SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72
  73         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  74         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  76
  77         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  78         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79
  80         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  81         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  82                                     .len = WLAN_MAX_KEY_LEN },
  83         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  84         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  85         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  86         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  87
  88         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  89         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  90         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  91                                        .len = IEEE80211_MAX_DATA_LEN },
  92         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  95         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  96         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  98                                                .len = NL80211_MAX_SUPP_RATES },
  99         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 100         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 101         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 102         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 103                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 104         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 105
 106         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 107         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 108
 109         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 110         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 113                                            .len = NL80211_MAX_SUPP_RATES },
 114
 115         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 116
 117         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 118                                          .len = NL80211_HT_CAPABILITY_LEN },
 119
 120         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 122                               .len = IEEE80211_MAX_DATA_LEN },
 123         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 124         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 127                                 .len = IEEE80211_MAX_SSID_LEN },
 128         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 129         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 130         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_STA_FLAGS2] = {
 134                 .len = sizeof(struct nl80211_sta_flag_update),
 135         },
 136         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 139         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 140         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 141         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 142 };
 143
 144 /* policy for the attributes */
 145 static struct nla_policy
 146 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 147         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 148         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 149         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 150         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 151         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 152         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 153 };
 154
 155 /* ifidx get helper */
 156 static int nl80211_get_ifidx(struct netlink_callback *cb)
 157 {
 158         int res;
 159
 160         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 161                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 162                           nl80211_policy);
 163         if (res)
 164                 return res;
 165
 166         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 167                 return -EINVAL;
 168
 169         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 170         if (!res)
 171                 return -EINVAL;
 172         return res;
 173 }
 174
 175 /* IE validation */
 176 static bool is_valid_ie_attr(const struct nlattr *attr)
 177 {
 178         const u8 *pos;
 179         int len;
 180
 181         if (!attr)
 182                 return true;
 183
 184         pos = nla_data(attr);
 185         len = nla_len(attr);
 186
 187         while (len) {
 188                 u8 elemlen;
 189
 190                 if (len < 2)
 191                         return false;
 192                 len -= 2;
 193
 194                 elemlen = pos[1];
 195                 if (elemlen > len)
 196                         return false;
 197
 198                 len -= elemlen;
 199                 pos += 2 + elemlen;
 200         }
 201
 202         return true;
 203 }
 204
 205 /* message building helper */
 206 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 207                                    int flags, u8 cmd)
 208 {
 209         /* since there is no private header just add the generic one */
 210         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 211 }
 212
 213 static int nl80211_msg_put_channel(struct sk_buff *msg,
 214                                    struct ieee80211_channel *chan)
 215 {
 216         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 217                     chan->center_freq);
 218
 219         if (chan->flags & IEEE80211_CHAN_DISABLED)
 220                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 221         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 222                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 223         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 224                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 225         if (chan->flags & IEEE80211_CHAN_RADAR)
 226                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 227
 228         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 229                     DBM_TO_MBM(chan->max_power));
 230
 231         return 0;
 232
 233  nla_put_failure:
 234         return -ENOBUFS;
 235 }
 236
 237 /* netlink command implementations */
 238
 239 struct key_parse {
 240         struct key_params p;
 241         int idx;
 242         bool def, defmgmt;
 243 };
 244
 245 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 246 {
 247         struct nlattr *tb[NL80211_KEY_MAX + 1];
 248         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 249                                    nl80211_key_policy);
 250         if (err)
 251                 return err;
 252
 253         k->def = !!tb[NL80211_KEY_DEFAULT];
 254         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 255
 256         if (tb[NL80211_KEY_IDX])
 257                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 258
 259         if (tb[NL80211_KEY_DATA]) {
 260                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 261                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 262         }
 263
 264         if (tb[NL80211_KEY_SEQ]) {
 265                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 266                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 267         }
 268
 269         if (tb[NL80211_KEY_CIPHER])
 270                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 271
 272         return 0;
 273 }
 274
 275 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 276 {
 277         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 278                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 279                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 280         }
 281
 282         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 283                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 284                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 285         }
 286
 287         if (info->attrs[NL80211_ATTR_KEY_IDX])
 288                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 289
 290         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 291                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 292
 293         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 294         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 295
 296         return 0;
 297 }
 298
 299 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 300 {
 301         int err;
 302
 303         memset(k, 0, sizeof(*k));
 304         k->idx = -1;
 305
 306         if (info->attrs[NL80211_ATTR_KEY])
 307                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 308         else
 309                 err = nl80211_parse_key_old(info, k);
 310
 311         if (err)
 312                 return err;
 313
 314         if (k->def && k->defmgmt)
 315                 return -EINVAL;
 316
 317         if (k->idx != -1) {
 318                 if (k->defmgmt) {
 319                         if (k->idx < 4 || k->idx > 5)
 320                                 return -EINVAL;
 321                 } else if (k->def) {
 322                         if (k->idx < 0 || k->idx > 3)
 323                                 return -EINVAL;
 324                 } else {
 325                         if (k->idx < 0 || k->idx > 5)
 326                                 return -EINVAL;
 327                 }
 328         }
 329
 330         return 0;
 331 }
 332
 333 static struct cfg80211_cached_keys *
 334 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 335                        struct nlattr *keys)
 336 {
 337         struct key_parse parse;
 338         struct nlattr *key;
 339         struct cfg80211_cached_keys *result;
 340         int rem, err, def = 0;
 341
 342         result = kzalloc(sizeof(*result), GFP_KERNEL);
 343         if (!result)
 344                 return ERR_PTR(-ENOMEM);
 345
 346         result->def = -1;
 347         result->defmgmt = -1;
 348
 349         nla_for_each_nested(key, keys, rem) {
 350                 memset(&parse, 0, sizeof(parse));
 351                 parse.idx = -1;
 352
 353                 err = nl80211_parse_key_new(key, &parse);
 354                 if (err)
 355                         goto error;
 356                 err = -EINVAL;
 357                 if (!parse.p.key)
 358                         goto error;
 359                 if (parse.idx < 0 || parse.idx > 4)
 360                         goto error;
 361                 if (parse.def) {
 362                         if (def)
 363                                 goto error;
 364                         def = 1;
 365                         result->def = parse.idx;
 366                 } else if (parse.defmgmt)
 367                         goto error;
 368                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 369                                                      parse.idx, NULL);
 370                 if (err)
 371                         goto error;
 372                 result->params[parse.idx].cipher = parse.p.cipher;
 373                 result->params[parse.idx].key_len = parse.p.key_len;
 374                 result->params[parse.idx].key = result->data[parse.idx];
 375                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 376         }
 377
 378         return result;
 379  error:
 380         kfree(result);
 381         return ERR_PTR(err);
 382 }
 383
 384 static int nl80211_key_allowed(struct wireless_dev *wdev)
 385 {
 386         ASSERT_WDEV_LOCK(wdev);
 387
 388         if (!netif_running(wdev->netdev))
 389                 return -ENETDOWN;
 390
 391         switch (wdev->iftype) {
 392         case NL80211_IFTYPE_AP:
 393         case NL80211_IFTYPE_AP_VLAN:
 394                 break;
 395         case NL80211_IFTYPE_ADHOC:
 396                 if (!wdev->current_bss)
 397                         return -ENOLINK;
 398                 break;
 399         case NL80211_IFTYPE_STATION:
 400                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 401                         return -ENOLINK;
 402                 break;
 403         default:
 404                 return -EINVAL;
 405         }
 406
 407         return 0;
 408 }
 409
 410 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 411                               struct cfg80211_registered_device *dev)
 412 {
 413         void *hdr;
 414         struct nlattr *nl_bands, *nl_band;
 415         struct nlattr *nl_freqs, *nl_freq;
 416         struct nlattr *nl_rates, *nl_rate;
 417         struct nlattr *nl_modes;
 418         struct nlattr *nl_cmds;
 419         enum ieee80211_band band;
 420         struct ieee80211_channel *chan;
 421         struct ieee80211_rate *rate;
 422         int i;
 423         u16 ifmodes = dev->wiphy.interface_modes;
 424
 425         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 426         if (!hdr)
 427                 return -1;
 428
 429         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 430         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 431
 432         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 433                     cfg80211_rdev_list_generation);
 434
 435         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 436                    dev->wiphy.retry_short);
 437         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 438                    dev->wiphy.retry_long);
 439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 440                     dev->wiphy.frag_threshold);
 441         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 442                     dev->wiphy.rts_threshold);
 443
 444         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 445                    dev->wiphy.max_scan_ssids);
 446         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 447                     dev->wiphy.max_scan_ie_len);
 448
 449         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 450                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 451                 dev->wiphy.cipher_suites);
 452
 453         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 454         if (!nl_modes)
 455                 goto nla_put_failure;
 456
 457         i = 0;
 458         while (ifmodes) {
 459                 if (ifmodes & 1)
 460                         NLA_PUT_FLAG(msg, i);
 461                 ifmodes >>= 1;
 462                 i++;
 463         }
 464
 465         nla_nest_end(msg, nl_modes);
 466
 467         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 468         if (!nl_bands)
 469                 goto nla_put_failure;
 470
 471         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 472                 if (!dev->wiphy.bands[band])
 473                         continue;
 474
 475                 nl_band = nla_nest_start(msg, band);
 476                 if (!nl_band)
 477                         goto nla_put_failure;
 478
 479                 /* add HT info */
 480                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 481                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 482                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 483                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 484                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 485                                 dev->wiphy.bands[band]->ht_cap.cap);
 486                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 487                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 488                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 489                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 490                 }
 491
 492                 /* add frequencies */
 493                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 494                 if (!nl_freqs)
 495                         goto nla_put_failure;
 496
 497                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 498                         nl_freq = nla_nest_start(msg, i);
 499                         if (!nl_freq)
 500                                 goto nla_put_failure;
 501
 502                         chan = &dev->wiphy.bands[band]->channels[i];
 503
 504                         if (nl80211_msg_put_channel(msg, chan))
 505                                 goto nla_put_failure;
 506
 507                         nla_nest_end(msg, nl_freq);
 508                 }
 509
 510                 nla_nest_end(msg, nl_freqs);
 511
 512                 /* add bitrates */
 513                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 514                 if (!nl_rates)
 515                         goto nla_put_failure;
 516
 517                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 518                         nl_rate = nla_nest_start(msg, i);
 519                         if (!nl_rate)
 520                                 goto nla_put_failure;
 521
 522                         rate = &dev->wiphy.bands[band]->bitrates[i];
 523                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 524                                     rate->bitrate);
 525                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 526                                 NLA_PUT_FLAG(msg,
 527                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 528
 529                         nla_nest_end(msg, nl_rate);
 530                 }
 531
 532                 nla_nest_end(msg, nl_rates);
 533
 534                 nla_nest_end(msg, nl_band);
 535         }
 536         nla_nest_end(msg, nl_bands);
 537
 538         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 539         if (!nl_cmds)
 540                 goto nla_put_failure;
 541
 542         i = 0;
 543 #define CMD(op, n)                                              \
 544          do {                                                   \
 545                 if (dev->ops->op) {                             \
 546                         i++;                                    \
 547                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 548                 }                                               \
 549         } while (0)
 550
 551         CMD(add_virtual_intf, NEW_INTERFACE);
 552         CMD(change_virtual_intf, SET_INTERFACE);
 553         CMD(add_key, NEW_KEY);
 554         CMD(add_beacon, NEW_BEACON);
 555         CMD(add_station, NEW_STATION);
 556         CMD(add_mpath, NEW_MPATH);
 557         CMD(set_mesh_params, SET_MESH_PARAMS);
 558         CMD(change_bss, SET_BSS);
 559         CMD(auth, AUTHENTICATE);
 560         CMD(assoc, ASSOCIATE);
 561         CMD(deauth, DEAUTHENTICATE);
 562         CMD(disassoc, DISASSOCIATE);
 563         CMD(join_ibss, JOIN_IBSS);
 564         if (dev->wiphy.netnsok) {
 565                 i++;
 566                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 567         }
 568
 569 #undef CMD
 570
 571         if (dev->ops->connect || dev->ops->auth) {
 572                 i++;
 573                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 574         }
 575
 576         if (dev->ops->disconnect || dev->ops->deauth) {
 577                 i++;
 578                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 579         }
 580
 581         nla_nest_end(msg, nl_cmds);
 582
 583         return genlmsg_end(msg, hdr);
 584
 585  nla_put_failure:
 586         genlmsg_cancel(msg, hdr);
 587         return -EMSGSIZE;
 588 }
 589
 590 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 591 {
 592         int idx = 0;
 593         int start = cb->args[0];
 594         struct cfg80211_registered_device *dev;
 595
 596         mutex_lock(&cfg80211_mutex);
 597         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 598                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 599                         continue;
 600                 if (++idx <= start)
 601                         continue;
 602                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 603                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 604                                        dev) < 0) {
 605                         idx--;
 606                         break;
 607                 }
 608         }
 609         mutex_unlock(&cfg80211_mutex);
 610
 611         cb->args[0] = idx;
 612
 613         return skb->len;
 614 }
 615
 616 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 617 {
 618         struct sk_buff *msg;
 619         struct cfg80211_registered_device *dev;
 620
 621         dev = cfg80211_get_dev_from_info(info);
 622         if (IS_ERR(dev))
 623                 return PTR_ERR(dev);
 624
 625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 626         if (!msg)
 627                 goto out_err;
 628
 629         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 630                 goto out_free;
 631
 632         cfg80211_unlock_rdev(dev);
 633
 634         return genlmsg_reply(msg, info);
 635
 636  out_free:
 637         nlmsg_free(msg);
 638  out_err:
 639         cfg80211_unlock_rdev(dev);
 640         return -ENOBUFS;
 641 }
 642
 643 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 644         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 645         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 646         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 647         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 648         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 649 };
 650
 651 static int parse_txq_params(struct nlattr *tb[],
 652                             struct ieee80211_txq_params *txq_params)
 653 {
 654         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 655             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 656             !tb[NL80211_TXQ_ATTR_AIFS])
 657                 return -EINVAL;
 658
 659         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 660         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 661         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 662         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 663         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 664
 665         return 0;
 666 }
 667
 668 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 669 {
 670         struct cfg80211_registered_device *rdev;
 671         int result = 0, rem_txq_params = 0;
 672         struct nlattr *nl_txq_params;
 673         u32 changed;
 674         u8 retry_short = 0, retry_long = 0;
 675         u32 frag_threshold = 0, rts_threshold = 0;
 676
 677         rtnl_lock();
 678
 679         mutex_lock(&cfg80211_mutex);
 680
 681         rdev = __cfg80211_rdev_from_info(info);
 682         if (IS_ERR(rdev)) {
 683                 mutex_unlock(&cfg80211_mutex);
 684                 result = PTR_ERR(rdev);
 685                 goto unlock;
 686         }
 687
 688         mutex_lock(&rdev->mtx);
 689
 690         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 691                 result = cfg80211_dev_rename(
 692                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 693
 694         mutex_unlock(&cfg80211_mutex);
 695
 696         if (result)
 697                 goto bad_res;
 698
 699         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 700                 struct ieee80211_txq_params txq_params;
 701                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 702
 703                 if (!rdev->ops->set_txq_params) {
 704                         result = -EOPNOTSUPP;
 705                         goto bad_res;
 706                 }
 707
 708                 nla_for_each_nested(nl_txq_params,
 709                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 710                                     rem_txq_params) {
 711                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 712                                   nla_data(nl_txq_params),
 713                                   nla_len(nl_txq_params),
 714                                   txq_params_policy);
 715                         result = parse_txq_params(tb, &txq_params);
 716                         if (result)
 717                                 goto bad_res;
 718
 719                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 720                                                            &txq_params);
 721                         if (result)
 722                                 goto bad_res;
 723                 }
 724         }
 725
 726         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 727                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 728                 u32 freq;
 729
 730                 result = -EINVAL;
 731
 732                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 733                         channel_type = nla_get_u32(info->attrs[
 734                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 735                         if (channel_type != NL80211_CHAN_NO_HT &&
 736                             channel_type != NL80211_CHAN_HT20 &&
 737                             channel_type != NL80211_CHAN_HT40PLUS &&
 738                             channel_type != NL80211_CHAN_HT40MINUS)
 739                                 goto bad_res;
 740                 }
 741
 742                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 743
 744                 mutex_lock(&rdev->devlist_mtx);
 745                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 746                 mutex_unlock(&rdev->devlist_mtx);
 747                 if (result)
 748                         goto bad_res;
 749         }
 750
 751         changed = 0;
 752
 753         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 754                 retry_short = nla_get_u8(
 755                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 756                 if (retry_short == 0) {
 757                         result = -EINVAL;
 758                         goto bad_res;
 759                 }
 760                 changed |= WIPHY_PARAM_RETRY_SHORT;
 761         }
 762
 763         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 764                 retry_long = nla_get_u8(
 765                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 766                 if (retry_long == 0) {
 767                         result = -EINVAL;
 768                         goto bad_res;
 769                 }
 770                 changed |= WIPHY_PARAM_RETRY_LONG;
 771         }
 772
 773         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 774                 frag_threshold = nla_get_u32(
 775                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 776                 if (frag_threshold < 256) {
 777                         result = -EINVAL;
 778                         goto bad_res;
 779                 }
 780                 if (frag_threshold != (u32) -1) {
 781                         /*
 782                          * Fragments (apart from the last one) are required to
 783                          * have even length. Make the fragmentation code
 784                          * simpler by stripping LSB should someone try to use
 785                          * odd threshold value.
