SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72
  73         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  74         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  76
  77         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  78         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79
  80         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  81         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  82                                     .len = WLAN_MAX_KEY_LEN },
  83         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  84         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  85         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  86         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  87
  88         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  89         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  90         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  91                                        .len = IEEE80211_MAX_DATA_LEN },
  92         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  95         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  96         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  98                                                .len = NL80211_MAX_SUPP_RATES },
  99         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 100         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 101         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 102         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 103                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 104         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 105
 106         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 107         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 108
 109         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 110         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 113                                            .len = NL80211_MAX_SUPP_RATES },
 114
 115         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 116
 117         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 118                                          .len = NL80211_HT_CAPABILITY_LEN },
 119
 120         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 122                               .len = IEEE80211_MAX_DATA_LEN },
 123         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 124         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 127                                 .len = IEEE80211_MAX_SSID_LEN },
 128         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 129         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 130         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_STA_FLAGS2] = {
 134                 .len = sizeof(struct nl80211_sta_flag_update),
 135         },
 136         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 139         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 140         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 141         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 142 };
 143
 144 /* policy for the attributes */
 145 static struct nla_policy
 146 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 147         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 148         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 149         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 150         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 151         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 152         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 153 };
 154
 155 /* ifidx get helper */
 156 static int nl80211_get_ifidx(struct netlink_callback *cb)
 157 {
 158         int res;
 159
 160         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 161                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 162                           nl80211_policy);
 163         if (res)
 164                 return res;
 165
 166         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 167                 return -EINVAL;
 168
 169         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 170         if (!res)
 171                 return -EINVAL;
 172         return res;
 173 }
 174
 175 /* IE validation */
 176 static bool is_valid_ie_attr(const struct nlattr *attr)
 177 {
 178         const u8 *pos;
 179         int len;
 180
 181         if (!attr)
 182                 return true;
 183
 184         pos = nla_data(attr);
 185         len = nla_len(attr);
 186
 187         while (len) {
 188                 u8 elemlen;
 189
 190                 if (len < 2)
 191                         return false;
 192                 len -= 2;
 193
 194                 elemlen = pos[1];
 195                 if (elemlen > len)
 196                         return false;
 197
 198                 len -= elemlen;
 199                 pos += 2 + elemlen;
 200         }
 201
 202         return true;
 203 }
 204
 205 /* message building helper */
 206 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 207                                    int flags, u8 cmd)
 208 {
 209         /* since there is no private header just add the generic one */
 210         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 211 }
 212
 213 static int nl80211_msg_put_channel(struct sk_buff *msg,
 214                                    struct ieee80211_channel *chan)
 215 {
 216         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 217                     chan->center_freq);
 218
 219         if (chan->flags & IEEE80211_CHAN_DISABLED)
 220                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 221         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 222                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 223         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 224                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 225         if (chan->flags & IEEE80211_CHAN_RADAR)
 226                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 227
 228         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 229                     DBM_TO_MBM(chan->max_power));
 230
 231         return 0;
 232
 233  nla_put_failure:
 234         return -ENOBUFS;
 235 }
 236
 237 /* netlink command implementations */
 238
 239 struct key_parse {
 240         struct key_params p;
 241         int idx;
 242         bool def, defmgmt;
 243 };
 244
 245 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 246 {
 247         struct nlattr *tb[NL80211_KEY_MAX + 1];
 248         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 249                                    nl80211_key_policy);
 250         if (err)
 251                 return err;
 252
 253         k->def = !!tb[NL80211_KEY_DEFAULT];
 254         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 255
 256         if (tb[NL80211_KEY_IDX])
 257                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 258
 259         if (tb[NL80211_KEY_DATA]) {
 260                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 261                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 262         }
 263
 264         if (tb[NL80211_KEY_SEQ]) {
 265                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 266                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 267         }
 268
 269         if (tb[NL80211_KEY_CIPHER])
 270                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 271
 272         return 0;
 273 }
 274
 275 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 276 {
 277         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 278                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 279                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 280         }
 281
 282         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 283                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 284                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 285         }
 286
 287         if (info->attrs[NL80211_ATTR_KEY_IDX])
 288                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 289
 290         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 291                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 292
 293         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 294         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 295
 296         return 0;
 297 }
 298
 299 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 300 {
 301         int err;
 302
 303         memset(k, 0, sizeof(*k));
 304         k->idx = -1;
 305
 306         if (info->attrs[NL80211_ATTR_KEY])
 307                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 308         else
 309                 err = nl80211_parse_key_old(info, k);
 310
 311         if (err)
 312                 return err;
 313
 314         if (k->def && k->defmgmt)
 315                 return -EINVAL;
 316
 317         if (k->idx != -1) {
 318                 if (k->defmgmt) {
 319                         if (k->idx < 4 || k->idx > 5)
 320                                 return -EINVAL;
 321                 } else if (k->def) {
 322                         if (k->idx < 0 || k->idx > 3)
 323                                 return -EINVAL;
 324                 } else {
 325                         if (k->idx < 0 || k->idx > 5)
 326                                 return -EINVAL;
 327                 }
 328         }
 329
 330         return 0;
 331 }
 332
 333 static struct cfg80211_cached_keys *
 334 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 335                        struct nlattr *keys)
 336 {
 337         struct key_parse parse;
 338         struct nlattr *key;
 339         struct cfg80211_cached_keys *result;
 340         int rem, err, def = 0;
 341
 342         result = kzalloc(sizeof(*result), GFP_KERNEL);
 343         if (!result)
 344                 return ERR_PTR(-ENOMEM);
 345
 346         result->def = -1;
 347         result->defmgmt = -1;
 348
 349         nla_for_each_nested(key, keys, rem) {
 350                 memset(&parse, 0, sizeof(parse));
 351                 parse.idx = -1;
 352
 353                 err = nl80211_parse_key_new(key, &parse);
 354                 if (err)
 355                         goto error;
 356                 err = -EINVAL;
 357                 if (!parse.p.key)
 358                         goto error;
 359                 if (parse.idx < 0 || parse.idx > 4)
 360                         goto error;
 361                 if (parse.def) {
 362                         if (def)
 363                                 goto error;
 364                         def = 1;
 365                         result->def = parse.idx;
 366                 } else if (parse.defmgmt)
 367                         goto error;
 368                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 369                                                      parse.idx, NULL);
 370                 if (err)
 371                         goto error;
 372                 result->params[parse.idx].cipher = parse.p.cipher;
 373                 result->params[parse.idx].key_len = parse.p.key_len;
 374                 result->params[parse.idx].key = result->data[parse.idx];
 375                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 376         }
 377
 378         return result;
 379  error:
 380         kfree(result);
 381         return ERR_PTR(err);
 382 }
 383
 384 static int nl80211_key_allowed(struct wireless_dev *wdev)
 385 {
 386         ASSERT_WDEV_LOCK(wdev);
 387
 388         if (!netif_running(wdev->netdev))
 389                 return -ENETDOWN;
 390
 391         switch (wdev->iftype) {
 392         case NL80211_IFTYPE_AP:
 393         case NL80211_IFTYPE_AP_VLAN:
 394                 break;
 395         case NL80211_IFTYPE_ADHOC:
 396                 if (!wdev->current_bss)
 397                         return -ENOLINK;
 398                 break;
 399         case NL80211_IFTYPE_STATION:
 400                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 401                         return -ENOLINK;
 402                 break;
 403         default:
 404                 return -EINVAL;
 405         }
 406
 407         return 0;
 408 }
 409
 410 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 411                               struct cfg80211_registered_device *dev)
 412 {
 413         void *hdr;
 414         struct nlattr *nl_bands, *nl_band;
 415         struct nlattr *nl_freqs, *nl_freq;
 416         struct nlattr *nl_rates, *nl_rate;
 417         struct nlattr *nl_modes;
 418         struct nlattr *nl_cmds;
 419         enum ieee80211_band band;
 420         struct ieee80211_channel *chan;
 421         struct ieee80211_rate *rate;
 422         int i;
 423         u16 ifmodes = dev->wiphy.interface_modes;
 424
 425         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 426         if (!hdr)
 427                 return -1;
 428
 429         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 430         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 431
 432         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 433                     cfg80211_rdev_list_generation);
 434
 435         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 436                    dev->wiphy.retry_short);
 437         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 438                    dev->wiphy.retry_long);
 439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 440                     dev->wiphy.frag_threshold);
 441         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 442                     dev->wiphy.rts_threshold);
 443
 444         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 445                    dev->wiphy.max_scan_ssids);
 446         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 447                     dev->wiphy.max_scan_ie_len);
 448
 449         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 450                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 451                 dev->wiphy.cipher_suites);
 452
 453         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 454         if (!nl_modes)
 455                 goto nla_put_failure;
 456
 457         i = 0;
 458         while (ifmodes) {
 459                 if (ifmodes & 1)
 460                         NLA_PUT_FLAG(msg, i);
 461                 ifmodes >>= 1;
 462                 i++;
 463         }
 464
 465         nla_nest_end(msg, nl_modes);
 466
 467         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 468         if (!nl_bands)
 469                 goto nla_put_failure;
 470
 471         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 472                 if (!dev->wiphy.bands[band])
 473                         continue;
 474
 475                 nl_band = nla_nest_start(msg, band);
 476                 if (!nl_band)
 477                         goto nla_put_failure;
 478
 479                 /* add HT info */
 480                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 481                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 482                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 483                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 484                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 485                                 dev->wiphy.bands[band]->ht_cap.cap);
 486                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 487                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 488                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 489                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 490                 }
 491
 492                 /* add frequencies */
 493                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 494                 if (!nl_freqs)
 495                         goto nla_put_failure;
 496
 497                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 498                         nl_freq = nla_nest_start(msg, i);
 499                         if (!nl_freq)
 500                                 goto nla_put_failure;
 501
 502                         chan = &dev->wiphy.bands[band]->channels[i];
 503
 504                         if (nl80211_msg_put_channel(msg, chan))
 505                                 goto nla_put_failure;
 506
 507                         nla_nest_end(msg, nl_freq);
 508                 }
 509
 510                 nla_nest_end(msg, nl_freqs);
 511
 512                 /* add bitrates */
 513                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 514                 if (!nl_rates)
 515                         goto nla_put_failure;
 516
 517                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 518                         nl_rate = nla_nest_start(msg, i);
 519                         if (!nl_rate)
 520                                 goto nla_put_failure;
 521
 522                         rate = &dev->wiphy.bands[band]->bitrates[i];
 523                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 524                                     rate->bitrate);
 525                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 526                                 NLA_PUT_FLAG(msg,
 527                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 528
 529                         nla_nest_end(msg, nl_rate);
 530                 }
 531
 532                 nla_nest_end(msg, nl_rates);
 533
 534                 nla_nest_end(msg, nl_band);
 535         }
 536         nla_nest_end(msg, nl_bands);
 537
 538         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 539         if (!nl_cmds)
 540                 goto nla_put_failure;
 541
 542         i = 0;
 543 #define CMD(op, n)                                              \
 544          do {                                                   \
 545                 if (dev->ops->op) {                             \
 546                         i++;                                    \
 547                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 548                 }                                               \
 549         } while (0)
 550
 551         CMD(add_virtual_intf, NEW_INTERFACE);
 552         CMD(change_virtual_intf, SET_INTERFACE);
 553         CMD(add_key, NEW_KEY);
 554         CMD(add_beacon, NEW_BEACON);
 555         CMD(add_station, NEW_STATION);
 556         CMD(add_mpath, NEW_MPATH);
 557         CMD(set_mesh_params, SET_MESH_PARAMS);
 558         CMD(change_bss, SET_BSS);
 559         CMD(auth, AUTHENTICATE);
 560         CMD(assoc, ASSOCIATE);
 561         CMD(deauth, DEAUTHENTICATE);
 562         CMD(disassoc, DISASSOCIATE);
 563         CMD(join_ibss, JOIN_IBSS);
 564         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 565                 i++;
 566                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 567         }
 568
 569 #undef CMD
 570
 571         if (dev->ops->connect || dev->ops->auth) {
 572                 i++;
 573                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 574         }
 575
 576         if (dev->ops->disconnect || dev->ops->deauth) {
 577                 i++;
 578                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 579         }
 580
 581         nla_nest_end(msg, nl_cmds);
 582
 583         return genlmsg_end(msg, hdr);
 584
 585  nla_put_failure:
 586         genlmsg_cancel(msg, hdr);
 587         return -EMSGSIZE;
 588 }
 589
 590 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 591 {
 592         int idx = 0;
 593         int start = cb->args[0];
 594         struct cfg80211_registered_device *dev;
 595
 596         mutex_lock(&cfg80211_mutex);
 597         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 598                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 599                         continue;
 600                 if (++idx <= start)
 601                         continue;
 602                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 603                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 604                                        dev) < 0) {
 605                         idx--;
 606                         break;
 607                 }
 608         }
 609         mutex_unlock(&cfg80211_mutex);
 610
 611         cb->args[0] = idx;
 612
 613         return skb->len;
 614 }
 615
 616 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 617 {
 618         struct sk_buff *msg;
 619         struct cfg80211_registered_device *dev;
 620
 621         dev = cfg80211_get_dev_from_info(info);
 622         if (IS_ERR(dev))
 623                 return PTR_ERR(dev);
 624
 625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 626         if (!msg)
 627                 goto out_err;
 628
 629         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 630                 goto out_free;
 631
 632         cfg80211_unlock_rdev(dev);
 633
 634         return genlmsg_reply(msg, info);
 635
 636  out_free:
 637         nlmsg_free(msg);
 638  out_err:
 639         cfg80211_unlock_rdev(dev);
 640         return -ENOBUFS;
 641 }
 642
 643 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 644         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 645         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 646         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 647         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 648         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 649 };
 650
 651 static int parse_txq_params(struct nlattr *tb[],
 652                             struct ieee80211_txq_params *txq_params)
 653 {
 654         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 655             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 656             !tb[NL80211_TXQ_ATTR_AIFS])
 657                 return -EINVAL;
 658
 659         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 660         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 661         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 662         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 663         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 664
 665         return 0;
 666 }
 667
 668 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 669 {
 670         struct cfg80211_registered_device *rdev;
 671         int result = 0, rem_txq_params = 0;
 672         struct nlattr *nl_txq_params;
 673         u32 changed;
 674         u8 retry_short = 0, retry_long = 0;
 675         u32 frag_threshold = 0, rts_threshold = 0;
 676
 677         rtnl_lock();
 678
 679         mutex_lock(&cfg80211_mutex);
 680
 681         rdev = __cfg80211_rdev_from_info(info);
 682         if (IS_ERR(rdev)) {
 683                 mutex_unlock(&cfg80211_mutex);
 684                 result = PTR_ERR(rdev);
 685                 goto unlock;
 686         }
 687
 688         mutex_lock(&rdev->mtx);
 689
 690         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 691                 result = cfg80211_dev_rename(
 692                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 693
 694         mutex_unlock(&cfg80211_mutex);
 695
 696         if (result)
 697                 goto bad_res;
 698
 699         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 700                 struct ieee80211_txq_params txq_params;
 701                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 702
 703                 if (!rdev->ops->set_txq_params) {
 704                         result = -EOPNOTSUPP;
 705                         goto bad_res;
 706                 }
 707
 708                 nla_for_each_nested(nl_txq_params,
 709                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 710                                     rem_txq_params) {
 711                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 712                                   nla_data(nl_txq_params),
 713                                   nla_len(nl_txq_params),
 714                                   txq_params_policy);
 715                         result = parse_txq_params(tb, &txq_params);
 716                         if (result)
 717                                 goto bad_res;
 718
 719                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 720                                                            &txq_params);
 721                         if (result)
 722                                 goto bad_res;
 723                 }
 724         }
 725
 726         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 727                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 728                 u32 freq;
 729
 730                 result = -EINVAL;
 731
 732                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 733                         channel_type = nla_get_u32(info->attrs[
 734                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 735                         if (channel_type != NL80211_CHAN_NO_HT &&
 736                             channel_type != NL80211_CHAN_HT20 &&
 737                             channel_type != NL80211_CHAN_HT40PLUS &&
 738                             channel_type != NL80211_CHAN_HT40MINUS)
 739                                 goto bad_res;
 740                 }
 741
 742                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 743
 744                 mutex_lock(&rdev->devlist_mtx);
 745                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 746                 mutex_unlock(&rdev->devlist_mtx);
 747                 if (result)
 748                         goto bad_res;
 749         }
 750
 751         changed = 0;
 752
 753         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 754                 retry_short = nla_get_u8(
 755                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 756                 if (retry_short == 0) {
 757                         result = -EINVAL;
 758                         goto bad_res;
 759                 }
 760                 changed |= WIPHY_PARAM_RETRY_SHORT;
 761         }
 762
 763         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 764                 retry_long = nla_get_u8(
 765                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 766                 if (retry_long == 0) {
 767                         result = -EINVAL;
 768                         goto bad_res;
 769                 }
 770                 changed |= WIPHY_PARAM_RETRY_LONG;
 771         }
 772
 773         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 774                 frag_threshold = nla_get_u32(
 775                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 776                 if (frag_threshold < 256) {
 777                         result = -EINVAL;
 778                         goto bad_res;
 779                 }
 780                 if (frag_threshold != (u32) -1) {
 781                         /*
 782                          * Fragments (apart from the last one) are required to
 783                          * have even length. Make the fragmentation code
 784                          * simpler by stripping LSB should someone try to use
 785                          * odd threshold value.
