SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72
  73         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  74         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  76
  77         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  78         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79
  80         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  81         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  82                                     .len = WLAN_MAX_KEY_LEN },
  83         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  84         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  85         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  86         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  87
  88         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  89         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  90         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  91                                        .len = IEEE80211_MAX_DATA_LEN },
  92         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  95         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  96         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  98                                                .len = NL80211_MAX_SUPP_RATES },
  99         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 100         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 101         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 102         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 103                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 104         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 105
 106         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 107         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 108
 109         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 110         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 113                                            .len = NL80211_MAX_SUPP_RATES },
 114
 115         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 116
 117         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 118                                          .len = NL80211_HT_CAPABILITY_LEN },
 119
 120         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 122                               .len = IEEE80211_MAX_DATA_LEN },
 123         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 124         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 127                                 .len = IEEE80211_MAX_SSID_LEN },
 128         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 129         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 130         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_STA_FLAGS2] = {
 134                 .len = sizeof(struct nl80211_sta_flag_update),
 135         },
 136         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 139         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 140         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 141 };
 142
 143 /* policy for the attributes */
 144 static struct nla_policy
 145 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 146         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 147         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 148         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 149         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 150         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 151         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 152 };
 153
 154 /* IE validation */
 155 static bool is_valid_ie_attr(const struct nlattr *attr)
 156 {
 157         const u8 *pos;
 158         int len;
 159
 160         if (!attr)
 161                 return true;
 162
 163         pos = nla_data(attr);
 164         len = nla_len(attr);
 165
 166         while (len) {
 167                 u8 elemlen;
 168
 169                 if (len < 2)
 170                         return false;
 171                 len -= 2;
 172
 173                 elemlen = pos[1];
 174                 if (elemlen > len)
 175                         return false;
 176
 177                 len -= elemlen;
 178                 pos += 2 + elemlen;
 179         }
 180
 181         return true;
 182 }
 183
 184 /* message building helper */
 185 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 186                                    int flags, u8 cmd)
 187 {
 188         /* since there is no private header just add the generic one */
 189         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 190 }
 191
 192 static int nl80211_msg_put_channel(struct sk_buff *msg,
 193                                    struct ieee80211_channel *chan)
 194 {
 195         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 196                     chan->center_freq);
 197
 198         if (chan->flags & IEEE80211_CHAN_DISABLED)
 199                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 200         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 201                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 202         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 203                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 204         if (chan->flags & IEEE80211_CHAN_RADAR)
 205                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 206
 207         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 208                     DBM_TO_MBM(chan->max_power));
 209
 210         return 0;
 211
 212  nla_put_failure:
 213         return -ENOBUFS;
 214 }
 215
 216 /* netlink command implementations */
 217
 218 struct key_parse {
 219         struct key_params p;
 220         int idx;
 221         bool def, defmgmt;
 222 };
 223
 224 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 225 {
 226         struct nlattr *tb[NL80211_KEY_MAX + 1];
 227         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 228                                    nl80211_key_policy);
 229         if (err)
 230                 return err;
 231
 232         k->def = !!tb[NL80211_KEY_DEFAULT];
 233         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 234
 235         if (tb[NL80211_KEY_IDX])
 236                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 237
 238         if (tb[NL80211_KEY_DATA]) {