 786                          */
 787                         frag_threshold &= ~0x1;
 788                 }
 789                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 790         }
 791
 792         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 793                 rts_threshold = nla_get_u32(
 794                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 795                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 796         }
 797
 798         if (changed) {
 799                 u8 old_retry_short, old_retry_long;
 800                 u32 old_frag_threshold, old_rts_threshold;
 801
 802                 if (!rdev->ops->set_wiphy_params) {
 803                         result = -EOPNOTSUPP;
 804                         goto bad_res;
 805                 }
 806
 807                 old_retry_short = rdev->wiphy.retry_short;
 808                 old_retry_long = rdev->wiphy.retry_long;
 809                 old_frag_threshold = rdev->wiphy.frag_threshold;
 810                 old_rts_threshold = rdev->wiphy.rts_threshold;
 811
 812                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 813                         rdev->wiphy.retry_short = retry_short;
 814                 if (changed & WIPHY_PARAM_RETRY_LONG)
 815                         rdev->wiphy.retry_long = retry_long;
 816                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 817                         rdev->wiphy.frag_threshold = frag_threshold;
 818                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 819                         rdev->wiphy.rts_threshold = rts_threshold;
 820
 821                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 822                 if (result) {
 823                         rdev->wiphy.retry_short = old_retry_short;
 824                         rdev->wiphy.retry_long = old_retry_long;
 825                         rdev->wiphy.frag_threshold = old_frag_threshold;
 826                         rdev->wiphy.rts_threshold = old_rts_threshold;
 827                 }
 828         }
 829
 830  bad_res:
 831         mutex_unlock(&rdev->mtx);
 832  unlock:
 833         rtnl_unlock();
 834         return result;
 835 }
 836
 837
 838 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 839                               struct cfg80211_registered_device *rdev,
 840                               struct net_device *dev)
 841 {
 842         void *hdr;
 843
 844         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 845         if (!hdr)
 846                 return -1;
 847
 848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 849         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 850         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 851         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 852
 853         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 854                     rdev->devlist_generation ^
 855                         (cfg80211_rdev_list_generation << 2));
 856
 857         return genlmsg_end(msg, hdr);
 858
 859  nla_put_failure:
 860         genlmsg_cancel(msg, hdr);
 861         return -EMSGSIZE;
 862 }
 863
 864 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 865 {
 866         int wp_idx = 0;
 867         int if_idx = 0;
 868         int wp_start = cb->args[0];
 869         int if_start = cb->args[1];
 870         struct cfg80211_registered_device *rdev;
 871         struct wireless_dev *wdev;
 872
 873         mutex_lock(&cfg80211_mutex);
 874         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 875                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 876                         continue;
 877                 if (wp_idx < wp_start) {
 878                         wp_idx++;
 879                         continue;
 880                 }
 881                 if_idx = 0;
 882
 883                 mutex_lock(&rdev->devlist_mtx);
 884                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 885                         if (if_idx < if_start) {
 886                                 if_idx++;
 887                                 continue;
 888                         }
 889                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 890                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 891                                                rdev, wdev->netdev) < 0) {
 892                                 mutex_unlock(&rdev->devlist_mtx);
 893                                 goto out;
 894                         }
 895                         if_idx++;
 896                 }
 897                 mutex_unlock(&rdev->devlist_mtx);
 898
 899                 wp_idx++;
 900         }
 901  out:
 902         mutex_unlock(&cfg80211_mutex);
 903
 904         cb->args[0] = wp_idx;
 905         cb->args[1] = if_idx;
 906
 907         return skb->len;
 908 }
 909
 910 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 911 {
 912         struct sk_buff *msg;
 913         struct cfg80211_registered_device *dev;
 914         struct net_device *netdev;
 915         int err;
 916
 917         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 918         if (err)
 919                 return err;
 920
 921         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 922         if (!msg)
 923                 goto out_err;
 924
 925         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 926                                dev, netdev) < 0)
 927                 goto out_free;
 928
 929         dev_put(netdev);
 930         cfg80211_unlock_rdev(dev);
 931
 932         return genlmsg_reply(msg, info);
 933
 934  out_free:
 935         nlmsg_free(msg);
 936  out_err:
 937         dev_put(netdev);
 938         cfg80211_unlock_rdev(dev);
 939         return -ENOBUFS;
 940 }
 941
 942 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 943         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 944         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 945         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 946         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 947         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 948 };
 949
 950 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 951 {
 952         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 953         int flag;
 954
 955         *mntrflags = 0;
 956
 957         if (!nla)
 958                 return -EINVAL;
 959
 960         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 961                              nla, mntr_flags_policy))
 962                 return -EINVAL;
 963
 964         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 965                 if (flags[flag])
 966                         *mntrflags |= (1<<flag);
 967
 968         return 0;
 969 }
 970
 971 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 972 {
 973         struct cfg80211_registered_device *rdev;
 974         struct vif_params params;
 975         int err;
 976         enum nl80211_iftype otype, ntype;
 977         struct net_device *dev;
 978         u32 _flags, *flags = NULL;
 979         bool change = false;
 980
 981         memset(&params, 0, sizeof(params));
 982
 983         rtnl_lock();
 984
 985         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
 986         if (err)
 987                 goto unlock_rtnl;
 988
 989         otype = ntype = dev->ieee80211_ptr->iftype;
 990
 991         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 992                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 993                 if (otype != ntype)
 994                         change = true;
 995                 if (ntype > NL80211_IFTYPE_MAX) {
 996                         err = -EINVAL;
 997                         goto unlock;
 998                 }
 999         }
1000
1001         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1002                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1003                         err = -EINVAL;
1004                         goto unlock;
1005                 }
1006                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1007                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1008                 change = true;
1009         }
1010
1011         if (info->attrs[NL80211_ATTR_4ADDR]) {
1012                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1013                 change = true;
1014         } else {
1015                 params.use_4addr = -1;
1016         }
1017
1018         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1019                 if (ntype != NL80211_IFTYPE_MONITOR) {
1020                         err = -EINVAL;
1021                         goto unlock;
1022                 }
1023                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1024                                           &_flags);
1025                 if (err)
1026                         goto unlock;
1027
1028                 flags = &_flags;
1029                 change = true;
1030         }
1031
1032         if (change)
1033                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1034         else
1035                 err = 0;
1036
1037  unlock:
1038         dev_put(dev);
1039         cfg80211_unlock_rdev(rdev);
1040  unlock_rtnl:
1041         rtnl_unlock();
1042         return err;
1043 }
1044
1045 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1046 {
1047         struct cfg80211_registered_device *rdev;
1048         struct vif_params params;
1049         int err;
1050         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1051         u32 flags;
1052
1053         memset(&params, 0, sizeof(params));
1054
1055         if (!info->attrs[NL80211_ATTR_IFNAME])
1056                 return -EINVAL;
1057
1058         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1059                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1060                 if (type > NL80211_IFTYPE_MAX)
1061                         return -EINVAL;
1062         }
1063
1064         rtnl_lock();
1065
1066         rdev = cfg80211_get_dev_from_info(info);
1067         if (IS_ERR(rdev)) {
1068                 err = PTR_ERR(rdev);
1069                 goto unlock_rtnl;
1070         }
1071
1072         if (!rdev->ops->add_virtual_intf ||
1073             !(rdev->wiphy.interface_modes & (1 << type))) {
1074                 err = -EOPNOTSUPP;
1075                 goto unlock;
1076         }
1077
1078         if (type == NL80211_IFTYPE_MESH_POINT &&
1079             info->attrs[NL80211_ATTR_MESH_ID]) {
1080                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1081                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1082         }
1083
1084         if (info->attrs[NL80211_ATTR_4ADDR])
1085                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1086
1087         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1088                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1089                                   &flags);
1090         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1091                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1092                 type, err ? NULL : &flags, &params);
1093
1094  unlock:
1095         cfg80211_unlock_rdev(rdev);
1096  unlock_rtnl:
1097         rtnl_unlock();
1098         return err;
1099 }
1100
1101 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1102 {
1103         struct cfg80211_registered_device *rdev;
1104         int err;
1105         struct net_device *dev;
1106
1107         rtnl_lock();
1108
1109         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1110         if (err)
1111                 goto unlock_rtnl;
1112
1113         if (!rdev->ops->del_virtual_intf) {
1114                 err = -EOPNOTSUPP;
1115                 goto out;
1116         }
1117
1118         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1119
1120  out:
1121         cfg80211_unlock_rdev(rdev);
1122         dev_put(dev);
1123  unlock_rtnl:
1124         rtnl_unlock();
1125         return err;
1126 }
1127
1128 struct get_key_cookie {
1129         struct sk_buff *msg;
1130         int error;
1131         int idx;
1132 };
1133
1134 static void get_key_callback(void *c, struct key_params *params)
1135 {
1136         struct nlattr *key;
1137         struct get_key_cookie *cookie = c;
1138
1139         if (params->key)
1140                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1141                         params->key_len, params->key);
1142
1143         if (params->seq)
1144                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1145                         params->seq_len, params->seq);
1146
1147         if (params->cipher)
1148                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1149                             params->cipher);
1150
1151         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1152         if (!key)
1153                 goto nla_put_failure;
1154
1155         if (params->key)
1156                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1157                         params->key_len, params->key);
1158
1159         if (params->seq)
1160                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1161                         params->seq_len, params->seq);
1162
1163         if (params->cipher)
1164                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1165                             params->cipher);
1166
1167         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1168
1169         nla_nest_end(cookie->msg, key);
1170
1171         return;
1172  nla_put_failure:
1173         cookie->error = 1;
1174 }
1175
1176 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1177 {
1178         struct cfg80211_registered_device *rdev;
1179         int err;
1180         struct net_device *dev;
1181         u8 key_idx = 0;
1182         u8 *mac_addr = NULL;
1183         struct get_key_cookie cookie = {
1184                 .error = 0,
1185         };
1186         void *hdr;
1187         struct sk_buff *msg;
1188
1189         if (info->attrs[NL80211_ATTR_KEY_IDX])
1190                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1191
1192         if (key_idx > 5)
1193                 return -EINVAL;
1194
1195         if (info->attrs[NL80211_ATTR_MAC])
1196                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1197
1198         rtnl_lock();
1199
1200         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1201         if (err)
1202                 goto unlock_rtnl;
1203
1204         if (!rdev->ops->get_key) {
1205                 err = -EOPNOTSUPP;
1206                 goto out;
1207         }
1208
1209         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1210         if (!msg) {
1211                 err = -ENOMEM;
1212                 goto out;
1213         }
1214
1215         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1216                              NL80211_CMD_NEW_KEY);
1217
1218         if (IS_ERR(hdr)) {
1219                 err = PTR_ERR(hdr);
1220                 goto free_msg;
1221         }
1222
1223         cookie.msg = msg;
1224         cookie.idx = key_idx;
1225
1226         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1227         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1228         if (mac_addr)
1229                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1230
1231         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1232                                 &cookie, get_key_callback);
1233
1234         if (err)
1235                 goto free_msg;
1236
1237         if (cookie.error)
1238                 goto nla_put_failure;
1239
1240         genlmsg_end(msg, hdr);
1241         err = genlmsg_reply(msg, info);
1242         goto out;
1243
1244  nla_put_failure:
1245         err = -ENOBUFS;
1246  free_msg:
1247         nlmsg_free(msg);
1248  out:
1249         cfg80211_unlock_rdev(rdev);
1250         dev_put(dev);
1251  unlock_rtnl:
1252         rtnl_unlock();
1253
1254         return err;
1255 }
1256
1257 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1258 {
1259         struct cfg80211_registered_device *rdev;
1260         struct key_parse key;
1261         int err;
1262         struct net_device *dev;
1263         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1264                     u8 key_index);
1265
1266         err = nl80211_parse_key(info, &key);
1267         if (err)
1268                 return err;
1269
1270         if (key.idx < 0)
1271                 return -EINVAL;
1272
1273         /* only support setting default key */
1274         if (!key.def && !key.defmgmt)
1275                 return -EINVAL;
1276
1277         rtnl_lock();
1278
1279         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1280         if (err)
1281                 goto unlock_rtnl;
1282
1283         if (key.def)
1284                 func = rdev->ops->set_default_key;
1285         else
1286                 func = rdev->ops->set_default_mgmt_key;
1287
1288         if (!func) {
1289                 err = -EOPNOTSUPP;
1290                 goto out;
1291         }
1292
1293         wdev_lock(dev->ieee80211_ptr);
1294         err = nl80211_key_allowed(dev->ieee80211_ptr);
1295         if (!err)
1296                 err = func(&rdev->wiphy, dev, key.idx);
1297
1298 #ifdef CONFIG_CFG80211_WEXT
1299         if (!err) {
1300                 if (func == rdev->ops->set_default_key)
1301                         dev->ieee80211_ptr->wext.default_key = key.idx;
1302                 else
1303                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1304         }
