiffies - intbss->ts));
3161
3162         switch (rdev->wiphy.signal_type) {
3163         case CFG80211_SIGNAL_TYPE_MBM:
3164                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3165                 break;
3166         case CFG80211_SIGNAL_TYPE_UNSPEC:
3167                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3168                 break;
3169         default:
3170                 break;
3171         }
3172
3173         switch (wdev->iftype) {
3174         case NL80211_IFTYPE_STATION:
3175                 if (intbss == wdev->current_bss)
3176                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3177                                     NL80211_BSS_STATUS_ASSOCIATED);
3178                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3179                         if (intbss != wdev->auth_bsses[i])
3180                                 continue;
3181                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3182                                     NL80211_BSS_STATUS_AUTHENTICATED);
3183                         break;
3184                 }
3185                 break;
3186         case NL80211_IFTYPE_ADHOC:
3187                 if (intbss == wdev->current_bss)
3188                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3189                                     NL80211_BSS_STATUS_IBSS_JOINED);
3190                 break;
3191         default:
3192                 break;
3193         }
3194
3195         nla_nest_end(msg, bss);
3196
3197         return genlmsg_end(msg, hdr);
3198
3199  nla_put_failure:
3200         genlmsg_cancel(msg, hdr);
3201         return -EMSGSIZE;
3202 }
3203
3204 static int nl80211_dump_scan(struct sk_buff *skb,
3205                              struct netlink_callback *cb)
3206 {
3207         struct cfg80211_registered_device *rdev;
3208         struct net_device *dev;
3209         struct cfg80211_internal_bss *scan;
3210         struct wireless_dev *wdev;
3211         int ifidx = cb->args[0];
3212         int start = cb->args[1], idx = 0;
3213         int err;
3214
3215         if (!ifidx)
3216                 ifidx = nl80211_get_ifidx(cb);
3217         if (ifidx < 0)
3218                 return ifidx;
3219         cb->args[0] = ifidx;
3220
3221         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3222         if (!dev)
3223                 return -ENODEV;
3224
3225         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3226         if (IS_ERR(rdev)) {
3227                 err = PTR_ERR(rdev);
3228                 goto out_put_netdev;
3229         }
3230
3231         wdev = dev->ieee80211_ptr;
3232
3233         wdev_lock(wdev);
3234         spin_lock_bh(&rdev->bss_lock);
3235         cfg80211_bss_expire(rdev);
3236
3237         list_for_each_entry(scan, &rdev->bss_list, list) {
3238                 if (++idx <= start)
3239                         continue;
3240                 if (nl80211_send_bss(skb,
3241                                 NETLINK_CB(cb->skb).pid,
3242                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3243                                 rdev, wdev, scan) < 0) {
3244                         idx--;
3245                         goto out;
3246                 }
3247         }
3248
3249  out:
3250         spin_unlock_bh(&rdev->bss_lock);
3251         wdev_unlock(wdev);
3252
3253         cb->args[1] = idx;
3254         err = skb->len;
3255         cfg80211_unlock_rdev(rdev);
3256  out_put_netdev:
3257         dev_put(dev);
3258
3259         return err;
3260 }
3261
3262 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3263                                 int flags, struct net_device *dev,
3264                                 struct survey_info *survey)
3265 {
3266         void *hdr;
3267         struct nlattr *infoattr;
3268
3269         /* Survey without a channel doesn't make sense */
3270         if (!survey->channel)
3271                 return -EINVAL;
3272
3273         hdr = nl80211hdr_put(msg, pid, seq, flags,
3274                              NL80211_CMD_NEW_SURVEY_RESULTS);
3275         if (!hdr)
3276                 return -ENOMEM;
3277
3278         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3279
3280         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3281         if (!infoattr)
3282                 goto nla_put_failure;
3283
3284         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3285                     survey->channel->center_freq);
3286         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3287                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3288                             survey->noise);
3289
3290         nla_nest_end(msg, infoattr);
3291
3292         return genlmsg_end(msg, hdr);
3293
3294  nla_put_failure:
3295         genlmsg_cancel(msg, hdr);
3296         return -EMSGSIZE;
3297 }
3298
3299 static int nl80211_dump_survey(struct sk_buff *skb,
3300                         struct netlink_callback *cb)
3301 {
3302         struct survey_info survey;
3303         struct cfg80211_registered_device *dev;
3304         struct net_device *netdev;
3305         int ifidx = cb->args[0];
3306         int survey_idx = cb->args[1];
3307         int res;
3308
3309         if (!ifidx)
3310                 ifidx = nl80211_get_ifidx(cb);
3311         if (ifidx < 0)
3312                 return ifidx;
3313         cb->args[0] = ifidx;
3314
3315         rtnl_lock();
3316
3317         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3318         if (!netdev) {
3319                 res = -ENODEV;
3320                 goto out_rtnl;
3321         }
3322
3323         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3324         if (IS_ERR(dev)) {
3325                 res = PTR_ERR(dev);
3326                 goto out_rtnl;
3327         }
3328
3329         if (!dev->ops->dump_survey) {
3330                 res = -EOPNOTSUPP;
3331                 goto out_err;
3332         }
3333
3334         while (1) {
3335                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3336                                             &survey);
3337                 if (res == -ENOENT)
3338                         break;
3339                 if (res)
3340                         goto out_err;
3341
3342                 if (nl80211_send_survey(skb,
3343                                 NETLINK_CB(cb->skb).pid,
3344                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3345                                 netdev,
3346                                 &survey) < 0)
3347                         goto out;
3348                 survey_idx++;
3349         }
3350
3351  out:
3352         cb->args[1] = survey_idx;
3353         res = skb->len;
3354  out_err:
3355         cfg80211_unlock_rdev(dev);
3356  out_rtnl:
3357         rtnl_unlock();
3358
3359         return res;
3360 }
3361
3362 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3363 {
3364         return auth_type <= NL80211_AUTHTYPE_MAX;
3365 }
3366
3367 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3368 {
3369         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3370                                   NL80211_WPA_VERSION_2));
3371 }
3372
3373 static bool nl80211_valid_akm_suite(u32 akm)
3374 {
3375         return akm == WLAN_AKM_SUITE_8021X ||
3376                 akm == WLAN_AKM_SUITE_PSK;
3377 }
3378
3379 static bool nl80211_valid_cipher_suite(u32 cipher)
3380 {
3381         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3382                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3383                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3384                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3385                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3386 }
3387
3388
3389 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3390 {
3391         struct cfg80211_registered_device *rdev;
3392         struct net_device *dev;
3393         struct ieee80211_channel *chan;
3394         const u8 *bssid, *ssid, *ie = NULL;
3395         int err, ssid_len, ie_len = 0;
3396         enum nl80211_auth_type auth_type;
3397         struct key_parse key;
3398         bool local_state_change;
3399
3400         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3401                 return -EINVAL;
3402
3403         if (!info->attrs[NL80211_ATTR_MAC])
3404                 return -EINVAL;
3405
3406         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3407                 return -EINVAL;
3408
3409         if (!info->attrs[NL80211_ATTR_SSID])
3410                 return -EINVAL;
3411
3412         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3413                 return -EINVAL;
3414
3415         err = nl80211_parse_key(info, &key);
3416         if (err)
3417                 return err;
3418
3419         if (key.idx >= 0) {
3420                 if (!key.p.key || !key.p.key_len)
3421                         return -EINVAL;
3422                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3423                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3424                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3425                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3426                         return -EINVAL;
3427                 if (key.idx > 4)
3428                         return -EINVAL;
3429         } else {
3430                 key.p.key_len = 0;
3431                 key.p.key = NULL;
3432         }
3433
3434         rtnl_lock();
3435
3436         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3437         if (err)
3438                 goto unlock_rtnl;
3439
3440         if (!rdev->ops->auth) {
3441                 err = -EOPNOTSUPP;
3442                 goto out;
3443         }
3444
3445         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3446                 err = -EOPNOTSUPP;
3447                 goto out;
3448         }
3449
3450         if (!netif_running(dev)) {
3451                 err = -ENETDOWN;
3452                 goto out;
3453         }
3454
3455         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3456         chan = ieee80211_get_channel(&rdev->wiphy,
3457                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3458         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3459                 err = -EINVAL;
3460                 goto out;
3461         }
3462
3463         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3464         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3465
3466         if (info->attrs[NL80211_ATTR_IE]) {
3467                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3468                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3469         }
3470
3471         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3472         if (!nl80211_valid_auth_type(auth_type)) {
3473                 err = -EINVAL;
3474                 goto out;
3475         }
3476
3477         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3478
3479         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3480                                  ssid, ssid_len, ie, ie_len,
3481                                  key.p.key, key.p.key_len, key.idx,
3482                                  local_state_change);
3483
3484 out:
3485         cfg80211_unlock_rdev(rdev);
3486         dev_put(dev);
3487 unlock_rtnl:
3488         rtnl_unlock();
3489         return err;
3490 }
3491
3492 static int nl80211_crypto_settings(struct genl_info *info,
3493                                    struct cfg80211_crypto_settings *settings,
3494                                    int cipher_limit)
3495 {
3496         memset(settings, 0, sizeof(*settings));
3497
3498         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3499
3500         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3501                 void *data;
3502                 int len, i;
3503
3504                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3505                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3506                 settings->n_ciphers_pairwise = len / sizeof(u32);
3507
3508                 if (len % sizeof(u32))
3509                         return -EINVAL;
3510
3511                 if (settings->n_ciphers_pairwise > cipher_limit)
3512                         return -EINVAL;
3513
3514                 memcpy(settings->ciphers_pairwise, data, len);
3515
3516                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3517                         if (!nl80211_valid_cipher_suite(
3518                                         settings->ciphers_pairwise[i]))
3519                                 return -EINVAL;
3520         }
3521
3522         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3523                 settings->cipher_group =
3524                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3525                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3526                         return -EINVAL;
3527         }
3528
3529         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3530                 settings->wpa_versions =