 239                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 240                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 241         }
 242
 243         if (tb[NL80211_KEY_SEQ]) {
 244                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 245                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 246         }
 247
 248         if (tb[NL80211_KEY_CIPHER])
 249                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 250
 251         return 0;
 252 }
 253
 254 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 255 {
 256         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 257                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 258                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 259         }
 260
 261         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 262                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 263                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 264         }
 265
 266         if (info->attrs[NL80211_ATTR_KEY_IDX])
 267                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 268
 269         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 270                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 271
 272         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 273         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 274
 275         return 0;
 276 }
 277
 278 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 279 {
 280         int err;
 281
 282         memset(k, 0, sizeof(*k));
 283         k->idx = -1;
 284
 285         if (info->attrs[NL80211_ATTR_KEY])
 286                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 287         else
 288                 err = nl80211_parse_key_old(info, k);
 289
 290         if (err)
 291                 return err;
 292
 293         if (k->def && k->defmgmt)
 294                 return -EINVAL;
 295
 296         if (k->idx != -1) {
 297                 if (k->defmgmt) {
 298                         if (k->idx < 4 || k->idx > 5)
 299                                 return -EINVAL;
 300                 } else if (k->def) {
 301                         if (k->idx < 0 || k->idx > 3)
 302                                 return -EINVAL;
 303                 } else {
 304                         if (k->idx < 0 || k->idx > 5)
 305                                 return -EINVAL;
 306                 }
 307         }
 308
 309         return 0;
 310 }
 311
 312 static struct cfg80211_cached_keys *
 313 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 314                        struct nlattr *keys)
 315 {
 316         struct key_parse parse;
 317         struct nlattr *key;
 318         struct cfg80211_cached_keys *result;
 319         int rem, err, def = 0;
 320
 321         result = kzalloc(sizeof(*result), GFP_KERNEL);
 322         if (!result)
 323                 return ERR_PTR(-ENOMEM);
 324
 325         result->def = -1;
 326         result->defmgmt = -1;
 327
 328         nla_for_each_nested(key, keys, rem) {
 329                 memset(&parse, 0, sizeof(parse));
 330                 parse.idx = -1;
 331
 332                 err = nl80211_parse_key_new(key, &parse);
 333                 if (err)
 334                         goto error;
 335                 err = -EINVAL;
 336                 if (!parse.p.key)
 337                         goto error;
 338                 if (parse.idx < 0 || parse.idx > 4)
 339                         goto error;
 340                 if (parse.def) {
 341                         if (def)
 342                                 goto error;
 343                         def = 1;
 344                         result->def = parse.idx;
 345                 } else if (parse.defmgmt)
 346                         goto error;
 347                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 348                                                      parse.idx, NULL);
 349                 if (err)
 350                         goto error;
 351                 result->params[parse.idx].cipher = parse.p.cipher;
 352                 result->params[parse.idx].key_len = parse.p.key_len;
 353                 result->params[parse.idx].key = result->data[parse.idx];
 354                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 355         }
 356
 357         return result;
 358  error:
 359         kfree(result);
 360         return ERR_PTR(err);
 361 }
 362
 363 static int nl80211_key_allowed(struct wireless_dev *wdev)
 364 {
 365         ASSERT_WDEV_LOCK(wdev);
 366
 367         if (!netif_running(wdev->netdev))
 368                 return -ENETDOWN;
 369
 370         switch (wdev->iftype) {
 371         case NL80211_IFTYPE_AP:
 372         case NL80211_IFTYPE_AP_VLAN:
 373                 break;
 374         case NL80211_IFTYPE_ADHOC:
 375                 if (!wdev->current_bss)
 376                         return -ENOLINK;
 377                 break;
 378         case NL80211_IFTYPE_STATION:
 379                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 380                         return -ENOLINK;
 381                 break;
 382         default:
 383                 return -EINVAL;
 384         }
 385
 386         return 0;
 387 }
 388
 389 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 390                               struct cfg80211_registered_device *dev)
 391 {
 392         void *hdr;
 393         struct nlattr *nl_bands, *nl_band;
 394         struct nlattr *nl_freqs, *nl_freq;
 395         struct nlattr *nl_rates, *nl_rate;
 396         struct nlattr *nl_modes;
 397         struct nlattr *nl_cmds;
 398         enum ieee80211_band band;
 399         struct ieee80211_channel *chan;
 400         struct ieee80211_rate *rate;
 401         int i;
 402         u16 ifmodes = dev->wiphy.interface_modes;
 403
 404         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 405         if (!hdr)
 406                 return -1;
 407
 408         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 409         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 410
 411         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 412                    dev->wiphy.retry_short);
 413         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 414                    dev->wiphy.retry_long);
 415         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 416                     dev->wiphy.frag_threshold);