 786                          */
 787                         frag_threshold &= ~0x1;
 788                 }
 789                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 790         }
 791
 792         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 793                 rts_threshold = nla_get_u32(
 794                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 795                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 796         }
 797
 798         if (changed) {
 799                 u8 old_retry_short, old_retry_long;
 800                 u32 old_frag_threshold, old_rts_threshold;
 801
 802                 if (!rdev->ops->set_wiphy_params) {
 803                         result = -EOPNOTSUPP;
 804                         goto bad_res;
 805                 }
 806
 807                 old_retry_short = rdev->wiphy.retry_short;
 808                 old_retry_long = rdev->wiphy.retry_long;
 809                 old_frag_threshold = rdev->wiphy.frag_threshold;
 810                 old_rts_threshold = rdev->wiphy.rts_threshold;
 811
 812                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 813                         rdev->wiphy.retry_short = retry_short;
 814                 if (changed & WIPHY_PARAM_RETRY_LONG)
 815                         rdev->wiphy.retry_long = retry_long;
 816                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 817                         rdev->wiphy.frag_threshold = frag_threshold;
 818                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 819                         rdev->wiphy.rts_threshold = rts_threshold;
 820
 821                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 822                 if (result) {
 823                         rdev->wiphy.retry_short = old_retry_short;
 824                         rdev->wiphy.retry_long = old_retry_long;
 825                         rdev->wiphy.frag_threshold = old_frag_threshold;
 826                         rdev->wiphy.rts_threshold = old_rts_threshold;
 827                 }
 828         }
 829
 830  bad_res:
 831         mutex_unlock(&rdev->mtx);
 832  unlock:
 833         rtnl_unlock();
 834         return result;
 835 }
 836
 837
 838 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 839                               struct cfg80211_registered_device *rdev,
 840                               struct net_device *dev)
 841 {
 842         void *hdr;
 843
 844         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 845         if (!hdr)
 846                 return -1;
 847
 848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 849         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 850         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 851         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 852
 853         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 854                     rdev->devlist_generation ^
 855                         (cfg80211_rdev_list_generation << 2));
 856
 857         return genlmsg_end(msg, hdr);
 858
 859  nla_put_failure:
 860         genlmsg_cancel(msg, hdr);
 861         return -EMSGSIZE;
 862 }
 863
 864 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 865 {
 866         int wp_idx = 0;
 867         int if_idx = 0;
 868         int wp_start = cb->args[0];
 869         int if_start = cb->args[1];
 870         struct cfg80211_registered_device *rdev;
 871         struct wireless_dev *wdev;
 872
 873         mutex_lock(&cfg80211_mutex);
 874         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 875                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 876                         continue;
 877                 if (wp_idx < wp_start) {
 878                         wp_idx++;
 879                         continue;
 880                 }
 881                 if_idx = 0;
 882
 883                 mutex_lock(&rdev->devlist_mtx);
 884                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 885                         if (if_idx < if_start) {
 886                                 if_idx++;
 887                                 continue;
 888                         }
 889                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 890                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 891                                                rdev, wdev->netdev) < 0) {
 892                                 mutex_unlock(&rdev->devlist_mtx);
 893                                 goto out;
 894                         }
 895                         if_idx++;
 896                 }
 897                 mutex_unlock(&rdev->devlist_mtx);
 898
 899                 wp_idx++;
 900         }
 901  out:
 902         mutex_unlock(&cfg80211_mutex);
 903
 904         cb->args[0] = wp_idx;
 905         cb->args[1] = if_idx;
 906
 907         return skb->len;
 908 }
 909
 910 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 911 {
 912         struct sk_buff *msg;
 913         struct cfg80211_registered_device *dev;
 914         struct net_device *netdev;
 915         int err;
 916
 917         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 918         if (err)
 919                 return err;
 920
 921         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 922         if (!msg)
 923                 goto out_err;
 924
 925         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 926                                dev, netdev) < 0)
 927                 goto out_free;
 928
 929         dev_put(netdev);
 930         cfg80211_unlock_rdev(dev);
 931
 932         return genlmsg_reply(msg, info);
 933
 934  out_free:
 935         nlmsg_free(msg);
 936  out_err:
 937         dev_put(netdev);
 938         cfg80211_unlock_rdev(dev);
 939         return -ENOBUFS;
 940 }
 941
 942 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 943         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 944         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 945         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 946         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 947         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 948 };
 949
 950 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 951 {
 952         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 953         int flag;
 954
 955         *mntrflags = 0;
 956
 957         if (!nla)
 958                 return -EINVAL;
 959
 960         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 961                              nla, mntr_flags_policy))
 962                 return -EINVAL;
 963
 964         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 965                 if (flags[flag])
 966                         *mntrflags |= (1<<flag);
 967
 968         return 0;
 969 }
 970
 971 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
 972                                u8 use_4addr, enum nl80211_iftype iftype)
 973 {
 974         if (!use_4addr)
 975                 return 0;
 976
 977         switch (iftype) {
 978         case NL80211_IFTYPE_AP_VLAN:
 979                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
 980                         return 0;
 981                 break;
 982         case NL80211_IFTYPE_STATION:
 983                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
 984                         return 0;
 985                 break;
 986         default:
 987                 break;
 988         }
 989
 990         return -EOPNOTSUPP;
 991 }
 992
 993 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 994 {
 995         struct cfg80211_registered_device *rdev;
 996         struct vif_params params;
 997         int err;
 998         enum nl80211_iftype otype, ntype;
 999         struct net_device *dev;
1000         u32 _flags, *flags = NULL;
1001         bool change = false;
1002
1003         memset(&params, 0, sizeof(params));
1004
1005         rtnl_lock();
1006
1007         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1008         if (err)
1009                 goto unlock_rtnl;
1010
1011         otype = ntype = dev->ieee80211_ptr->iftype;
1012
1013         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1014                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1015                 if (otype != ntype)
1016                         change = true;
1017                 if (ntype > NL80211_IFTYPE_MAX) {
1018                         err = -EINVAL;
1019                         goto unlock;
1020                 }
1021         }
1022
1023         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1024                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1025                         err = -EINVAL;
1026                         goto unlock;
1027                 }
1028                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1029                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1030                 change = true;
1031         }
1032
1033         if (info->attrs[NL80211_ATTR_4ADDR]) {
1034                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1035                 change = true;
1036                 err = nl80211_valid_4addr(rdev, params.use_4addr, ntype);
1037                 if (err)
1038                         goto unlock;
1039         } else {
1040                 params.use_4addr = -1;
1041         }
1042
1043         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1044                 if (ntype != NL80211_IFTYPE_MONITOR) {
1045                         err = -EINVAL;
1046                         goto unlock;
1047                 }
1048                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1049                                           &_flags);
1050                 if (err)
1051                         goto unlock;
1052
1053                 flags = &_flags;
1054                 change = true;
1055         }
1056
1057         if (change)
1058                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1059         else
1060                 err = 0;
1061
1062         if (!err && params.use_4addr != -1)
1063                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1064
1065  unlock:
1066         dev_put(dev);
1067         cfg80211_unlock_rdev(rdev);
1068  unlock_rtnl:
1069         rtnl_unlock();
1070         return err;
1071 }
1072
1073 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1074 {
1075         struct cfg80211_registered_device *rdev;
1076         struct vif_params params;
1077         int err;
1078         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1079         u32 flags;
1080
1081         memset(&params, 0, sizeof(params));
1082
1083         if (!info->attrs[NL80211_ATTR_IFNAME])
1084                 return -EINVAL;
1085
1086         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1087                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1088                 if (type > NL80211_IFTYPE_MAX)
1089                         return -EINVAL;
1090         }
1091
1092         rtnl_lock();
1093
1094         rdev = cfg80211_get_dev_from_info(info);
1095         if (IS_ERR(rdev)) {
1096                 err = PTR_ERR(rdev);
1097                 goto unlock_rtnl;
1098         }
1099
1100         if (!rdev->ops->add_virtual_intf ||
1101             !(rdev->wiphy.interface_modes & (1 << type))) {
1102                 err = -EOPNOTSUPP;
1103                 goto unlock;
1104         }
1105
1106         if (type == NL80211_IFTYPE_MESH_POINT &&
1107             info->attrs[NL80211_ATTR_MESH_ID]) {
1108                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1109                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1110         }
1111
1112         if (info->attrs[NL80211_ATTR_4ADDR]) {
1113                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1114                 err = nl80211_valid_4addr(rdev, params.use_4addr, type);
1115                 if (err)
1116                         goto unlock;
1117         }
1118
1119         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1120                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1121                                   &flags);
1122         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1123                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1124                 type, err ? NULL : &flags, &params);
1125
1126  unlock:
1127         cfg80211_unlock_rdev(rdev);
1128  unlock_rtnl:
1129         rtnl_unlock();
1130         return err;
1131 }
1132
1133 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1134 {
1135         struct cfg80211_registered_device *rdev;
1136         int err;
1137         struct net_device *dev;
1138
1139         rtnl_lock();
1140
1141         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1142         if (err)
1143                 goto unlock_rtnl;
1144
1145         if (!rdev->ops->del_virtual_intf) {
1146                 err = -EOPNOTSUPP;
1147                 goto out;
1148         }
1149
1150         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1151
1152  out:
1153         cfg80211_unlock_rdev(rdev);
1154         dev_put(dev);
1155  unlock_rtnl:
1156         rtnl_unlock();
1157         return err;
1158 }
1159
1160 struct get_key_cookie {
1161         struct sk_buff *msg;
1162         int error;
1163         int idx;
1164 };
1165
1166 static void get_key_callback(void *c, struct key_params *params)
1167 {
1168         struct nlattr *key;
1169         struct get_key_cookie *cookie = c;
1170
1171         if (params->key)
1172                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1173                         params->key_len, params->key);
1174
1175         if (params->seq)
1176                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1177                         params->seq_len, params->seq);
1178
1179         if (params->cipher)
1180                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1181                             params->cipher);
1182
1183         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1184         if (!key)
1185                 goto nla_put_failure;
1186
1187         if (params->key)
1188                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1189                         params->key_len, params->key);
1190
1191         if (params->seq)
1192                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1193                         params->seq_len, params->seq);
1194
1195         if (params->cipher)
1196                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1197                             params->cipher);
1198
1199         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1200
1201         nla_nest_end(cookie->msg, key);
1202
1203         return;
1204  nla_put_failure:
1205         cookie->error = 1;
1206 }
1207
1208 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1209 {
1210         struct cfg80211_registered_device *rdev;
1211         int err;
1212         struct net_device *dev;
1213         u8 key_idx = 0;
1214         u8 *mac_addr = NULL;
1215         struct get_key_cookie cookie = {
1216                 .error = 0,
1217         };
1218         void *hdr;
1219         struct sk_buff *msg;
1220
1221         if (info->attrs[NL80211_ATTR_KEY_IDX])
1222                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1223
1224         if (key_idx > 5)
1225                 return -EINVAL;
1226
1227         if (info->attrs[NL80211_ATTR_MAC])
1228                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1229
1230         rtnl_lock();
1231
1232         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1233         if (err)
1234                 goto unlock_rtnl;
1235
1236         if (!rdev->ops->get_key) {
1237                 err = -EOPNOTSUPP;
1238                 goto out;
1239         }
1240
1241         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1242         if (!msg) {
1243                 err = -ENOMEM;
1244                 goto out;
1245         }
1246
1247         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1248                              NL80211_CMD_NEW_KEY);
1249
1250         if (IS_ERR(hdr)) {
1251                 err = PTR_ERR(hdr);
1252                 goto free_msg;
1253         }
1254
1255         cookie.msg = msg;
1256         cookie.idx = key_idx;
1257
1258         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1259         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1260         if (mac_addr)
1261                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1262
1263         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1264                                 &cookie, get_key_callback);
1265
1266         if (err)
1267                 goto free_msg;
1268
1269         if (cookie.error)
1270                 goto nla_put_failure;
1271
1272         genlmsg_end(msg, hdr);
1273         err = genlmsg_reply(msg, info);
1274         goto out;
1275
1276  nla_put_failure:
1277         err = -ENOBUFS;
1278  free_msg:
1279         nlmsg_free(msg);
1280  out:
1281         cfg80211_unlock_rdev(rdev);
1282         dev_put(dev);
1283  unlock_rtnl:
1284         rtnl_unlock();
1285
1286         return err;
1287 }
1288
1289 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1290 {
1291         struct cfg80211_registered_device *rdev;
1292         struct key_parse key;
1293         int err;
1294         struct net_device *dev;
1295         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1296                     u8 key_index);
1297
1298         err = nl80211_parse_key(info, &key);
1299         if (err)
1300                 return err;
1301
1302         if (key.idx < 0)
1303                 return -EINVAL;
1304
1305         /* only support setting default key */
1306         if (!key.def && !key.defmgmt)
1307                 return -EINVAL;
1308
1309         rtnl_lock();
1310
1311         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1312         if (err)
1313                 goto unlock_rtnl;
1314
1315         if (key.def)
1316                 func = rdev->ops->set_default_key;
1317         else
1318                 func = rdev->ops->set_default_mgmt_key;
1319
1320         if (!func) {