3531                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3532                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3533                         return -EINVAL;
3534         }
3535
3536         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3537                 void *data;
3538                 int len, i;
3539
3540                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3541                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3542                 settings->n_akm_suites = len / sizeof(u32);
3543
3544                 if (len % sizeof(u32))
3545                         return -EINVAL;
3546
3547                 memcpy(settings->akm_suites, data, len);
3548
3549                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3550                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3551                                 return -EINVAL;
3552         }
3553
3554         return 0;
3555 }
3556
3557 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3558 {
3559         struct cfg80211_registered_device *rdev;
3560         struct net_device *dev;
3561         struct wireless_dev *wdev;
3562         struct cfg80211_crypto_settings crypto;
3563         struct ieee80211_channel *chan, *fixedchan;
3564         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3565         int err, ssid_len, ie_len = 0;
3566         bool use_mfp = false;
3567
3568         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3569                 return -EINVAL;
3570
3571         if (!info->attrs[NL80211_ATTR_MAC] ||
3572             !info->attrs[NL80211_ATTR_SSID] ||
3573             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3574                 return -EINVAL;
3575
3576         rtnl_lock();
3577
3578         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3579         if (err)
3580                 goto unlock_rtnl;
3581
3582         if (!rdev->ops->assoc) {
3583                 err = -EOPNOTSUPP;
3584                 goto out;
3585         }
3586
3587         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3588                 err = -EOPNOTSUPP;
3589                 goto out;
3590         }
3591
3592         if (!netif_running(dev)) {
3593                 err = -ENETDOWN;
3594                 goto out;
3595         }
3596
3597         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3598
3599         chan = ieee80211_get_channel(&rdev->wiphy,
3600                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3601         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3602                 err = -EINVAL;
3603                 goto out;
3604         }
3605
3606         mutex_lock(&rdev->devlist_mtx);
3607         wdev = dev->ieee80211_ptr;
3608         fixedchan = rdev_fixed_channel(rdev, wdev);
3609         if (fixedchan && chan != fixedchan) {
3610                 err = -EBUSY;
3611                 mutex_unlock(&rdev->devlist_mtx);
3612                 goto out;
3613         }
3614         mutex_unlock(&rdev->devlist_mtx);
3615
3616         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3617         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3618
3619         if (info->attrs[NL80211_ATTR_IE]) {
3620                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3621                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3622         }
3623
3624         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3625                 enum nl80211_mfp mfp =
3626                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3627                 if (mfp == NL80211_MFP_REQUIRED)
3628                         use_mfp = true;
3629                 else if (mfp != NL80211_MFP_NO) {
3630                         err = -EINVAL;
3631                         goto out;
3632                 }
3633         }
3634
3635         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3636                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3637
3638         err = nl80211_crypto_settings(info, &crypto, 1);
3639         if (!err)
3640                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3641                                           ssid, ssid_len, ie, ie_len, use_mfp,
3642                                           &crypto);
3643
3644 out:
3645         cfg80211_unlock_rdev(rdev);
3646         dev_put(dev);
3647 unlock_rtnl:
3648         rtnl_unlock();
3649         return err;
3650 }
3651
3652 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3653 {
3654         struct cfg80211_registered_device *rdev;
3655         struct net_device *dev;
3656         const u8 *ie = NULL, *bssid;
3657         int err, ie_len = 0;
3658         u16 reason_code;
3659         bool local_state_change;
3660
3661         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3662                 return -EINVAL;
3663
3664         if (!info->attrs[NL80211_ATTR_MAC])
3665                 return -EINVAL;
3666
3667         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3668                 return -EINVAL;
3669
3670         rtnl_lock();
3671
3672         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3673         if (err)
3674                 goto unlock_rtnl;
3675
3676         if (!rdev->ops->deauth) {
3677                 err = -EOPNOTSUPP;
3678                 goto out;
3679         }
3680
3681         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3682                 err = -EOPNOTSUPP;
3683                 goto out;
3684         }
3685
3686         if (!netif_running(dev)) {
3687                 err = -ENETDOWN;
3688                 goto out;
3689         }
3690
3691         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3692
3693         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3694         if (reason_code == 0) {
3695                 /* Reason Code 0 is reserved */
3696                 err = -EINVAL;
3697                 goto out;
3698         }
3699
3700         if (info->attrs[NL80211_ATTR_IE]) {
3701                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3702                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3703         }
3704
3705         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3706
3707         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3708                                    local_state_change);
3709
3710 out:
3711         cfg80211_unlock_rdev(rdev);
3712         dev_put(dev);
3713 unlock_rtnl:
3714         rtnl_unlock();
3715         return err;
3716 }
3717
3718 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3719 {
3720         struct cfg80211_registered_device *rdev;
3721         struct net_device *dev;
3722         const u8 *ie = NULL, *bssid;
3723         int err, ie_len = 0;
3724         u16 reason_code;
3725         bool local_state_change;
3726
3727         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3728                 return -EINVAL;
3729
3730         if (!info->attrs[NL80211_ATTR_MAC])
3731                 return -EINVAL;
3732
3733         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3734                 return -EINVAL;
3735
3736         rtnl_lock();
3737
3738         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3739         if (err)
3740                 goto unlock_rtnl;
3741
3742         if (!rdev->ops->disassoc) {
3743                 err = -EOPNOTSUPP;
3744                 goto out;
3745         }
3746
3747         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3748                 err = -EOPNOTSUPP;
3749                 goto out;
3750         }
3751
3752         if (!netif_running(dev)) {
3753                 err = -ENETDOWN;
3754                 goto out;
3755         }
3756
3757         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3758
3759         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3760         if (reason_code == 0) {
3761                 /* Reason Code 0 is reserved */
3762                 err = -EINVAL;
3763                 goto out;
3764         }
3765
3766         if (info->attrs[NL80211_ATTR_IE]) {
3767                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3768                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3769         }
3770
3771         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3772
3773         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3774                                      local_state_change);
3775
3776 out:
3777         cfg80211_unlock_rdev(rdev);
3778         dev_put(dev);
3779 unlock_rtnl:
3780         rtnl_unlock();
3781         return err;
3782 }
3783
3784 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3785 {
3786         struct cfg80211_registered_device *rdev;
3787         struct net_device *dev;
3788         struct cfg80211_ibss_params ibss;
3789         struct wiphy *wiphy;
3790         struct cfg80211_cached_keys *connkeys = NULL;
3791         int err;
3792
3793         memset(&ibss, 0, sizeof(ibss));
3794
3795         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3796                 return -EINVAL;
3797
3798         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3799             !info->attrs[NL80211_ATTR_SSID] ||
3800             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3801                 return -EINVAL;
3802
3803         ibss.beacon_interval = 100;
3804
3805         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3806                 ibss.beacon_interval =
3807                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3808                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3809                         return -EINVAL;
3810         }
3811
3812         rtnl_lock();
3813
3814         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3815         if (err)
3816                 goto unlock_rtnl;
3817
3818         if (!rdev->ops->join_ibss) {
3819                 err = -EOPNOTSUPP;
3820                 goto out;
3821         }
3822
3823         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3824                 err = -EOPNOTSUPP;
3825                 goto out;
3826         }
3827
3828         if (!netif_running(dev)) {
3829                 err = -ENETDOWN;
3830                 goto out;
3831         }
3832
3833         wiphy = &rdev->wiphy;
3834
3835         if (info->attrs[NL80211_ATTR_MAC])
3836                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3837         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3838         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3839
3840         if (info->attrs[NL80211_ATTR_IE]) {
3841                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3842                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3843         }
3844
3845         ibss.channel = ieee80211_get_channel(wiphy,
3846                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3847         if (!ibss.channel ||
3848             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3849             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3850                 err = -EINVAL;
3851                 goto out;
3852         }
3853
3854         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3855         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3856
3857         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3858                 connkeys = nl80211_parse_connkeys(rdev,
3859                                         info->attrs[NL80211_ATTR_KEYS]);
3860                 if (IS_ERR(connkeys)) {
3861                         err = PTR_ERR(connkeys);
3862                         connkeys = NULL;
3863                         goto out;
3864                 }
3865         }
3866
3867         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3868
3869 out:
3870         cfg80211_unlock_rdev(rdev);
3871         dev_put(dev);
3872 unlock_rtnl:
3873         if (err)
3874                 kfree(connkeys);
3875         rtnl_unlock();
3876         return err;
3877 }
3878
3879 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3880 {
3881         struct cfg80211_registered_device *rdev;
3882         struct net_device *dev;
3883         int err;
3884
3885         rtnl_lock();
3886
3887         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3888         if (err)
3889                 goto unlock_rtnl;
3890
3891         if (!rdev->ops->leave_ibss) {
3892                 err = -EOPNOTSUPP;
3893                 goto out;
3894         }
3895
3896         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3897                 err = -EOPNOTSUPP;
3898                 goto out;
3899         }
3900
3901         if (!netif_running(dev)) {
3902                 err = -ENETDOWN;
3903                 goto out;
3904         }
3905
3906         err = cfg80211_leave_ibss(rdev, dev, false);
3907
3908 out:
3909         cfg80211_unlock_rdev(rdev);
3910         dev_put(dev);
3911 unlock_rtnl:
3912         rtnl_unlock();
3913         return err;
3914 }
3915
3916 #ifdef CONFIG_NL80211_TESTMODE
3917 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3918         .name = "testmode",
3919 };
3920