1305 #endif
1306         wdev_unlock(dev->ieee80211_ptr);
1307
1308  out:
1309         cfg80211_unlock_rdev(rdev);
1310         dev_put(dev);
1311
1312  unlock_rtnl:
1313         rtnl_unlock();
1314
1315         return err;
1316 }
1317
1318 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1319 {
1320         struct cfg80211_registered_device *rdev;
1321         int err;
1322         struct net_device *dev;
1323         struct key_parse key;
1324         u8 *mac_addr = NULL;
1325
1326         err = nl80211_parse_key(info, &key);
1327         if (err)
1328                 return err;
1329
1330         if (!key.p.key)
1331                 return -EINVAL;
1332
1333         if (info->attrs[NL80211_ATTR_MAC])
1334                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1335
1336         rtnl_lock();
1337
1338         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1339         if (err)
1340                 goto unlock_rtnl;
1341
1342         if (!rdev->ops->add_key) {
1343                 err = -EOPNOTSUPP;
1344                 goto out;
1345         }
1346
1347         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1348                 err = -EINVAL;
1349                 goto out;
1350         }
1351
1352         wdev_lock(dev->ieee80211_ptr);
1353         err = nl80211_key_allowed(dev->ieee80211_ptr);
1354         if (!err)
1355                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1356                                          mac_addr, &key.p);
1357         wdev_unlock(dev->ieee80211_ptr);
1358
1359  out:
1360         cfg80211_unlock_rdev(rdev);
1361         dev_put(dev);
1362  unlock_rtnl:
1363         rtnl_unlock();
1364
1365         return err;
1366 }
1367
1368 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1369 {
1370         struct cfg80211_registered_device *rdev;
1371         int err;
1372         struct net_device *dev;
1373         u8 *mac_addr = NULL;
1374         struct key_parse key;
1375
1376         err = nl80211_parse_key(info, &key);
1377         if (err)
1378                 return err;
1379
1380         if (info->attrs[NL80211_ATTR_MAC])
1381                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1382
1383         rtnl_lock();
1384
1385         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1386         if (err)
1387                 goto unlock_rtnl;
1388
1389         if (!rdev->ops->del_key) {
1390                 err = -EOPNOTSUPP;
1391                 goto out;
1392         }
1393
1394         wdev_lock(dev->ieee80211_ptr);
1395         err = nl80211_key_allowed(dev->ieee80211_ptr);
1396         if (!err)
1397                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1398
1399 #ifdef CONFIG_CFG80211_WEXT
1400         if (!err) {
1401                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1402                         dev->ieee80211_ptr->wext.default_key = -1;
1403                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1404                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1405         }
1406 #endif
1407         wdev_unlock(dev->ieee80211_ptr);
1408
1409  out:
1410         cfg80211_unlock_rdev(rdev);
1411         dev_put(dev);
1412
1413  unlock_rtnl:
1414         rtnl_unlock();
1415
1416         return err;
1417 }
1418
1419 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1420 {
1421         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1422                     struct beacon_parameters *info);
1423         struct cfg80211_registered_device *rdev;
1424         int err;
1425         struct net_device *dev;
1426         struct beacon_parameters params;
1427         int haveinfo = 0;
1428
1429         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1430                 return -EINVAL;
1431
1432         rtnl_lock();
1433
1434         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1435         if (err)
1436                 goto unlock_rtnl;
1437
1438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1439                 err = -EOPNOTSUPP;
1440                 goto out;
1441         }
1442
1443         switch (info->genlhdr->cmd) {
1444         case NL80211_CMD_NEW_BEACON:
1445                 /* these are required for NEW_BEACON */
1446                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1447                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1448                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1449                         err = -EINVAL;
1450                         goto out;
1451                 }
1452
1453                 call = rdev->ops->add_beacon;
1454                 break;
1455         case NL80211_CMD_SET_BEACON:
1456                 call = rdev->ops->set_beacon;
1457                 break;
1458         default:
1459                 WARN_ON(1);
1460                 err = -EOPNOTSUPP;
1461                 goto out;
1462         }
1463
1464         if (!call) {
1465                 err = -EOPNOTSUPP;
1466                 goto out;
1467         }
1468
1469         memset(&params, 0, sizeof(params));
1470
1471         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1472                 params.interval =
1473                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1474                 haveinfo = 1;
1475         }
1476
1477         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1478                 params.dtim_period =
1479                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1480                 haveinfo = 1;
1481         }
1482
1483         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1484                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1485                 params.head_len =
1486                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1487                 haveinfo = 1;
1488         }
1489
1490         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1491                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1492                 params.tail_len =
1493                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1494                 haveinfo = 1;
1495         }
1496
1497         if (!haveinfo) {
1498                 err = -EINVAL;
1499                 goto out;
1500         }
1501
1502         err = call(&rdev->wiphy, dev, &params);
1503
1504  out:
1505         cfg80211_unlock_rdev(rdev);
1506         dev_put(dev);
1507  unlock_rtnl:
1508         rtnl_unlock();
1509
1510         return err;
1511 }
1512
1513 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1514 {
1515         struct cfg80211_registered_device *rdev;
1516         int err;
1517         struct net_device *dev;
1518
1519         rtnl_lock();
1520
1521         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1522         if (err)
1523                 goto unlock_rtnl;
1524
1525         if (!rdev->ops->del_beacon) {
1526                 err = -EOPNOTSUPP;
1527                 goto out;
1528         }
1529
1530         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1531                 err = -EOPNOTSUPP;
1532                 goto out;
1533         }
1534         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1535
1536  out:
1537         cfg80211_unlock_rdev(rdev);
1538         dev_put(dev);
1539  unlock_rtnl:
1540         rtnl_unlock();
1541
1542         return err;
1543 }
1544
1545 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1546         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1547         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1548         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1549         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1550 };
1551
1552 static int parse_station_flags(struct genl_info *info,
1553                                struct station_parameters *params)
1554 {
1555         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1556         struct nlattr *nla;
1557         int flag;
1558
1559         /*
1560          * Try parsing the new attribute first so userspace
1561          * can specify both for older kernels.
1562          */
1563         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1564         if (nla) {
1565                 struct nl80211_sta_flag_update *sta_flags;
1566
1567                 sta_flags = nla_data(nla);
1568                 params->sta_flags_mask = sta_flags->mask;
1569                 params->sta_flags_set = sta_flags->set;
1570                 if ((params->sta_flags_mask |
1571                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1572                         return -EINVAL;
1573                 return 0;
1574         }
1575
1576         /* if present, parse the old attribute */
1577
1578         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1579         if (!nla)
1580                 return 0;
1581
1582         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1583                              nla, sta_flags_policy))
1584                 return -EINVAL;
1585
1586         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1587         params->sta_flags_mask &= ~1;
1588
1589         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1590                 if (flags[flag])
1591                         params->sta_flags_set |= (1<<flag);
1592
1593         return 0;
1594 }
1595
1596 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1597 {
1598         int modulation, streams, bitrate;
1599
1600         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1601                 return rate->legacy;
1602
1603         /* the formula below does only work for MCS values smaller than 32 */
1604         if (rate->mcs >= 32)
1605                 return 0;
1606
1607         modulation = rate->mcs & 7;
1608         streams = (rate->mcs >> 3) + 1;
1609
1610         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1611                         13500000 : 6500000;
1612
1613         if (modulation < 4)
1614                 bitrate *= (modulation + 1);
1615         else if (modulation == 4)
1616                 bitrate *= (modulation + 2);
1617         else
1618                 bitrate *= (modulation + 3);
1619
1620         bitrate *= streams;
1621
1622         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1623                 bitrate = (bitrate / 9) * 10;
1624
1625         /* do NOT round down here */
1626         return (bitrate + 50000) / 100000;
1627 }
1628
1629 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1630                                 int flags, struct net_device *dev,
1631                                 u8 *mac_addr, struct station_info *sinfo)
1632 {
1633         void *hdr;
1634         struct nlattr *sinfoattr, *txrate;
1635         u16 bitrate;
1636
1637         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1638         if (!hdr)
1639                 return -1;
1640
1641         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1642         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1643
1644         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1645
1646         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1647         if (!sinfoattr)
1648                 goto nla_put_failure;
1649         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1650                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1651                             sinfo->inactive_time);
1652         if (sinfo->filled & STATION_INFO_RX_BYTES)
1653                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1654                             sinfo->rx_bytes);
1655         if (sinfo->filled & STATION_INFO_TX_BYTES)
1656                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1657                             sinfo->tx_bytes);
1658         if (sinfo->filled & STATION_INFO_LLID)
1659                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1660                             sinfo->llid);
1661         if (sinfo->filled & STATION_INFO_PLID)
1662                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1663                             sinfo->plid);
1664         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1665                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1666                             sinfo->plink_state);
1667         if (sinfo->filled & STATION_INFO_SIGNAL)
1668                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1669                            sinfo->signal);
1670         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1671                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1672                 if (!txrate)
1673                         goto nla_put_failure;
1674
1675                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1676                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1677                 if (bitrate > 0)
1678                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1679
1680                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1681                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1682                                     sinfo->txrate.mcs);
1683                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1684                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1685                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1686                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1687
1688                 nla_nest_end(msg, txrate);
1689         }
1690         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1691                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1692                             sinfo->rx_packets);
1693         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1694                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1695                             sinfo->tx_packets);
1696         nla_nest_end(msg, sinfoattr);
1697
1698         return genlmsg_end(msg, hdr);
1699
1700  nla_put_failure:
1701         genlmsg_cancel(msg, hdr);
1702         return -EMSGSIZE;
1703 }
1704
1705 static int nl80211_dump_station(struct sk_buff *skb,
1706                                 struct netlink_callback *cb)
1707 {
1708         struct station_info sinfo;
1709         struct cfg80211_registered_device *dev;
1710         struct net_device *netdev;
1711         u8 mac_addr[ETH_ALEN];
1712         int ifidx = cb->args[0];
1713         int sta_idx = cb->args[1];
1714         int err;
1715
1716         if (!ifidx)
1717                 ifidx = nl80211_get_ifidx(cb);
1718         if (ifidx < 0)
1719                 return ifidx;
1720
1721         rtnl_lock();
1722
1723         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1724         if (!netdev) {
1725                 err = -ENODEV;
1726                 goto out_rtnl;
1727         }
1728
1729         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1730         if (IS_ERR(dev)) {
1731                 err = PTR_ERR(dev);
1732                 goto out_rtnl;
1733         }
1734
1735         if (!dev->ops->dump_station) {
1736                 err = -EOPNOTSUPP;
1737                 goto out_err;
1738         }
1739
1740         while (1) {
1741                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1742                                              mac_addr, &sinfo);
1743                 if (err == -ENOENT)
1744                         break;
1745                 if (err)
1746                         goto out_err;
1747
1748                 if (nl80211_send_station(skb,
1749                                 NETLINK_CB(cb->skb).pid,
1750                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1751                                 netdev, mac_addr,
1752                                 &sinfo) < 0)
1753                         goto out;
1754
1755                 sta_idx++;
1756         }
1757
1758
1759  out:
1760         cb->args[1] = sta_idx;
1761         err = skb->len;
1762  out_err:
1763         cfg80211_unlock_rdev(dev);
1764  out_rtnl:
1765         rtnl_unlock();
1766
1767         return err;
1768 }
1769
1770 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1771 {
1772         struct cfg80211_registered_device *rdev;
1773         int err;
1774         struct net_device *dev;
1775         struct station_info sinfo;
1776         struct sk_buff *msg;
1777         u8 *mac_addr = NULL;
1778
1779         memset(&sinfo, 0, sizeof(sinfo));
1780
1781         if (!info->attrs[NL80211_ATTR_MAC])
1782                 return -EINVAL;
1783
1784         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1785
1786         rtnl_lock();
1787
1788         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1789         if (err)
1790                 goto out_rtnl;
1791
1792         if (!rdev->ops->get_station) {
1793                 err = -EOPNOTSUPP;
1794                 goto out;
1795         }
1796
1797         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1798         if (err)
1799                 goto out;
1800
1801         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1802         if (!msg)
1803                 goto out;
1804
1805         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1806                                  dev, mac_addr, &sinfo) < 0)
1807                 goto out_free;
1808
1809         err = genlmsg_reply(msg, info);
1810         goto out;
1811
1812  out_free:
1813         nlmsg_free(msg);
1814  out:
1815         cfg80211_unlock_rdev(rdev);
1816         dev_put(dev);
1817  out_rtnl:
1818         rtnl_unlock();
1819
1820         return err;
1821 }
1822
1823 /*
1824  * Get vlan interface making sure it is on the right wiphy.