 417         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 418                     dev->wiphy.rts_threshold);
 419
 420         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 421                    dev->wiphy.max_scan_ssids);
 422         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 423                     dev->wiphy.max_scan_ie_len);
 424
 425         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 426                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 427                 dev->wiphy.cipher_suites);
 428
 429         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 430         if (!nl_modes)
 431                 goto nla_put_failure;
 432
 433         i = 0;
 434         while (ifmodes) {
 435                 if (ifmodes & 1)
 436                         NLA_PUT_FLAG(msg, i);
 437                 ifmodes >>= 1;
 438                 i++;
 439         }
 440
 441         nla_nest_end(msg, nl_modes);
 442
 443         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 444         if (!nl_bands)
 445                 goto nla_put_failure;
 446
 447         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 448                 if (!dev->wiphy.bands[band])
 449                         continue;
 450
 451                 nl_band = nla_nest_start(msg, band);
 452                 if (!nl_band)
 453                         goto nla_put_failure;
 454
 455                 /* add HT info */
 456                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 457                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 458                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 459                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 460                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 461                                 dev->wiphy.bands[band]->ht_cap.cap);
 462                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 463                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 464                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 465                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 466                 }
 467
 468                 /* add frequencies */
 469                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 470                 if (!nl_freqs)
 471                         goto nla_put_failure;
 472
 473                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 474                         nl_freq = nla_nest_start(msg, i);
 475                         if (!nl_freq)
 476                                 goto nla_put_failure;
 477
 478                         chan = &dev->wiphy.bands[band]->channels[i];
 479
 480                         if (nl80211_msg_put_channel(msg, chan))
 481                                 goto nla_put_failure;
 482
 483                         nla_nest_end(msg, nl_freq);
 484                 }
 485
 486                 nla_nest_end(msg, nl_freqs);
 487
 488                 /* add bitrates */
 489                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 490                 if (!nl_rates)
 491                         goto nla_put_failure;
 492
 493                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 494                         nl_rate = nla_nest_start(msg, i);
 495                         if (!nl_rate)
 496                                 goto nla_put_failure;
 497
 498                         rate = &dev->wiphy.bands[band]->bitrates[i];
 499                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 500                                     rate->bitrate);
 501                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 502                                 NLA_PUT_FLAG(msg,
 503                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 504
 505                         nla_nest_end(msg, nl_rate);
 506                 }
 507
 508                 nla_nest_end(msg, nl_rates);
 509
 510                 nla_nest_end(msg, nl_band);
 511         }
 512         nla_nest_end(msg, nl_bands);
 513
 514         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 515         if (!nl_cmds)
 516                 goto nla_put_failure;
 517
 518         i = 0;
 519 #define CMD(op, n)                                              \
 520          do {                                                   \
 521                 if (dev->ops->op) {                             \
 522                         i++;                                    \
 523                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 524                 }                                               \
 525         } while (0)
 526
 527         CMD(add_virtual_intf, NEW_INTERFACE);
 528         CMD(change_virtual_intf, SET_INTERFACE);
 529         CMD(add_key, NEW_KEY);
 530         CMD(add_beacon, NEW_BEACON);
 531         CMD(add_station, NEW_STATION);
 532         CMD(add_mpath, NEW_MPATH);
 533         CMD(set_mesh_params, SET_MESH_PARAMS);
 534         CMD(change_bss, SET_BSS);
 535         CMD(auth, AUTHENTICATE);
 536         CMD(assoc, ASSOCIATE);
 537         CMD(deauth, DEAUTHENTICATE);
 538         CMD(disassoc, DISASSOCIATE);
 539         CMD(join_ibss, JOIN_IBSS);
 540         if (dev->wiphy.netnsok) {
 541                 i++;
 542                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 543         }
 544
 545 #undef CMD
 546
 547         if (dev->ops->connect || dev->ops->auth) {
 548                 i++;
 549                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 550         }
 551
 552         if (dev->ops->disconnect || dev->ops->deauth) {
 553                 i++;
 554                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 555         }
 556
 557         nla_nest_end(msg, nl_cmds);
 558
 559         return genlmsg_end(msg, hdr);
 560
 561  nla_put_failure:
 562         genlmsg_cancel(msg, hdr);
 563         return -EMSGSIZE;
 564 }
 565
 566 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 567 {
 568         int idx = 0;
 569         int start = cb->args[0];
 570         struct cfg80211_registered_device *dev;
 571
 572         mutex_lock(&cfg80211_mutex);
 573         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 574                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 575                         continue;
 576                 if (++idx <= start)
 577                         continue;