3921 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3922 {
3923         struct cfg80211_registered_device *rdev;
3924         int err;
3925
3926         if (!info->attrs[NL80211_ATTR_TESTDATA])
3927                 return -EINVAL;
3928
3929         rtnl_lock();
3930
3931         rdev = cfg80211_get_dev_from_info(info);
3932         if (IS_ERR(rdev)) {
3933                 err = PTR_ERR(rdev);
3934                 goto unlock_rtnl;
3935         }
3936
3937         err = -EOPNOTSUPP;
3938         if (rdev->ops->testmode_cmd) {
3939                 rdev->testmode_info = info;
3940                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3941                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3942                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3943                 rdev->testmode_info = NULL;
3944         }
3945
3946         cfg80211_unlock_rdev(rdev);
3947
3948  unlock_rtnl:
3949         rtnl_unlock();
3950         return err;
3951 }
3952
3953 static struct sk_buff *
3954 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3955                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3956 {
3957         struct sk_buff *skb;
3958         void *hdr;
3959         struct nlattr *data;
3960
3961         skb = nlmsg_new(approxlen + 100, gfp);
3962         if (!skb)
3963                 return NULL;
3964
3965         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3966         if (!hdr) {
3967                 kfree_skb(skb);
3968                 return NULL;
3969         }
3970
3971         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3972         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3973
3974         ((void **)skb->cb)[0] = rdev;
3975         ((void **)skb->cb)[1] = hdr;
3976         ((void **)skb->cb)[2] = data;
3977
3978         return skb;
3979
3980  nla_put_failure:
3981         kfree_skb(skb);
3982         return NULL;
3983 }
3984
3985 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3986                                                   int approxlen)
3987 {
3988         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3989
3990         if (WARN_ON(!rdev->testmode_info))
3991                 return NULL;
3992
3993         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3994                                 rdev->testmode_info->snd_pid,
3995                                 rdev->testmode_info->snd_seq,
3996                                 GFP_KERNEL);
3997 }
3998 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3999
4000 int cfg80211_testmode_reply(struct sk_buff *skb)
4001 {
4002         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4003         void *hdr = ((void **)skb->cb)[1];
4004         struct nlattr *data = ((void **)skb->cb)[2];
4005
4006         if (WARN_ON(!rdev->testmode_info)) {
4007                 kfree_skb(skb);
4008                 return -EINVAL;
4009         }
4010
4011         nla_nest_end(skb, data);
4012         genlmsg_end(skb, hdr);
4013         return genlmsg_reply(skb, rdev->testmode_info);
4014 }
4015 EXPORT_SYMBOL(cfg80211_testmode_reply);
4016
4017 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4018                                                   int approxlen, gfp_t gfp)
4019 {
4020         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4021
4022         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4023 }
4024 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4025
4026 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4027 {
4028         void *hdr = ((void **)skb->cb)[1];
4029         struct nlattr *data = ((void **)skb->cb)[2];
4030
4031         nla_nest_end(skb, data);
4032         genlmsg_end(skb, hdr);
4033         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4034 }
4035 EXPORT_SYMBOL(cfg80211_testmode_event);
4036 #endif
4037
4038 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4039 {
4040         struct cfg80211_registered_device *rdev;
4041         struct net_device *dev;
4042         struct cfg80211_connect_params connect;
4043         struct wiphy *wiphy;
4044         struct cfg80211_cached_keys *connkeys = NULL;
4045         int err;
4046
4047         memset(&connect, 0, sizeof(connect));
4048
4049         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4050                 return -EINVAL;
4051
4052         if (!info->attrs[NL80211_ATTR_SSID] ||
4053             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4054                 return -EINVAL;
4055
4056         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4057                 connect.auth_type =
4058                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4059                 if (!nl80211_valid_auth_type(connect.auth_type))
4060                         return -EINVAL;
4061         } else
4062                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4063
4064         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4065
4066         err = nl80211_crypto_settings(info, &connect.crypto,
4067                                       NL80211_MAX_NR_CIPHER_SUITES);
4068         if (err)
4069                 return err;
4070         rtnl_lock();
4071
4072         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4073         if (err)
4074                 goto unlock_rtnl;
4075
4076         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4077                 err = -EOPNOTSUPP;
4078                 goto out;
4079         }
4080
4081         if (!netif_running(dev)) {
4082                 err = -ENETDOWN;
4083                 goto out;
4084         }
4085
4086         wiphy = &rdev->wiphy;
4087
4088         if (info->attrs[NL80211_ATTR_MAC])
4089                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4090         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4091         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4092
4093         if (info->attrs[NL80211_ATTR_IE]) {
4094                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4095                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4096         }
4097
4098         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4099                 connect.channel =
4100                         ieee80211_get_channel(wiphy,
4101                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4102                 if (!connect.channel ||
4103                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4104                         err = -EINVAL;
4105                         goto out;
4106                 }
4107         }
4108
4109         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4110                 connkeys = nl80211_parse_connkeys(rdev,
4111                                         info->attrs[NL80211_ATTR_KEYS]);
4112                 if (IS_ERR(connkeys)) {
4113                         err = PTR_ERR(connkeys);
4114                         connkeys = NULL;
4115                         goto out;
4116                 }
4117         }
4118
4119         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4120
4121 out:
4122         cfg80211_unlock_rdev(rdev);
4123         dev_put(dev);
4124 unlock_rtnl:
4125         if (err)
4126                 kfree(connkeys);
4127         rtnl_unlock();
4128         return err;
4129 }
4130
4131 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4132 {
4133         struct cfg80211_registered_device *rdev;
4134         struct net_device *dev;
4135         int err;
4136         u16 reason;
4137
4138         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4139                 reason = WLAN_REASON_DEAUTH_LEAVING;
4140         else
4141                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4142
4143         if (reason == 0)
4144                 return -EINVAL;
4145
4146         rtnl_lock();
4147
4148         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4149         if (err)
4150                 goto unlock_rtnl;
4151
4152         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4153                 err = -EOPNOTSUPP;
4154                 goto out;
4155         }
4156
4157         if (!netif_running(dev)) {
4158                 err = -ENETDOWN;
4159                 goto out;
4160         }
4161
4162         err = cfg80211_disconnect(rdev, dev, reason, true);
4163
4164 out:
4165         cfg80211_unlock_rdev(rdev);
4166         dev_put(dev);
4167 unlock_rtnl:
4168         rtnl_unlock();
4169         return err;
4170 }
4171
4172 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4173 {
4174         struct cfg80211_registered_device *rdev;
4175         struct net *net;
4176         int err;
4177         u32 pid;
4178
4179         if (!info->attrs[NL80211_ATTR_PID])
4180                 return -EINVAL;
4181
4182         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4183
4184         rtnl_lock();
4185
4186         rdev = cfg80211_get_dev_from_info(info);
4187         if (IS_ERR(rdev)) {
4188                 err = PTR_ERR(rdev);
4189                 goto out_rtnl;
4190         }
4191
4192         net = get_net_ns_by_pid(pid);
4193         if (IS_ERR(net)) {
4194                 err = PTR_ERR(net);
4195                 goto out;
4196         }
4197
4198         err = 0;
4199
4200         /* check if anything to do */
4201         if (net_eq(wiphy_net(&rdev->wiphy), net))
4202                 goto out_put_net;
4203
4204         err = cfg80211_switch_netns(rdev, net);
4205  out_put_net:
4206         put_net(net);
4207  out:
4208         cfg80211_unlock_rdev(rdev);
4209  out_rtnl:
4210         rtnl_unlock();
4211         return err;
4212 }
4213
4214 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4215 {
4216         struct cfg80211_registered_device *rdev;
4217         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4218                         struct cfg80211_pmksa *pmksa) = NULL;
4219         int err;
4220         struct net_device *dev;
4221         struct cfg80211_pmksa pmksa;
4222
4223         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4224
4225         if (!info->attrs[NL80211_ATTR_MAC])
4226                 return -EINVAL;
4227
4228         if (!info->attrs[NL80211_ATTR_PMKID])
4229                 return -EINVAL;
4230
4231         rtnl_lock();
4232
4233         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4234         if (err)
4235                 goto out_rtnl;
4236
4237         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4238         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4239
4240         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4241                 err = -EOPNOTSUPP;
4242                 goto out;
4243         }
4244
4245         switch (info->genlhdr->cmd) {
4246         case NL80211_CMD_SET_PMKSA:
4247                 rdev_ops = rdev->ops->set_pmksa;
4248                 break;
4249         case NL80211_CMD_DEL_PMKSA:
4250                 rdev_ops = rdev->ops->del_pmksa;
4251                 break;
4252         default:
4253                 WARN_ON(1);
4254                 break;
4255         }
4256
4257         if (!rdev_ops) {
4258                 err = -EOPNOTSUPP;
4259                 goto out;
4260         }
4261
4262         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4263
4264  out:
4265         cfg80211_unlock_rdev(rdev);
4266         dev_put(dev);
4267  out_rtnl:
4268         rtnl_unlock();
4269
4270         return err;
4271 }
4272
4273 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4274 {
4275         struct cfg80211_registered_device *rdev;
4276         int err;
4277         struct net_device *dev;
4278
4279         rtnl_lock();
4280
4281         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4282         if (err)
4283                 goto out_rtnl;
4284
4285         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4286                 err = -EOPNOTSUPP;
4287                 goto out;
4288         }
4289
4290         if (!rdev->ops->flush_pmksa) {
4291                 err = -EOPNOTSUPP;
4292                 goto out;
4293         }
4294
4295         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4296
4297  out:
4298         cfg80211_unlock_rdev(rdev);
4299         dev_put(dev);
4300  out_rtnl:
4301         rtnl_unlock();
4302
4303         return err;
4304
4305 }
4306
4307 static int nl80211_remain_on_channel(struct sk_buff *skb,
4308                                      struct genl_info *info)
4309 {
4310         struct cfg80211_registered_device *rdev;
4311         struct net_device *dev;
4312         struct ieee80211_channel *chan;
4313         struct sk_buff *msg;
4314         void *hdr;
4315         u64 cookie;
4316         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4317         u32 freq, duration;
4318         int err;
4319
4320         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4321             !info->attrs[NL80211_ATTR_DURATION])
4322                 return -EINVAL;
4323
4324         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4325
4326         /*
4327          * We should be on that channel for at least one jiffie,
4328          * and more than 5 seconds seems excessive.