1321                 err = -EOPNOTSUPP;
1322                 goto out;
1323         }
1324
1325         wdev_lock(dev->ieee80211_ptr);
1326         err = nl80211_key_allowed(dev->ieee80211_ptr);
1327         if (!err)
1328                 err = func(&rdev->wiphy, dev, key.idx);
1329
1330 #ifdef CONFIG_CFG80211_WEXT
1331         if (!err) {
1332                 if (func == rdev->ops->set_default_key)
1333                         dev->ieee80211_ptr->wext.default_key = key.idx;
1334                 else
1335                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1336         }
1337 #endif
1338         wdev_unlock(dev->ieee80211_ptr);
1339
1340  out:
1341         cfg80211_unlock_rdev(rdev);
1342         dev_put(dev);
1343
1344  unlock_rtnl:
1345         rtnl_unlock();
1346
1347         return err;
1348 }
1349
1350 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1351 {
1352         struct cfg80211_registered_device *rdev;
1353         int err;
1354         struct net_device *dev;
1355         struct key_parse key;
1356         u8 *mac_addr = NULL;
1357
1358         err = nl80211_parse_key(info, &key);
1359         if (err)
1360                 return err;
1361
1362         if (!key.p.key)
1363                 return -EINVAL;
1364
1365         if (info->attrs[NL80211_ATTR_MAC])
1366                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1367
1368         rtnl_lock();
1369
1370         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1371         if (err)
1372                 goto unlock_rtnl;
1373
1374         if (!rdev->ops->add_key) {
1375                 err = -EOPNOTSUPP;
1376                 goto out;
1377         }
1378
1379         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1380                 err = -EINVAL;
1381                 goto out;
1382         }
1383
1384         wdev_lock(dev->ieee80211_ptr);
1385         err = nl80211_key_allowed(dev->ieee80211_ptr);
1386         if (!err)
1387                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1388                                          mac_addr, &key.p);
1389         wdev_unlock(dev->ieee80211_ptr);
1390
1391  out:
1392         cfg80211_unlock_rdev(rdev);
1393         dev_put(dev);
1394  unlock_rtnl:
1395         rtnl_unlock();
1396
1397         return err;
1398 }
1399
1400 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1401 {
1402         struct cfg80211_registered_device *rdev;
1403         int err;
1404         struct net_device *dev;
1405         u8 *mac_addr = NULL;
1406         struct key_parse key;
1407
1408         err = nl80211_parse_key(info, &key);
1409         if (err)
1410                 return err;
1411
1412         if (info->attrs[NL80211_ATTR_MAC])
1413                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1414
1415         rtnl_lock();
1416
1417         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1418         if (err)
1419                 goto unlock_rtnl;
1420
1421         if (!rdev->ops->del_key) {
1422                 err = -EOPNOTSUPP;
1423                 goto out;
1424         }
1425
1426         wdev_lock(dev->ieee80211_ptr);
1427         err = nl80211_key_allowed(dev->ieee80211_ptr);
1428         if (!err)
1429                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1430
1431 #ifdef CONFIG_CFG80211_WEXT
1432         if (!err) {
1433                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1434                         dev->ieee80211_ptr->wext.default_key = -1;
1435                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1436                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1437         }
1438 #endif
1439         wdev_unlock(dev->ieee80211_ptr);
1440
1441  out:
1442         cfg80211_unlock_rdev(rdev);
1443         dev_put(dev);
1444
1445  unlock_rtnl:
1446         rtnl_unlock();
1447
1448         return err;
1449 }
1450
1451 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1452 {
1453         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1454                     struct beacon_parameters *info);
1455         struct cfg80211_registered_device *rdev;
1456         int err;
1457         struct net_device *dev;
1458         struct beacon_parameters params;
1459         int haveinfo = 0;
1460
1461         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1462                 return -EINVAL;
1463
1464         rtnl_lock();
1465
1466         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1467         if (err)
1468                 goto unlock_rtnl;
1469
1470         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1471                 err = -EOPNOTSUPP;
1472                 goto out;
1473         }
1474
1475         switch (info->genlhdr->cmd) {
1476         case NL80211_CMD_NEW_BEACON:
1477                 /* these are required for NEW_BEACON */
1478                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1479                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1480                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1481                         err = -EINVAL;
1482                         goto out;
1483                 }
1484
1485                 call = rdev->ops->add_beacon;
1486                 break;
1487         case NL80211_CMD_SET_BEACON:
1488                 call = rdev->ops->set_beacon;
1489                 break;
1490         default:
1491                 WARN_ON(1);
1492                 err = -EOPNOTSUPP;
1493                 goto out;
1494         }
1495
1496         if (!call) {
1497                 err = -EOPNOTSUPP;
1498                 goto out;
1499         }
1500
1501         memset(&params, 0, sizeof(params));
1502
1503         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1504                 params.interval =
1505                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1506                 haveinfo = 1;
1507         }
1508
1509         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1510                 params.dtim_period =
1511                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1512                 haveinfo = 1;
1513         }
1514
1515         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1516                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1517                 params.head_len =
1518                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1519                 haveinfo = 1;
1520         }
1521
1522         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1523                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1524                 params.tail_len =
1525                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1526                 haveinfo = 1;
1527         }
1528
1529         if (!haveinfo) {
1530                 err = -EINVAL;
1531                 goto out;
1532         }
1533
1534         err = call(&rdev->wiphy, dev, &params);
1535
1536  out:
1537         cfg80211_unlock_rdev(rdev);
1538         dev_put(dev);
1539  unlock_rtnl:
1540         rtnl_unlock();
1541
1542         return err;
1543 }
1544
1545 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1546 {
1547         struct cfg80211_registered_device *rdev;
1548         int err;
1549         struct net_device *dev;
1550
1551         rtnl_lock();
1552
1553         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1554         if (err)
1555                 goto unlock_rtnl;
1556
1557         if (!rdev->ops->del_beacon) {
1558                 err = -EOPNOTSUPP;
1559                 goto out;
1560         }
1561
1562         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1563                 err = -EOPNOTSUPP;
1564                 goto out;
1565         }
1566         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1567
1568  out:
1569         cfg80211_unlock_rdev(rdev);
1570         dev_put(dev);
1571  unlock_rtnl:
1572         rtnl_unlock();
1573
1574         return err;
1575 }
1576
1577 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1578         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1579         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1580         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1581         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1582 };
1583
1584 static int parse_station_flags(struct genl_info *info,
1585                                struct station_parameters *params)
1586 {
1587         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1588         struct nlattr *nla;
1589         int flag;
1590
1591         /*
1592          * Try parsing the new attribute first so userspace
1593          * can specify both for older kernels.
1594          */
1595         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1596         if (nla) {
1597                 struct nl80211_sta_flag_update *sta_flags;
1598
1599                 sta_flags = nla_data(nla);
1600                 params->sta_flags_mask = sta_flags->mask;
1601                 params->sta_flags_set = sta_flags->set;
1602                 if ((params->sta_flags_mask |
1603                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1604                         return -EINVAL;
1605                 return 0;
1606         }
1607
1608         /* if present, parse the old attribute */
1609
1610         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1611         if (!nla)
1612                 return 0;
1613
1614         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1615                              nla, sta_flags_policy))
1616                 return -EINVAL;
1617
1618         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1619         params->sta_flags_mask &= ~1;
1620
1621         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1622                 if (flags[flag])
1623                         params->sta_flags_set |= (1<<flag);
1624
1625         return 0;
1626 }
1627
1628 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1629 {
1630         int modulation, streams, bitrate;
1631
1632         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1633                 return rate->legacy;
1634
1635         /* the formula below does only work for MCS values smaller than 32 */
1636         if (rate->mcs >= 32)
1637                 return 0;
1638
1639         modulation = rate->mcs & 7;
1640         streams = (rate->mcs >> 3) + 1;
1641
1642         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1643                         13500000 : 6500000;
1644
1645         if (modulation < 4)
1646                 bitrate *= (modulation + 1);
1647         else if (modulation == 4)
1648                 bitrate *= (modulation + 2);
1649         else
1650                 bitrate *= (modulation + 3);
1651
1652         bitrate *= streams;
1653
1654         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1655                 bitrate = (bitrate / 9) * 10;
1656
1657         /* do NOT round down here */
1658         return (bitrate + 50000) / 100000;
1659 }
1660
1661 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1662                                 int flags, struct net_device *dev,
1663                                 u8 *mac_addr, struct station_info *sinfo)
1664 {
1665         void *hdr;
1666         struct nlattr *sinfoattr, *txrate;
1667         u16 bitrate;
1668
1669         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1670         if (!hdr)
1671                 return -1;
1672
1673         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1674         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1675
1676         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1677
1678         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1679         if (!sinfoattr)
1680                 goto nla_put_failure;
1681         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1682                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1683                             sinfo->inactive_time);
1684         if (sinfo->filled & STATION_INFO_RX_BYTES)
1685                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1686                             sinfo->rx_bytes);
1687         if (sinfo->filled & STATION_INFO_TX_BYTES)
1688                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1689                             sinfo->tx_bytes);
1690         if (sinfo->filled & STATION_INFO_LLID)
1691                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1692                             sinfo->llid);
1693         if (sinfo->filled & STATION_INFO_PLID)
1694                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1695                             sinfo->plid);
1696         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1697                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1698                             sinfo->plink_state);
1699         if (sinfo->filled & STATION_INFO_SIGNAL)
1700                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1701                            sinfo->signal);
1702         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1703                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1704                 if (!txrate)
1705                         goto nla_put_failure;
1706
1707                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1708                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1709                 if (bitrate > 0)
1710                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1711
1712                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1713                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1714                                     sinfo->txrate.mcs);
1715                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1716                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1717                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1718                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1719
1720                 nla_nest_end(msg, txrate);
1721         }
1722         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1723                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1724                             sinfo->rx_packets);
1725         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1726                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1727                             sinfo->tx_packets);
1728         nla_nest_end(msg, sinfoattr);
1729
1730         return genlmsg_end(msg, hdr);
1731
1732  nla_put_failure:
1733         genlmsg_cancel(msg, hdr);
1734         return -EMSGSIZE;
1735 }
1736
1737 static int nl80211_dump_station(struct sk_buff *skb,
1738                                 struct netlink_callback *cb)
1739 {
1740         struct station_info sinfo;
1741         struct cfg80211_registered_device *dev;
1742         struct net_device *netdev;
1743         u8 mac_addr[ETH_ALEN];
1744         int ifidx = cb->args[0];
1745         int sta_idx = cb->args[1];
1746         int err;
1747
1748         if (!ifidx)
1749                 ifidx = nl80211_get_ifidx(cb);
1750         if (ifidx < 0)
1751                 return ifidx;
1752
1753         rtnl_lock();
1754
1755         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1756         if (!netdev) {
1757                 err = -ENODEV;
1758                 goto out_rtnl;
1759         }
1760
1761         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1762         if (IS_ERR(dev)) {
1763                 err = PTR_ERR(dev);
1764                 goto out_rtnl;
1765         }
1766
1767         if (!dev->ops->dump_station) {
1768                 err = -EOPNOTSUPP;
1769                 goto out_err;
1770         }
1771
1772         while (1) {
1773                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1774                                              mac_addr, &sinfo);
1775                 if (err == -ENOENT)
1776                         break;
1777                 if (err)
1778                         goto out_err;
1779
1780                 if (nl80211_send_station(skb,
1781                                 NETLINK_CB(cb->skb).pid,
1782                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1783                                 netdev, mac_addr,
1784                                 &sinfo) < 0)
1785                         goto out;
1786
1787                 sta_idx++;
1788         }
1789
1790
1791  out:
1792         cb->args[1] = sta_idx;
1793         err = skb->len;
1794  out_err:
1795         cfg80211_unlock_rdev(dev);
1796  out_rtnl:
1797         rtnl_unlock();
1798
1799         return err;
1800 }
1801
1802 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1803 {
1804         struct cfg80211_registered_device *rdev;
1805         int err;
1806         struct net_device *dev;
1807         struct station_info sinfo;
1808         struct sk_buff *msg;
1809         u8 *mac_addr = NULL;
1810
1811         memset(&sinfo, 0, sizeof(sinfo));
1812
1813         if (!info->attrs[NL80211_ATTR_MAC])
1814                 return -EINVAL;
1815
1816         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1817
1818         rtnl_lock();
1819
1820         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1821         if (err)
1822                 goto out_rtnl;
1823
1824         if (!rdev->ops->get_station) {
1825                 err = -EOPNOTSUPP;
1826                 goto out;
1827         }
1828
1829         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1830         if (err)
1831                 goto out;
1832
1833         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1834         if (!msg)
1835                 goto out;
1836
1837         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1838                                  dev, mac_addr, &sinfo) < 0)
1839                 goto out_free;
1840
1841         err = genlmsg_reply(msg, info);
1842         goto out;
1843
1844  out_free:
1845         nlmsg_free(msg);
1846  out:
1847         cfg80211_unlock_rdev(rdev);
1848         dev_put(dev);
1849  out_rtnl:
1850         rtnl_unlock();
1851
1852         return err;
1853 }
1854
1855 /*
1856  * Get vlan interface making sure it is running and on the right wiphy.