 578                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 579                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 580                                        dev) < 0) {
 581                         idx--;
 582                         break;
 583                 }
 584         }
 585         mutex_unlock(&cfg80211_mutex);
 586
 587         cb->args[0] = idx;
 588
 589         return skb->len;
 590 }
 591
 592 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 593 {
 594         struct sk_buff *msg;
 595         struct cfg80211_registered_device *dev;
 596
 597         dev = cfg80211_get_dev_from_info(info);
 598         if (IS_ERR(dev))
 599                 return PTR_ERR(dev);
 600
 601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 602         if (!msg)
 603                 goto out_err;
 604
 605         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 606                 goto out_free;
 607
 608         cfg80211_unlock_rdev(dev);
 609
 610         return genlmsg_reply(msg, info);
 611
 612  out_free:
 613         nlmsg_free(msg);
 614  out_err:
 615         cfg80211_unlock_rdev(dev);
 616         return -ENOBUFS;
 617 }
 618
 619 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 620         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 621         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 622         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 623         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 624         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 625 };
 626
 627 static int parse_txq_params(struct nlattr *tb[],
 628                             struct ieee80211_txq_params *txq_params)
 629 {
 630         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 631             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 632             !tb[NL80211_TXQ_ATTR_AIFS])
 633                 return -EINVAL;
 634
 635         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 636         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 637         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 638         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 639         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 640
 641         return 0;
 642 }
 643
 644 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 645 {
 646         struct cfg80211_registered_device *rdev;
 647         int result = 0, rem_txq_params = 0;
 648         struct nlattr *nl_txq_params;
 649         u32 changed;
 650         u8 retry_short = 0, retry_long = 0;
 651         u32 frag_threshold = 0, rts_threshold = 0;
 652
 653         rtnl_lock();
 654
 655         mutex_lock(&cfg80211_mutex);
 656
 657         rdev = __cfg80211_rdev_from_info(info);
 658         if (IS_ERR(rdev)) {
 659                 mutex_unlock(&cfg80211_mutex);
 660                 result = PTR_ERR(rdev);
 661                 goto unlock;
 662         }
 663
 664         mutex_lock(&rdev->mtx);
 665
 666         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 667                 result = cfg80211_dev_rename(
 668                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 669
 670         mutex_unlock(&cfg80211_mutex);
 671
 672         if (result)
 673                 goto bad_res;
 674
 675         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 676                 struct ieee80211_txq_params txq_params;
 677                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 678
 679                 if (!rdev->ops->set_txq_params) {
 680                         result = -EOPNOTSUPP;
 681                         goto bad_res;
 682                 }
 683
 684                 nla_for_each_nested(nl_txq_params,
 685                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 686                                     rem_txq_params) {
 687                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 688                                   nla_data(nl_txq_params),
 689                                   nla_len(nl_txq_params),
 690                                   txq_params_policy);
 691                         result = parse_txq_params(tb, &txq_params);
 692                         if (result)
 693                                 goto bad_res;
 694
 695                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 696                                                            &txq_params);
 697                         if (result)
 698                                 goto bad_res;
 699                 }
 700         }
 701
 702         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 703                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 704                 struct ieee80211_channel *chan;
 705                 struct ieee80211_sta_ht_cap *ht_cap;
 706                 u32 freq;
 707
 708                 if (!rdev->ops->set_channel) {
 709                         result = -EOPNOTSUPP;
 710                         goto bad_res;
 711                 }
 712
 713                 result = -EINVAL;
 714
 715                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 716                         channel_type = nla_get_u32(info->attrs[
 717                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 718                         if (channel_type != NL80211_CHAN_NO_HT &&
 719                             channel_type != NL80211_CHAN_HT20 &&
 720                             channel_type != NL80211_CHAN_HT40PLUS &&
 721                             channel_type != NL80211_CHAN_HT40MINUS)
 722                                 goto bad_res;
 723                 }
 724
 725                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 726                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 727
 728                 /* Primary channel not allowed */
 729                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 730                         goto bad_res;
 731
 732                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 733                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 734                         goto bad_res;
 735                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 736                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 737                         goto bad_res;
 738
 739                 /*
 740                  * At this point we know if that if HT40 was requested
 741                  * we are allowed to use it and the extension channel
 742                  * exists.