4329          */
4330         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4331                 return -EINVAL;
4332
4333         rtnl_lock();
4334
4335         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4336         if (err)
4337                 goto unlock_rtnl;
4338
4339         if (!rdev->ops->remain_on_channel) {
4340                 err = -EOPNOTSUPP;
4341                 goto out;
4342         }
4343
4344         if (!netif_running(dev)) {
4345                 err = -ENETDOWN;
4346                 goto out;
4347         }
4348
4349         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4350                 channel_type = nla_get_u32(
4351                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4352                 if (channel_type != NL80211_CHAN_NO_HT &&
4353                     channel_type != NL80211_CHAN_HT20 &&
4354                     channel_type != NL80211_CHAN_HT40PLUS &&
4355                     channel_type != NL80211_CHAN_HT40MINUS)
4356                         err = -EINVAL;
4357                         goto out;
4358         }
4359
4360         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4361         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4362         if (chan == NULL) {
4363                 err = -EINVAL;
4364                 goto out;
4365         }
4366
4367         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4368         if (!msg) {
4369                 err = -ENOMEM;
4370                 goto out;
4371         }
4372
4373         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4374                              NL80211_CMD_REMAIN_ON_CHANNEL);
4375
4376         if (IS_ERR(hdr)) {
4377                 err = PTR_ERR(hdr);
4378                 goto free_msg;
4379         }
4380
4381         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4382                                            channel_type, duration, &cookie);
4383
4384         if (err)
4385                 goto free_msg;
4386
4387         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4388
4389         genlmsg_end(msg, hdr);
4390         err = genlmsg_reply(msg, info);
4391         goto out;
4392
4393  nla_put_failure:
4394         err = -ENOBUFS;
4395  free_msg:
4396         nlmsg_free(msg);
4397  out:
4398         cfg80211_unlock_rdev(rdev);
4399         dev_put(dev);
4400  unlock_rtnl:
4401         rtnl_unlock();
4402         return err;
4403 }
4404
4405 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4406                                             struct genl_info *info)
4407 {
4408         struct cfg80211_registered_device *rdev;
4409         struct net_device *dev;
4410         u64 cookie;
4411         int err;
4412
4413         if (!info->attrs[NL80211_ATTR_COOKIE])
4414                 return -EINVAL;
4415
4416         rtnl_lock();
4417
4418         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4419         if (err)
4420                 goto unlock_rtnl;
4421
4422         if (!rdev->ops->cancel_remain_on_channel) {
4423                 err = -EOPNOTSUPP;
4424                 goto out;
4425         }
4426
4427         if (!netif_running(dev)) {
4428                 err = -ENETDOWN;
4429                 goto out;
4430         }
4431
4432         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4433
4434         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4435
4436  out:
4437         cfg80211_unlock_rdev(rdev);
4438         dev_put(dev);
4439  unlock_rtnl:
4440         rtnl_unlock();
4441         return err;
4442 }
4443
4444 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4445                            u8 *rates, u8 rates_len)
4446 {
4447         u8 i;
4448         u32 mask = 0;
4449
4450         for (i = 0; i < rates_len; i++) {
4451                 int rate = (rates[i] & 0x7f) * 5;
4452                 int ridx;
4453                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4454                         struct ieee80211_rate *srate =
4455                                 &sband->bitrates[ridx];
4456                         if (rate == srate->bitrate) {
4457                                 mask |= 1 << ridx;
4458                                 break;
4459                         }
4460                 }
4461                 if (ridx == sband->n_bitrates)
4462                         return 0; /* rate not found */
4463         }
4464
4465         return mask;
4466 }
4467
4468 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4469         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4470                                     .len = NL80211_MAX_SUPP_RATES },
4471 };
4472
4473 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4474                                        struct genl_info *info)
4475 {
4476         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4477         struct cfg80211_registered_device *rdev;
4478         struct cfg80211_bitrate_mask mask;
4479         int err, rem, i;
4480         struct net_device *dev;
4481         struct nlattr *tx_rates;
4482         struct ieee80211_supported_band *sband;
4483
4484         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4485                 return -EINVAL;
4486
4487         rtnl_lock();
4488
4489         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4490         if (err)
4491                 goto unlock_rtnl;
4492
4493         if (!rdev->ops->set_bitrate_mask) {
4494                 err = -EOPNOTSUPP;
4495                 goto unlock;
4496         }
4497
4498         memset(&mask, 0, sizeof(mask));
4499         /* Default to all rates enabled */
4500         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4501                 sband = rdev->wiphy.bands[i];
4502                 mask.control[i].legacy =
4503                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4504         }
4505
4506         /*
4507          * The nested attribute uses enum nl80211_band as the index. This maps
4508          * directly to the enum ieee80211_band values used in cfg80211.
4509          */
4510         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4511         {
4512                 enum ieee80211_band band = nla_type(tx_rates);
4513                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4514                         err = -EINVAL;
4515                         goto unlock;
4516                 }
4517                 sband = rdev->wiphy.bands[band];
4518                 if (sband == NULL) {
4519                         err = -EINVAL;
4520                         goto unlock;
4521                 }
4522                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4523                           nla_len(tx_rates), nl80211_txattr_policy);
4524                 if (tb[NL80211_TXRATE_LEGACY]) {
4525                         mask.control[band].legacy = rateset_to_mask(
4526                                 sband,
4527                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4528                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4529                         if (mask.control[band].legacy == 0) {
4530                                 err = -EINVAL;
4531                                 goto unlock;
4532                         }
4533                 }
4534         }
4535
4536         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4537
4538  unlock:
4539         dev_put(dev);
4540         cfg80211_unlock_rdev(rdev);
4541  unlock_rtnl:
4542         rtnl_unlock();
4543         return err;
4544 }
4545
4546 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4547 {
4548         struct cfg80211_registered_device *rdev;
4549         struct net_device *dev;
4550         int err;
4551
4552         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4553                 return -EINVAL;
4554
4555         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4556                 return -EINVAL;
4557
4558         rtnl_lock();
4559
4560         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4561         if (err)
4562                 goto unlock_rtnl;
4563
4564         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4565                 err = -EOPNOTSUPP;
4566                 goto out;
4567         }
4568
4569         /* not much point in registering if we can't reply */
4570         if (!rdev->ops->action) {
4571                 err = -EOPNOTSUPP;
4572                 goto out;
4573         }
4574
4575         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4576                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4577                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4578  out:
4579         cfg80211_unlock_rdev(rdev);
4580         dev_put(dev);
4581  unlock_rtnl:
4582         rtnl_unlock();
4583         return err;
4584 }
4585
4586 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4587 {
4588         struct cfg80211_registered_device *rdev;
4589         struct net_device *dev;
4590         struct ieee80211_channel *chan;
4591         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4592         u32 freq;
4593         int err;
4594         void *hdr;
4595         u64 cookie;
4596         struct sk_buff *msg;
4597
4598         if (!info->attrs[NL80211_ATTR_FRAME] ||
4599             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4600                 return -EINVAL;
4601
4602         rtnl_lock();
4603
4604         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4605         if (err)
4606                 goto unlock_rtnl;
4607
4608         if (!rdev->ops->action) {
4609                 err = -EOPNOTSUPP;
4610                 goto out;
4611         }
4612
4613         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4614                 err = -EOPNOTSUPP;
4615                 goto out;
4616         }
4617
4618         if (!netif_running(dev)) {
4619                 err = -ENETDOWN;
4620                 goto out;
4621         }
4622
4623         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4624                 channel_type = nla_get_u32(
4625                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4626                 if (channel_type != NL80211_CHAN_NO_HT &&
4627                     channel_type != NL80211_CHAN_HT20 &&
4628                     channel_type != NL80211_CHAN_HT40PLUS &&
4629                     channel_type != NL80211_CHAN_HT40MINUS)
4630                         err = -EINVAL;
4631                         goto out;
4632         }
4633
4634         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4635         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4636         if (chan == NULL) {
4637                 err = -EINVAL;
4638                 goto out;
4639         }
4640
4641         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4642         if (!msg) {
4643                 err = -ENOMEM;
4644                 goto out;
4645         }
4646
4647         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4648                              NL80211_CMD_ACTION);
4649
4650         if (IS_ERR(hdr)) {
4651                 err = PTR_ERR(hdr);
4652                 goto free_msg;
4653         }
4654         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4655                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4656                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4657                                    &cookie);
4658         if (err)
4659                 goto free_msg;
4660
4661         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4662
4663         genlmsg_end(msg, hdr);
4664         err = genlmsg_reply(msg, info);