1825  */
1826 static int get_vlan(struct genl_info *info,
1827                     struct cfg80211_registered_device *rdev,
1828                     struct net_device **vlan)
1829 {
1830         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1831         *vlan = NULL;
1832
1833         if (vlanattr) {
1834                 *vlan = dev_get_by_index(genl_info_net(info),
1835                                          nla_get_u32(vlanattr));
1836                 if (!*vlan)
1837                         return -ENODEV;
1838                 if (!(*vlan)->ieee80211_ptr)
1839                         return -EINVAL;
1840                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1841                         return -EINVAL;
1842         }
1843         return 0;
1844 }
1845
1846 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1847 {
1848         struct cfg80211_registered_device *rdev;
1849         int err;
1850         struct net_device *dev;
1851         struct station_parameters params;
1852         u8 *mac_addr = NULL;
1853
1854         memset(&params, 0, sizeof(params));
1855
1856         params.listen_interval = -1;
1857
1858         if (info->attrs[NL80211_ATTR_STA_AID])
1859                 return -EINVAL;
1860
1861         if (!info->attrs[NL80211_ATTR_MAC])
1862                 return -EINVAL;
1863
1864         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1865
1866         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1867                 params.supported_rates =
1868                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1869                 params.supported_rates_len =
1870                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1871         }
1872
1873         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1874                 params.listen_interval =
1875                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1876
1877         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1878                 params.ht_capa =
1879                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1880
1881         if (parse_station_flags(info, &params))
1882                 return -EINVAL;
1883
1884         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1885                 params.plink_action =
1886                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1887
1888         rtnl_lock();
1889
1890         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1891         if (err)
1892                 goto out_rtnl;
1893
1894         err = get_vlan(info, rdev, &params.vlan);
1895         if (err)
1896                 goto out;
1897
1898         /* validate settings */
1899         err = 0;
1900
1901         switch (dev->ieee80211_ptr->iftype) {
1902         case NL80211_IFTYPE_AP:
1903         case NL80211_IFTYPE_AP_VLAN:
1904                 /* disallow mesh-specific things */
1905                 if (params.plink_action)
1906                         err = -EINVAL;
1907                 break;
1908         case NL80211_IFTYPE_STATION:
1909                 /* disallow everything but AUTHORIZED flag */
1910                 if (params.plink_action)
1911                         err = -EINVAL;
1912                 if (params.vlan)
1913                         err = -EINVAL;
1914                 if (params.supported_rates)
1915                         err = -EINVAL;
1916                 if (params.ht_capa)
1917                         err = -EINVAL;
1918                 if (params.listen_interval >= 0)
1919                         err = -EINVAL;
1920                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1921                         err = -EINVAL;
1922                 break;
1923         case NL80211_IFTYPE_MESH_POINT:
1924                 /* disallow things mesh doesn't support */
1925                 if (params.vlan)
1926                         err = -EINVAL;
1927                 if (params.ht_capa)
1928                         err = -EINVAL;
1929                 if (params.listen_interval >= 0)
1930                         err = -EINVAL;
1931                 if (params.supported_rates)
1932                         err = -EINVAL;
1933                 if (params.sta_flags_mask)
1934                         err = -EINVAL;
1935                 break;
1936         default:
1937                 err = -EINVAL;
1938         }
1939
1940         if (err)
1941                 goto out;
1942
1943         if (!rdev->ops->change_station) {
1944                 err = -EOPNOTSUPP;
1945                 goto out;
1946         }
1947
1948         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1949
1950  out:
1951         if (params.vlan)
1952                 dev_put(params.vlan);
1953         cfg80211_unlock_rdev(rdev);
1954         dev_put(dev);
1955  out_rtnl:
1956         rtnl_unlock();
1957
1958         return err;
1959 }
1960
1961 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1962 {
1963         struct cfg80211_registered_device *rdev;
1964         int err;
1965         struct net_device *dev;
1966         struct station_parameters params;
1967         u8 *mac_addr = NULL;
1968
1969         memset(&params, 0, sizeof(params));
1970
1971         if (!info->attrs[NL80211_ATTR_MAC])
1972                 return -EINVAL;
1973
1974         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1975                 return -EINVAL;
1976
1977         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1978                 return -EINVAL;
1979
1980         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1981         params.supported_rates =
1982                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1983         params.supported_rates_len =
1984                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1985         params.listen_interval =
1986                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1987
1988         if (info->attrs[NL80211_ATTR_STA_AID]) {
1989                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1990                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1991                         return -EINVAL;
1992         }
1993
1994         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1995                 params.ht_capa =
1996                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1997
1998         if (parse_station_flags(info, &params))
1999                 return -EINVAL;
2000
2001         rtnl_lock();
2002
2003         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2004         if (err)
2005                 goto out_rtnl;
2006
2007         err = get_vlan(info, rdev, &params.vlan);
2008         if (err)
2009                 goto out;
2010
2011         /* validate settings */
2012         err = 0;
2013
2014         switch (dev->ieee80211_ptr->iftype) {
2015         case NL80211_IFTYPE_AP:
2016         case NL80211_IFTYPE_AP_VLAN:
2017                 /* all ok but must have AID */
2018                 if (!params.aid)
2019                         err = -EINVAL;
2020                 break;
2021         case NL80211_IFTYPE_MESH_POINT:
2022                 /* disallow things mesh doesn't support */
2023                 if (params.vlan)
2024                         err = -EINVAL;
2025                 if (params.aid)
2026                         err = -EINVAL;
2027                 if (params.ht_capa)
2028                         err = -EINVAL;
2029                 if (params.listen_interval >= 0)
2030                         err = -EINVAL;
2031                 if (params.supported_rates)
2032                         err = -EINVAL;
2033                 if (params.sta_flags_mask)
2034                         err = -EINVAL;
2035                 break;
2036         default:
2037                 err = -EINVAL;
2038         }
2039
2040         if (err)
2041                 goto out;
2042
2043         if (!rdev->ops->add_station) {
2044                 err = -EOPNOTSUPP;
2045                 goto out;
2046         }
2047
2048         if (!netif_running(dev)) {
2049                 err = -ENETDOWN;
2050                 goto out;
2051         }
2052
2053         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2054
2055  out:
2056         if (params.vlan)
2057                 dev_put(params.vlan);
2058         cfg80211_unlock_rdev(rdev);
2059         dev_put(dev);
2060  out_rtnl:
2061         rtnl_unlock();
2062
2063         return err;
2064 }
2065
2066 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2067 {
2068         struct cfg80211_registered_device *rdev;
2069         int err;
2070         struct net_device *dev;
2071         u8 *mac_addr = NULL;
2072
2073         if (info->attrs[NL80211_ATTR_MAC])
2074                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2075
2076         rtnl_lock();
2077
2078         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2079         if (err)
2080                 goto out_rtnl;
2081
2082         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2083             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2084             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2085                 err = -EINVAL;
2086                 goto out;
2087         }
2088
2089         if (!rdev->ops->del_station) {
2090                 err = -EOPNOTSUPP;
2091                 goto out;
2092         }
2093
2094         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2095
2096  out:
2097         cfg80211_unlock_rdev(rdev);
2098         dev_put(dev);
2099  out_rtnl:
2100         rtnl_unlock();
2101
2102         return err;
2103 }
2104
2105 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2106                                 int flags, struct net_device *dev,
2107                                 u8 *dst, u8 *next_hop,
2108                                 struct mpath_info *pinfo)
2109 {
2110         void *hdr;
2111         struct nlattr *pinfoattr;
2112
2113         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2114         if (!hdr)
2115                 return -1;
2116
2117         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2118         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2119         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2120
2121         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2122
2123         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2124         if (!pinfoattr)
2125                 goto nla_put_failure;
2126         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2127                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2128                             pinfo->frame_qlen);
2129         if (pinfo->filled & MPATH_INFO_SN)
2130                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2131                             pinfo->sn);
2132         if (pinfo->filled & MPATH_INFO_METRIC)
2133                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2134                             pinfo->metric);
2135         if (pinfo->filled & MPATH_INFO_EXPTIME)
2136                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2137                             pinfo->exptime);
2138         if (pinfo->filled & MPATH_INFO_FLAGS)
2139                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2140                             pinfo->flags);
2141         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2142                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2143                             pinfo->discovery_timeout);
2144         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2145                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2146                             pinfo->discovery_retries);
2147
2148         nla_nest_end(msg, pinfoattr);
2149
2150         return genlmsg_end(msg, hdr);
2151
2152  nla_put_failure:
2153         genlmsg_cancel(msg, hdr);
2154         return -EMSGSIZE;
2155 }
2156
2157 static int nl80211_dump_mpath(struct sk_buff *skb,
2158                               struct netlink_callback *cb)
2159 {
2160         struct mpath_info pinfo;
2161         struct cfg80211_registered_device *dev;
2162         struct net_device *netdev;
2163         u8 dst[ETH_ALEN];
2164         u8 next_hop[ETH_ALEN];
2165         int ifidx = cb->args[0];
2166         int path_idx = cb->args[1];
2167         int err;
2168
2169         if (!ifidx)
2170                 ifidx = nl80211_get_ifidx(cb);
2171         if (ifidx < 0)
2172                 return ifidx;
2173
2174         rtnl_lock();
2175
2176         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2177         if (!netdev) {
2178                 err = -ENODEV;
2179                 goto out_rtnl;
2180         }
2181
2182         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2183         if (IS_ERR(dev)) {
2184                 err = PTR_ERR(dev);
2185                 goto out_rtnl;
2186         }
2187
2188         if (!dev->ops->dump_mpath) {
2189                 err = -EOPNOTSUPP;
2190                 goto out_err;
2191         }
2192
2193         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2194                 err = -EOPNOTSUPP;
2195                 goto out_err;
2196         }
2197
2198         while (1) {
2199                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2200                                            dst, next_hop, &pinfo);
2201                 if (err == -ENOENT)
2202                         break;
2203                 if (err)
2204                         goto out_err;
2205
2206                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2207                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2208                                        netdev, dst, next_hop,
2209                                        &pinfo) < 0)
2210                         goto out;
2211
2212                 path_idx++;
2213         }
2214
2215
2216  out:
2217         cb->args[1] = path_idx;
2218         err = skb->len;
2219  out_err:
2220         cfg80211_unlock_rdev(dev);
2221  out_rtnl:
2222         rtnl_unlock();
2223
2224         return err;
2225 }
2226
2227 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2228 {
2229         struct cfg80211_registered_device *rdev;
2230         int err;
2231         struct net_device *dev;
2232         struct mpath_info pinfo;
2233         struct sk_buff *msg;
2234         u8 *dst = NULL;
2235         u8 next_hop[ETH_ALEN];
2236
2237         memset(&pinfo, 0, sizeof(pinfo));
2238
2239         if (!info->attrs[NL80211_ATTR_MAC])
2240                 return -EINVAL;
2241
2242         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2243
2244         rtnl_lock();
2245
2246         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2247         if (err)
2248                 goto out_rtnl;
2249
2250         if (!rdev->ops->get_mpath) {
2251                 err = -EOPNOTSUPP;
2252                 goto out;
2253         }
2254
2255         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2256                 err = -EOPNOTSUPP;
2257                 goto out;
2258         }
2259
2260         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2261         if (err)
2262                 goto out;
2263
2264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2265         if (!msg)
2266                 goto out;
2267
2268         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2269                                  dev, dst, next_hop, &pinfo) < 0)
2270                 goto out_free;
2271
2272         err = genlmsg_reply(msg, info);
2273         goto out;
2274
2275  out_free:
2276         nlmsg_free(msg);
2277  out:
2278         cfg80211_unlock_rdev(rdev);
2279         dev_put(dev);
2280  out_rtnl:
2281         rtnl_unlock();
2282
2283         return err;
2284 }
2285
2286 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2287 {
2288         struct cfg80211_registered_device *rdev;
2289         int err;
2290         struct net_device *dev;
2291         u8 *dst = NULL;
2292         u8 *next_hop = NULL;
2293
2294         if (!info->attrs[NL80211_ATTR_MAC])
2295                 return -EINVAL;
2296
2297         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2298                 return -EINVAL;
2299
2300         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2301         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2302
2303         rtnl_lock();
2304
2305         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2306         if (err)
2307                 goto out_rtnl;
2308
2309         if (!rdev->ops->change_mpath) {
2310                 err = -EOPNOTSUPP;
2311                 goto out;
2312         }
2313
2314         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2315                 err = -EOPNOTSUPP;
2316                 goto out;
2317         }
2318
2319         if (!netif_running(dev)) {
2320                 err = -ENETDOWN;
2321                 goto out;
2322         }
2323
2324         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2325
2326  out:
2327         cfg80211_unlock_rdev(rdev);
2328         dev_put(dev);
2329  out_rtnl:
2330         rtnl_unlock();
2331
2332         return err;
2333 }
2334 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2335 {
2336         struct cfg80211_registered_device *rdev;
2337         int err;
2338         struct net_device *dev;
2339         u8 *dst = NULL;
2340         u8 *next_hop = NULL;
2341
2342         if (!info->attrs[NL80211_ATTR_MAC])
2343                 return -EINVAL;
2344
2345         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2346                 return -EINVAL;
2347
2348         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2349         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2350
2351         rtnl_lock();
2352
2353         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2354         if (err)
2355                 goto out_rtnl;
2356
2357         if (!rdev->ops->add_mpath) {
2358                 err = -EOPNOTSUPP;
2359                 goto out;
2360         }
2361
2362         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2363                 err = -EOPNOTSUPP;
2364                 goto out;
2365         }
2366
2367         if (!netif_running(dev)) {
2368                 err = -ENETDOWN;
2369                 goto out;
2370         }
2371
2372         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2373
2374  out:
2375         cfg80211_unlock_rdev(rdev);
2376         dev_put(dev);
2377  out_rtnl:
2378         rtnl_unlock();
2379
2380         return err;
2381 }
2382
2383 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2384 {
2385         struct cfg80211_registered_device *rdev;
2386         int err;
2387         struct net_device *dev;
2388         u8 *dst = NULL;
2389
2390         if (info->attrs[NL80211_ATTR_MAC])
2391                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2392
2393         rtnl_lock();
2394
2395         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2396         if (err)
2397                 goto out_rtnl;
2398
2399         if (!rdev->ops->del_mpath) {
2400                 err = -EOPNOTSUPP;
2401                 goto out;
2402         }
2403
2404         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2405
2406  out:
2407         cfg80211_unlock_rdev(rdev);
2408         dev_put(dev);
2409  out_rtnl:
2410         rtnl_unlock();
2411
2412         return err;
2413 }
2414
2415 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2416 {
2417         struct cfg80211_registered_device *rdev;
2418         int err;
2419         struct net_device *dev;
2420         struct bss_parameters params;
2421
2422         memset(&params, 0, sizeof(params));
2423         /* default to not changing parameters */
2424         params.use_cts_prot = -1;
2425         params.use_short_preamble = -1;
2426         params.use_short_slot_time = -1;
2427
2428         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2429                 params.use_cts_prot =
2430                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2431         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2432                 params.use_short_preamble =
2433                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2434         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2435                 params.use_short_slot_time =
2436                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2437         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2438                 params.basic_rates =
2439                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2440                 params.basic_rates_len =
2441                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2442         }
2443
2444         rtnl_lock();
2445
2446         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2447         if (err)
2448                 goto out_rtnl;
2449
2450         if (!rdev->ops->change_bss) {
2451                 err = -EOPNOTSUPP;
2452                 goto out;
2453         }
2454
2455         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2456                 err = -EOPNOTSUPP;
2457                 goto out;
2458         }
2459
2460         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2461
2462  out:
2463         cfg80211_unlock_rdev(rdev);
2464         dev_put(dev);
2465  out_rtnl:
2466         rtnl_unlock();
2467
2468         return err;
2469 }
2470
2471 static const struct nla_policy
2472         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2473         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2474         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2475         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2476         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2477         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2478         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2479 };
2480
2481 static int parse_reg_rule(struct nlattr *tb[],
2482         struct ieee80211_reg_rule *reg_rule)
2483 {
2484         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2485         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2486
2487         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2488                 return -EINVAL;
2489         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2490                 return -EINVAL;
2491         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2492                 return -EINVAL;
2493         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2494                 return -EINVAL;
2495         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2496                 return -EINVAL;
2497
2498         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2499
2500         freq_range->start_freq_khz =
2501                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2502         freq_range->end_freq_khz =
2503                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2504         freq_range->max_bandwidth_khz =
2505                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2506
2507         power_rule->max_eirp =
2508                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2509
2510         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2511                 power_rule->max_antenna_gain =
2512                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2513
2514         return 0;
2515 }
2516
2517 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2518 {
2519         int r;
2520         char *data = NULL;
2521
2522         /*
2523          * You should only get this when cfg80211 hasn't yet initialized
2524          * completely when built-in to the kernel right between the time
2525          * window between nl80211_init() and regulatory_init(), if that is
2526          * even possible.