1857  */
1858 static int get_vlan(struct genl_info *info,
1859                     struct cfg80211_registered_device *rdev,
1860                     struct net_device **vlan)
1861 {
1862         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1863         *vlan = NULL;
1864
1865         if (vlanattr) {
1866                 *vlan = dev_get_by_index(genl_info_net(info),
1867                                          nla_get_u32(vlanattr));
1868                 if (!*vlan)
1869                         return -ENODEV;
1870                 if (!(*vlan)->ieee80211_ptr)
1871                         return -EINVAL;
1872                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1873                         return -EINVAL;
1874                 if (!netif_running(*vlan))
1875                         return -ENETDOWN;
1876         }
1877         return 0;
1878 }
1879
1880 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1881 {
1882         struct cfg80211_registered_device *rdev;
1883         int err;
1884         struct net_device *dev;
1885         struct station_parameters params;
1886         u8 *mac_addr = NULL;
1887
1888         memset(&params, 0, sizeof(params));
1889
1890         params.listen_interval = -1;
1891
1892         if (info->attrs[NL80211_ATTR_STA_AID])
1893                 return -EINVAL;
1894
1895         if (!info->attrs[NL80211_ATTR_MAC])
1896                 return -EINVAL;
1897
1898         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1899
1900         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1901                 params.supported_rates =
1902                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1903                 params.supported_rates_len =
1904                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1905         }
1906
1907         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1908                 params.listen_interval =
1909                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1910
1911         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1912                 params.ht_capa =
1913                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1914
1915         if (parse_station_flags(info, &params))
1916                 return -EINVAL;
1917
1918         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1919                 params.plink_action =
1920                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1921
1922         rtnl_lock();
1923
1924         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1925         if (err)
1926                 goto out_rtnl;
1927
1928         err = get_vlan(info, rdev, &params.vlan);
1929         if (err)
1930                 goto out;
1931
1932         /* validate settings */
1933         err = 0;
1934
1935         switch (dev->ieee80211_ptr->iftype) {
1936         case NL80211_IFTYPE_AP:
1937         case NL80211_IFTYPE_AP_VLAN:
1938                 /* disallow mesh-specific things */
1939                 if (params.plink_action)
1940                         err = -EINVAL;
1941                 break;
1942         case NL80211_IFTYPE_STATION:
1943                 /* disallow everything but AUTHORIZED flag */
1944                 if (params.plink_action)
1945                         err = -EINVAL;
1946                 if (params.vlan)
1947                         err = -EINVAL;
1948                 if (params.supported_rates)
1949                         err = -EINVAL;
1950                 if (params.ht_capa)
1951                         err = -EINVAL;
1952                 if (params.listen_interval >= 0)
1953                         err = -EINVAL;
1954                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1955                         err = -EINVAL;
1956                 break;
1957         case NL80211_IFTYPE_MESH_POINT:
1958                 /* disallow things mesh doesn't support */
1959                 if (params.vlan)
1960                         err = -EINVAL;
1961                 if (params.ht_capa)
1962                         err = -EINVAL;
1963                 if (params.listen_interval >= 0)
1964                         err = -EINVAL;
1965                 if (params.supported_rates)
1966                         err = -EINVAL;
1967                 if (params.sta_flags_mask)
1968                         err = -EINVAL;
1969                 break;
1970         default:
1971                 err = -EINVAL;
1972         }
1973
1974         if (err)
1975                 goto out;
1976
1977         if (!rdev->ops->change_station) {
1978                 err = -EOPNOTSUPP;
1979                 goto out;
1980         }
1981
1982         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1983
1984  out:
1985         if (params.vlan)
1986                 dev_put(params.vlan);
1987         cfg80211_unlock_rdev(rdev);
1988         dev_put(dev);
1989  out_rtnl:
1990         rtnl_unlock();
1991
1992         return err;
1993 }
1994
1995 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1996 {
1997         struct cfg80211_registered_device *rdev;
1998         int err;
1999         struct net_device *dev;
2000         struct station_parameters params;
2001         u8 *mac_addr = NULL;
2002
2003         memset(&params, 0, sizeof(params));
2004
2005         if (!info->attrs[NL80211_ATTR_MAC])
2006                 return -EINVAL;
2007
2008         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2009                 return -EINVAL;
2010
2011         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2012                 return -EINVAL;
2013
2014         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2015         params.supported_rates =
2016                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2017         params.supported_rates_len =
2018                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2019         params.listen_interval =
2020                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2021
2022         if (info->attrs[NL80211_ATTR_STA_AID]) {
2023                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2024                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
2025                         return -EINVAL;
2026         }
2027
2028         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2029                 params.ht_capa =
2030                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2031
2032         if (parse_station_flags(info, &params))
2033                 return -EINVAL;
2034
2035         rtnl_lock();
2036
2037         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2038         if (err)
2039                 goto out_rtnl;
2040
2041         err = get_vlan(info, rdev, &params.vlan);
2042         if (err)
2043                 goto out;
2044
2045         /* validate settings */
2046         err = 0;
2047
2048         switch (dev->ieee80211_ptr->iftype) {
2049         case NL80211_IFTYPE_AP:
2050         case NL80211_IFTYPE_AP_VLAN:
2051                 /* all ok but must have AID */
2052                 if (!params.aid)
2053                         err = -EINVAL;
2054                 break;
2055         case NL80211_IFTYPE_MESH_POINT:
2056                 /* disallow things mesh doesn't support */
2057                 if (params.vlan)
2058                         err = -EINVAL;
2059                 if (params.aid)
2060                         err = -EINVAL;
2061                 if (params.ht_capa)
2062                         err = -EINVAL;
2063                 if (params.listen_interval >= 0)
2064                         err = -EINVAL;
2065                 if (params.supported_rates)
2066                         err = -EINVAL;
2067                 if (params.sta_flags_mask)
2068                         err = -EINVAL;
2069                 break;
2070         default:
2071                 err = -EINVAL;
2072         }
2073
2074         if (err)
2075                 goto out;
2076
2077         if (!rdev->ops->add_station) {
2078                 err = -EOPNOTSUPP;
2079                 goto out;
2080         }
2081
2082         if (!netif_running(dev)) {
2083                 err = -ENETDOWN;
2084                 goto out;
2085         }
2086
2087         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2088
2089  out:
2090         if (params.vlan)
2091                 dev_put(params.vlan);
2092         cfg80211_unlock_rdev(rdev);
2093         dev_put(dev);
2094  out_rtnl:
2095         rtnl_unlock();
2096
2097         return err;
2098 }
2099
2100 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2101 {
2102         struct cfg80211_registered_device *rdev;
2103         int err;
2104         struct net_device *dev;
2105         u8 *mac_addr = NULL;
2106
2107         if (info->attrs[NL80211_ATTR_MAC])
2108                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2109
2110         rtnl_lock();
2111
2112         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2113         if (err)
2114                 goto out_rtnl;
2115
2116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2118             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2119                 err = -EINVAL;
2120                 goto out;
2121         }
2122
2123         if (!rdev->ops->del_station) {
2124                 err = -EOPNOTSUPP;
2125                 goto out;
2126         }
2127
2128         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2129
2130  out:
2131         cfg80211_unlock_rdev(rdev);
2132         dev_put(dev);
2133  out_rtnl:
2134         rtnl_unlock();
2135
2136         return err;
2137 }
2138
2139 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2140                                 int flags, struct net_device *dev,
2141                                 u8 *dst, u8 *next_hop,
2142                                 struct mpath_info *pinfo)
2143 {
2144         void *hdr;
2145         struct nlattr *pinfoattr;
2146
2147         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2148         if (!hdr)
2149                 return -1;
2150
2151         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2152         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2153         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2154
2155         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2156
2157         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2158         if (!pinfoattr)
2159                 goto nla_put_failure;
2160         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2161                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2162                             pinfo->frame_qlen);
2163         if (pinfo->filled & MPATH_INFO_SN)
2164                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2165                             pinfo->sn);
2166         if (pinfo->filled & MPATH_INFO_METRIC)
2167                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2168                             pinfo->metric);
2169         if (pinfo->filled & MPATH_INFO_EXPTIME)
2170                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2171                             pinfo->exptime);
2172         if (pinfo->filled & MPATH_INFO_FLAGS)
2173                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2174                             pinfo->flags);
2175         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2176                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2177                             pinfo->discovery_timeout);
2178         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2179                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2180                             pinfo->discovery_retries);
2181
2182         nla_nest_end(msg, pinfoattr);
2183
2184         return genlmsg_end(msg, hdr);
2185
2186  nla_put_failure:
2187         genlmsg_cancel(msg, hdr);
2188         return -EMSGSIZE;
2189 }
2190
2191 static int nl80211_dump_mpath(struct sk_buff *skb,
2192                               struct netlink_callback *cb)
2193 {
2194         struct mpath_info pinfo;
2195         struct cfg80211_registered_device *dev;
2196         struct net_device *netdev;
2197         u8 dst[ETH_ALEN];
2198         u8 next_hop[ETH_ALEN];
2199         int ifidx = cb->args[0];
2200         int path_idx = cb->args[1];
2201         int err;
2202
2203         if (!ifidx)
2204                 ifidx = nl80211_get_ifidx(cb);
2205         if (ifidx < 0)
2206                 return ifidx;
2207
2208         rtnl_lock();
2209
2210         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2211         if (!netdev) {
2212                 err = -ENODEV;
2213                 goto out_rtnl;
2214         }
2215
2216         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2217         if (IS_ERR(dev)) {
2218                 err = PTR_ERR(dev);
2219                 goto out_rtnl;
2220         }
2221
2222         if (!dev->ops->dump_mpath) {
2223                 err = -EOPNOTSUPP;
2224                 goto out_err;
2225         }
2226
2227         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2228                 err = -EOPNOTSUPP;
2229                 goto out_err;
2230         }
2231
2232         while (1) {
2233                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2234                                            dst, next_hop, &pinfo);
2235                 if (err == -ENOENT)
2236                         break;
2237                 if (err)
2238                         goto out_err;
2239
2240                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2241                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2242                                        netdev, dst, next_hop,
2243                                        &pinfo) < 0)
2244                         goto out;
2245
2246                 path_idx++;
2247         }
2248
2249
2250  out:
2251         cb->args[1] = path_idx;
2252         err = skb->len;
2253  out_err:
2254         cfg80211_unlock_rdev(dev);
2255  out_rtnl:
2256         rtnl_unlock();
2257
2258         return err;
2259 }
2260
2261 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2262 {
2263         struct cfg80211_registered_device *rdev;
2264         int err;
2265         struct net_device *dev;
2266         struct mpath_info pinfo;
2267         struct sk_buff *msg;
2268         u8 *dst = NULL;
2269         u8 next_hop[ETH_ALEN];
2270
2271         memset(&pinfo, 0, sizeof(pinfo));
2272
2273         if (!info->attrs[NL80211_ATTR_MAC])
2274                 return -EINVAL;
2275
2276         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2277
2278         rtnl_lock();
2279
2280         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2281         if (err)
2282                 goto out_rtnl;
2283
2284         if (!rdev->ops->get_mpath) {
2285                 err = -EOPNOTSUPP;
2286                 goto out;
2287         }
2288
2289         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2290                 err = -EOPNOTSUPP;
2291                 goto out;
2292         }
2293
2294         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2295         if (err)
2296                 goto out;
2297
2298         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2299         if (!msg)
2300                 goto out;
2301
2302         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2303                                  dev, dst, next_hop, &pinfo) < 0)
2304                 goto out_free;
2305
2306         err = genlmsg_reply(msg, info);
2307         goto out;
2308
2309  out_free:
2310         nlmsg_free(msg);
2311  out:
2312         cfg80211_unlock_rdev(rdev);
2313         dev_put(dev);
2314  out_rtnl:
2315         rtnl_unlock();
2316
2317         return err;
2318 }
2319
2320 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2321 {
2322         struct cfg80211_registered_device *rdev;
2323         int err;
2324         struct net_device *dev;
2325         u8 *dst = NULL;
2326         u8 *next_hop = NULL;
2327
2328         if (!info->attrs[NL80211_ATTR_MAC])
2329                 return -EINVAL;
2330
2331         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2332                 return -EINVAL;
2333
2334         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2335         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2336
2337         rtnl_lock();
2338
2339         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2340         if (err)
2341                 goto out_rtnl;
2342
2343         if (!rdev->ops->change_mpath) {
2344                 err = -EOPNOTSUPP;
2345                 goto out;
2346         }
2347
2348         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2349                 err = -EOPNOTSUPP;
2350                 goto out;
2351         }
2352
2353         if (!netif_running(dev)) {
2354                 err = -ENETDOWN;
2355                 goto out;
2356         }
2357
2358         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2359
2360  out:
2361         cfg80211_unlock_rdev(rdev);
2362         dev_put(dev);
2363  out_rtnl:
2364         rtnl_unlock();
2365
2366         return err;
2367 }
2368 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2369 {
2370         struct cfg80211_registered_device *rdev;
2371         int err;
2372         struct net_device *dev;
2373         u8 *dst = NULL;
2374         u8 *next_hop = NULL;
2375
2376         if (!info->attrs[NL80211_ATTR_MAC])
2377                 return -EINVAL;
2378
2379         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2380                 return -EINVAL;
2381
2382         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2383         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2384
2385         rtnl_lock();
2386
2387         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2388         if (err)
2389                 goto out_rtnl;
2390
2391         if (!rdev->ops->add_mpath) {
2392                 err = -EOPNOTSUPP;
2393                 goto out;
2394         }
2395
2396         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2397                 err = -EOPNOTSUPP;
2398                 goto out;
2399         }
2400
2401         if (!netif_running(dev)) {
2402                 err = -ENETDOWN;
2403                 goto out;
2404         }
2405
2406         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2407
2408  out:
2409         cfg80211_unlock_rdev(rdev);
2410         dev_put(dev);
2411  out_rtnl:
2412         rtnl_unlock();
2413
2414         return err;
2415 }
2416
2417 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2418 {
2419         struct cfg80211_registered_device *rdev;
2420         int err;
2421         struct net_device *dev;
2422         u8 *dst = NULL;
2423
2424         if (info->attrs[NL80211_ATTR_MAC])
2425                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2426
2427         rtnl_lock();
2428
2429         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2430         if (err)
2431                 goto out_rtnl;
2432
2433         if (!rdev->ops->del_mpath) {
2434                 err = -EOPNOTSUPP;
2435                 goto out;
2436         }
2437
2438         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2439
2440  out:
2441         cfg80211_unlock_rdev(rdev);
2442         dev_put(dev);
2443  out_rtnl:
2444         rtnl_unlock();
2445
2446         return err;
2447 }
2448
2449 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2450 {
2451         struct cfg80211_registered_device *rdev;
2452         int err;
2453         struct net_device *dev;
2454         struct bss_parameters params;
2455
2456         memset(&params, 0, sizeof(params));
2457         /* default to not changing parameters */
2458         params.use_cts_prot = -1;
2459         params.use_short_preamble = -1;
2460         params.use_short_slot_time = -1;
2461
2462         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2463                 params.use_cts_prot =
2464                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2465         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2466                 params.use_short_preamble =
2467                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2468         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2469                 params.use_short_slot_time =
2470                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2471         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2472                 params.basic_rates =
2473                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2474                 params.basic_rates_len =
2475                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2476         }
2477
2478         rtnl_lock();
2479
2480         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2481         if (err)
2482                 goto out_rtnl;
2483
2484         if (!rdev->ops->change_bss) {
2485                 err = -EOPNOTSUPP;
2486                 goto out;
2487         }
2488
2489         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2490                 err = -EOPNOTSUPP;
2491                 goto out;
2492         }
2493
2494         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2495
2496  out:
2497         cfg80211_unlock_rdev(rdev);
2498         dev_put(dev);
2499  out_rtnl:
2500         rtnl_unlock();
2501
2502         return err;
2503 }
2504
2505 static const struct nla_policy
2506         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2507         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2508         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2509         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2510         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2511         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2512         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2513 };
2514
2515 static int parse_reg_rule(struct nlattr *tb[],
2516         struct ieee80211_reg_rule *reg_rule)
2517 {
2518         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2519         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2520
2521         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2522                 return -EINVAL;
2523         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2524                 return -EINVAL;
2525         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2526                 return -EINVAL;
2527         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2528                 return -EINVAL;
2529         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2530                 return -EINVAL;
2531
2532         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2533
2534         freq_range->start_freq_khz =
2535                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2536         freq_range->end_freq_khz =
2537                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2538         freq_range->max_bandwidth_khz =
2539                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2540
2541         power_rule->max_eirp =
2542                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2543
2544         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2545                 power_rule->max_antenna_gain =
2546                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2547
2548         return 0;
2549 }
2550
2551 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2552 {
2553         int r;
2554         char *data = NULL;
2555
2556         /*
2557          * You should only get this when cfg80211 hasn't yet initialized
2558          * completely when built-in to the kernel right between the time
2559          * window between nl80211_init() and regulatory_init(), if that is
2560          * even possible.