4665         goto out;
4666
4667  nla_put_failure:
4668         err = -ENOBUFS;
4669  free_msg:
4670         nlmsg_free(msg);
4671  out:
4672         cfg80211_unlock_rdev(rdev);
4673         dev_put(dev);
4674 unlock_rtnl:
4675         rtnl_unlock();
4676         return err;
4677 }
4678
4679 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4680 {
4681         struct cfg80211_registered_device *rdev;
4682         struct wireless_dev *wdev;
4683         struct net_device *dev;
4684         u8 ps_state;
4685         bool state;
4686         int err;
4687
4688         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4689                 err = -EINVAL;
4690                 goto out;
4691         }
4692
4693         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4694
4695         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4696                 err = -EINVAL;
4697                 goto out;
4698         }
4699
4700         rtnl_lock();
4701
4702         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4703         if (err)
4704                 goto unlock_rdev;
4705
4706         wdev = dev->ieee80211_ptr;
4707
4708         if (!rdev->ops->set_power_mgmt) {
4709                 err = -EOPNOTSUPP;
4710                 goto unlock_rdev;
4711         }
4712
4713         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4714
4715         if (state == wdev->ps)
4716                 goto unlock_rdev;
4717
4718         wdev->ps = state;
4719
4720         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4721                                       wdev->ps_timeout))
4722                 /* assume this means it's off */
4723                 wdev->ps = false;
4724
4725 unlock_rdev:
4726         cfg80211_unlock_rdev(rdev);
4727         dev_put(dev);
4728         rtnl_unlock();
4729
4730 out:
4731         return err;
4732 }
4733
4734 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4735 {
4736         struct cfg80211_registered_device *rdev;
4737         enum nl80211_ps_state ps_state;
4738         struct wireless_dev *wdev;
4739         struct net_device *dev;
4740         struct sk_buff *msg;
4741         void *hdr;
4742         int err;
4743
4744         rtnl_lock();
4745
4746         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4747         if (err)
4748                 goto unlock_rtnl;
4749
4750         wdev = dev->ieee80211_ptr;
4751
4752         if (!rdev->ops->set_power_mgmt) {
4753                 err = -EOPNOTSUPP;
4754                 goto out;
4755         }
4756
4757         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4758         if (!msg) {
4759                 err = -ENOMEM;
4760                 goto out;
4761         }
4762
4763         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4764                              NL80211_CMD_GET_POWER_SAVE);
4765         if (!hdr) {
4766                 err = -ENOMEM;
4767                 goto free_msg;
4768         }
4769
4770         if (wdev->ps)
4771                 ps_state = NL80211_PS_ENABLED;
4772         else
4773                 ps_state = NL80211_PS_DISABLED;
4774
4775         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4776
4777         genlmsg_end(msg, hdr);
4778         err = genlmsg_reply(msg, info);
4779         goto out;
4780
4781 nla_put_failure:
4782         err = -ENOBUFS;
4783
4784 free_msg:
4785         nlmsg_free(msg);
4786
4787 out:
4788         cfg80211_unlock_rdev(rdev);
4789         dev_put(dev);
4790
4791 unlock_rtnl:
4792         rtnl_unlock();
4793
4794         return err;
4795 }
4796
4797 static struct nla_policy
4798 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4799         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4800         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4801         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4802 };
4803
4804 static int nl80211_set_cqm_rssi(struct genl_info *info,
4805                                 s32 threshold, u32 hysteresis)
4806 {
4807         struct cfg80211_registered_device *rdev;
4808         struct wireless_dev *wdev;
4809         struct net_device *dev;
4810         int err;
4811
4812         if (threshold > 0)
4813                 return -EINVAL;
4814
4815         rtnl_lock();
4816
4817         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4818         if (err)
4819                 goto unlock_rdev;
4820
4821         wdev = dev->ieee80211_ptr;
4822
4823         if (!rdev->ops->set_cqm_rssi_config) {
4824                 err = -EOPNOTSUPP;
4825                 goto unlock_rdev;
4826         }
4827
4828         if (wdev->iftype != NL80211_IFTYPE_STATION) {
4829                 err = -EOPNOTSUPP;
4830                 goto unlock_rdev;
4831         }
4832
4833         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
4834                                              threshold, hysteresis);
4835
4836 unlock_rdev:
4837         cfg80211_unlock_rdev(rdev);
4838         dev_put(dev);
4839         rtnl_unlock();
4840
4841         return err;
4842 }
4843
4844 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
4845 {
4846         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
4847         struct nlattr *cqm;
4848         int err;
4849
4850         cqm = info->attrs[NL80211_ATTR_CQM];
4851         if (!cqm) {
4852                 err = -EINVAL;
4853                 goto out;
4854         }
4855
4856         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
4857                                nl80211_attr_cqm_policy);
4858         if (err)
4859                 goto out;
4860
4861         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
4862             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
4863                 s32 threshold;
4864                 u32 hysteresis;
4865                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
4866                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
4867                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
4868         } else
4869                 err = -EINVAL;
4870
4871 out:
4872         return err;
4873 }
4874
4875 static struct genl_ops nl80211_ops[] = {
4876         {
4877                 .cmd = NL80211_CMD_GET_WIPHY,
4878                 .doit = nl80211_get_wiphy,
4879                 .dumpit = nl80211_dump_wiphy,
4880                 .policy = nl80211_policy,
4881                 /* can be retrieved by unprivileged users */
4882         },
4883         {
4884                 .cmd = NL80211_CMD_SET_WIPHY,
4885                 .doit = nl80211_set_wiphy,
4886                 .policy = nl80211_policy,
4887                 .flags = GENL_ADMIN_PERM,
4888         },
4889         {
4890                 .cmd = NL80211_CMD_GET_INTERFACE,
4891                 .doit = nl80211_get_interface,
4892                 .dumpit = nl80211_dump_interface,
4893                 .policy = nl80211_policy,
4894                 /* can be retrieved by unprivileged users */
4895         },
4896         {
4897                 .cmd = NL80211_CMD_SET_INTERFACE,
4898                 .doit = nl80211_set_interface,
4899                 .policy = nl80211_policy,
4900                 .flags = GENL_ADMIN_PERM,
4901         },
4902         {
4903                 .cmd = NL80211_CMD_NEW_INTERFACE,
4904                 .doit = nl80211_new_interface,
4905                 .policy = nl80211_policy,
4906                 .flags = GENL_ADMIN_PERM,
4907         },
4908         {
4909                 .cmd = NL80211_CMD_DEL_INTERFACE,
4910                 .doit = nl80211_del_interface,
4911                 .policy = nl80211_policy,
4912                 .flags = GENL_ADMIN_PERM,
4913         },
4914         {
4915                 .cmd = NL80211_CMD_GET_KEY,
4916                 .doit = nl80211_get_key,
4917                 .policy = nl80211_policy,
4918                 .flags = GENL_ADMIN_PERM,
4919         },
4920         {
4921                 .cmd = NL80211_CMD_SET_KEY,
4922                 .doit = nl80211_set_key,
4923                 .policy = nl80211_policy,
4924                 .flags = GENL_ADMIN_PERM,
4925         },
4926         {
4927                 .cmd = NL80211_CMD_NEW_KEY,
4928                 .doit = nl80211_new_key,
4929                 .policy = nl80211_policy,
4930                 .flags = GENL_ADMIN_PERM,
4931         },
4932         {
4933                 .cmd = NL80211_CMD_DEL_KEY,
4934                 .doit = nl80211_del_key,
4935                 .policy = nl80211_policy,
4936                 .flags = GENL_ADMIN_PERM,
4937         },
4938         {
4939                 .cmd = NL80211_CMD_SET_BEACON,
4940                 .policy = nl80211_policy,
4941                 .flags = GENL_ADMIN_PERM,
4942                 .doit = nl80211_addset_beacon,
4943         },
4944         {
4945                 .cmd = NL80211_CMD_NEW_BEACON,
4946                 .policy = nl80211_policy,
4947                 .flags = GENL_ADMIN_PERM,
4948                 .doit = nl80211_addset_beacon,
4949         },
4950         {
4951                 .cmd = NL80211_CMD_DEL_BEACON,
4952                 .policy = nl80211_policy,
4953                 .flags = GENL_ADMIN_PERM,
4954                 .doit = nl80211_del_beacon,
4955         },
4956         {
4957                 .cmd = NL80211_CMD_GET_STATION,
4958                 .doit = nl80211_get_station,
4959                 .dumpit = nl80211_dump_station,
4960                 .policy = nl80211_policy,
4961         },
4962         {
4963                 .cmd = NL80211_CMD_SET_STATION,
4964                 .doit = nl80211_set_station,
4965                 .policy = nl80211_policy,
4966                 .flags = GENL_ADMIN_PERM,
4967         },
4968         {
4969                 .cmd = NL80211_CMD_NEW_STATION,
4970                 .doit = nl80211_new_station,
4971                 .policy = nl80211_policy,
4972                 .flags = GENL_ADMIN_PERM,
4973         },
4974         {
4975                 .cmd = NL80211_CMD_DEL_STATION,
4976                 .doit = nl80211_del_station,
4977                 .policy = nl80211_policy,
4978                 .flags = GENL_ADMIN_PERM,
4979         },
4980         {
4981                 .cmd = NL80211_CMD_GET_MPATH,
4982                 .doit = nl80211_get_mpath,
4983                 .dumpit = nl80211_dump_mpath,
4984                 .policy = nl80211_policy,
4985                 .flags = GENL_ADMIN_PERM,
4986         },
4987         {
4988                 .cmd = NL80211_CMD_SET_MPATH,
4989                 .doit = nl80211_set_mpath,
4990                 .policy = nl80211_policy,
4991                 .flags = GENL_ADMIN_PERM,
4992         },
4993         {
4994                 .cmd = NL80211_CMD_NEW_MPATH,
4995                 .doit = nl80211_new_mpath,
4996                 .policy = nl80211_policy,
4997                 .flags = GENL_ADMIN_PERM,
4998         },
4999         {
5000                 .cmd = NL80211_CMD_DEL_MPATH,
5001                 .doit = nl80211_del_mpath,
5002                 .policy = nl80211_policy,
5003                 .flags = GENL_ADMIN_PERM,
5004         },
5005         {
5006                 .cmd = NL80211_CMD_SET_BSS,
5007                 .doit = nl80211_set_bss,
5008                 .policy = nl80211_policy,
5009                 .flags = GENL_ADMIN_PERM,
5010         },
5011         {
5012                 .cmd = NL80211_CMD_GET_REG,
5013                 .doit = nl80211_get_reg,
5014                 .policy = nl80211_policy,
5015                 /* can be retrieved by unprivileged users */
5016         },
5017         {
5018                 .cmd = NL80211_CMD_SET_REG,
5019                 .doit = nl80211_set_reg,