2527          */
2528         mutex_lock(&cfg80211_mutex);
2529         if (unlikely(!cfg80211_regdomain)) {
2530                 mutex_unlock(&cfg80211_mutex);
2531                 return -EINPROGRESS;
2532         }
2533         mutex_unlock(&cfg80211_mutex);
2534
2535         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2536                 return -EINVAL;
2537
2538         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2539
2540 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2541         /* We ignore world regdom requests with the old regdom setup */
2542         if (is_world_regdom(data))
2543                 return -EINVAL;
2544 #endif
2545
2546         r = regulatory_hint_user(data);
2547
2548         return r;
2549 }
2550
2551 static int nl80211_get_mesh_params(struct sk_buff *skb,
2552         struct genl_info *info)
2553 {
2554         struct cfg80211_registered_device *rdev;
2555         struct mesh_config cur_params;
2556         int err;
2557         struct net_device *dev;
2558         void *hdr;
2559         struct nlattr *pinfoattr;
2560         struct sk_buff *msg;
2561
2562         rtnl_lock();
2563
2564         /* Look up our device */
2565         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2566         if (err)
2567                 goto out_rtnl;
2568
2569         if (!rdev->ops->get_mesh_params) {
2570                 err = -EOPNOTSUPP;
2571                 goto out;
2572         }
2573
2574         /* Get the mesh params */
2575         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2576         if (err)
2577                 goto out;
2578
2579         /* Draw up a netlink message to send back */
2580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2581         if (!msg) {
2582                 err = -ENOBUFS;
2583                 goto out;
2584         }
2585         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2586                              NL80211_CMD_GET_MESH_PARAMS);
2587         if (!hdr)
2588                 goto nla_put_failure;
2589         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2590         if (!pinfoattr)
2591                 goto nla_put_failure;
2592         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2593         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2594                         cur_params.dot11MeshRetryTimeout);
2595         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2596                         cur_params.dot11MeshConfirmTimeout);
2597         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2598                         cur_params.dot11MeshHoldingTimeout);
2599         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2600                         cur_params.dot11MeshMaxPeerLinks);
2601         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2602                         cur_params.dot11MeshMaxRetries);
2603         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2604                         cur_params.dot11MeshTTL);
2605         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2606                         cur_params.auto_open_plinks);
2607         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2608                         cur_params.dot11MeshHWMPmaxPREQretries);
2609         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2610                         cur_params.path_refresh_time);
2611         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2612                         cur_params.min_discovery_timeout);
2613         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2614                         cur_params.dot11MeshHWMPactivePathTimeout);
2615         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2616                         cur_params.dot11MeshHWMPpreqMinInterval);
2617         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2618                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2619         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2620                         cur_params.dot11MeshHWMPRootMode);
2621         nla_nest_end(msg, pinfoattr);
2622         genlmsg_end(msg, hdr);
2623         err = genlmsg_reply(msg, info);
2624         goto out;
2625
2626  nla_put_failure:
2627         genlmsg_cancel(msg, hdr);
2628         err = -EMSGSIZE;
2629  out:
2630         /* Cleanup */
2631         cfg80211_unlock_rdev(rdev);
2632         dev_put(dev);
2633  out_rtnl:
2634         rtnl_unlock();
2635
2636         return err;
2637 }
2638
2639 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2640 do {\
2641         if (table[attr_num]) {\
2642                 cfg.param = nla_fn(table[attr_num]); \
2643                 mask |= (1 << (attr_num - 1)); \
2644         } \
2645 } while (0);\
2646
2647 static struct nla_policy
2648 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2649         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2650         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2651         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2652         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2653         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2654         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2655         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2656
2657         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2658         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2659         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2661         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2663 };
2664
2665 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2666 {
2667         int err;
2668         u32 mask;
2669         struct cfg80211_registered_device *rdev;
2670         struct net_device *dev;
2671         struct mesh_config cfg;
2672         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2673         struct nlattr *parent_attr;
2674
2675         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2676         if (!parent_attr)
2677                 return -EINVAL;
2678         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2679                         parent_attr, nl80211_meshconf_params_policy))
2680                 return -EINVAL;
2681
2682         rtnl_lock();
2683
2684         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2685         if (err)
2686                 goto out_rtnl;
2687
2688         if (!rdev->ops->set_mesh_params) {
2689                 err = -EOPNOTSUPP;
2690                 goto out;
2691         }
2692
2693         /* This makes sure that there aren't more than 32 mesh config
2694          * parameters (otherwise our bitfield scheme would not work.) */
2695         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2696
2697         /* Fill in the params struct */
2698         mask = 0;
2699         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2700                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2701         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2702                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2703         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2704                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2705         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2706                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2708                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2710                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2712                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2714                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2715                         nla_get_u8);
2716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2717                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2719                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2720                         nla_get_u16);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2722                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2723                         nla_get_u32);
2724         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2725                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2726                         nla_get_u16);
2727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2728                         dot11MeshHWMPnetDiameterTraversalTime,
2729                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2730                         nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2732                         dot11MeshHWMPRootMode, mask,
2733                         NL80211_MESHCONF_HWMP_ROOTMODE,
2734                         nla_get_u8);
2735
2736         /* Apply changes */
2737         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2738
2739  out:
2740         /* cleanup */
2741         cfg80211_unlock_rdev(rdev);
2742         dev_put(dev);
2743  out_rtnl:
2744         rtnl_unlock();
2745
2746         return err;
2747 }
2748
2749 #undef FILL_IN_MESH_PARAM_IF_SET
2750
2751 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2752 {
2753         struct sk_buff *msg;
2754         void *hdr = NULL;
2755         struct nlattr *nl_reg_rules;
2756         unsigned int i;
2757         int err = -EINVAL;
2758
2759         mutex_lock(&cfg80211_mutex);
2760
2761         if (!cfg80211_regdomain)
2762                 goto out;
2763
2764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2765         if (!msg) {
2766                 err = -ENOBUFS;
2767                 goto out;
2768         }
2769
2770         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2771                              NL80211_CMD_GET_REG);
2772         if (!hdr)
2773                 goto nla_put_failure;
2774
2775         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2776                 cfg80211_regdomain->alpha2);
2777
2778         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2779         if (!nl_reg_rules)
2780                 goto nla_put_failure;
2781
2782         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2783                 struct nlattr *nl_reg_rule;
2784                 const struct ieee80211_reg_rule *reg_rule;
2785                 const struct ieee80211_freq_range *freq_range;
2786                 const struct ieee80211_power_rule *power_rule;
2787
2788                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2789                 freq_range = &reg_rule->freq_range;
2790                 power_rule = &reg_rule->power_rule;
2791
2792                 nl_reg_rule = nla_nest_start(msg, i);
2793                 if (!nl_reg_rule)
2794                         goto nla_put_failure;
2795
2796                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2797                         reg_rule->flags);
2798                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2799                         freq_range->start_freq_khz);
2800                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2801                         freq_range->end_freq_khz);
2802                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2803                         freq_range->max_bandwidth_khz);
2804                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2805                         power_rule->max_antenna_gain);
2806                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2807                         power_rule->max_eirp);
2808
2809                 nla_nest_end(msg, nl_reg_rule);
2810         }
2811
2812         nla_nest_end(msg, nl_reg_rules);
2813
2814         genlmsg_end(msg, hdr);
2815         err = genlmsg_reply(msg, info);
2816         goto out;
2817
2818 nla_put_failure:
2819         genlmsg_cancel(msg, hdr);
2820         err = -EMSGSIZE;
2821 out:
2822         mutex_unlock(&cfg80211_mutex);
2823         return err;
2824 }
2825
2826 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2827 {
2828         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2829         struct nlattr *nl_reg_rule;
2830         char *alpha2 = NULL;
2831         int rem_reg_rules = 0, r = 0;
2832         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2833         struct ieee80211_regdomain *rd = NULL;
2834
2835         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2836                 return -EINVAL;
2837
2838         if (!info->attrs[NL80211_ATTR_REG_RULES])
2839                 return -EINVAL;
2840
2841         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2842
2843         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2844                         rem_reg_rules) {
2845                 num_rules++;
2846                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2847                         return -EINVAL;
2848         }
2849
2850         mutex_lock(&cfg80211_mutex);
2851
2852         if (!reg_is_valid_request(alpha2)) {
2853                 r = -EINVAL;
2854                 goto bad_reg;
2855         }
2856
2857         size_of_regd = sizeof(struct ieee80211_regdomain) +
2858                 (num_rules * sizeof(struct ieee80211_reg_rule));
2859
2860         rd = kzalloc(size_of_regd, GFP_KERNEL);
2861         if (!rd) {
2862                 r = -ENOMEM;
2863                 goto bad_reg;
2864         }
2865
2866         rd->n_reg_rules = num_rules;
2867         rd->alpha2[0] = alpha2[0];
2868         rd->alpha2[1] = alpha2[1];
2869
2870         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2871                         rem_reg_rules) {
2872                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2873                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2874                         reg_rule_policy);
2875                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2876                 if (r)
2877                         goto bad_reg;
2878
2879                 rule_idx++;
2880
2881                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2882                         r = -EINVAL;
2883                         goto bad_reg;
2884                 }
2885         }
2886
2887         BUG_ON(rule_idx != num_rules);
2888
2889         r = set_regdom(rd);
2890
2891         mutex_unlock(&cfg80211_mutex);
2892
2893         return r;
2894
2895  bad_reg:
2896         mutex_unlock(&cfg80211_mutex);
2897         kfree(rd);
2898         return r;
2899 }
2900
2901 static int validate_scan_freqs(struct nlattr *freqs)
2902 {
2903         struct nlattr *attr1, *attr2;
2904         int n_channels = 0, tmp1, tmp2;
2905
2906         nla_for_each_nested(attr1, freqs, tmp1) {
2907                 n_channels++;
2908                 /*
2909                  * Some hardware has a limited channel list for
2910                  * scanning, and it is pretty much nonsensical
2911                  * to scan for a channel twice, so disallow that
2912                  * and don't require drivers to check that the
2913                  * channel list they get isn't longer than what
2914                  * they can scan, as long as they can scan all
2915                  * the channels they registered at once.
2916                  */
2917                 nla_for_each_nested(attr2, freqs, tmp2)
2918                         if (attr1 != attr2 &&
2919                             nla_get_u32(attr1) == nla_get_u32(attr2))
2920                                 return 0;
2921         }
2922
2923         return n_channels;
2924 }
2925
2926 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2927 {
2928         struct cfg80211_registered_device *rdev;
2929         struct net_device *dev;
2930         struct cfg80211_scan_request *request;
2931         struct cfg80211_ssid *ssid;
2932         struct ieee80211_channel *channel;
2933         struct nlattr *attr;
2934         struct wiphy *wiphy;
2935         int err, tmp, n_ssids = 0, n_channels, i;
2936         enum ieee80211_band band;
2937         size_t ie_len;
2938
2939         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2940                 return -EINVAL;
2941
2942         rtnl_lock();
2943
2944         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2945         if (err)
2946                 goto out_rtnl;
2947
2948         wiphy = &rdev->wiphy;
2949
2950         if (!rdev->ops->scan) {
2951                 err = -EOPNOTSUPP;
2952                 goto out;
2953         }
2954
2955         if (!netif_running(dev)) {
2956                 err = -ENETDOWN;
2957                 goto out;
2958         }
2959
2960         if (rdev->scan_req) {
2961                 err = -EBUSY;
2962                 goto out;
2963         }
2964
2965         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2966                 n_channels = validate_scan_freqs(
2967                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2968                 if (!n_channels) {
2969                         err = -EINVAL;
2970                         goto out;
2971                 }
2972         } else {
2973                 n_channels = 0;
2974
2975                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2976                         if (wiphy->bands[band])
2977                                 n_channels += wiphy->bands[band]->n_channels;
2978         }
2979
2980         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2981                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2982                         n_ssids++;
2983
2984         if (n_ssids > wiphy->max_scan_ssids) {
2985                 err = -EINVAL;
2986                 goto out;
2987         }
2988
2989         if (info->attrs[NL80211_ATTR_IE])
2990                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2991         else
2992                 ie_len = 0;
2993
2994         if (ie_len > wiphy->max_scan_ie_len) {
2995                 err = -EINVAL;
2996                 goto out;
2997         }
2998
2999         request = kzalloc(sizeof(*request)
3000                         + sizeof(*ssid) * n_ssids
3001                         + sizeof(channel) * n_channels
3002                         + ie_len, GFP_KERNEL);
3003         if (!request) {
3004                 err = -ENOMEM;
3005                 goto out;
3006         }
3007
3008         if (n_ssids)
3009                 request->ssids = (void *)&request->channels[n_channels];
3010         request->n_ssids = n_ssids;
3011         if (ie_len) {
3012                 if (request->ssids)
3013                         request->ie = (void *)(request->ssids + n_ssids);
3014                 else
3015                         request->ie = (void *)(request->channels + n_channels);
3016         }
3017
3018         i = 0;
3019         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3020                 /* user specified, bail out if channel not found */
3021                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3022                         struct ieee80211_channel *chan;
3023
3024                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3025
3026                         if (!chan) {
3027                                 err = -EINVAL;
3028                                 goto out_free;
3029                         }
3030
3031                         /* ignore disabled channels */
3032                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3033                                 continue;
3034
3035                         request->channels[i] = chan;
3036                         i++;
3037                 }
3038         } else {
3039                 /* all channels */
3040                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3041                         int j;
3042                         if (!wiphy->bands[band])
3043                                 continue;
3044                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3045                                 struct ieee80211_channel *chan;
3046
3047                                 chan = &wiphy->bands[band]->channels[j];
3048
3049                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3050                                         continue;
3051
3052                                 request->channels[i] = chan;
3053                                 i++;
3054                         }
3055                 }
3056         }
3057
3058         if (!i) {
3059                 err = -EINVAL;
3060                 goto out_free;
3061         }
3062
3063         request->n_channels = i;
3064
3065         i = 0;
3066         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3067                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3068                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3069                                 err = -EINVAL;
3070                                 goto out_free;
3071                         }
3072                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3073                         request->ssids[i].ssid_len = nla_len(attr);
3074                         i++;
3075                 }
3076         }
3077
3078         if (info->attrs[NL80211_ATTR_IE]) {
3079                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3080                 memcpy((void *)request->ie,
3081                        nla_data(info->attrs[NL80211_ATTR_IE]),
3082                        request->ie_len);
3083         }
3084
3085         request->dev = dev;
3086         request->wiphy = &rdev->wiphy;
3087
3088         rdev->scan_req = request;
3089         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3090
3091         if (!err) {
3092                 nl80211_send_scan_start(rdev, dev);
3093                 dev_hold(dev);
3094         }
3095
3096  out_free:
3097         if (err) {
3098                 rdev->scan_req = NULL;
3099                 kfree(request);
3100         }
3101  out:
3102         cfg80211_unlock_rdev(rdev);
3103         dev_put(dev);
3104  out_rtnl:
3105         rtnl_unlock();
3106
3107         return err;
3108 }
3109
3110 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3111                             struct cfg80211_registered_device *rdev,
3112                             struct wireless_dev *wdev,
3113                             struct cfg80211_internal_bss *intbss)
3114 {
3115         struct cfg80211_bss *res = &intbss->pub;
3116         void *hdr;
3117         struct nlattr *bss;
3118         int i;
3119
3120         ASSERT_WDEV_LOCK(wdev);
3121
3122         hdr = nl80211hdr_put(msg, pid, seq, flags,
3123                              NL80211_CMD_NEW_SCAN_RESULTS);
3124         if (!hdr)
3125                 return -1;
3126
3127         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3128         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3129
3130         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3131         if (!bss)
3132                 goto nla_put_failure;
3133         if (!is_zero_ether_addr(res->bssid))
3134                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3135         if (res->information_elements && res->len_information_elements)
3136                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3137                         res->len_information_elements,
3138                         res->information_elements);
3139         if (res->tsf)