2561          */
2562         mutex_lock(&cfg80211_mutex);
2563         if (unlikely(!cfg80211_regdomain)) {
2564                 mutex_unlock(&cfg80211_mutex);
2565                 return -EINPROGRESS;
2566         }
2567         mutex_unlock(&cfg80211_mutex);
2568
2569         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2570                 return -EINVAL;
2571
2572         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2573
2574 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2575         /* We ignore world regdom requests with the old regdom setup */
2576         if (is_world_regdom(data))
2577                 return -EINVAL;
2578 #endif
2579
2580         r = regulatory_hint_user(data);
2581
2582         return r;
2583 }
2584
2585 static int nl80211_get_mesh_params(struct sk_buff *skb,
2586         struct genl_info *info)
2587 {
2588         struct cfg80211_registered_device *rdev;
2589         struct mesh_config cur_params;
2590         int err;
2591         struct net_device *dev;
2592         void *hdr;
2593         struct nlattr *pinfoattr;
2594         struct sk_buff *msg;
2595
2596         rtnl_lock();
2597
2598         /* Look up our device */
2599         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2600         if (err)
2601                 goto out_rtnl;
2602
2603         if (!rdev->ops->get_mesh_params) {
2604                 err = -EOPNOTSUPP;
2605                 goto out;
2606         }
2607
2608         /* Get the mesh params */
2609         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2610         if (err)
2611                 goto out;
2612
2613         /* Draw up a netlink message to send back */
2614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2615         if (!msg) {
2616                 err = -ENOBUFS;
2617                 goto out;
2618         }
2619         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2620                              NL80211_CMD_GET_MESH_PARAMS);
2621         if (!hdr)
2622                 goto nla_put_failure;
2623         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2624         if (!pinfoattr)
2625                 goto nla_put_failure;
2626         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2627         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2628                         cur_params.dot11MeshRetryTimeout);
2629         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2630                         cur_params.dot11MeshConfirmTimeout);
2631         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2632                         cur_params.dot11MeshHoldingTimeout);
2633         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2634                         cur_params.dot11MeshMaxPeerLinks);
2635         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2636                         cur_params.dot11MeshMaxRetries);
2637         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2638                         cur_params.dot11MeshTTL);
2639         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2640                         cur_params.auto_open_plinks);
2641         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2642                         cur_params.dot11MeshHWMPmaxPREQretries);
2643         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2644                         cur_params.path_refresh_time);
2645         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2646                         cur_params.min_discovery_timeout);
2647         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2648                         cur_params.dot11MeshHWMPactivePathTimeout);
2649         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2650                         cur_params.dot11MeshHWMPpreqMinInterval);
2651         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2652                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2653         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2654                         cur_params.dot11MeshHWMPRootMode);
2655         nla_nest_end(msg, pinfoattr);
2656         genlmsg_end(msg, hdr);
2657         err = genlmsg_reply(msg, info);
2658         goto out;
2659
2660  nla_put_failure:
2661         genlmsg_cancel(msg, hdr);
2662         err = -EMSGSIZE;
2663  out:
2664         /* Cleanup */
2665         cfg80211_unlock_rdev(rdev);
2666         dev_put(dev);
2667  out_rtnl:
2668         rtnl_unlock();
2669
2670         return err;
2671 }
2672
2673 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2674 do {\
2675         if (table[attr_num]) {\
2676                 cfg.param = nla_fn(table[attr_num]); \
2677                 mask |= (1 << (attr_num - 1)); \
2678         } \
2679 } while (0);\
2680
2681 static struct nla_policy
2682 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2683         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2684         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2685         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2686         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2687         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2688         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2689         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2690
2691         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2692         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2693         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2694         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2695         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2696         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2697 };
2698
2699 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2700 {
2701         int err;
2702         u32 mask;
2703         struct cfg80211_registered_device *rdev;
2704         struct net_device *dev;
2705         struct mesh_config cfg;
2706         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2707         struct nlattr *parent_attr;
2708
2709         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2710         if (!parent_attr)
2711                 return -EINVAL;
2712         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2713                         parent_attr, nl80211_meshconf_params_policy))
2714                 return -EINVAL;
2715
2716         rtnl_lock();
2717
2718         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2719         if (err)
2720                 goto out_rtnl;
2721
2722         if (!rdev->ops->set_mesh_params) {
2723                 err = -EOPNOTSUPP;
2724                 goto out;
2725         }
2726
2727         /* This makes sure that there aren't more than 32 mesh config
2728          * parameters (otherwise our bitfield scheme would not work.) */
2729         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2730
2731         /* Fill in the params struct */
2732         mask = 0;
2733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2734                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2736                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2738                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2740                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2741         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2742                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2743         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2744                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2746                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2747         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2748                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2749                         nla_get_u8);
2750         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2751                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2752         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2753                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2754                         nla_get_u16);
2755         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2756                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2757                         nla_get_u32);
2758         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2759                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2760                         nla_get_u16);
2761         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2762                         dot11MeshHWMPnetDiameterTraversalTime,
2763                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2764                         nla_get_u16);
2765         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2766                         dot11MeshHWMPRootMode, mask,
2767                         NL80211_MESHCONF_HWMP_ROOTMODE,
2768                         nla_get_u8);
2769
2770         /* Apply changes */
2771         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2772
2773  out:
2774         /* cleanup */
2775         cfg80211_unlock_rdev(rdev);
2776         dev_put(dev);
2777  out_rtnl:
2778         rtnl_unlock();
2779
2780         return err;
2781 }
2782
2783 #undef FILL_IN_MESH_PARAM_IF_SET
2784
2785 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2786 {
2787         struct sk_buff *msg;
2788         void *hdr = NULL;
2789         struct nlattr *nl_reg_rules;
2790         unsigned int i;
2791         int err = -EINVAL;
2792
2793         mutex_lock(&cfg80211_mutex);
2794
2795         if (!cfg80211_regdomain)
2796                 goto out;
2797
2798         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2799         if (!msg) {
2800                 err = -ENOBUFS;
2801                 goto out;
2802         }
2803
2804         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2805                              NL80211_CMD_GET_REG);
2806         if (!hdr)
2807                 goto nla_put_failure;
2808
2809         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2810                 cfg80211_regdomain->alpha2);
2811
2812         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2813         if (!nl_reg_rules)
2814                 goto nla_put_failure;
2815
2816         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2817                 struct nlattr *nl_reg_rule;
2818                 const struct ieee80211_reg_rule *reg_rule;
2819                 const struct ieee80211_freq_range *freq_range;
2820                 const struct ieee80211_power_rule *power_rule;
2821
2822                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2823                 freq_range = &reg_rule->freq_range;
2824                 power_rule = &reg_rule->power_rule;
2825
2826                 nl_reg_rule = nla_nest_start(msg, i);
2827                 if (!nl_reg_rule)
2828                         goto nla_put_failure;
2829
2830                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2831                         reg_rule->flags);
2832                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2833                         freq_range->start_freq_khz);
2834                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2835                         freq_range->end_freq_khz);
2836                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2837                         freq_range->max_bandwidth_khz);
2838                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2839                         power_rule->max_antenna_gain);
2840                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2841                         power_rule->max_eirp);
2842
2843                 nla_nest_end(msg, nl_reg_rule);
2844         }
2845
2846         nla_nest_end(msg, nl_reg_rules);
2847
2848         genlmsg_end(msg, hdr);
2849         err = genlmsg_reply(msg, info);
2850         goto out;
2851
2852 nla_put_failure:
2853         genlmsg_cancel(msg, hdr);
2854         err = -EMSGSIZE;
2855 out:
2856         mutex_unlock(&cfg80211_mutex);
2857         return err;
2858 }
2859
2860 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2861 {
2862         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2863         struct nlattr *nl_reg_rule;
2864         char *alpha2 = NULL;
2865         int rem_reg_rules = 0, r = 0;
2866         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2867         struct ieee80211_regdomain *rd = NULL;
2868
2869         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2870                 return -EINVAL;
2871
2872         if (!info->attrs[NL80211_ATTR_REG_RULES])
2873                 return -EINVAL;
2874
2875         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2876
2877         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2878                         rem_reg_rules) {
2879                 num_rules++;
2880                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2881                         return -EINVAL;
2882         }
2883
2884         mutex_lock(&cfg80211_mutex);
2885
2886         if (!reg_is_valid_request(alpha2)) {
2887                 r = -EINVAL;
2888                 goto bad_reg;
2889         }
2890
2891         size_of_regd = sizeof(struct ieee80211_regdomain) +
2892                 (num_rules * sizeof(struct ieee80211_reg_rule));
2893
2894         rd = kzalloc(size_of_regd, GFP_KERNEL);
2895         if (!rd) {
2896                 r = -ENOMEM;
2897                 goto bad_reg;
2898         }
2899
2900         rd->n_reg_rules = num_rules;
2901         rd->alpha2[0] = alpha2[0];
2902         rd->alpha2[1] = alpha2[1];
2903
2904         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2905                         rem_reg_rules) {
2906                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2907                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2908                         reg_rule_policy);
2909                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2910                 if (r)
2911                         goto bad_reg;
2912
2913                 rule_idx++;
2914
2915                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2916                         r = -EINVAL;
2917                         goto bad_reg;
2918                 }
2919         }
2920
2921         BUG_ON(rule_idx != num_rules);
2922
2923         r = set_regdom(rd);
2924
2925         mutex_unlock(&cfg80211_mutex);
2926
2927         return r;
2928
2929  bad_reg:
2930         mutex_unlock(&cfg80211_mutex);
2931         kfree(rd);
2932         return r;
2933 }
2934
2935 static int validate_scan_freqs(struct nlattr *freqs)
2936 {
2937         struct nlattr *attr1, *attr2;
2938         int n_channels = 0, tmp1, tmp2;
2939
2940         nla_for_each_nested(attr1, freqs, tmp1) {
2941                 n_channels++;
2942                 /*
2943                  * Some hardware has a limited channel list for
2944                  * scanning, and it is pretty much nonsensical
2945                  * to scan for a channel twice, so disallow that
2946                  * and don't require drivers to check that the
2947                  * channel list they get isn't longer than what
2948                  * they can scan, as long as they can scan all
2949                  * the channels they registered at once.
2950                  */
2951                 nla_for_each_nested(attr2, freqs, tmp2)
2952                         if (attr1 != attr2 &&
2953                             nla_get_u32(attr1) == nla_get_u32(attr2))
2954                                 return 0;
2955         }
2956
2957         return n_channels;
2958 }
2959
2960 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2961 {
2962         struct cfg80211_registered_device *rdev;
2963         struct net_device *dev;
2964         struct cfg80211_scan_request *request;
2965         struct cfg80211_ssid *ssid;
2966         struct ieee80211_channel *channel;
2967         struct nlattr *attr;
2968         struct wiphy *wiphy;
2969         int err, tmp, n_ssids = 0, n_channels, i;
2970         enum ieee80211_band band;
2971         size_t ie_len;
2972
2973         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2974                 return -EINVAL;
2975
2976         rtnl_lock();
2977
2978         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2979         if (err)
2980                 goto out_rtnl;
2981
2982         wiphy = &rdev->wiphy;
2983
2984         if (!rdev->ops->scan) {
2985                 err = -EOPNOTSUPP;
2986                 goto out;
2987         }
2988
2989         if (!netif_running(dev)) {
2990                 err = -ENETDOWN;
2991                 goto out;
2992         }
2993
2994         if (rdev->scan_req) {
2995                 err = -EBUSY;
2996                 goto out;
2997         }
2998
2999         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3000                 n_channels = validate_scan_freqs(
3001                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3002                 if (!n_channels) {
3003                         err = -EINVAL;
3004                         goto out;
3005                 }
3006         } else {
3007                 n_channels = 0;
3008
3009                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3010                         if (wiphy->bands[band])
3011                                 n_channels += wiphy->bands[band]->n_channels;
3012         }
3013
3014         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3015                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3016                         n_ssids++;
3017
3018         if (n_ssids > wiphy->max_scan_ssids) {
3019                 err = -EINVAL;
3020                 goto out;
3021         }
3022
3023         if (info->attrs[NL80211_ATTR_IE])
3024                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3025         else
3026                 ie_len = 0;
3027
3028         if (ie_len > wiphy->max_scan_ie_len) {
3029                 err = -EINVAL;
3030                 goto out;
3031         }
3032
3033         request = kzalloc(sizeof(*request)
3034                         + sizeof(*ssid) * n_ssids
3035                         + sizeof(channel) * n_channels
3036                         + ie_len, GFP_KERNEL);
3037         if (!request) {
3038                 err = -ENOMEM;
3039                 goto out;
3040         }
3041
3042         if (n_ssids)
3043                 request->ssids = (void *)&request->channels[n_channels];
3044         request->n_ssids = n_ssids;
3045         if (ie_len) {
3046                 if (request->ssids)
3047                         request->ie = (void *)(request->ssids + n_ssids);
3048                 else
3049                         request->ie = (void *)(request->channels + n_channels);
3050         }
3051
3052         i = 0;
3053         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3054                 /* user specified, bail out if channel not found */
3055                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3056                         struct ieee80211_channel *chan;
3057
3058                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3059
3060                         if (!chan) {
3061                                 err = -EINVAL;
3062                                 goto out_free;
3063                         }
3064
3065                         /* ignore disabled channels */
3066                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3067                                 continue;
3068
3069                         request->channels[i] = chan;
3070                         i++;
3071                 }
3072         } else {
3073                 /* all channels */
3074                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3075                         int j;
3076                         if (!wiphy->bands[band])
3077                                 continue;
3078                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3079                                 struct ieee80211_channel *chan;
3080
3081                                 chan = &wiphy->bands[band]->channels[j];
3082
3083                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3084                                         continue;
3085
3086                                 request->channels[i] = chan;
3087                                 i++;
3088                         }
3089                 }
3090         }
3091
3092         if (!i) {
3093                 err = -EINVAL;
3094                 goto out_free;
3095         }
3096
3097         request->n_channels = i;
3098
3099         i = 0;
3100         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3101                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3102                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3103                                 err = -EINVAL;
3104                                 goto out_free;
3105                         }
3106                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3107                         request->ssids[i].ssid_len = nla_len(attr);
3108                         i++;
3109                 }
3110         }
3111
3112         if (info->attrs[NL80211_ATTR_IE]) {
3113                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3114                 memcpy((void *)request->ie,
3115                        nla_data(info->attrs[NL80211_ATTR_IE]),
3116                        request->ie_len);
3117         }
3118
3119         request->dev = dev;
3120         request->wiphy = &rdev->wiphy;
3121
3122         rdev->scan_req = request;
3123         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3124
3125         if (!err) {
3126                 nl80211_send_scan_start(rdev, dev);
3127                 dev_hold(dev);
3128         }
3129
3130  out_free:
3131         if (err) {
3132                 rdev->scan_req = NULL;
3133                 kfree(request);
3134         }
3135  out:
3136         cfg80211_unlock_rdev(rdev);
3137         dev_put(dev);
3138  out_rtnl:
3139         rtnl_unlock();
3140
3141         return err;
3142 }
3143
3144 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3145                             struct cfg80211_registered_device *rdev,
3146                             struct wireless_dev *wdev,
3147                             struct cfg80211_internal_bss *intbss)
3148 {
3149         struct cfg80211_bss *res = &intbss->pub;
3150         void *hdr;
3151         struct nlattr *bss;
3152         int i;
3153
3154         ASSERT_WDEV_LOCK(wdev);
3155
3156         hdr = nl80211hdr_put(msg, pid, seq, flags,
3157                              NL80211_CMD_NEW_SCAN_RESULTS);
3158         if (!hdr)
3159                 return -1;
3160
3161         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3162         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3163
3164         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3165         if (!bss)
3166                 goto nla_put_failure;
3167         if (!is_zero_ether_addr(res->bssid))
3168                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3169         if (res->information_elements && res->len_information_elements)
3170                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3171                         res->len_information_elements,
3172                         res->information_elements);
3173         if (res->tsf)
3174                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3175         if (res->beacon_interval)
3176                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3177         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3178         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3179         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3180                 jiffies_to_msecs(jiffies - intbss->ts));
3181
3182         switch (rdev->wiphy.signal_type) {
3183         case CFG80211_SIGNAL_TYPE_MBM:
3184                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3185                 break;
3186         case CFG80211_SIGNAL_TYPE_UNSPEC:
3187                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3188                 break;
3189         default:
3190                 break;
3191         }
3192
3193         switch (wdev->iftype) {
3194         case NL80211_IFTYPE_STATION:
3195                 if (intbss == wdev->current_bss)