5020                 .policy = nl80211_policy,
5021                 .flags = GENL_ADMIN_PERM,
5022         },
5023         {
5024                 .cmd = NL80211_CMD_REQ_SET_REG,
5025                 .doit = nl80211_req_set_reg,
5026                 .policy = nl80211_policy,
5027                 .flags = GENL_ADMIN_PERM,
5028         },
5029         {
5030                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
5031                 .doit = nl80211_get_mesh_params,
5032                 .policy = nl80211_policy,
5033                 /* can be retrieved by unprivileged users */
5034         },
5035         {
5036                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
5037                 .doit = nl80211_set_mesh_params,
5038                 .policy = nl80211_policy,
5039                 .flags = GENL_ADMIN_PERM,
5040         },
5041         {
5042                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5043                 .doit = nl80211_trigger_scan,
5044                 .policy = nl80211_policy,
5045                 .flags = GENL_ADMIN_PERM,
5046         },
5047         {
5048                 .cmd = NL80211_CMD_GET_SCAN,
5049                 .policy = nl80211_policy,
5050                 .dumpit = nl80211_dump_scan,
5051         },
5052         {
5053                 .cmd = NL80211_CMD_AUTHENTICATE,
5054                 .doit = nl80211_authenticate,
5055                 .policy = nl80211_policy,
5056                 .flags = GENL_ADMIN_PERM,
5057         },
5058         {
5059                 .cmd = NL80211_CMD_ASSOCIATE,
5060                 .doit = nl80211_associate,
5061                 .policy = nl80211_policy,
5062                 .flags = GENL_ADMIN_PERM,
5063         },
5064         {
5065                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5066                 .doit = nl80211_deauthenticate,
5067                 .policy = nl80211_policy,
5068                 .flags = GENL_ADMIN_PERM,
5069         },
5070         {
5071                 .cmd = NL80211_CMD_DISASSOCIATE,
5072                 .doit = nl80211_disassociate,
5073                 .policy = nl80211_policy,
5074                 .flags = GENL_ADMIN_PERM,
5075         },
5076         {
5077                 .cmd = NL80211_CMD_JOIN_IBSS,
5078                 .doit = nl80211_join_ibss,
5079                 .policy = nl80211_policy,
5080                 .flags = GENL_ADMIN_PERM,
5081         },
5082         {
5083                 .cmd = NL80211_CMD_LEAVE_IBSS,
5084                 .doit = nl80211_leave_ibss,
5085                 .policy = nl80211_policy,
5086                 .flags = GENL_ADMIN_PERM,
5087         },
5088 #ifdef CONFIG_NL80211_TESTMODE
5089         {
5090                 .cmd = NL80211_CMD_TESTMODE,
5091                 .doit = nl80211_testmode_do,
5092                 .policy = nl80211_policy,
5093                 .flags = GENL_ADMIN_PERM,
5094         },
5095 #endif
5096         {
5097                 .cmd = NL80211_CMD_CONNECT,
5098                 .doit = nl80211_connect,
5099                 .policy = nl80211_policy,
5100                 .flags = GENL_ADMIN_PERM,
5101         },
5102         {
5103                 .cmd = NL80211_CMD_DISCONNECT,
5104                 .doit = nl80211_disconnect,
5105                 .policy = nl80211_policy,
5106                 .flags = GENL_ADMIN_PERM,
5107         },
5108         {
5109                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5110                 .doit = nl80211_wiphy_netns,
5111                 .policy = nl80211_policy,
5112                 .flags = GENL_ADMIN_PERM,
5113         },
5114         {
5115                 .cmd = NL80211_CMD_GET_SURVEY,
5116                 .policy = nl80211_policy,
5117                 .dumpit = nl80211_dump_survey,
5118         },
5119         {
5120                 .cmd = NL80211_CMD_SET_PMKSA,
5121                 .doit = nl80211_setdel_pmksa,
5122                 .policy = nl80211_policy,
5123                 .flags = GENL_ADMIN_PERM,
5124         },
5125         {
5126                 .cmd = NL80211_CMD_DEL_PMKSA,
5127                 .doit = nl80211_setdel_pmksa,
5128                 .policy = nl80211_policy,
5129                 .flags = GENL_ADMIN_PERM,
5130         },
5131         {
5132                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5133                 .doit = nl80211_flush_pmksa,
5134                 .policy = nl80211_policy,
5135                 .flags = GENL_ADMIN_PERM,
5136         },
5137         {
5138                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5139                 .doit = nl80211_remain_on_channel,
5140                 .policy = nl80211_policy,
5141                 .flags = GENL_ADMIN_PERM,
5142         },
5143         {
5144                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5145                 .doit = nl80211_cancel_remain_on_channel,
5146                 .policy = nl80211_policy,
5147                 .flags = GENL_ADMIN_PERM,
5148         },
5149         {
5150                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5151                 .doit = nl80211_set_tx_bitrate_mask,
5152                 .policy = nl80211_policy,
5153                 .flags = GENL_ADMIN_PERM,
5154         },
5155         {
5156                 .cmd = NL80211_CMD_REGISTER_ACTION,
5157                 .doit = nl80211_register_action,
5158                 .policy = nl80211_policy,
5159                 .flags = GENL_ADMIN_PERM,
5160         },
5161         {
5162                 .cmd = NL80211_CMD_ACTION,
5163                 .doit = nl80211_action,
5164                 .policy = nl80211_policy,
5165                 .flags = GENL_ADMIN_PERM,
5166         },
5167         {
5168                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5169                 .doit = nl80211_set_power_save,
5170                 .policy = nl80211_policy,
5171                 .flags = GENL_ADMIN_PERM,
5172         },
5173         {
5174                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5175                 .doit = nl80211_get_power_save,
5176                 .policy = nl80211_policy,
5177                 /* can be retrieved by unprivileged users */
5178         },
5179         {
5180                 .cmd = NL80211_CMD_SET_CQM,
5181                 .doit = nl80211_set_cqm,
5182                 .policy = nl80211_policy,
5183                 .flags = GENL_ADMIN_PERM,
5184         },
5185 };
5186
5187 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5188         .name = "mlme",
5189 };
5190
5191 /* multicast groups */
5192 static struct genl_multicast_group nl80211_config_mcgrp = {
5193         .name = "config",
5194 };
5195 static struct genl_multicast_group nl80211_scan_mcgrp = {
5196         .name = "scan",
5197 };
5198 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5199         .name = "regulatory",
5200 };
5201
5202 /* notification functions */
5203
5204 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5205 {
5206         struct sk_buff *msg;
5207
5208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5209         if (!msg)
5210                 return;
5211
5212         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5213                 nlmsg_free(msg);
5214                 return;
5215         }
5216
5217         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5218                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5219 }
5220
5221 static int nl80211_add_scan_req(struct sk_buff *msg,
5222                                 struct cfg80211_registered_device *rdev)
5223 {
5224         struct cfg80211_scan_request *req = rdev->scan_req;
5225         struct nlattr *nest;
5226         int i;
5227
5228         ASSERT_RDEV_LOCK(rdev);
5229
5230         if (WARN_ON(!req))
5231                 return 0;
5232
5233         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5234         if (!nest)
5235                 goto nla_put_failure;
5236         for (i = 0; i < req->n_ssids; i++)
5237                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5238         nla_nest_end(msg, nest);
5239
5240         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5241         if (!nest)
5242                 goto nla_put_failure;
5243         for (i = 0; i < req->n_channels; i++)
5244                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5245         nla_nest_end(msg, nest);
5246
5247         if (req->ie)
5248                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5249
5250         return 0;
5251  nla_put_failure:
5252         return -ENOBUFS;
5253 }
5254
5255 static int nl80211_send_scan_msg(struct sk_buff *msg,
5256                                  struct cfg80211_registered_device *rdev,
5257                                  struct net_device *netdev,
5258                                  u32 pid, u32 seq, int flags,
5259                                  u32 cmd)
5260 {
5261         void *hdr;
5262
5263         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5264         if (!hdr)
5265                 return -1;
5266
5267         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5268         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5269
5270         /* ignore errors and send incomplete event anyway */
5271         nl80211_add_scan_req(msg, rdev);
5272
5273         return genlmsg_end(msg, hdr);
5274
5275  nla_put_failure:
5276         genlmsg_cancel(msg, hdr);
5277         return -EMSGSIZE;
5278 }
5279
5280 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5281                              struct net_device *netdev)
5282 {
5283         struct sk_buff *msg;
5284
5285         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5286         if (!msg)
5287                 return;
5288
5289         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5290                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5291                 nlmsg_free(msg);
5292                 return;
5293         }
5294
5295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5296                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5297 }
5298
5299 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5300                             struct net_device *netdev)
5301 {
5302         struct sk_buff *msg;
5303
5304         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5305         if (!msg)
5306                 return;
5307
5308         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5309                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5310                 nlmsg_free(msg);
5311                 return;
5312         }
5313
5314         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5315                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5316 }
5317
5318 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5319                                struct net_device *netdev)
5320 {
5321         struct sk_buff *msg;
5322
5323         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5324         if (!msg)
5325                 return;
5326
5327         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5328                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5329                 nlmsg_free(msg);
5330                 return;
5331         }
5332
5333         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5334                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5335 }
5336
5337 /*
5338  * This can happen on global regulatory changes or device specific settings
5339  * based on custom world regulatory domains.