3140                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3141         if (res->beacon_interval)
3142                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3143         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3144         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3145         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3146                 jiffies_to_msecs(jiffies - intbss->ts));
3147
3148         switch (rdev->wiphy.signal_type) {
3149         case CFG80211_SIGNAL_TYPE_MBM:
3150                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3151                 break;
3152         case CFG80211_SIGNAL_TYPE_UNSPEC:
3153                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3154                 break;
3155         default:
3156                 break;
3157         }
3158
3159         switch (wdev->iftype) {
3160         case NL80211_IFTYPE_STATION:
3161                 if (intbss == wdev->current_bss)
3162                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3163                                     NL80211_BSS_STATUS_ASSOCIATED);
3164                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3165                         if (intbss != wdev->auth_bsses[i])
3166                                 continue;
3167                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3168                                     NL80211_BSS_STATUS_AUTHENTICATED);
3169                         break;
3170                 }
3171                 break;
3172         case NL80211_IFTYPE_ADHOC:
3173                 if (intbss == wdev->current_bss)
3174                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3175                                     NL80211_BSS_STATUS_IBSS_JOINED);
3176                 break;
3177         default:
3178                 break;
3179         }
3180
3181         nla_nest_end(msg, bss);
3182
3183         return genlmsg_end(msg, hdr);
3184
3185  nla_put_failure:
3186         genlmsg_cancel(msg, hdr);
3187         return -EMSGSIZE;
3188 }
3189
3190 static int nl80211_dump_scan(struct sk_buff *skb,
3191                              struct netlink_callback *cb)
3192 {
3193         struct cfg80211_registered_device *rdev;
3194         struct net_device *dev;
3195         struct cfg80211_internal_bss *scan;
3196         struct wireless_dev *wdev;
3197         int ifidx = cb->args[0];
3198         int start = cb->args[1], idx = 0;
3199         int err;
3200
3201         if (!ifidx)
3202                 ifidx = nl80211_get_ifidx(cb);
3203         if (ifidx < 0)
3204                 return ifidx;
3205         cb->args[0] = ifidx;
3206
3207         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3208         if (!dev)
3209                 return -ENODEV;
3210
3211         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3212         if (IS_ERR(rdev)) {
3213                 err = PTR_ERR(rdev);
3214                 goto out_put_netdev;
3215         }
3216
3217         wdev = dev->ieee80211_ptr;
3218
3219         wdev_lock(wdev);
3220         spin_lock_bh(&rdev->bss_lock);
3221         cfg80211_bss_expire(rdev);
3222
3223         list_for_each_entry(scan, &rdev->bss_list, list) {
3224                 if (++idx <= start)
3225                         continue;
3226                 if (nl80211_send_bss(skb,
3227                                 NETLINK_CB(cb->skb).pid,
3228                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3229                                 rdev, wdev, scan) < 0) {
3230                         idx--;
3231                         goto out;
3232                 }
3233         }
3234
3235  out:
3236         spin_unlock_bh(&rdev->bss_lock);
3237         wdev_unlock(wdev);
3238
3239         cb->args[1] = idx;
3240         err = skb->len;
3241         cfg80211_unlock_rdev(rdev);
3242  out_put_netdev:
3243         dev_put(dev);
3244
3245         return err;
3246 }
3247
3248 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3249 {
3250         return auth_type <= NL80211_AUTHTYPE_MAX;
3251 }
3252
3253 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3254 {
3255         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3256                                   NL80211_WPA_VERSION_2));
3257 }
3258
3259 static bool nl80211_valid_akm_suite(u32 akm)
3260 {
3261         return akm == WLAN_AKM_SUITE_8021X ||
3262                 akm == WLAN_AKM_SUITE_PSK;
3263 }
3264
3265 static bool nl80211_valid_cipher_suite(u32 cipher)
3266 {
3267         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3268                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3269                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3270                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3271                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3272 }
3273
3274
3275 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3276 {
3277         struct cfg80211_registered_device *rdev;
3278         struct net_device *dev;
3279         struct ieee80211_channel *chan;
3280         const u8 *bssid, *ssid, *ie = NULL;
3281         int err, ssid_len, ie_len = 0;
3282         enum nl80211_auth_type auth_type;
3283         struct key_parse key;
3284
3285         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3286                 return -EINVAL;
3287
3288         if (!info->attrs[NL80211_ATTR_MAC])
3289                 return -EINVAL;
3290
3291         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3292                 return -EINVAL;
3293
3294         if (!info->attrs[NL80211_ATTR_SSID])
3295                 return -EINVAL;
3296
3297         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3298                 return -EINVAL;
3299
3300         err = nl80211_parse_key(info, &key);
3301         if (err)
3302                 return err;
3303
3304         if (key.idx >= 0) {
3305                 if (!key.p.key || !key.p.key_len)
3306                         return -EINVAL;
3307                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3308                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3309                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3310                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3311                         return -EINVAL;
3312                 if (key.idx > 4)
3313                         return -EINVAL;
3314         } else {
3315                 key.p.key_len = 0;
3316                 key.p.key = NULL;
3317         }
3318
3319         rtnl_lock();
3320
3321         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3322         if (err)
3323                 goto unlock_rtnl;
3324
3325         if (!rdev->ops->auth) {
3326                 err = -EOPNOTSUPP;
3327                 goto out;
3328         }
3329
3330         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3331                 err = -EOPNOTSUPP;
3332                 goto out;
3333         }
3334
3335         if (!netif_running(dev)) {
3336                 err = -ENETDOWN;
3337                 goto out;
3338         }
3339
3340         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3341         chan = ieee80211_get_channel(&rdev->wiphy,
3342                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3343         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3344                 err = -EINVAL;
3345                 goto out;
3346         }
3347
3348         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3349         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3350
3351         if (info->attrs[NL80211_ATTR_IE]) {
3352                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3353                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3354         }
3355
3356         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3357         if (!nl80211_valid_auth_type(auth_type)) {
3358                 err = -EINVAL;
3359                 goto out;
3360         }
3361
3362         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3363                                  ssid, ssid_len, ie, ie_len,
3364                                  key.p.key, key.p.key_len, key.idx);
3365
3366 out:
3367         cfg80211_unlock_rdev(rdev);
3368         dev_put(dev);
3369 unlock_rtnl:
3370         rtnl_unlock();
3371         return err;
3372 }
3373
3374 static int nl80211_crypto_settings(struct genl_info *info,
3375                                    struct cfg80211_crypto_settings *settings,
3376                                    int cipher_limit)
3377 {
3378         memset(settings, 0, sizeof(*settings));
3379
3380         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3381
3382         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3383                 void *data;
3384                 int len, i;
3385
3386                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3387                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3388                 settings->n_ciphers_pairwise = len / sizeof(u32);
3389
3390                 if (len % sizeof(u32))
3391                         return -EINVAL;
3392
3393                 if (settings->n_ciphers_pairwise > cipher_limit)
3394                         return -EINVAL;
3395
3396                 memcpy(settings->ciphers_pairwise, data, len);
3397
3398                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3399                         if (!nl80211_valid_cipher_suite(
3400                                         settings->ciphers_pairwise[i]))
3401                                 return -EINVAL;
3402         }
3403
3404         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3405                 settings->cipher_group =
3406                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3407                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3408                         return -EINVAL;
3409         }
3410
3411         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3412                 settings->wpa_versions =
3413                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3414                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3415                         return -EINVAL;
3416         }
3417
3418         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3419                 void *data;
3420                 int len, i;
3421
3422                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3423                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3424                 settings->n_akm_suites = len / sizeof(u32);
3425
3426                 if (len % sizeof(u32))
3427                         return -EINVAL;
3428
3429                 memcpy(settings->akm_suites, data, len);
3430
3431                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3432                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3433                                 return -EINVAL;
3434         }
3435
3436         return 0;
3437 }
3438
3439 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3440 {
3441         struct cfg80211_registered_device *rdev;
3442         struct net_device *dev;
3443         struct cfg80211_crypto_settings crypto;
3444         struct ieee80211_channel *chan, *fixedchan;
3445         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3446         int err, ssid_len, ie_len = 0;
3447         bool use_mfp = false;
3448
3449         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3450                 return -EINVAL;
3451
3452         if (!info->attrs[NL80211_ATTR_MAC] ||
3453             !info->attrs[NL80211_ATTR_SSID] ||
3454             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3455                 return -EINVAL;
3456
3457         rtnl_lock();
3458
3459         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3460         if (err)
3461                 goto unlock_rtnl;
3462
3463         if (!rdev->ops->assoc) {
3464                 err = -EOPNOTSUPP;
3465                 goto out;
3466         }
3467
3468         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3469                 err = -EOPNOTSUPP;
3470                 goto out;
3471         }
3472
3473         if (!netif_running(dev)) {
3474                 err = -ENETDOWN;
3475                 goto out;
3476         }
3477
3478         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3479
3480         chan = ieee80211_get_channel(&rdev->wiphy,
3481                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3482         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3483                 err = -EINVAL;
3484                 goto out;
3485         }
3486
3487         mutex_lock(&rdev->devlist_mtx);
3488         fixedchan = rdev_fixed_channel(rdev, NULL);
3489         if (fixedchan && chan != fixedchan) {
3490                 err = -EBUSY;
3491                 mutex_unlock(&rdev->devlist_mtx);
3492                 goto out;
3493         }
3494         mutex_unlock(&rdev->devlist_mtx);
3495
3496         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3497         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3498
3499         if (info->attrs[NL80211_ATTR_IE]) {
3500                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3501                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3502         }
3503
3504         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3505                 enum nl80211_mfp mfp =
3506                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3507                 if (mfp == NL80211_MFP_REQUIRED)
3508                         use_mfp = true;
3509                 else if (mfp != NL80211_MFP_NO) {
3510                         err = -EINVAL;
3511                         goto out;
3512                 }
3513         }
3514
3515         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3516                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3517
3518         err = nl80211_crypto_settings(info, &crypto, 1);
3519         if (!err)
3520                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3521                                           ssid, ssid_len, ie, ie_len, use_mfp,
3522                                           &crypto);
3523
3524 out:
3525         cfg80211_unlock_rdev(rdev);
3526         dev_put(dev);
3527 unlock_rtnl:
3528         rtnl_unlock();
3529         return err;
3530 }
3531
3532 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3533 {
3534         struct cfg80211_registered_device *rdev;
3535         struct net_device *dev;
3536         const u8 *ie = NULL, *bssid;
3537         int err, ie_len = 0;
3538         u16 reason_code;
3539
3540         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3541                 return -EINVAL;
3542
3543         if (!info->attrs[NL80211_ATTR_MAC])
3544                 return -EINVAL;
3545
3546         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3547                 return -EINVAL;
3548
3549         rtnl_lock();
3550
3551         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3552         if (err)
3553                 goto unlock_rtnl;
3554
3555         if (!rdev->ops->deauth) {
3556                 err = -EOPNOTSUPP;
3557                 goto out;
3558         }
3559
3560         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3561                 err = -EOPNOTSUPP;
3562                 goto out;
3563         }
3564
3565         if (!netif_running(dev)) {
3566                 err = -ENETDOWN;
3567                 goto out;
3568         }
3569
3570         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3571
3572         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3573         if (reason_code == 0) {
3574                 /* Reason Code 0 is reserved */
3575                 err = -EINVAL;
3576                 goto out;
3577         }
3578
3579         if (info->attrs[NL80211_ATTR_IE]) {
3580                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3581                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3582         }
3583
3584         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3585
3586 out:
3587         cfg80211_unlock_rdev(rdev);
3588         dev_put(dev);
3589 unlock_rtnl:
3590         rtnl_unlock();
3591         return err;
3592 }
3593
3594 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3595 {
3596         struct cfg80211_registered_device *rdev;
3597         struct net_device *dev;
3598         const u8 *ie = NULL, *bssid;
3599         int err, ie_len = 0;
3600         u16 reason_code;
3601
3602         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3603                 return -EINVAL;
3604
3605         if (!info->attrs[NL80211_ATTR_MAC])
3606                 return -EINVAL;
3607
3608         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3609                 return -EINVAL;
3610
3611         rtnl_lock();
3612
3613         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3614         if (err)
3615                 goto unlock_rtnl;
3616
3617         if (!rdev->ops->disassoc) {
3618                 err = -EOPNOTSUPP;
3619                 goto out;
3620         }
3621
3622         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3623                 err = -EOPNOTSUPP;
3624                 goto out;
3625         }
3626
3627         if (!netif_running(dev)) {
3628                 err = -ENETDOWN;
3629                 goto out;
3630         }
3631
3632         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3633
3634         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3635         if (reason_code == 0) {
3636                 /* Reason Code 0 is reserved */
3637                 err = -EINVAL;
3638                 goto out;
3639         }
3640
3641         if (info->attrs[NL80211_ATTR_IE]) {
3642                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3643                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3644         }
3645
3646         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3647
3648 out:
3649         cfg80211_unlock_rdev(rdev);
3650         dev_put(dev);
3651 unlock_rtnl:
3652         rtnl_unlock();
3653         return err;
3654 }
3655
3656 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3657 {
3658         struct cfg80211_registered_device *rdev;
3659         struct net_device *dev;
3660         struct cfg80211_ibss_params ibss;
3661         struct wiphy *wiphy;
3662         struct cfg80211_cached_keys *connkeys = NULL;
3663         int err;
3664
3665         memset(&ibss, 0, sizeof(ibss));
3666
3667         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3668                 return -EINVAL;
3669
3670         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3671             !info->attrs[NL80211_ATTR_SSID] ||
3672             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3673                 return -EINVAL;
3674
3675         ibss.beacon_interval = 100;
3676
3677         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3678                 ibss.beacon_interval =
3679                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3680                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3681                         return -EINVAL;
3682         }
3683
3684         rtnl_lock();
3685
3686         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3687         if (err)
3688                 goto unlock_rtnl;
3689
3690         if (!rdev->ops->join_ibss) {
3691                 err = -EOPNOTSUPP;
3692                 goto out;
3693         }
3694
3695         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3696                 err = -EOPNOTSUPP;
3697                 goto out;
3698         }
3699
3700         if (!netif_running(dev)) {
3701                 err = -ENETDOWN;
3702                 goto out;
3703         }
3704
3705         wiphy = &rdev->wiphy;
3706
3707         if (info->attrs[NL80211_ATTR_MAC])
3708                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3709         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3710         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3711
3712         if (info->attrs[NL80211_ATTR_IE]) {
3713                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3714                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3715         }
3716
3717         ibss.channel = ieee80211_get_channel(wiphy,
3718                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3719         if (!ibss.channel ||
3720             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3721             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3722                 err = -EINVAL;
3723                 goto out;
3724         }
3725
3726         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3727         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3728
3729         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3730                 connkeys = nl80211_parse_connkeys(rdev,
3731                                         info->attrs[NL80211_ATTR_KEYS]);
3732                 if (IS_ERR(connkeys)) {
3733                         err = PTR_ERR(connkeys);
3734                         connkeys = NULL;
3735                         goto out;
3736                 }
3737         }
3738
3739         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3740
3741 out:
3742         cfg80211_unlock_rdev(rdev);
3743         dev_put(dev);
3744 unlock_rtnl:
3745         if (err)
3746                 kfree(connkeys);
3747         rtnl_unlock();
3748         return err;
3749 }
3750
3751 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3752 {
3753         struct cfg80211_registered_device *rdev;
3754         struct net_device *dev;
3755         int err;
3756
3757         rtnl_lock();
3758
3759         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3760         if (err)
3761                 goto unlock_rtnl;
3762
3763         if (!rdev->ops->leave_ibss) {
3764                 err = -EOPNOTSUPP;
3765                 goto out;
3766         }
3767
3768         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3769                 err = -EOPNOTSUPP;
3770                 goto out;
3771         }
3772
3773         if (!netif_running(dev)) {
3774                 err = -ENETDOWN;
3775                 goto out;
3776         }
3777
3778         err = cfg80211_leave_ibss(rdev, dev, false);
3779
3780 out:
3781         cfg80211_unlock_rdev(rdev);
3782         dev_put(dev);
3783 unlock_rtnl:
3784         rtnl_unlock();
3785         return err;
3786 }
3787
3788 #ifdef CONFIG_NL80211_TESTMODE
3789 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3790         .name = "testmode",
3791 };
3792
3793 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3794 {
3795         struct cfg80211_registered_device *rdev;
3796         int err;
3797
3798         if (!info->attrs[NL80211_ATTR_TESTDATA])
3799                 return -EINVAL;
3800
3801         rtnl_lock();
3802
3803         rdev = cfg80211_get_dev_from_info(info);
3804         if (IS_ERR(rdev)) {
3805                 err = PTR_ERR(rdev);
3806                 goto unlock_rtnl;
3807         }
3808
3809         err = -EOPNOTSUPP;
3810         if (rdev->ops->testmode_cmd) {
3811                 rdev->testmode_info = info;