3196                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3197                                     NL80211_BSS_STATUS_ASSOCIATED);
3198                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3199                         if (intbss != wdev->auth_bsses[i])
3200                                 continue;
3201                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3202                                     NL80211_BSS_STATUS_AUTHENTICATED);
3203                         break;
3204                 }
3205                 break;
3206         case NL80211_IFTYPE_ADHOC:
3207                 if (intbss == wdev->current_bss)
3208                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3209                                     NL80211_BSS_STATUS_IBSS_JOINED);
3210                 break;
3211         default:
3212                 break;
3213         }
3214
3215         nla_nest_end(msg, bss);
3216
3217         return genlmsg_end(msg, hdr);
3218
3219  nla_put_failure:
3220         genlmsg_cancel(msg, hdr);
3221         return -EMSGSIZE;
3222 }
3223
3224 static int nl80211_dump_scan(struct sk_buff *skb,
3225                              struct netlink_callback *cb)
3226 {
3227         struct cfg80211_registered_device *rdev;
3228         struct net_device *dev;
3229         struct cfg80211_internal_bss *scan;
3230         struct wireless_dev *wdev;
3231         int ifidx = cb->args[0];
3232         int start = cb->args[1], idx = 0;
3233         int err;
3234
3235         if (!ifidx)
3236                 ifidx = nl80211_get_ifidx(cb);
3237         if (ifidx < 0)
3238                 return ifidx;
3239         cb->args[0] = ifidx;
3240
3241         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3242         if (!dev)
3243                 return -ENODEV;
3244
3245         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3246         if (IS_ERR(rdev)) {
3247                 err = PTR_ERR(rdev);
3248                 goto out_put_netdev;
3249         }
3250
3251         wdev = dev->ieee80211_ptr;
3252
3253         wdev_lock(wdev);
3254         spin_lock_bh(&rdev->bss_lock);
3255         cfg80211_bss_expire(rdev);
3256
3257         list_for_each_entry(scan, &rdev->bss_list, list) {
3258                 if (++idx <= start)
3259                         continue;
3260                 if (nl80211_send_bss(skb,
3261                                 NETLINK_CB(cb->skb).pid,
3262                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3263                                 rdev, wdev, scan) < 0) {
3264                         idx--;
3265                         goto out;
3266                 }
3267         }
3268
3269  out:
3270         spin_unlock_bh(&rdev->bss_lock);
3271         wdev_unlock(wdev);
3272
3273         cb->args[1] = idx;
3274         err = skb->len;
3275         cfg80211_unlock_rdev(rdev);
3276  out_put_netdev:
3277         dev_put(dev);
3278
3279         return err;
3280 }
3281
3282 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3283                                 int flags, struct net_device *dev,
3284                                 struct survey_info *survey)
3285 {
3286         void *hdr;
3287         struct nlattr *infoattr;
3288
3289         /* Survey without a channel doesn't make sense */
3290         if (!survey->channel)
3291                 return -EINVAL;
3292
3293         hdr = nl80211hdr_put(msg, pid, seq, flags,
3294                              NL80211_CMD_NEW_SURVEY_RESULTS);
3295         if (!hdr)
3296                 return -ENOMEM;
3297
3298         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3299
3300         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3301         if (!infoattr)
3302                 goto nla_put_failure;
3303
3304         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3305                     survey->channel->center_freq);
3306         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3307                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3308                             survey->noise);
3309
3310         nla_nest_end(msg, infoattr);
3311
3312         return genlmsg_end(msg, hdr);
3313
3314  nla_put_failure:
3315         genlmsg_cancel(msg, hdr);
3316         return -EMSGSIZE;
3317 }
3318
3319 static int nl80211_dump_survey(struct sk_buff *skb,
3320                         struct netlink_callback *cb)
3321 {
3322         struct survey_info survey;
3323         struct cfg80211_registered_device *dev;
3324         struct net_device *netdev;
3325         int ifidx = cb->args[0];
3326         int survey_idx = cb->args[1];
3327         int res;
3328
3329         if (!ifidx)
3330                 ifidx = nl80211_get_ifidx(cb);
3331         if (ifidx < 0)
3332                 return ifidx;
3333         cb->args[0] = ifidx;
3334
3335         rtnl_lock();
3336
3337         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3338         if (!netdev) {
3339                 res = -ENODEV;
3340                 goto out_rtnl;
3341         }
3342
3343         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3344         if (IS_ERR(dev)) {
3345                 res = PTR_ERR(dev);
3346                 goto out_rtnl;
3347         }
3348
3349         if (!dev->ops->dump_survey) {
3350                 res = -EOPNOTSUPP;
3351                 goto out_err;
3352         }
3353
3354         while (1) {
3355                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3356                                             &survey);
3357                 if (res == -ENOENT)
3358                         break;
3359                 if (res)
3360                         goto out_err;
3361
3362                 if (nl80211_send_survey(skb,
3363                                 NETLINK_CB(cb->skb).pid,
3364                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3365                                 netdev,
3366                                 &survey) < 0)
3367                         goto out;
3368                 survey_idx++;
3369         }
3370
3371  out:
3372         cb->args[1] = survey_idx;
3373         res = skb->len;
3374  out_err:
3375         cfg80211_unlock_rdev(dev);
3376  out_rtnl:
3377         rtnl_unlock();
3378
3379         return res;
3380 }
3381
3382 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3383 {
3384         return auth_type <= NL80211_AUTHTYPE_MAX;
3385 }
3386
3387 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3388 {
3389         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3390                                   NL80211_WPA_VERSION_2));
3391 }
3392
3393 static bool nl80211_valid_akm_suite(u32 akm)
3394 {
3395         return akm == WLAN_AKM_SUITE_8021X ||
3396                 akm == WLAN_AKM_SUITE_PSK;
3397 }
3398
3399 static bool nl80211_valid_cipher_suite(u32 cipher)
3400 {
3401         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3402                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3403                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3404                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3405                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3406 }
3407
3408
3409 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3410 {
3411         struct cfg80211_registered_device *rdev;
3412         struct net_device *dev;
3413         struct ieee80211_channel *chan;
3414         const u8 *bssid, *ssid, *ie = NULL;
3415         int err, ssid_len, ie_len = 0;
3416         enum nl80211_auth_type auth_type;
3417         struct key_parse key;
3418
3419         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3420                 return -EINVAL;
3421
3422         if (!info->attrs[NL80211_ATTR_MAC])
3423                 return -EINVAL;
3424
3425         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3426                 return -EINVAL;
3427
3428         if (!info->attrs[NL80211_ATTR_SSID])
3429                 return -EINVAL;
3430
3431         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3432                 return -EINVAL;
3433
3434         err = nl80211_parse_key(info, &key);
3435         if (err)
3436                 return err;
3437
3438         if (key.idx >= 0) {
3439                 if (!key.p.key || !key.p.key_len)
3440                         return -EINVAL;
3441                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3442                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3443                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3444                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3445                         return -EINVAL;
3446                 if (key.idx > 4)
3447                         return -EINVAL;
3448         } else {
3449                 key.p.key_len = 0;
3450                 key.p.key = NULL;
3451         }
3452
3453         rtnl_lock();
3454
3455         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3456         if (err)
3457                 goto unlock_rtnl;
3458
3459         if (!rdev->ops->auth) {
3460                 err = -EOPNOTSUPP;
3461                 goto out;
3462         }
3463
3464         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3465                 err = -EOPNOTSUPP;
3466                 goto out;
3467         }
3468
3469         if (!netif_running(dev)) {
3470                 err = -ENETDOWN;
3471                 goto out;
3472         }
3473
3474         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3475         chan = ieee80211_get_channel(&rdev->wiphy,
3476                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3477         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3478                 err = -EINVAL;
3479                 goto out;
3480         }
3481
3482         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3483         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3484
3485         if (info->attrs[NL80211_ATTR_IE]) {
3486                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3487                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3488         }
3489
3490         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3491         if (!nl80211_valid_auth_type(auth_type)) {
3492                 err = -EINVAL;
3493                 goto out;
3494         }
3495
3496         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3497                                  ssid, ssid_len, ie, ie_len,
3498                                  key.p.key, key.p.key_len, key.idx);
3499
3500 out:
3501         cfg80211_unlock_rdev(rdev);
3502         dev_put(dev);
3503 unlock_rtnl:
3504         rtnl_unlock();
3505         return err;
3506 }
3507
3508 static int nl80211_crypto_settings(struct genl_info *info,
3509                                    struct cfg80211_crypto_settings *settings,
3510                                    int cipher_limit)
3511 {
3512         memset(settings, 0, sizeof(*settings));
3513
3514         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3515
3516         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3517                 void *data;
3518                 int len, i;
3519
3520                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3521                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3522                 settings->n_ciphers_pairwise = len / sizeof(u32);
3523
3524                 if (len % sizeof(u32))
3525                         return -EINVAL;
3526
3527                 if (settings->n_ciphers_pairwise > cipher_limit)
3528                         return -EINVAL;
3529
3530                 memcpy(settings->ciphers_pairwise, data, len);
3531
3532                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3533                         if (!nl80211_valid_cipher_suite(
3534                                         settings->ciphers_pairwise[i]))
3535                                 return -EINVAL;
3536         }
3537
3538         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3539                 settings->cipher_group =
3540                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3541                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3542                         return -EINVAL;
3543         }
3544
3545         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3546                 settings->wpa_versions =
3547                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3548                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3549                         return -EINVAL;
3550         }
3551
3552         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3553                 void *data;
3554                 int len, i;
3555
3556                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3557                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3558                 settings->n_akm_suites = len / sizeof(u32);
3559
3560                 if (len % sizeof(u32))
3561                         return -EINVAL;
3562
3563                 memcpy(settings->akm_suites, data, len);
3564
3565                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3566                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3567                                 return -EINVAL;
3568         }
3569
3570         return 0;
3571 }
3572
3573 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3574 {
3575         struct cfg80211_registered_device *rdev;
3576         struct net_device *dev;
3577         struct cfg80211_crypto_settings crypto;
3578         struct ieee80211_channel *chan, *fixedchan;
3579         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3580         int err, ssid_len, ie_len = 0;
3581         bool use_mfp = false;
3582
3583         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3584                 return -EINVAL;
3585
3586         if (!info->attrs[NL80211_ATTR_MAC] ||
3587             !info->attrs[NL80211_ATTR_SSID] ||
3588             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3589                 return -EINVAL;
3590
3591         rtnl_lock();
3592
3593         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3594         if (err)
3595                 goto unlock_rtnl;
3596
3597         if (!rdev->ops->assoc) {
3598                 err = -EOPNOTSUPP;
3599                 goto out;
3600         }
3601
3602         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3603                 err = -EOPNOTSUPP;
3604                 goto out;
3605         }
3606
3607         if (!netif_running(dev)) {
3608                 err = -ENETDOWN;
3609                 goto out;
3610         }
3611
3612         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3613
3614         chan = ieee80211_get_channel(&rdev->wiphy,
3615                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3616         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3617                 err = -EINVAL;
3618                 goto out;
3619         }
3620
3621         mutex_lock(&rdev->devlist_mtx);
3622         fixedchan = rdev_fixed_channel(rdev, NULL);
3623         if (fixedchan && chan != fixedchan) {
3624                 err = -EBUSY;
3625                 mutex_unlock(&rdev->devlist_mtx);
3626                 goto out;
3627         }
3628         mutex_unlock(&rdev->devlist_mtx);
3629
3630         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3631         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3632
3633         if (info->attrs[NL80211_ATTR_IE]) {
3634                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3635                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3636         }
3637
3638         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3639                 enum nl80211_mfp mfp =
3640                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3641                 if (mfp == NL80211_MFP_REQUIRED)
3642                         use_mfp = true;
3643                 else if (mfp != NL80211_MFP_NO) {
3644                         err = -EINVAL;
3645                         goto out;
3646                 }
3647         }
3648
3649         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3650                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3651
3652         err = nl80211_crypto_settings(info, &crypto, 1);
3653         if (!err)
3654                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3655                                           ssid, ssid_len, ie, ie_len, use_mfp,
3656                                           &crypto);
3657
3658 out:
3659         cfg80211_unlock_rdev(rdev);
3660         dev_put(dev);
3661 unlock_rtnl:
3662         rtnl_unlock();
3663         return err;
3664 }
3665
3666 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3667 {
3668         struct cfg80211_registered_device *rdev;
3669         struct net_device *dev;
3670         const u8 *ie = NULL, *bssid;
3671         int err, ie_len = 0;
3672         u16 reason_code;
3673
3674         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3675                 return -EINVAL;
3676
3677         if (!info->attrs[NL80211_ATTR_MAC])
3678                 return -EINVAL;
3679
3680         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3681                 return -EINVAL;
3682
3683         rtnl_lock();
3684
3685         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3686         if (err)
3687                 goto unlock_rtnl;
3688
3689         if (!rdev->ops->deauth) {
3690                 err = -EOPNOTSUPP;
3691                 goto out;
3692         }
3693
3694         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3695                 err = -EOPNOTSUPP;
3696                 goto out;
3697         }
3698
3699         if (!netif_running(dev)) {
3700                 err = -ENETDOWN;
3701                 goto out;
3702         }
3703
3704         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3705
3706         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3707         if (reason_code == 0) {
3708                 /* Reason Code 0 is reserved */
3709                 err = -EINVAL;
3710                 goto out;
3711         }
3712
3713         if (info->attrs[NL80211_ATTR_IE]) {
3714                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3715                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3716         }
3717
3718         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3719
3720 out:
3721         cfg80211_unlock_rdev(rdev);
3722         dev_put(dev);
3723 unlock_rtnl:
3724         rtnl_unlock();
3725         return err;
3726 }
3727
3728 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3729 {
3730         struct cfg80211_registered_device *rdev;
3731         struct net_device *dev;
3732         const u8 *ie = NULL, *bssid;
3733         int err, ie_len = 0;
3734         u16 reason_code;
3735
3736         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3737                 return -EINVAL;
3738
3739         if (!info->attrs[NL80211_ATTR_MAC])
3740                 return -EINVAL;
3741
3742         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3743                 return -EINVAL;
3744
3745         rtnl_lock();
3746
3747         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3748         if (err)
3749                 goto unlock_rtnl;
3750
3751         if (!rdev->ops->disassoc) {
3752                 err = -EOPNOTSUPP;
3753                 goto out;
3754         }
3755
3756         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3757                 err = -EOPNOTSUPP;
3758                 goto out;
3759         }
3760
3761         if (!netif_running(dev)) {
3762                 err = -ENETDOWN;
3763                 goto out;
3764         }
3765
3766         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3767
3768         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3769         if (reason_code == 0) {
3770                 /* Reason Code 0 is reserved */
3771                 err = -EINVAL;
3772                 goto out;
3773         }
3774
3775         if (info->attrs[NL80211_ATTR_IE]) {
3776                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3777                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3778         }
3779
3780         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3781
3782 out:
3783         cfg80211_unlock_rdev(rdev);
3784         dev_put(dev);
3785 unlock_rtnl:
3786         rtnl_unlock();
3787         return err;
3788 }
3789
3790 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3791 {
3792         struct cfg80211_registered_device *rdev;
3793         struct net_device *dev;
3794         struct cfg80211_ibss_params ibss;
3795         struct wiphy *wiphy;
3796         struct cfg80211_cached_keys *connkeys = NULL;
3797         int err;
3798
3799         memset(&ibss, 0, sizeof(ibss));
3800
3801         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3802                 return -EINVAL;
3803
3804         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3805             !info->attrs[NL80211_ATTR_SSID] ||
3806             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3807                 return -EINVAL;
3808
3809         ibss.beacon_interval = 100;
3810
3811         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3812                 ibss.beacon_interval =
3813                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3814                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3815                         return -EINVAL;
3816         }
3817
3818         rtnl_lock();
3819
3820         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3821         if (err)
3822                 goto unlock_rtnl;
3823
3824         if (!rdev->ops->join_ibss) {
3825                 err = -EOPNOTSUPP;
3826                 goto out;
3827         }
3828
3829         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3830                 err = -EOPNOTSUPP;
3831                 goto out;
3832         }
3833
3834         if (!netif_running(dev)) {
3835                 err = -ENETDOWN;
3836                 goto out;
3837         }
3838
3839         wiphy = &rdev->wiphy;
3840
3841         if (info->attrs[NL80211_ATTR_MAC])
3842                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3843         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3844         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3845
3846         if (info->attrs[NL80211_ATTR_IE]) {
3847                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3848                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3849         }
3850
3851         ibss.channel = ieee80211_get_channel(wiphy,
3852                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3853         if (!ibss.channel ||
3854             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3855             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3856                 err = -EINVAL;
3857                 goto out;
3858         }
3859
3860         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3861         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3862
3863         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3864                 connkeys = nl80211_parse_connkeys(rdev,
3865                                         info->attrs[NL80211_ATTR_KEYS]);
3866                 if (IS_ERR(connkeys)) {
3867                         err = PTR_ERR(connkeys);
3868                         connkeys = NULL;
3869                         goto out;
3870                 }
3871         }
3872
3873         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3874
3875 out:
3876         cfg80211_unlock_rdev(rdev);
3877         dev_put(dev);
3878 unlock_rtnl:
3879         if (err)
3880                 kfree(connkeys);
3881         rtnl_unlock();
3882         return err;
3883 }
3884
3885 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3886 {
3887         struct cfg80211_registered_device *rdev;
3888         struct net_device *dev;
3889         int err;
3890
3891         rtnl_lock();
3892
3893         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3894         if (err)
3895                 goto unlock_rtnl;
3896
3897         if (!rdev->ops->leave_ibss) {
3898                 err = -EOPNOTSUPP;
3899                 goto out;
3900         }
3901
3902         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3903                 err = -EOPNOTSUPP;
3904                 goto out;
3905         }