 743                  */
 744
 745                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 746
 747                 /* no HT capabilities or intolerant */
 748                 if (channel_type != NL80211_CHAN_NO_HT) {
 749                         if (!ht_cap->ht_supported)
 750                                 goto bad_res;
 751                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 752                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 753                                 goto bad_res;
 754                 }
 755
 756                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 757                                                 channel_type);
 758                 if (result)
 759                         goto bad_res;
 760         }
 761
 762         changed = 0;
 763
 764         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 765                 retry_short = nla_get_u8(
 766                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 767                 if (retry_short == 0) {
 768                         result = -EINVAL;
 769                         goto bad_res;
 770                 }
 771                 changed |= WIPHY_PARAM_RETRY_SHORT;
 772         }
 773
 774         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 775                 retry_long = nla_get_u8(
 776                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 777                 if (retry_long == 0) {
 778                         result = -EINVAL;
 779                         goto bad_res;
 780                 }
 781                 changed |= WIPHY_PARAM_RETRY_LONG;
 782         }
 783
 784         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 785                 frag_threshold = nla_get_u32(
 786                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 787                 if (frag_threshold < 256) {
 788                         result = -EINVAL;
 789                         goto bad_res;
 790                 }
 791                 if (frag_threshold != (u32) -1) {
 792                         /*
 793                          * Fragments (apart from the last one) are required to
 794                          * have even length. Make the fragmentation code
 795                          * simpler by stripping LSB should someone try to use
 796                          * odd threshold value.
 797                          */
 798                         frag_threshold &= ~0x1;
 799                 }
 800                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 801         }
 802
 803         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 804                 rts_threshold = nla_get_u32(
 805                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 806                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 807         }
 808
 809         if (changed) {
 810                 u8 old_retry_short, old_retry_long;
 811                 u32 old_frag_threshold, old_rts_threshold;
 812
 813                 if (!rdev->ops->set_wiphy_params) {
 814                         result = -EOPNOTSUPP;
 815                         goto bad_res;
 816                 }
 817
 818                 old_retry_short = rdev->wiphy.retry_short;
 819                 old_retry_long = rdev->wiphy.retry_long;
 820                 old_frag_threshold = rdev->wiphy.frag_threshold;
 821                 old_rts_threshold = rdev->wiphy.rts_threshold;
 822
 823                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 824                         rdev->wiphy.retry_short = retry_short;
 825                 if (changed & WIPHY_PARAM_RETRY_LONG)
 826                         rdev->wiphy.retry_long = retry_long;
 827                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 828                         rdev->wiphy.frag_threshold = frag_threshold;
 829                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 830                         rdev->wiphy.rts_threshold = rts_threshold;
 831
 832                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 833                 if (result) {
 834                         rdev->wiphy.retry_short = old_retry_short;
 835                         rdev->wiphy.retry_long = old_retry_long;
 836                         rdev->wiphy.frag_threshold = old_frag_threshold;
 837                         rdev->wiphy.rts_threshold = old_rts_threshold;
 838                 }
 839         }
 840
 841  bad_res:
 842         mutex_unlock(&rdev->mtx);
 843  unlock:
 844         rtnl_unlock();
 845         return result;
 846 }
 847
 848
 849 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 850                               struct cfg80211_registered_device *rdev,
 851                               struct net_device *dev)
 852 {
 853         void *hdr;
 854
 855         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 856         if (!hdr)
 857                 return -1;
 858
 859         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 860         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 861         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 862         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 863         return genlmsg_end(msg, hdr);