5340  */
5341 void nl80211_send_reg_change_event(struct regulatory_request *request)
5342 {
5343         struct sk_buff *msg;
5344         void *hdr;
5345
5346         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5347         if (!msg)
5348                 return;
5349
5350         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5351         if (!hdr) {
5352                 nlmsg_free(msg);
5353                 return;
5354         }
5355
5356         /* Userspace can always count this one always being set */
5357         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5358
5359         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5360                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5361                            NL80211_REGDOM_TYPE_WORLD);
5362         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5363                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5364                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5365         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5366                  request->intersect)
5367                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5368                            NL80211_REGDOM_TYPE_INTERSECTION);
5369         else {
5370                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5371                            NL80211_REGDOM_TYPE_COUNTRY);
5372                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5373         }
5374
5375         if (wiphy_idx_valid(request->wiphy_idx))
5376                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5377
5378         if (genlmsg_end(msg, hdr) < 0) {
5379                 nlmsg_free(msg);
5380                 return;
5381         }
5382
5383         rcu_read_lock();
5384         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5385                                 GFP_ATOMIC);
5386         rcu_read_unlock();
5387
5388         return;
5389
5390 nla_put_failure:
5391         genlmsg_cancel(msg, hdr);
5392         nlmsg_free(msg);
5393 }
5394
5395 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5396                                     struct net_device *netdev,
5397                                     const u8 *buf, size_t len,
5398                                     enum nl80211_commands cmd, gfp_t gfp)
5399 {
5400         struct sk_buff *msg;
5401         void *hdr;
5402
5403         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5404         if (!msg)
5405                 return;
5406
5407         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5408         if (!hdr) {
5409                 nlmsg_free(msg);
5410                 return;
5411         }
5412
5413         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5414         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5415         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5416
5417         if (genlmsg_end(msg, hdr) < 0) {
5418                 nlmsg_free(msg);
5419                 return;
5420         }
5421
5422         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5423                                 nl80211_mlme_mcgrp.id, gfp);
5424         return;
5425
5426  nla_put_failure:
5427         genlmsg_cancel(msg, hdr);
5428         nlmsg_free(msg);
5429 }
5430
5431 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5432                           struct net_device *netdev, const u8 *buf,
5433                           size_t len, gfp_t gfp)
5434 {
5435         nl80211_send_mlme_event(rdev, netdev, buf, len,
5436                                 NL80211_CMD_AUTHENTICATE, gfp);
5437 }
5438
5439 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5440                            struct net_device *netdev, const u8 *buf,
5441                            size_t len, gfp_t gfp)
5442 {
5443         nl80211_send_mlme_event(rdev, netdev, buf, len,
5444                                 NL80211_CMD_ASSOCIATE, gfp);
5445 }
5446
5447 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5448                          struct net_device *netdev, const u8 *buf,
5449                          size_t len, gfp_t gfp)
5450 {
5451         nl80211_send_mlme_event(rdev, netdev, buf, len,
5452                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5453 }
5454
5455 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5456                            struct net_device *netdev, const u8 *buf,
5457                            size_t len, gfp_t gfp)
5458 {
5459         nl80211_send_mlme_event(rdev, netdev, buf, len,
5460                                 NL80211_CMD_DISASSOCIATE, gfp);
5461 }
5462
5463 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5464                                       struct net_device *netdev, int cmd,
5465                                       const u8 *addr, gfp_t gfp)
5466 {
5467         struct sk_buff *msg;
5468         void *hdr;
5469
5470         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5471         if (!msg)
5472                 return;
5473
5474         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5475         if (!hdr) {
5476                 nlmsg_free(msg);
5477                 return;
5478         }
5479
5480         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5481         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5482         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5483         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5484
5485         if (genlmsg_end(msg, hdr) < 0) {
5486                 nlmsg_free(msg);
5487                 return;
5488         }
5489
5490         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5491                                 nl80211_mlme_mcgrp.id, gfp);
5492         return;
5493
5494  nla_put_failure:
5495         genlmsg_cancel(msg, hdr);
5496         nlmsg_free(msg);
5497 }
5498
5499 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5500                                struct net_device *netdev, const u8 *addr,
5501                                gfp_t gfp)
5502 {
5503         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5504                                   addr, gfp);
5505 }
5506
5507 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5508                                 struct net_device *netdev, const u8 *addr,
5509                                 gfp_t gfp)
5510 {
5511         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5512                                   addr, gfp);
5513 }
5514
5515 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5516                                  struct net_device *netdev, const u8 *bssid,
5517                                  const u8 *req_ie, size_t req_ie_len,
5518                                  const u8 *resp_ie, size_t resp_ie_len,
5519                                  u16 status, gfp_t gfp)
5520 {
5521         struct sk_buff *msg;
5522         void *hdr;
5523
5524         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5525         if (!msg)
5526                 return;
5527
5528         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5529         if (!hdr) {
5530                 nlmsg_free(msg);
5531                 return;
5532         }
5533
5534         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5535         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5536         if (bssid)
5537                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5538         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5539         if (req_ie)
5540                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5541         if (resp_ie)
5542                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5543
5544         if (genlmsg_end(msg, hdr) < 0) {
5545                 nlmsg_free(msg);
5546                 return;
5547         }
5548
5549         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5550                                 nl80211_mlme_mcgrp.id, gfp);
5551         return;
5552
5553  nla_put_failure:
5554         genlmsg_cancel(msg, hdr);
5555         nlmsg_free(msg);
5556
5557 }
5558
5559 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5560                          struct net_device *netdev, const u8 *bssid,
5561                          const u8 *req_ie, size_t req_ie_len,
5562                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5563 {
5564         struct sk_buff *msg;
5565         void *hdr;
5566
5567         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5568         if (!msg)
5569                 return;
5570
5571         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5572         if (!hdr) {
5573                 nlmsg_free(msg);
5574                 return;
5575         }
5576
5577         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5578         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5579         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5580         if (req_ie)
5581                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5582         if (resp_ie)
5583                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5584
5585         if (genlmsg_end(msg, hdr) < 0) {
5586                 nlmsg_free(msg);
5587                 return;
5588         }
5589
5590         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5591                                 nl80211_mlme_mcgrp.id, gfp);
5592         return;
5593
5594  nla_put_failure:
5595         genlmsg_cancel(msg, hdr);
5596         nlmsg_free(msg);
5597
5598 }
5599
5600 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5601                                struct net_device *netdev, u16 reason,
5602                                const u8 *ie, size_t ie_len, bool from_ap)
5603 {
5604         struct sk_buff *msg;
5605         void *hdr;
5606
5607         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5608         if (!msg)
5609                 return;
5610
5611         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5612         if (!hdr) {
5613                 nlmsg_free(msg);
5614                 return;
5615         }
5616
5617         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5618         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5619         if (from_ap && reason)
5620                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5621         if (from_ap)
5622                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5623         if (ie)
5624                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5625
5626         if (genlmsg_end(msg, hdr) < 0) {
5627                 nlmsg_free(msg);
5628                 return;
5629         }
5630
5631         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5632                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5633         return;
5634
5635  nla_put_failure:
5636         genlmsg_cancel(msg, hdr);
5637         nlmsg_free(msg);
5638
5639 }
5640
5641 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5642                              struct net_device *netdev, const u8 *bssid,
5643                              gfp_t gfp)
5644 {
5645         struct sk_buff *msg;
5646         void *hdr;
5647
5648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5649         if (!msg)
5650                 return;
5651
5652         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5653         if (!hdr) {
5654                 nlmsg_free(msg);
5655                 return;
5656         }
5657
5658         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5659         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5660         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5661
5662         if (genlmsg_end(msg, hdr) < 0) {
5663                 nlmsg_free(msg);
5664                 return;
5665         }
5666
5667         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5668                                 nl80211_mlme_mcgrp.id, gfp);
5669         return;
5670
5671  nla_put_failure:
5672         genlmsg_cancel(msg, hdr);
5673         nlmsg_free(msg);
5674 }
5675
5676 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5677                                  struct net_device *netdev, const u8 *addr,
5678                                  enum nl80211_key_type key_type, int key_id,
5679                                  const u8 *tsc, gfp_t gfp)
5680 {
5681         struct sk_buff *msg;
5682         void *hdr;
5683
5684         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5685         if (!msg)
5686                 return;
5687