3812                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3813                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3814                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3815                 rdev->testmode_info = NULL;
3816         }
3817
3818         cfg80211_unlock_rdev(rdev);
3819
3820  unlock_rtnl:
3821         rtnl_unlock();
3822         return err;
3823 }
3824
3825 static struct sk_buff *
3826 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3827                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3828 {
3829         struct sk_buff *skb;
3830         void *hdr;
3831         struct nlattr *data;
3832
3833         skb = nlmsg_new(approxlen + 100, gfp);
3834         if (!skb)
3835                 return NULL;
3836
3837         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3838         if (!hdr) {
3839                 kfree_skb(skb);
3840                 return NULL;
3841         }
3842
3843         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3844         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3845
3846         ((void **)skb->cb)[0] = rdev;
3847         ((void **)skb->cb)[1] = hdr;
3848         ((void **)skb->cb)[2] = data;
3849
3850         return skb;
3851
3852  nla_put_failure:
3853         kfree_skb(skb);
3854         return NULL;
3855 }
3856
3857 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3858                                                   int approxlen)
3859 {
3860         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3861
3862         if (WARN_ON(!rdev->testmode_info))
3863                 return NULL;
3864
3865         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3866                                 rdev->testmode_info->snd_pid,
3867                                 rdev->testmode_info->snd_seq,
3868                                 GFP_KERNEL);
3869 }
3870 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3871
3872 int cfg80211_testmode_reply(struct sk_buff *skb)
3873 {
3874         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3875         void *hdr = ((void **)skb->cb)[1];
3876         struct nlattr *data = ((void **)skb->cb)[2];
3877
3878         if (WARN_ON(!rdev->testmode_info)) {
3879                 kfree_skb(skb);
3880                 return -EINVAL;
3881         }
3882
3883         nla_nest_end(skb, data);
3884         genlmsg_end(skb, hdr);
3885         return genlmsg_reply(skb, rdev->testmode_info);
3886 }
3887 EXPORT_SYMBOL(cfg80211_testmode_reply);
3888
3889 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3890                                                   int approxlen, gfp_t gfp)
3891 {
3892         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3893
3894         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3895 }
3896 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3897
3898 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3899 {
3900         void *hdr = ((void **)skb->cb)[1];
3901         struct nlattr *data = ((void **)skb->cb)[2];
3902
3903         nla_nest_end(skb, data);
3904         genlmsg_end(skb, hdr);
3905         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3906 }
3907 EXPORT_SYMBOL(cfg80211_testmode_event);
3908 #endif
3909
3910 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3911 {
3912         struct cfg80211_registered_device *rdev;
3913         struct net_device *dev;
3914         struct cfg80211_connect_params connect;
3915         struct wiphy *wiphy;
3916         struct cfg80211_cached_keys *connkeys = NULL;
3917         int err;
3918
3919         memset(&connect, 0, sizeof(connect));
3920
3921         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3922                 return -EINVAL;
3923
3924         if (!info->attrs[NL80211_ATTR_SSID] ||
3925             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3926                 return -EINVAL;
3927
3928         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3929                 connect.auth_type =
3930                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3931                 if (!nl80211_valid_auth_type(connect.auth_type))
3932                         return -EINVAL;
3933         } else
3934                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3935
3936         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3937
3938         err = nl80211_crypto_settings(info, &connect.crypto,
3939                                       NL80211_MAX_NR_CIPHER_SUITES);
3940         if (err)
3941                 return err;
3942         rtnl_lock();
3943
3944         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3945         if (err)
3946                 goto unlock_rtnl;
3947
3948         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3949                 err = -EOPNOTSUPP;
3950                 goto out;
3951         }
3952
3953         if (!netif_running(dev)) {
3954                 err = -ENETDOWN;
3955                 goto out;
3956         }
3957
3958         wiphy = &rdev->wiphy;
3959
3960         if (info->attrs[NL80211_ATTR_MAC])
3961                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3962         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3963         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3964
3965         if (info->attrs[NL80211_ATTR_IE]) {
3966                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3967                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3968         }
3969
3970         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3971                 connect.channel =
3972                         ieee80211_get_channel(wiphy,
3973                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3974                 if (!connect.channel ||
3975                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3976                         err = -EINVAL;
3977                         goto out;
3978                 }
3979         }
3980
3981         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3982                 connkeys = nl80211_parse_connkeys(rdev,
3983                                         info->attrs[NL80211_ATTR_KEYS]);
3984                 if (IS_ERR(connkeys)) {
3985                         err = PTR_ERR(connkeys);
3986                         connkeys = NULL;
3987                         goto out;
3988                 }
3989         }
3990
3991         err = cfg80211_connect(rdev, dev, &connect, connkeys);
3992
3993 out:
3994         cfg80211_unlock_rdev(rdev);
3995         dev_put(dev);
3996 unlock_rtnl:
3997         if (err)
3998                 kfree(connkeys);
3999         rtnl_unlock();
4000         return err;
4001 }
4002
4003 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4004 {
4005         struct cfg80211_registered_device *rdev;
4006         struct net_device *dev;
4007         int err;
4008         u16 reason;
4009
4010         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4011                 reason = WLAN_REASON_DEAUTH_LEAVING;
4012         else
4013                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4014
4015         if (reason == 0)
4016                 return -EINVAL;
4017
4018         rtnl_lock();
4019
4020         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4021         if (err)
4022                 goto unlock_rtnl;
4023
4024         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4025                 err = -EOPNOTSUPP;
4026                 goto out;
4027         }
4028
4029         if (!netif_running(dev)) {
4030                 err = -ENETDOWN;
4031                 goto out;
4032         }
4033
4034         err = cfg80211_disconnect(rdev, dev, reason, true);
4035
4036 out:
4037         cfg80211_unlock_rdev(rdev);
4038         dev_put(dev);
4039 unlock_rtnl:
4040         rtnl_unlock();
4041         return err;
4042 }
4043
4044 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4045 {
4046         struct cfg80211_registered_device *rdev;
4047         struct net *net;
4048         int err;
4049         u32 pid;
4050
4051         if (!info->attrs[NL80211_ATTR_PID])
4052                 return -EINVAL;
4053
4054         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4055
4056         rtnl_lock();
4057
4058         rdev = cfg80211_get_dev_from_info(info);
4059         if (IS_ERR(rdev)) {
4060                 err = PTR_ERR(rdev);
4061                 goto out_rtnl;
4062         }
4063
4064         net = get_net_ns_by_pid(pid);
4065         if (IS_ERR(net)) {
4066                 err = PTR_ERR(net);
4067                 goto out;
4068         }
4069
4070         err = 0;
4071
4072         /* check if anything to do */
4073         if (net_eq(wiphy_net(&rdev->wiphy), net))
4074                 goto out_put_net;
4075
4076         err = cfg80211_switch_netns(rdev, net);
4077  out_put_net:
4078         put_net(net);
4079  out:
4080         cfg80211_unlock_rdev(rdev);
4081  out_rtnl:
4082         rtnl_unlock();
4083         return err;
4084 }
4085
4086 static struct genl_ops nl80211_ops[] = {
4087         {
4088                 .cmd = NL80211_CMD_GET_WIPHY,
4089                 .doit = nl80211_get_wiphy,
4090                 .dumpit = nl80211_dump_wiphy,
4091                 .policy = nl80211_policy,
4092                 /* can be retrieved by unprivileged users */
4093         },
4094         {
4095                 .cmd = NL80211_CMD_SET_WIPHY,
4096                 .doit = nl80211_set_wiphy,
4097                 .policy = nl80211_policy,
4098                 .flags = GENL_ADMIN_PERM,
4099         },
4100         {
4101                 .cmd = NL80211_CMD_GET_INTERFACE,
4102                 .doit = nl80211_get_interface,
4103                 .dumpit = nl80211_dump_interface,
4104                 .policy = nl80211_policy,
4105                 /* can be retrieved by unprivileged users */
4106         },
4107         {
4108                 .cmd = NL80211_CMD_SET_INTERFACE,
4109                 .doit = nl80211_set_interface,
4110                 .policy = nl80211_policy,
4111                 .flags = GENL_ADMIN_PERM,
4112         },
4113         {
4114                 .cmd = NL80211_CMD_NEW_INTERFACE,
4115                 .doit = nl80211_new_interface,
4116                 .policy = nl80211_policy,
4117                 .flags = GENL_ADMIN_PERM,
4118         },
4119         {
4120                 .cmd = NL80211_CMD_DEL_INTERFACE,
4121                 .doit = nl80211_del_interface,
4122                 .policy = nl80211_policy,
4123                 .flags = GENL_ADMIN_PERM,
4124         },
4125         {
4126                 .cmd = NL80211_CMD_GET_KEY,
4127                 .doit = nl80211_get_key,
4128                 .policy = nl80211_policy,
4129                 .flags = GENL_ADMIN_PERM,
4130         },
4131         {
4132                 .cmd = NL80211_CMD_SET_KEY,
4133                 .doit = nl80211_set_key,
4134                 .policy = nl80211_policy,
4135                 .flags = GENL_ADMIN_PERM,
4136         },
4137         {
4138                 .cmd = NL80211_CMD_NEW_KEY,
4139                 .doit = nl80211_new_key,
4140                 .policy = nl80211_policy,
4141                 .flags = GENL_ADMIN_PERM,
4142         },
4143         {
4144                 .cmd = NL80211_CMD_DEL_KEY,
4145                 .doit = nl80211_del_key,
4146                 .policy = nl80211_policy,
4147                 .flags = GENL_ADMIN_PERM,
4148         },
4149         {
4150                 .cmd = NL80211_CMD_SET_BEACON,
4151                 .policy = nl80211_policy,
4152                 .flags = GENL_ADMIN_PERM,
4153                 .doit = nl80211_addset_beacon,
4154         },
4155         {
4156                 .cmd = NL80211_CMD_NEW_BEACON,
4157                 .policy = nl80211_policy,
4158                 .flags = GENL_ADMIN_PERM,
4159                 .doit = nl80211_addset_beacon,
4160         },
4161         {
4162                 .cmd = NL80211_CMD_DEL_BEACON,
4163                 .policy = nl80211_policy,
4164                 .flags = GENL_ADMIN_PERM,
4165                 .doit = nl80211_del_beacon,
4166         },
4167         {
4168                 .cmd = NL80211_CMD_GET_STATION,
4169                 .doit = nl80211_get_station,
4170                 .dumpit = nl80211_dump_station,
4171                 .policy = nl80211_policy,
4172         },
4173         {
4174                 .cmd = NL80211_CMD_SET_STATION,
4175                 .doit = nl80211_set_station,
4176                 .policy = nl80211_policy,
4177                 .flags = GENL_ADMIN_PERM,
4178         },
4179         {
4180                 .cmd = NL80211_CMD_NEW_STATION,
4181                 .doit = nl80211_new_station,
4182                 .policy = nl80211_policy,
4183                 .flags = GENL_ADMIN_PERM,
4184         },
4185         {
4186                 .cmd = NL80211_CMD_DEL_STATION,
4187                 .doit = nl80211_del_station,
4188                 .policy = nl80211_policy,
4189                 .flags = GENL_ADMIN_PERM,
4190         },
4191         {
4192                 .cmd = NL80211_CMD_GET_MPATH,
4193                 .doit = nl80211_get_mpath,
4194                 .dumpit = nl80211_dump_mpath,
4195                 .policy = nl80211_policy,
4196                 .flags = GENL_ADMIN_PERM,
4197         },
4198         {
4199                 .cmd = NL80211_CMD_SET_MPATH,
4200                 .doit = nl80211_set_mpath,
4201                 .policy = nl80211_policy,
4202                 .flags = GENL_ADMIN_PERM,
4203         },
4204         {
4205                 .cmd = NL80211_CMD_NEW_MPATH,
4206                 .doit = nl80211_new_mpath,
4207                 .policy = nl80211_policy,
4208                 .flags = GENL_ADMIN_PERM,
4209         },
4210         {
4211                 .cmd = NL80211_CMD_DEL_MPATH,
4212                 .doit = nl80211_del_mpath,
4213                 .policy = nl80211_policy,
4214                 .flags = GENL_ADMIN_PERM,
4215         },
4216         {
4217                 .cmd = NL80211_CMD_SET_BSS,
4218                 .doit = nl80211_set_bss,
4219                 .policy = nl80211_policy,
4220                 .flags = GENL_ADMIN_PERM,
4221         },
4222         {
4223                 .cmd = NL80211_CMD_GET_REG,
4224                 .doit = nl80211_get_reg,
4225                 .policy = nl80211_policy,
4226                 /* can be retrieved by unprivileged users */
4227         },
4228         {
4229                 .cmd = NL80211_CMD_SET_REG,
4230                 .doit = nl80211_set_reg,
4231                 .policy = nl80211_policy,
4232                 .flags = GENL_ADMIN_PERM,
4233         },
4234         {
4235                 .cmd = NL80211_CMD_REQ_SET_REG,
4236                 .doit = nl80211_req_set_reg,
4237                 .policy = nl80211_policy,
4238                 .flags = GENL_ADMIN_PERM,
4239         },
4240         {
4241                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4242                 .doit = nl80211_get_mesh_params,
4243                 .policy = nl80211_policy,
4244                 /* can be retrieved by unprivileged users */
4245         },
4246         {
4247                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4248                 .doit = nl80211_set_mesh_params,
4249                 .policy = nl80211_policy,
4250                 .flags = GENL_ADMIN_PERM,
4251         },
4252         {
4253                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4254                 .doit = nl80211_trigger_scan,
4255                 .policy = nl80211_policy,
4256                 .flags = GENL_ADMIN_PERM,
4257         },
4258         {
4259                 .cmd = NL80211_CMD_GET_SCAN,
4260                 .policy = nl80211_policy,
4261                 .dumpit = nl80211_dump_scan,
4262         },
4263         {
4264                 .cmd = NL80211_CMD_AUTHENTICATE,
4265                 .doit = nl80211_authenticate,
4266                 .policy = nl80211_policy,
4267                 .flags = GENL_ADMIN_PERM,
4268         },
4269         {
4270                 .cmd = NL80211_CMD_ASSOCIATE,
4271                 .doit = nl80211_associate,
4272                 .policy = nl80211_policy,
4273                 .flags = GENL_ADMIN_PERM,
4274         },
4275         {
4276                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4277                 .doit = nl80211_deauthenticate,
4278                 .policy = nl80211_policy,
4279                 .flags = GENL_ADMIN_PERM,
4280         },
4281         {
4282                 .cmd = NL80211_CMD_DISASSOCIATE,
4283                 .doit = nl80211_disassociate,
4284                 .policy = nl80211_policy,
4285                 .flags = GENL_ADMIN_PERM,
4286         },
4287         {
4288                 .cmd = NL80211_CMD_JOIN_IBSS,
4289                 .doit = nl80211_join_ibss,
4290                 .policy = nl80211_policy,
4291                 .flags = GENL_ADMIN_PERM,
4292         },
4293         {
4294                 .cmd = NL80211_CMD_LEAVE_IBSS,
4295                 .doit = nl80211_leave_ibss,
4296                 .policy = nl80211_policy,
4297                 .flags = GENL_ADMIN_PERM,
4298         },
4299 #ifdef CONFIG_NL80211_TESTMODE
4300         {
4301                 .cmd = NL80211_CMD_TESTMODE,
4302                 .doit = nl80211_testmode_do,
4303                 .policy = nl80211_policy,
4304                 .flags = GENL_ADMIN_PERM,
4305         },
4306 #endif
4307         {
4308                 .cmd = NL80211_CMD_CONNECT,
4309                 .doit = nl80211_connect,
4310                 .policy = nl80211_policy,
4311                 .flags = GENL_ADMIN_PERM,
4312         },
4313         {
4314                 .cmd = NL80211_CMD_DISCONNECT,
4315                 .doit = nl80211_disconnect,
4316                 .policy = nl80211_policy,
4317                 .flags = GENL_ADMIN_PERM,
4318         },
4319         {
4320                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4321                 .doit = nl80211_wiphy_netns,
4322                 .policy = nl80211_policy,
4323                 .flags = GENL_ADMIN_PERM,
4324         },
4325 };
4326 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4327         .name = "mlme",
4328 };
4329
4330 /* multicast groups */
4331 static struct genl_multicast_group nl80211_config_mcgrp = {
4332         .name = "config",
4333 };
4334 static struct genl_multicast_group nl80211_scan_mcgrp = {
4335         .name = "scan",
4336 };
4337 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4338         .name = "regulatory",
4339 };
4340
4341 /* notification functions */
4342
4343 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4344 {
4345         struct sk_buff *msg;
4346
4347         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4348         if (!msg)
4349                 return;
4350
4351         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4352                 nlmsg_free(msg);
4353                 return;
4354         }
4355
4356         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4357                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4358 }
4359
4360 static int nl80211_add_scan_req(struct sk_buff *msg,
4361                                 struct cfg80211_registered_device *rdev)
4362 {
4363         struct cfg80211_scan_request *req = rdev->scan_req;
4364         struct nlattr *nest;
4365         int i;
4366
4367         ASSERT_RDEV_LOCK(rdev);
4368
4369         if (WARN_ON(!req))
4370                 return 0;
4371
4372         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4373         if (!nest)
4374                 goto nla_put_failure;
4375         for (i = 0; i < req->n_ssids; i++)
4376                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4377         nla_nest_end(msg, nest);
4378
4379         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4380         if (!nest)
4381                 goto nla_put_failure;
4382         for (i = 0; i < req->n_channels; i++)
4383                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4384         nla_nest_end(msg, nest);
4385
4386         if (req->ie)
4387                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4388
4389         return 0;
4390  nla_put_failure:
4391         return -ENOBUFS;
4392 }
4393
4394 static int nl80211_send_scan_msg(struct sk_buff *msg,
4395                                  struct cfg80211_registered_device *rdev,
4396                                  struct net_device *netdev,
4397                                  u32 pid, u32 seq, int flags,
4398                                  u32 cmd)
4399 {
4400         void *hdr;
4401
4402         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4403         if (!hdr)
4404                 return -1;
4405
4406         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4407         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4408
4409         /* ignore errors and send incomplete event anyway */
4410         nl80211_add_scan_req(msg, rdev);
4411
4412         return genlmsg_end(msg, hdr);
4413
4414  nla_put_failure:
4415         genlmsg_cancel(msg, hdr);
4416         return -EMSGSIZE;
4417 }
4418
4419 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4420                              struct net_device *netdev)
4421 {
4422         struct sk_buff *msg;
4423
4424         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4425         if (!msg)
4426                 return;
4427
4428         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4429                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4430                 nlmsg_free(msg);
4431                 return;
4432         }
4433
4434         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4435                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4436 }
4437
4438 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4439                             struct net_device *netdev)
4440 {
4441         struct sk_buff *msg;
4442
4443         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4444         if (!msg)
4445                 return;
4446
4447         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4448                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4449                 nlmsg_free(msg);
4450                 return;
4451         }
4452
4453         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4454                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4455 }
4456
4457 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4458                                struct net_device *netdev)
4459 {
4460         struct sk_buff *msg;
4461
4462         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4463         if (!msg)
4464                 return;
4465
4466         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4467                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4468                 nlmsg_free(msg);
4469                 return;
4470         }
4471
4472         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4473                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4474 }
4475
4476 /*
4477  * This can happen on global regulatory changes or device specific settings
4478  * based on custom world regulatory domains.