 864
 865  nla_put_failure:
 866         genlmsg_cancel(msg, hdr);
 867         return -EMSGSIZE;
 868 }
 869
 870 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 871 {
 872         int wp_idx = 0;
 873         int if_idx = 0;
 874         int wp_start = cb->args[0];
 875         int if_start = cb->args[1];
 876         struct cfg80211_registered_device *dev;
 877         struct wireless_dev *wdev;
 878
 879         mutex_lock(&cfg80211_mutex);
 880         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 881                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 882                         continue;
 883                 if (wp_idx < wp_start) {
 884                         wp_idx++;
 885                         continue;
 886                 }
 887                 if_idx = 0;
 888
 889                 mutex_lock(&dev->devlist_mtx);
 890                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 891                         if (if_idx < if_start) {
 892                                 if_idx++;
 893                                 continue;
 894                         }
 895                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 896                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 897                                                dev, wdev->netdev) < 0) {
 898                                 mutex_unlock(&dev->devlist_mtx);
 899                                 goto out;
 900                         }
 901                         if_idx++;
 902                 }
 903                 mutex_unlock(&dev->devlist_mtx);
 904
 905                 wp_idx++;
 906         }
 907  out:
 908         mutex_unlock(&cfg80211_mutex);
 909
 910         cb->args[0] = wp_idx;
 911         cb->args[1] = if_idx;
 912
 913         return skb->len;
 914 }
 915
 916 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 917 {
 918         struct sk_buff *msg;
 919         struct cfg80211_registered_device *dev;
 920         struct net_device *netdev;
 921         int err;
 922
 923         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 924         if (err)
 925                 return err;
 926
 927         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 928         if (!msg)
 929                 goto out_err;
 930
 931         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 932                                dev, netdev) < 0)
 933                 goto out_free;
 934
 935         dev_put(netdev);
 936         cfg80211_unlock_rdev(dev);
 937
 938         return genlmsg_reply(msg, info);
 939
 940  out_free:
 941         nlmsg_free(msg);
 942  out_err:
 943         dev_put(netdev);
 944         cfg80211_unlock_rdev(dev);
 945         return -ENOBUFS;
 946 }
 947
 948 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 949         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 950         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 951         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 952         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 953         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 954 };
 955
 956 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 957 {
 958         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 959         int flag;
 960
 961         *mntrflags = 0;
 962
 963         if (!nla)
 964                 return -EINVAL;
 965
 966         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 967                              nla, mntr_flags_policy))
 968                 return -EINVAL;
 969
 970         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 971                 if (flags[flag])
 972                         *mntrflags |= (1<<flag);
 973
 974         return 0;
 975 }
 976
 977 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 978 {
 979         struct cfg80211_registered_device *rdev;
 980         struct vif_params params;
 981         int err;
 982         enum nl80211_iftype otype, ntype;
 983         struct net_device *dev;
 984         u32 _flags, *flags = NULL;
 985         bool change = false;
 986
 987         memset(&params, 0, sizeof(params));
 988
 989         rtnl_lock();
 990
 991         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
 992         if (err)
 993                 goto unlock_rtnl;
 994
 995         otype = ntype = dev->ieee80211_ptr->iftype;
 996
 997         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 998                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 999                 if (otype != ntype)
1000                         change = true;
1001                 if (ntype > NL80211_IFTYPE_MAX) {
1002                         err = -EINVAL;
1003                         goto unlock;
1004                 }
1005         }
1006
1007         if (!rdev->ops->change_virtual_intf ||
1008             !(rdev->wiphy.interface_modes & (1 << ntype))) {
1009                 err = -EOPNOTSUPP;
1010                 goto unlock;
1011         }
1012