5688         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5689         if (!hdr) {
5690                 nlmsg_free(msg);
5691                 return;
5692         }
5693
5694         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5695         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5696         if (addr)
5697                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5698         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5699         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5700         if (tsc)
5701                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5702
5703         if (genlmsg_end(msg, hdr) < 0) {
5704                 nlmsg_free(msg);
5705                 return;
5706         }
5707
5708         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5709                                 nl80211_mlme_mcgrp.id, gfp);
5710         return;
5711
5712  nla_put_failure:
5713         genlmsg_cancel(msg, hdr);
5714         nlmsg_free(msg);
5715 }
5716
5717 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5718                                     struct ieee80211_channel *channel_before,
5719                                     struct ieee80211_channel *channel_after)
5720 {
5721         struct sk_buff *msg;
5722         void *hdr;
5723         struct nlattr *nl_freq;
5724
5725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5726         if (!msg)
5727                 return;
5728
5729         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5730         if (!hdr) {
5731                 nlmsg_free(msg);
5732                 return;
5733         }
5734
5735         /*
5736          * Since we are applying the beacon hint to a wiphy we know its
5737          * wiphy_idx is valid
5738          */
5739         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5740
5741         /* Before */
5742         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5743         if (!nl_freq)
5744                 goto nla_put_failure;
5745         if (nl80211_msg_put_channel(msg, channel_before))
5746                 goto nla_put_failure;
5747         nla_nest_end(msg, nl_freq);
5748
5749         /* After */
5750         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5751         if (!nl_freq)
5752                 goto nla_put_failure;
5753         if (nl80211_msg_put_channel(msg, channel_after))
5754                 goto nla_put_failure;
5755         nla_nest_end(msg, nl_freq);
5756
5757         if (genlmsg_end(msg, hdr) < 0) {
5758                 nlmsg_free(msg);
5759                 return;
5760         }
5761
5762         rcu_read_lock();
5763         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5764                                 GFP_ATOMIC);
5765         rcu_read_unlock();
5766
5767         return;
5768
5769 nla_put_failure:
5770         genlmsg_cancel(msg, hdr);
5771         nlmsg_free(msg);
5772 }
5773
5774 static void nl80211_send_remain_on_chan_event(
5775         int cmd, struct cfg80211_registered_device *rdev,
5776         struct net_device *netdev, u64 cookie,
5777         struct ieee80211_channel *chan,
5778         enum nl80211_channel_type channel_type,
5779         unsigned int duration, gfp_t gfp)
5780 {
5781         struct sk_buff *msg;
5782         void *hdr;
5783
5784         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5785         if (!msg)
5786                 return;
5787
5788         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5789         if (!hdr) {
5790                 nlmsg_free(msg);
5791                 return;
5792         }
5793
5794         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5795         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5796         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5797         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5798         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5799
5800         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5801                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5802
5803         if (genlmsg_end(msg, hdr) < 0) {
5804                 nlmsg_free(msg);
5805                 return;
5806         }
5807
5808         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5809                                 nl80211_mlme_mcgrp.id, gfp);
5810         return;
5811
5812  nla_put_failure:
5813         genlmsg_cancel(msg, hdr);
5814         nlmsg_free(msg);
5815 }
5816
5817 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5818                                     struct net_device *netdev, u64 cookie,
5819                                     struct ieee80211_channel *chan,
5820                                     enum nl80211_channel_type channel_type,
5821                                     unsigned int duration, gfp_t gfp)
5822 {
5823         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5824                                           rdev, netdev, cookie, chan,
5825                                           channel_type, duration, gfp);
5826 }
5827
5828 void nl80211_send_remain_on_channel_cancel(
5829         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5830         u64 cookie, struct ieee80211_channel *chan,
5831         enum nl80211_channel_type channel_type, gfp_t gfp)
5832 {
5833         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5834                                           rdev, netdev, cookie, chan,
5835                                           channel_type, 0, gfp);
5836 }
5837
5838 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5839                             struct net_device *dev, const u8 *mac_addr,
5840                             struct station_info *sinfo, gfp_t gfp)
5841 {
5842         struct sk_buff *msg;
5843
5844         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5845         if (!msg)
5846                 return;
5847
5848         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5849                 nlmsg_free(msg);
5850                 return;
5851         }
5852
5853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5854                                 nl80211_mlme_mcgrp.id, gfp);
5855 }
5856
5857 int nl80211_send_action(struct cfg80211_registered_device *rdev,
5858                         struct net_device *netdev, u32 nlpid,
5859                         int freq, const u8 *buf, size_t len, gfp_t gfp)
5860 {
5861         struct sk_buff *msg;
5862         void *hdr;
5863         int err;
5864
5865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5866         if (!msg)
5867                 return -ENOMEM;
5868
5869         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
5870         if (!hdr) {
5871                 nlmsg_free(msg);
5872                 return -ENOMEM;
5873         }
5874
5875         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5876         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5877         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5878         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5879
5880         err = genlmsg_end(msg, hdr);
5881         if (err < 0) {
5882                 nlmsg_free(msg);
5883                 return err;
5884         }
5885
5886         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
5887         if (err < 0)
5888                 return err;
5889         return 0;
5890
5891  nla_put_failure:
5892         genlmsg_cancel(msg, hdr);
5893         nlmsg_free(msg);
5894         return -ENOBUFS;
5895 }
5896
5897 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
5898                                    struct net_device *netdev, u64 cookie,
5899                                    const u8 *buf, size_t len, bool ack,
5900                                    gfp_t gfp)
5901 {
5902         struct sk_buff *msg;
5903         void *hdr;
5904
5905         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5906         if (!msg)
5907                 return;
5908
5909         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
5910         if (!hdr) {
5911                 nlmsg_free(msg);
5912                 return;
5913         }
5914
5915         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5916         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5917         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5918         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5919         if (ack)
5920                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
5921
5922         if (genlmsg_end(msg, hdr) < 0) {
5923                 nlmsg_free(msg);
5924                 return;
5925         }
5926
5927         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
5928         return;
5929
5930  nla_put_failure:
5931         genlmsg_cancel(msg, hdr);
5932         nlmsg_free(msg);
5933 }
5934
5935 void
5936 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
5937                              struct net_device *netdev,
5938                              enum nl80211_cqm_rssi_threshold_event rssi_event,
5939                              gfp_t gfp)
5940 {
5941         struct sk_buff *msg;
5942         struct nlattr *pinfoattr;
5943         void *hdr;
5944
5945         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5946         if (!msg)
5947                 return;
5948
5949         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
5950         if (!hdr) {
5951                 nlmsg_free(msg);
5952                 return;
5953         }
5954
5955         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5956         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5957
5958         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
5959         if (!pinfoattr)
5960                 goto nla_put_failure;
5961
5962         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
5963                     rssi_event);
5964
5965         nla_nest_end(msg, pinfoattr);
5966
5967         if (genlmsg_end(msg, hdr) < 0) {
5968                 nlmsg_free(msg);
5969                 return;
5970         }
5971
5972         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5973                                 nl80211_mlme_mcgrp.id, gfp);
5974         return;
5975
5976  nla_put_failure:
5977         genlmsg_cancel(msg, hdr);
5978         nlmsg_free(msg);
5979 }
5980
5981 static int nl80211_netlink_notify(struct notifier_block * nb,
5982                                   unsigned long state,
5983                                   void *_notify)
5984 {
5985         struct netlink_notify *notify = _notify;
5986         struct cfg80211_registered_device *rdev;
5987         struct wireless_dev *wdev;
5988
5989         if (state != NETLINK_URELEASE)
5990                 return NOTIFY_DONE;
5991
5992         rcu_read_lock();
5993
5994         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
5995                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
5996                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
5997
5998         rcu_read_unlock();
5999
6000         return NOTIFY_DONE;
6001 }
6002
6003 static struct notifier_block nl80211_netlink_notifier = {
6004         .notifier_call = nl80211_netlink_notify,
6005 };
6006
6007 /* initialisation/exit functions */
6008
6009 int nl80211_init(void)
6010 {
6011         int err;
6012
6013         err = genl_register_family_with_ops(&nl80211_fam,
6014                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6015         if (err)
6016                 return err;
6017
6018         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6019         if (err)
6020                 goto err_out;
6021
6022         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6023         if (err)
6024                 goto err_out;
6025
6026         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6027         if (err)
6028                 goto err_out;
6029
6030         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6031         if (err)
6032                 goto err_out;
6033
6034 #ifdef CONFIG_NL80211_TESTMODE
6035         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6036         if (err)
6037                 goto err_out;
6038 #endif
6039
6040         err = netlink_register_notifier(&nl80211_netlink_notifier);
6041         if (err)
6042                 goto err_out;
6043
6044         return 0;
6045  err_out:
6046         genl_unregister_family(&nl80211_fam);
6047         return err;
6048 }
6049
6050 void nl80211_exit(void)
6051 {
6052         netlink_unregister_notifier(&nl80211_netlink_notifier);
6053         genl_unregister_family(&nl80211_fam);
6054 }