4479  */
4480 void nl80211_send_reg_change_event(struct regulatory_request *request)
4481 {
4482         struct sk_buff *msg;
4483         void *hdr;
4484
4485         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4486         if (!msg)
4487                 return;
4488
4489         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4490         if (!hdr) {
4491                 nlmsg_free(msg);
4492                 return;
4493         }
4494
4495         /* Userspace can always count this one always being set */
4496         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4497
4498         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4499                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4500                            NL80211_REGDOM_TYPE_WORLD);
4501         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4502                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4503                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4504         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4505                  request->intersect)
4506                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4507                            NL80211_REGDOM_TYPE_INTERSECTION);
4508         else {
4509                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4510                            NL80211_REGDOM_TYPE_COUNTRY);
4511                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4512         }
4513
4514         if (wiphy_idx_valid(request->wiphy_idx))
4515                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4516
4517         if (genlmsg_end(msg, hdr) < 0) {
4518                 nlmsg_free(msg);
4519                 return;
4520         }
4521
4522         rcu_read_lock();
4523         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4524                                 GFP_ATOMIC);
4525         rcu_read_unlock();
4526
4527         return;
4528
4529 nla_put_failure:
4530         genlmsg_cancel(msg, hdr);
4531         nlmsg_free(msg);
4532 }
4533
4534 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4535                                     struct net_device *netdev,
4536                                     const u8 *buf, size_t len,
4537                                     enum nl80211_commands cmd, gfp_t gfp)
4538 {
4539         struct sk_buff *msg;
4540         void *hdr;
4541
4542         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4543         if (!msg)
4544                 return;
4545
4546         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4547         if (!hdr) {
4548                 nlmsg_free(msg);
4549                 return;
4550         }
4551
4552         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4554         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4555
4556         if (genlmsg_end(msg, hdr) < 0) {
4557                 nlmsg_free(msg);
4558                 return;
4559         }
4560
4561         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4562                                 nl80211_mlme_mcgrp.id, gfp);
4563         return;
4564
4565  nla_put_failure:
4566         genlmsg_cancel(msg, hdr);
4567         nlmsg_free(msg);
4568 }
4569
4570 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4571                           struct net_device *netdev, const u8 *buf,
4572                           size_t len, gfp_t gfp)
4573 {
4574         nl80211_send_mlme_event(rdev, netdev, buf, len,
4575                                 NL80211_CMD_AUTHENTICATE, gfp);
4576 }
4577
4578 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4579                            struct net_device *netdev, const u8 *buf,
4580                            size_t len, gfp_t gfp)
4581 {
4582         nl80211_send_mlme_event(rdev, netdev, buf, len,
4583                                 NL80211_CMD_ASSOCIATE, gfp);
4584 }
4585
4586 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4587                          struct net_device *netdev, const u8 *buf,
4588                          size_t len, gfp_t gfp)
4589 {
4590         nl80211_send_mlme_event(rdev, netdev, buf, len,
4591                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4592 }
4593
4594 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4595                            struct net_device *netdev, const u8 *buf,
4596                            size_t len, gfp_t gfp)
4597 {
4598         nl80211_send_mlme_event(rdev, netdev, buf, len,
4599                                 NL80211_CMD_DISASSOCIATE, gfp);
4600 }
4601
4602 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4603                                       struct net_device *netdev, int cmd,
4604                                       const u8 *addr, gfp_t gfp)
4605 {
4606         struct sk_buff *msg;
4607         void *hdr;
4608
4609         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4610         if (!msg)
4611                 return;
4612
4613         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4614         if (!hdr) {
4615                 nlmsg_free(msg);
4616                 return;
4617         }
4618
4619         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4620         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4621         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4622         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4623
4624         if (genlmsg_end(msg, hdr) < 0) {
4625                 nlmsg_free(msg);
4626                 return;
4627         }
4628
4629         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4630                                 nl80211_mlme_mcgrp.id, gfp);
4631         return;
4632
4633  nla_put_failure:
4634         genlmsg_cancel(msg, hdr);
4635         nlmsg_free(msg);
4636 }
4637
4638 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4639                                struct net_device *netdev, const u8 *addr,
4640                                gfp_t gfp)
4641 {
4642         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4643                                   addr, gfp);
4644 }
4645
4646 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4647                                 struct net_device *netdev, const u8 *addr,
4648                                 gfp_t gfp)
4649 {
4650         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4651                                   addr, gfp);
4652 }
4653
4654 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4655                                  struct net_device *netdev, const u8 *bssid,
4656                                  const u8 *req_ie, size_t req_ie_len,
4657                                  const u8 *resp_ie, size_t resp_ie_len,
4658                                  u16 status, gfp_t gfp)
4659 {
4660         struct sk_buff *msg;
4661         void *hdr;
4662
4663         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4664         if (!msg)
4665                 return;
4666
4667         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4668         if (!hdr) {
4669                 nlmsg_free(msg);
4670                 return;
4671         }
4672
4673         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4674         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4675         if (bssid)
4676                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4677         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4678         if (req_ie)
4679                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4680         if (resp_ie)
4681                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4682
4683         if (genlmsg_end(msg, hdr) < 0) {
4684                 nlmsg_free(msg);
4685                 return;
4686         }
4687
4688         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4689                                 nl80211_mlme_mcgrp.id, gfp);
4690         return;
4691
4692  nla_put_failure:
4693         genlmsg_cancel(msg, hdr);
4694         nlmsg_free(msg);
4695
4696 }
4697
4698 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4699                          struct net_device *netdev, const u8 *bssid,
4700                          const u8 *req_ie, size_t req_ie_len,
4701                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4702 {
4703         struct sk_buff *msg;
4704         void *hdr;
4705
4706         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4707         if (!msg)
4708                 return;
4709
4710         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4711         if (!hdr) {
4712                 nlmsg_free(msg);
4713                 return;
4714         }
4715
4716         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4717         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4718         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4719         if (req_ie)
4720                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4721         if (resp_ie)
4722                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4723
4724         if (genlmsg_end(msg, hdr) < 0) {
4725                 nlmsg_free(msg);
4726                 return;
4727         }
4728
4729         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4730                                 nl80211_mlme_mcgrp.id, gfp);
4731         return;
4732
4733  nla_put_failure:
4734         genlmsg_cancel(msg, hdr);
4735         nlmsg_free(msg);
4736
4737 }
4738
4739 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4740                                struct net_device *netdev, u16 reason,
4741                                const u8 *ie, size_t ie_len, bool from_ap)
4742 {
4743         struct sk_buff *msg;
4744         void *hdr;
4745
4746         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4747         if (!msg)
4748                 return;
4749
4750         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4751         if (!hdr) {
4752                 nlmsg_free(msg);
4753                 return;
4754         }
4755
4756         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4757         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4758         if (from_ap && reason)
4759                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4760         if (from_ap)
4761                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4762         if (ie)
4763                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4764
4765         if (genlmsg_end(msg, hdr) < 0) {
4766                 nlmsg_free(msg);
4767                 return;
4768         }
4769
4770         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4771                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
4772         return;
4773
4774  nla_put_failure:
4775         genlmsg_cancel(msg, hdr);
4776         nlmsg_free(msg);
4777
4778 }
4779
4780 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4781                              struct net_device *netdev, const u8 *bssid,
4782                              gfp_t gfp)
4783 {
4784         struct sk_buff *msg;
4785         void *hdr;
4786
4787         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4788         if (!msg)
4789                 return;
4790
4791         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4792         if (!hdr) {
4793                 nlmsg_free(msg);
4794                 return;
4795         }
4796
4797         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4798         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4799         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4800
4801         if (genlmsg_end(msg, hdr) < 0) {
4802                 nlmsg_free(msg);
4803                 return;
4804         }
4805
4806         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4807                                 nl80211_mlme_mcgrp.id, gfp);
4808         return;
4809
4810  nla_put_failure:
4811         genlmsg_cancel(msg, hdr);
4812         nlmsg_free(msg);
4813 }
4814
4815 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4816                                  struct net_device *netdev, const u8 *addr,
4817                                  enum nl80211_key_type key_type, int key_id,
4818                                  const u8 *tsc, gfp_t gfp)
4819 {
4820         struct sk_buff *msg;
4821         void *hdr;
4822
4823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4824         if (!msg)
4825                 return;
4826
4827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4828         if (!hdr) {
4829                 nlmsg_free(msg);
4830                 return;
4831         }
4832
4833         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4834         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4835         if (addr)
4836                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4837         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4838         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4839         if (tsc)
4840                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4841
4842         if (genlmsg_end(msg, hdr) < 0) {
4843                 nlmsg_free(msg);
4844                 return;
4845         }
4846
4847         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4848                                 nl80211_mlme_mcgrp.id, gfp);
4849         return;
4850
4851  nla_put_failure:
4852         genlmsg_cancel(msg, hdr);
4853         nlmsg_free(msg);
4854 }
4855
4856 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4857                                     struct ieee80211_channel *channel_before,
4858                                     struct ieee80211_channel *channel_after)
4859 {
4860         struct sk_buff *msg;
4861         void *hdr;
4862         struct nlattr *nl_freq;
4863
4864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4865         if (!msg)
4866                 return;
4867
4868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4869         if (!hdr) {
4870                 nlmsg_free(msg);
4871                 return;
4872         }
4873
4874         /*
4875          * Since we are applying the beacon hint to a wiphy we know its
4876          * wiphy_idx is valid
4877          */
4878         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4879
4880         /* Before */
4881         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4882         if (!nl_freq)
4883                 goto nla_put_failure;
4884         if (nl80211_msg_put_channel(msg, channel_before))
4885                 goto nla_put_failure;
4886         nla_nest_end(msg, nl_freq);
4887
4888         /* After */
4889         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4890         if (!nl_freq)
4891                 goto nla_put_failure;
4892         if (nl80211_msg_put_channel(msg, channel_after))
4893                 goto nla_put_failure;
4894         nla_nest_end(msg, nl_freq);
4895
4896         if (genlmsg_end(msg, hdr) < 0) {
4897                 nlmsg_free(msg);
4898                 return;
4899         }
4900
4901         rcu_read_lock();
4902         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4903                                 GFP_ATOMIC);
4904         rcu_read_unlock();
4905
4906         return;
4907
4908 nla_put_failure:
4909         genlmsg_cancel(msg, hdr);
4910         nlmsg_free(msg);
4911 }
4912
4913 /* initialisation/exit functions */
4914
4915 int nl80211_init(void)
4916 {
4917         int err;
4918
4919         err = genl_register_family_with_ops(&nl80211_fam,
4920                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4921         if (err)
4922                 return err;
4923
4924         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4925         if (err)
4926                 goto err_out;
4927
4928         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4929         if (err)
4930                 goto err_out;
4931
4932         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4933         if (err)
4934                 goto err_out;
4935
4936         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4937         if (err)
4938                 goto err_out;
4939
4940 #ifdef CONFIG_NL80211_TESTMODE
4941         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4942         if (err)
4943                 goto err_out;
4944 #endif
4945
4946         return 0;
4947  err_out:
4948         genl_unregister_family(&nl80211_fam);
4949         return err;
4950 }
4951
4952 void nl80211_exit(void)
4953 {
4954         genl_unregister_family(&nl80211_fam);
4955 }