1013         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1014                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1015                         err = -EINVAL;
1016                         goto unlock;
1017                 }
1018                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1019                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1020                 change = true;
1021         }
1022
1023         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1024                 if (ntype != NL80211_IFTYPE_MONITOR) {
1025                         err = -EINVAL;
1026                         goto unlock;
1027                 }
1028                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1029                                           &_flags);
1030                 if (err)
1031                         goto unlock;
1032
1033                 flags = &_flags;
1034                 change = true;
1035         }
1036
1037         if (change)
1038                 err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
1039                                                     ntype, flags, &params);
1040         else
1041                 err = 0;
1042
1043         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
1044
1045         if (!err && (ntype != otype)) {
1046                 if (otype == NL80211_IFTYPE_ADHOC)
1047                         cfg80211_clear_ibss(dev, false);
1048         }
1049
1050  unlock:
1051         dev_put(dev);
1052         cfg80211_unlock_rdev(rdev);
1053  unlock_rtnl:
1054         rtnl_unlock();
1055         return err;
1056 }
1057
1058 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1059 {
1060         struct cfg80211_registered_device *rdev;
1061         struct vif_params params;
1062         int err;
1063         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1064         u32 flags;
1065
1066         memset(&params, 0, sizeof(params));
1067
1068         if (!info->attrs[NL80211_ATTR_IFNAME])
1069                 return -EINVAL;
1070
1071         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1072                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1073                 if (type > NL80211_IFTYPE_MAX)
1074                         return -EINVAL;
1075         }
1076
1077         rtnl_lock();
1078
1079         rdev = cfg80211_get_dev_from_info(info);
1080         if (IS_ERR(rdev)) {
1081                 err = PTR_ERR(rdev);
1082                 goto unlock_rtnl;
1083         }
1084
1085         if (!rdev->ops->add_virtual_intf ||
1086             !(rdev->wiphy.interface_modes & (1 << type))) {
1087                 err = -EOPNOTSUPP;
1088                 goto unlock;
1089         }
1090
1091         if (type == NL80211_IFTYPE_MESH_POINT &&
1092             info->attrs[NL80211_ATTR_MESH_ID]) {
1093                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1094                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1095         }
1096
1097         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1098                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1099                                   &flags);
1100         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1101                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1102                 type, err ? NULL : &flags, &params);
1103
1104  unlock:
1105         cfg80211_unlock_rdev(rdev);
1106  unlock_rtnl:
1107         rtnl_unlock();
1108         return err;
1109 }
1110
1111 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1112 {
1113         struct cfg80211_registered_device *rdev;
1114         int err;
1115         struct net_device *dev;
1116
1117         rtnl_lock();
1118
1119         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1120         if (err)
1121                 goto unlock_rtnl;
1122
1123         if (!rdev->ops->del_virtual_intf) {
1124                 err = -EOPNOTSUPP;
1125                 goto out;
1126         }
1127
1128         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1129
1130  out:
1131         cfg80211_unlock_rdev(rdev);
1132         dev_put(dev);
1133  unlock_rtnl:
1134         rtnl_unlock();
1135         return err;
1136 }
1137
1138 struct get_key_cookie {
1139         struct sk_buff *msg;
1140         int error;
1141         int idx;
1142 };
1143
1144 static void get_key_callback(void *c, struct key_params *params)
1145 {
1146         struct nlattr *key;
1147         struct get_key_cookie *cookie = c;
1148
1149         if (params->key)
1150                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1151                         params->key_len, params->key);
1152
1153         if (params->seq)
1154                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1155                         params->seq_len, params->seq);
1156
1157         if (params->cipher)
1158                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1159                             params->cipher);
1160
1161         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1162         if (!key)
1163                 goto nla_put_failure;
1164
1165         if (params->key)