3906
3907         if (!netif_running(dev)) {
3908                 err = -ENETDOWN;
3909                 goto out;
3910         }
3911
3912         err = cfg80211_leave_ibss(rdev, dev, false);
3913
3914 out:
3915         cfg80211_unlock_rdev(rdev);
3916         dev_put(dev);
3917 unlock_rtnl:
3918         rtnl_unlock();
3919         return err;
3920 }
3921
3922 #ifdef CONFIG_NL80211_TESTMODE
3923 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3924         .name = "testmode",
3925 };
3926
3927 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3928 {
3929         struct cfg80211_registered_device *rdev;
3930         int err;
3931
3932         if (!info->attrs[NL80211_ATTR_TESTDATA])
3933                 return -EINVAL;
3934
3935         rtnl_lock();
3936
3937         rdev = cfg80211_get_dev_from_info(info);
3938         if (IS_ERR(rdev)) {
3939                 err = PTR_ERR(rdev);
3940                 goto unlock_rtnl;
3941         }
3942
3943         err = -EOPNOTSUPP;
3944         if (rdev->ops->testmode_cmd) {
3945                 rdev->testmode_info = info;
3946                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3947                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3948                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3949                 rdev->testmode_info = NULL;
3950         }
3951
3952         cfg80211_unlock_rdev(rdev);
3953
3954  unlock_rtnl:
3955         rtnl_unlock();
3956         return err;
3957 }
3958
3959 static struct sk_buff *
3960 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3961                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3962 {
3963         struct sk_buff *skb;
3964         void *hdr;
3965         struct nlattr *data;
3966
3967         skb = nlmsg_new(approxlen + 100, gfp);
3968         if (!skb)
3969                 return NULL;
3970
3971         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3972         if (!hdr) {
3973                 kfree_skb(skb);
3974                 return NULL;
3975         }
3976
3977         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3978         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3979
3980         ((void **)skb->cb)[0] = rdev;
3981         ((void **)skb->cb)[1] = hdr;
3982         ((void **)skb->cb)[2] = data;
3983
3984         return skb;
3985
3986  nla_put_failure:
3987         kfree_skb(skb);
3988         return NULL;
3989 }
3990
3991 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3992                                                   int approxlen)
3993 {
3994         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3995
3996         if (WARN_ON(!rdev->testmode_info))
3997                 return NULL;
3998
3999         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4000                                 rdev->testmode_info->snd_pid,
4001                                 rdev->testmode_info->snd_seq,
4002                                 GFP_KERNEL);
4003 }
4004 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4005
4006 int cfg80211_testmode_reply(struct sk_buff *skb)
4007 {
4008         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4009         void *hdr = ((void **)skb->cb)[1];
4010         struct nlattr *data = ((void **)skb->cb)[2];
4011
4012         if (WARN_ON(!rdev->testmode_info)) {
4013                 kfree_skb(skb);
4014                 return -EINVAL;
4015         }
4016
4017         nla_nest_end(skb, data);
4018         genlmsg_end(skb, hdr);
4019         return genlmsg_reply(skb, rdev->testmode_info);
4020 }
4021 EXPORT_SYMBOL(cfg80211_testmode_reply);
4022
4023 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4024                                                   int approxlen, gfp_t gfp)
4025 {
4026         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4027
4028         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4029 }
4030 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4031
4032 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4033 {
4034         void *hdr = ((void **)skb->cb)[1];
4035         struct nlattr *data = ((void **)skb->cb)[2];
4036
4037         nla_nest_end(skb, data);
4038         genlmsg_end(skb, hdr);
4039         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4040 }
4041 EXPORT_SYMBOL(cfg80211_testmode_event);
4042 #endif
4043
4044 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4045 {
4046         struct cfg80211_registered_device *rdev;
4047         struct net_device *dev;
4048         struct cfg80211_connect_params connect;
4049         struct wiphy *wiphy;
4050         struct cfg80211_cached_keys *connkeys = NULL;
4051         int err;
4052
4053         memset(&connect, 0, sizeof(connect));
4054
4055         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4056                 return -EINVAL;
4057
4058         if (!info->attrs[NL80211_ATTR_SSID] ||
4059             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4060                 return -EINVAL;
4061
4062         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4063                 connect.auth_type =
4064                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4065                 if (!nl80211_valid_auth_type(connect.auth_type))
4066                         return -EINVAL;
4067         } else
4068                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4069
4070         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4071
4072         err = nl80211_crypto_settings(info, &connect.crypto,
4073                                       NL80211_MAX_NR_CIPHER_SUITES);
4074         if (err)
4075                 return err;
4076         rtnl_lock();
4077
4078         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4079         if (err)
4080                 goto unlock_rtnl;
4081
4082         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4083                 err = -EOPNOTSUPP;
4084                 goto out;
4085         }
4086
4087         if (!netif_running(dev)) {
4088                 err = -ENETDOWN;
4089                 goto out;
4090         }
4091
4092         wiphy = &rdev->wiphy;
4093
4094         if (info->attrs[NL80211_ATTR_MAC])
4095                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4096         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4097         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4098
4099         if (info->attrs[NL80211_ATTR_IE]) {
4100                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4101                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4102         }
4103
4104         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4105                 connect.channel =
4106                         ieee80211_get_channel(wiphy,
4107                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4108                 if (!connect.channel ||
4109                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4110                         err = -EINVAL;
4111                         goto out;
4112                 }
4113         }
4114
4115         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4116                 connkeys = nl80211_parse_connkeys(rdev,
4117                                         info->attrs[NL80211_ATTR_KEYS]);
4118                 if (IS_ERR(connkeys)) {
4119                         err = PTR_ERR(connkeys);
4120                         connkeys = NULL;
4121                         goto out;
4122                 }
4123         }
4124
4125         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4126
4127 out:
4128         cfg80211_unlock_rdev(rdev);
4129         dev_put(dev);
4130 unlock_rtnl:
4131         if (err)
4132                 kfree(connkeys);
4133         rtnl_unlock();
4134         return err;
4135 }
4136
4137 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4138 {
4139         struct cfg80211_registered_device *rdev;
4140         struct net_device *dev;
4141         int err;
4142         u16 reason;
4143
4144         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4145                 reason = WLAN_REASON_DEAUTH_LEAVING;
4146         else
4147                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4148
4149         if (reason == 0)
4150                 return -EINVAL;
4151
4152         rtnl_lock();
4153
4154         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4155         if (err)
4156                 goto unlock_rtnl;
4157
4158         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4159                 err = -EOPNOTSUPP;
4160                 goto out;
4161         }
4162
4163         if (!netif_running(dev)) {
4164                 err = -ENETDOWN;
4165                 goto out;
4166         }
4167
4168         err = cfg80211_disconnect(rdev, dev, reason, true);
4169
4170 out:
4171         cfg80211_unlock_rdev(rdev);
4172         dev_put(dev);
4173 unlock_rtnl:
4174         rtnl_unlock();
4175         return err;
4176 }
4177
4178 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4179 {
4180         struct cfg80211_registered_device *rdev;
4181         struct net *net;
4182         int err;
4183         u32 pid;
4184
4185         if (!info->attrs[NL80211_ATTR_PID])
4186                 return -EINVAL;
4187
4188         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4189
4190         rtnl_lock();
4191
4192         rdev = cfg80211_get_dev_from_info(info);
4193         if (IS_ERR(rdev)) {
4194                 err = PTR_ERR(rdev);
4195                 goto out_rtnl;
4196         }
4197
4198         net = get_net_ns_by_pid(pid);
4199         if (IS_ERR(net)) {
4200                 err = PTR_ERR(net);
4201                 goto out;
4202         }
4203
4204         err = 0;
4205
4206         /* check if anything to do */
4207         if (net_eq(wiphy_net(&rdev->wiphy), net))
4208                 goto out_put_net;
4209
4210         err = cfg80211_switch_netns(rdev, net);
4211  out_put_net:
4212         put_net(net);
4213  out:
4214         cfg80211_unlock_rdev(rdev);
4215  out_rtnl:
4216         rtnl_unlock();
4217         return err;
4218 }
4219
4220 static struct genl_ops nl80211_ops[] = {
4221         {
4222                 .cmd = NL80211_CMD_GET_WIPHY,
4223                 .doit = nl80211_get_wiphy,
4224                 .dumpit = nl80211_dump_wiphy,
4225                 .policy = nl80211_policy,
4226                 /* can be retrieved by unprivileged users */
4227         },
4228         {
4229                 .cmd = NL80211_CMD_SET_WIPHY,
4230                 .doit = nl80211_set_wiphy,
4231                 .policy = nl80211_policy,
4232                 .flags = GENL_ADMIN_PERM,
4233         },
4234         {
4235                 .cmd = NL80211_CMD_GET_INTERFACE,
4236                 .doit = nl80211_get_interface,
4237                 .dumpit = nl80211_dump_interface,
4238                 .policy = nl80211_policy,
4239                 /* can be retrieved by unprivileged users */
4240         },
4241         {
4242                 .cmd = NL80211_CMD_SET_INTERFACE,
4243                 .doit = nl80211_set_interface,
4244                 .policy = nl80211_policy,
4245                 .flags = GENL_ADMIN_PERM,
4246         },
4247         {
4248                 .cmd = NL80211_CMD_NEW_INTERFACE,
4249                 .doit = nl80211_new_interface,
4250                 .policy = nl80211_policy,
4251                 .flags = GENL_ADMIN_PERM,
4252         },
4253         {
4254                 .cmd = NL80211_CMD_DEL_INTERFACE,
4255                 .doit = nl80211_del_interface,
4256                 .policy = nl80211_policy,
4257                 .flags = GENL_ADMIN_PERM,
4258         },
4259         {
4260                 .cmd = NL80211_CMD_GET_KEY,
4261                 .doit = nl80211_get_key,
4262                 .policy = nl80211_policy,
4263                 .flags = GENL_ADMIN_PERM,
4264         },
4265         {
4266                 .cmd = NL80211_CMD_SET_KEY,
4267                 .doit = nl80211_set_key,
4268                 .policy = nl80211_policy,
4269                 .flags = GENL_ADMIN_PERM,
4270         },
4271         {
4272                 .cmd = NL80211_CMD_NEW_KEY,
4273                 .doit = nl80211_new_key,
4274                 .policy = nl80211_policy,
4275                 .flags = GENL_ADMIN_PERM,
4276         },
4277         {
4278                 .cmd = NL80211_CMD_DEL_KEY,
4279                 .doit = nl80211_del_key,
4280                 .policy = nl80211_policy,
4281                 .flags = GENL_ADMIN_PERM,
4282         },
4283         {
4284                 .cmd = NL80211_CMD_SET_BEACON,
4285                 .policy = nl80211_policy,
4286                 .flags = GENL_ADMIN_PERM,
4287                 .doit = nl80211_addset_beacon,
4288         },
4289         {
4290                 .cmd = NL80211_CMD_NEW_BEACON,
4291                 .policy = nl80211_policy,
4292                 .flags = GENL_ADMIN_PERM,
4293                 .doit = nl80211_addset_beacon,
4294         },
4295         {
4296                 .cmd = NL80211_CMD_DEL_BEACON,
4297                 .policy = nl80211_policy,
4298                 .flags = GENL_ADMIN_PERM,
4299                 .doit = nl80211_del_beacon,
4300         },
4301         {
4302                 .cmd = NL80211_CMD_GET_STATION,
4303                 .doit = nl80211_get_station,
4304                 .dumpit = nl80211_dump_station,
4305                 .policy = nl80211_policy,
4306         },
4307         {
4308                 .cmd = NL80211_CMD_SET_STATION,
4309                 .doit = nl80211_set_station,
4310                 .policy = nl80211_policy,
4311                 .flags = GENL_ADMIN_PERM,
4312         },
4313         {
4314                 .cmd = NL80211_CMD_NEW_STATION,
4315                 .doit = nl80211_new_station,
4316                 .policy = nl80211_policy,
4317                 .flags = GENL_ADMIN_PERM,
4318         },
4319         {
4320                 .cmd = NL80211_CMD_DEL_STATION,
4321                 .doit = nl80211_del_station,
4322                 .policy = nl80211_policy,
4323                 .flags = GENL_ADMIN_PERM,
4324         },
4325         {
4326                 .cmd = NL80211_CMD_GET_MPATH,
4327                 .doit = nl80211_get_mpath,
4328                 .dumpit = nl80211_dump_mpath,
4329                 .policy = nl80211_policy,
4330                 .flags = GENL_ADMIN_PERM,
4331         },
4332         {
4333                 .cmd = NL80211_CMD_SET_MPATH,
4334                 .doit = nl80211_set_mpath,
4335                 .policy = nl80211_policy,
4336                 .flags = GENL_ADMIN_PERM,
4337         },
4338         {
4339                 .cmd = NL80211_CMD_NEW_MPATH,
4340                 .doit = nl80211_new_mpath,
4341                 .policy = nl80211_policy,
4342                 .flags = GENL_ADMIN_PERM,
4343         },
4344         {
4345                 .cmd = NL80211_CMD_DEL_MPATH,
4346                 .doit = nl80211_del_mpath,
4347                 .policy = nl80211_policy,
4348                 .flags = GENL_ADMIN_PERM,
4349         },
4350         {
4351                 .cmd = NL80211_CMD_SET_BSS,
4352                 .doit = nl80211_set_bss,
4353                 .policy = nl80211_policy,
4354                 .flags = GENL_ADMIN_PERM,
4355         },
4356         {
4357                 .cmd = NL80211_CMD_GET_REG,
4358                 .doit = nl80211_get_reg,
4359                 .policy = nl80211_policy,
4360                 /* can be retrieved by unprivileged users */
4361         },
4362         {
4363                 .cmd = NL80211_CMD_SET_REG,
4364                 .doit = nl80211_set_reg,
4365                 .policy = nl80211_policy,
4366                 .flags = GENL_ADMIN_PERM,
4367         },
4368         {
4369                 .cmd = NL80211_CMD_REQ_SET_REG,
4370                 .doit = nl80211_req_set_reg,
4371                 .policy = nl80211_policy,
4372                 .flags = GENL_ADMIN_PERM,
4373         },
4374         {
4375                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4376                 .doit = nl80211_get_mesh_params,
4377                 .policy = nl80211_policy,
4378                 /* can be retrieved by unprivileged users */
4379         },
4380         {
4381                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4382                 .doit = nl80211_set_mesh_params,
4383                 .policy = nl80211_policy,
4384                 .flags = GENL_ADMIN_PERM,
4385         },
4386         {
4387                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4388                 .doit = nl80211_trigger_scan,
4389                 .policy = nl80211_policy,
4390                 .flags = GENL_ADMIN_PERM,
4391         },
4392         {
4393                 .cmd = NL80211_CMD_GET_SCAN,
4394                 .policy = nl80211_policy,
4395                 .dumpit = nl80211_dump_scan,
4396         },
4397         {
4398                 .cmd = NL80211_CMD_AUTHENTICATE,
4399                 .doit = nl80211_authenticate,
4400                 .policy = nl80211_policy,
4401                 .flags = GENL_ADMIN_PERM,
4402         },
4403         {
4404                 .cmd = NL80211_CMD_ASSOCIATE,
4405                 .doit = nl80211_associate,
4406                 .policy = nl80211_policy,
4407                 .flags = GENL_ADMIN_PERM,
4408         },
4409         {
4410                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4411                 .doit = nl80211_deauthenticate,
4412                 .policy = nl80211_policy,
4413                 .flags = GENL_ADMIN_PERM,
4414         },
4415         {
4416                 .cmd = NL80211_CMD_DISASSOCIATE,
4417                 .doit = nl80211_disassociate,
4418                 .policy = nl80211_policy,
4419                 .flags = GENL_ADMIN_PERM,
4420         },
4421         {
4422                 .cmd = NL80211_CMD_JOIN_IBSS,
4423                 .doit = nl80211_join_ibss,
4424                 .policy = nl80211_policy,
4425                 .flags = GENL_ADMIN_PERM,
4426         },
4427         {
4428                 .cmd = NL80211_CMD_LEAVE_IBSS,
4429                 .doit = nl80211_leave_ibss,
4430                 .policy = nl80211_policy,
4431                 .flags = GENL_ADMIN_PERM,
4432         },
4433 #ifdef CONFIG_NL80211_TESTMODE
4434         {
4435                 .cmd = NL80211_CMD_TESTMODE,
4436                 .doit = nl80211_testmode_do,
4437                 .policy = nl80211_policy,
4438                 .flags = GENL_ADMIN_PERM,
4439         },
4440 #endif
4441         {
4442                 .cmd = NL80211_CMD_CONNECT,
4443                 .doit = nl80211_connect,
4444                 .policy = nl80211_policy,
4445                 .flags = GENL_ADMIN_PERM,
4446         },
4447         {
4448                 .cmd = NL80211_CMD_DISCONNECT,
4449                 .doit = nl80211_disconnect,
4450                 .policy = nl80211_policy,
4451                 .flags = GENL_ADMIN_PERM,
4452         },
4453         {
4454                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4455                 .doit = nl80211_wiphy_netns,
4456                 .policy = nl80211_policy,
4457                 .flags = GENL_ADMIN_PERM,
4458         },
4459         {
4460                 .cmd = NL80211_CMD_GET_SURVEY,
4461                 .policy = nl80211_policy,
4462                 .dumpit = nl80211_dump_survey,
4463         },
4464 };
4465 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4466         .name = "mlme",
4467 };
4468
4469 /* multicast groups */
4470 static struct genl_multicast_group nl80211_config_mcgrp = {
4471         .name = "config",
4472 };
4473 static struct genl_multicast_group nl80211_scan_mcgrp = {
4474         .name = "scan",
4475 };
4476 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4477         .name = "regulatory",
4478 };
4479
4480 /* notification functions */
4481
4482 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4483 {
4484         struct sk_buff *msg;
4485
4486         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4487         if (!msg)
4488                 return;
4489
4490         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4491                 nlmsg_free(msg);
4492                 return;
4493         }
4494
4495         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4496                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4497 }
4498
4499 static int nl80211_add_scan_req(struct sk_buff *msg,
4500                                 struct cfg80211_registered_device *rdev)
4501 {
4502         struct cfg80211_scan_request *req = rdev->scan_req;
4503         struct nlattr *nest;
4504         int i;
4505
4506         ASSERT_RDEV_LOCK(rdev);
4507
4508         if (WARN_ON(!req))
4509                 return 0;
4510
4511         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4512         if (!nest)
4513                 goto nla_put_failure;
4514         for (i = 0; i < req->n_ssids; i++)
4515                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4516         nla_nest_end(msg, nest);
4517
4518         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4519         if (!nest)
4520                 goto nla_put_failure;
4521         for (i = 0; i < req->n_channels; i++)
4522                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4523         nla_nest_end(msg, nest);
4524
4525         if (req->ie)
4526                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4527
4528         return 0;
4529  nla_put_failure:
4530         return -ENOBUFS;
4531 }
4532
4533 static int nl80211_send_scan_msg(struct sk_buff *msg,
4534                                  struct cfg80211_registered_device *rdev,
4535                                  struct net_device *netdev,
4536                                  u32 pid, u32 seq, int flags,
4537                                  u32 cmd)
4538 {
4539         void *hdr;
4540
4541         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4542         if (!hdr)
4543                 return -1;
4544
4545         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4546         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4547
4548         /* ignore errors and send incomplete event anyway */
4549         nl80211_add_scan_req(msg, rdev);
4550
4551         return genlmsg_end(msg, hdr);
4552
4553  nla_put_failure:
4554         genlmsg_cancel(msg, hdr);
4555         return -EMSGSIZE;
4556 }
4557
4558 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4559                              struct net_device *netdev)
4560 {
4561         struct sk_buff *msg;
4562
4563         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4564         if (!msg)
4565                 return;
4566
4567         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4568                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4569                 nlmsg_free(msg);
4570                 return;
4571         }
4572
4573         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4574                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4575 }
4576
4577 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4578                             struct net_device *netdev)
4579 {
4580         struct sk_buff *msg;
4581
4582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4583         if (!msg)
4584                 return;
4585
4586         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4587                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4588                 nlmsg_free(msg);
4589                 return;
4590         }
4591
4592         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4593                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4594 }
4595
4596 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4597                                struct net_device *netdev)
4598 {
4599         struct sk_buff *msg;
4600
4601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4602         if (!msg)
4603                 return;
4604
4605         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4606                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4607                 nlmsg_free(msg);
4608                 return;
4609         }
4610
4611         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4612                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4613 }
4614
4615 /*
4616  * This can happen on global regulatory changes or device specific settings
4617  * based on custom world regulatory domains.
4618  */
4619 void nl80211_send_reg_change_event(struct regulatory_request *request)
4620 {
4621         struct sk_buff *msg;
4622         void *hdr;
4623
4624         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4625         if (!msg)
4626                 return;
4627
4628         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4629         if (!hdr) {
4630                 nlmsg_free(msg);
4631                 return;
4632         }
4633
4634         /* Userspace can always count this one always being set */
4635         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4636
4637         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4638                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4639                            NL80211_REGDOM_TYPE_WORLD);
4640         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4641                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4642                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4643         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4644                  request->intersect)
4645                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4646                            NL80211_REGDOM_TYPE_INTERSECTION);
4647         else {
4648                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4649                            NL80211_REGDOM_TYPE_COUNTRY);
4650                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4651         }
4652
4653         if (wiphy_idx_valid(request->wiphy_idx))
4654                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4655
4656         if (genlmsg_end(msg, hdr) < 0) {
4657                 nlmsg_free(msg);
4658                 return;
4659         }
4660
4661         rcu_read_lock();
4662         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4663                                 GFP_ATOMIC);
4664         rcu_read_unlock();
4665
4666         return;
4667
4668 nla_put_failure:
4669         genlmsg_cancel(msg, hdr);
4670         nlmsg_free(msg);
4671 }
4672
4673 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4674                                     struct net_device *netdev,
4675                                     const u8 *buf, size_t len,
4676                                     enum nl80211_commands cmd, gfp_t gfp)
4677 {
4678         struct sk_buff *msg;
4679         void *hdr;
4680
4681         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4682         if (!msg)
4683                 return;
4684
4685         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4686         if (!hdr) {
4687                 nlmsg_free(msg);
4688                 return;
4689         }
4690
4691         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4692         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4693         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4694
4695         if (genlmsg_end(msg, hdr) < 0) {
4696                 nlmsg_free(msg);
4697                 return;
4698         }
4699
4700         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4701                                 nl80211_mlme_mcgrp.id, gfp);
4702         return;
4703
4704  nla_put_failure:
4705         genlmsg_cancel(msg, hdr);
4706         nlmsg_free(msg);
4707 }
4708
4709 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4710                           struct net_device *netdev, const u8 *buf,
4711                           size_t len, gfp_t gfp)
4712 {
4713         nl80211_send_mlme_event(rdev, netdev, buf, len,
4714                                 NL80211_CMD_AUTHENTICATE, gfp);
4715 }
4716
4717 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4718                            struct net_device *netdev, const u8 *buf,
4719                            size_t len, gfp_t gfp)
4720 {
4721         nl80211_send_mlme_event(rdev, netdev, buf, len,
4722                                 NL80211_CMD_ASSOCIATE, gfp);
4723 }
4724
4725 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4726                          struct net_device *netdev, const u8 *buf,
4727                          size_t len, gfp_t gfp)
4728 {
4729         nl80211_send_mlme_event(rdev, netdev, buf, len,
4730                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4731 }
4732
4733 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4734                            struct net_device *netdev, const u8 *buf,
4735                            size_t len, gfp_t gfp)
4736 {
4737         nl80211_send_mlme_event(rdev, netdev, buf, len,
4738                                 NL80211_CMD_DISASSOCIATE, gfp);
4739 }
4740
4741 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4742                                       struct net_device *netdev, int cmd,
4743                                       const u8 *addr, gfp_t gfp)
4744 {
4745         struct sk_buff *msg;
4746         void *hdr;
4747
4748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4749         if (!msg)
4750                 return;
4751
4752         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4753         if (!hdr) {
4754                 nlmsg_free(msg);
4755                 return;
4756         }
4757
4758         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4759         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4760         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4761         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4762
4763         if (genlmsg_end(msg, hdr) < 0) {
4764                 nlmsg_free(msg);
4765                 return;
4766         }
4767
4768         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4769                                 nl80211_mlme_mcgrp.id, gfp);
4770         return;
4771
4772  nla_put_failure:
4773         genlmsg_cancel(msg, hdr);
4774         nlmsg_free(msg);
4775 }
4776
4777 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4778                                struct net_device *netdev, const u8 *addr,
4779                                gfp_t gfp)
4780 {
4781         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4782                                   addr, gfp);
4783 }
4784
4785 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4786                                 struct net_device *netdev, const u8 *addr,
4787                                 gfp_t gfp)
4788 {
4789         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4790                                   addr, gfp);
4791 }
4792
4793 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4794                                  struct net_device *netdev, const u8 *bssid,
4795                                  const u8 *req_ie, size_t req_ie_len,
4796                                  const u8 *resp_ie, size_t resp_ie_len,
4797                                  u16 status, gfp_t gfp)
4798 {
4799         struct sk_buff *msg;
4800         void *hdr;
4801
4802         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4803         if (!msg)
4804                 return;
4805
4806         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4807         if (!hdr) {
4808                 nlmsg_free(msg);
4809                 return;
4810         }
4811
4812         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4813         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4814         if (bssid)
4815                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4816         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4817         if (req_ie)
4818                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4819         if (resp_ie)
4820                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4821
4822         if (genlmsg_end(msg, hdr) < 0) {
4823                 nlmsg_free(msg);
4824                 return;
4825         }
4826
4827         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4828                                 nl80211_mlme_mcgrp.id, gfp);
4829         return;
4830
4831  nla_put_failure:
4832         genlmsg_cancel(msg, hdr);
4833         nlmsg_free(msg);
4834
4835 }
4836
4837 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4838                          struct net_device *netdev, const u8 *bssid,
4839                          const u8 *req_ie, size_t req_ie_len,
4840                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4841 {
4842         struct sk_buff *msg;
4843         void *hdr;
4844
4845         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4846         if (!msg)
4847                 return;
4848
4849         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4850         if (!hdr) {
4851                 nlmsg_free(msg);
4852                 return;
4853         }
4854
4855         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4856         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4857         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4858         if (req_ie)
4859                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4860         if (resp_ie)
4861                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4862
4863         if (genlmsg_end(msg, hdr) < 0) {
4864                 nlmsg_free(msg);
4865                 return;
4866         }
4867
4868         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4869                                 nl80211_mlme_mcgrp.id, gfp);
4870         return;
4871
4872  nla_put_failure:
4873         genlmsg_cancel(msg, hdr);
4874         nlmsg_free(msg);
4875
4876 }
4877
4878 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4879                                struct net_device *netdev, u16 reason,
4880                                const u8 *ie, size_t ie_len, bool from_ap)
4881 {
4882         struct sk_buff *msg;
4883         void *hdr;
4884
4885         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4886         if (!msg)
4887                 return;
4888
4889         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4890         if (!hdr) {
4891                 nlmsg_free(msg);
4892                 return;
4893         }
4894
4895         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4896         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4897         if (from_ap && reason)
4898                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4899         if (from_ap)
4900                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4901         if (ie)
4902                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4903
4904         if (genlmsg_end(msg, hdr) < 0) {
4905                 nlmsg_free(msg);
4906                 return;
4907         }
4908
4909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4910                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
4911         return;
4912
4913  nla_put_failure:
4914         genlmsg_cancel(msg, hdr);
4915         nlmsg_free(msg);
4916
4917 }
4918
4919 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4920                              struct net_device *netdev, const u8 *bssid,
4921                              gfp_t gfp)
4922 {
4923         struct sk_buff *msg;
4924         void *hdr;
4925
4926         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4927         if (!msg)
4928                 return;
4929
4930         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4931         if (!hdr) {
4932                 nlmsg_free(msg);
4933                 return;
4934         }
4935
4936         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4937         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4938         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4939
4940         if (genlmsg_end(msg, hdr) < 0) {
4941                 nlmsg_free(msg);
4942                 return;
4943         }
4944
4945         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4946                                 nl80211_mlme_mcgrp.id, gfp);
4947         return;
4948
4949  nla_put_failure:
4950         genlmsg_cancel(msg, hdr);
4951         nlmsg_free(msg);
4952 }
4953
4954 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4955                                  struct net_device *netdev, const u8 *addr,
4956                                  enum nl80211_key_type key_type, int key_id,
4957                                  const u8 *tsc, gfp_t gfp)
4958 {
4959         struct sk_buff *msg;
4960         void *hdr;
4961
4962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4963         if (!msg)
4964                 return;
4965
4966         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4967         if (!hdr) {
4968                 nlmsg_free(msg);
4969                 return;
4970         }
4971
4972         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4973         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4974         if (addr)
4975                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4976         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4977         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4978         if (tsc)
4979                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4980
4981         if (genlmsg_end(msg, hdr) < 0) {
4982                 nlmsg_free(msg);
4983                 return;
4984         }
4985
4986         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4987                                 nl80211_mlme_mcgrp.id, gfp);
4988         return;
4989
4990  nla_put_failure:
4991         genlmsg_cancel(msg, hdr);
4992         nlmsg_free(msg);
4993 }
4994
4995 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4996                                     struct ieee80211_channel *channel_before,
4997                                     struct ieee80211_channel *channel_after)
4998 {
4999         struct sk_buff *msg;
5000         void *hdr;
5001         struct nlattr *nl_freq;
5002
5003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5004         if (!msg)
5005                 return;
5006
5007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5008         if (!hdr) {
5009                 nlmsg_free(msg);
5010                 return;
5011         }
5012
5013         /*
5014          * Since we are applying the beacon hint to a wiphy we know its
5015          * wiphy_idx is valid
5016          */
5017         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5018
5019         /* Before */
5020         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5021         if (!nl_freq)
5022                 goto nla_put_failure;
5023         if (nl80211_msg_put_channel(msg, channel_before))
5024                 goto nla_put_failure;
5025         nla_nest_end(msg, nl_freq);
5026
5027         /* After */
5028         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5029         if (!nl_freq)
5030                 goto nla_put_failure;
5031         if (nl80211_msg_put_channel(msg, channel_after))
5032                 goto nla_put_failure;
5033         nla_nest_end(msg, nl_freq);
5034
5035         if (genlmsg_end(msg, hdr) < 0) {
5036                 nlmsg_free(msg);
5037                 return;
5038         }
5039
5040         rcu_read_lock();
5041         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5042                                 GFP_ATOMIC);
5043         rcu_read_unlock();
5044
5045         return;
5046
5047 nla_put_failure:
5048         genlmsg_cancel(msg, hdr);
5049         nlmsg_free(msg);
5050 }
5051
5052 /* initialisation/exit functions */
5053
5054 int nl80211_init(void)
5055 {
5056         int err;
5057
5058         err = genl_register_family_with_ops(&nl80211_fam,
5059                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5060         if (err)
5061                 return err;
5062
5063         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5064         if (err)
5065                 goto err_out;
5066
5067         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5068         if (err)
5069                 goto err_out;
5070
5071         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5072         if (err)
5073                 goto err_out;
5074
5075         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5076         if (err)
5077                 goto err_out;
5078
5079 #ifdef CONFIG_NL80211_TESTMODE
5080         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5081         if (err)
5082                 goto err_out;
5083 #endif
5084
5085         return 0;
5086  err_out:
5087         genl_unregister_family(&nl80211_fam);
5088         return err;
5089 }
5090
5091 void nl80211_exit(void)
5092 {
5093         genl_unregister_family(&nl80211_fam);
5094 }