1166                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1167                         params->key_len, params->key);
1168
1169         if (params->seq)
1170                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1171                         params->seq_len, params->seq);
1172
1173         if (params->cipher)
1174                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1175                             params->cipher);
1176
1177         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1178
1179         nla_nest_end(cookie->msg, key);
1180
1181         return;
1182  nla_put_failure:
1183         cookie->error = 1;
1184 }
1185
1186 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1187 {
1188         struct cfg80211_registered_device *rdev;
1189         int err;
1190         struct net_device *dev;
1191         u8 key_idx = 0;
1192         u8 *mac_addr = NULL;
1193         struct get_key_cookie cookie = {
1194                 .error = 0,
1195         };
1196         void *hdr;
1197         struct sk_buff *msg;
1198
1199         if (info->attrs[NL80211_ATTR_KEY_IDX])
1200                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1201
1202         if (key_idx > 5)
1203                 return -EINVAL;
1204
1205         if (info->attrs[NL80211_ATTR_MAC])
1206                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1207
1208         rtnl_lock();
1209
1210         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1211         if (err)
1212                 goto unlock_rtnl;
1213
1214         if (!rdev->ops->get_key) {
1215                 err = -EOPNOTSUPP;
1216                 goto out;
1217         }
1218
1219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1220         if (!msg) {
1221                 err = -ENOMEM;
1222                 goto out;
1223         }
1224
1225         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1226                              NL80211_CMD_NEW_KEY);
1227
1228         if (IS_ERR(hdr)) {
1229                 err = PTR_ERR(hdr);
1230                 goto free_msg;
1231         }
1232
1233         cookie.msg = msg;
1234         cookie.idx = key_idx;
1235
1236         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1237         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1238         if (mac_addr)
1239                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1240
1241         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1242                                 &cookie, get_key_callback);
1243
1244         if (err)
1245                 goto free_msg;
1246
1247         if (cookie.error)
1248                 goto nla_put_failure;
1249
1250         genlmsg_end(msg, hdr);
1251         err = genlmsg_reply(msg, info);
1252         goto out;
1253
1254  nla_put_failure:
1255         err = -ENOBUFS;
1256  free_msg:
1257         nlmsg_free(msg);
1258  out:
1259         cfg80211_unlock_rdev(rdev);
1260         dev_put(dev);
1261  unlock_rtnl:
1262         rtnl_unlock();
1263
1264         return err;
1265 }
1266
1267 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1268 {
1269         struct cfg80211_registered_device *rdev;
1270         struct key_parse key;
1271         int err;
1272         struct net_device *dev;
1273         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1274                     u8 key_index);
1275
1276         err = nl80211_parse_key(info, &key);
1277         if (err)
1278                 return err;
1279
1280         if (key.idx < 0)
1281                 return -EINVAL;
1282
1283         /* only support setting default key */
1284         if (!key.def && !key.defmgmt)
1285                 return -EINVAL;
1286
1287         rtnl_lock();
1288
1289         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1290         if (err)
1291                 goto unlock_rtnl;
1292
1293         if (key.def)
1294                 func = rdev->ops->set_default_key;
1295         else
1296                 func = rdev->ops->set_default_mgmt_key;
1297
1298         if (!func) {
1299                 err = -EOPNOTSUPP;
1300                 goto out;
1301         }
1302
1303         wdev_lock(dev->ieee80211_ptr);
1304         err = nl80211_key_allowed(dev->ieee80211_ptr);
1305         if (!err)
1306                 err = func(&rdev->wiphy, dev, key.idx);
1307
1308 #ifdef CONFIG_WIRELESS_EXT
1309         if (!err) {
1310                 if (func == rdev->ops->set_default_key)
1311                         dev->ieee80211_ptr->wext.default_key = key.idx;
1312                 else
1313                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1314         }
1315 #endif
1316         wdev_unlock(dev->ieee80211_ptr);
1317
1318  out:
1319         cfg80211_unlock_rdev(rdev);
1320         dev_put(dev);
1321
1322  unlock_rtnl:
1323         rtnl_unlock();
1324
1325         return err;
1326 }
1327
1328 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1329 {
1330         struct cfg80211_registered_device *rdev;
1331         int err;
1332         struct net_device *dev;
1333         struct key_parse key;
1334         u8 *mac_addr = NULL;
1335
1336         err = nl80211_parse_key(info, &key);
1337         if (err)
1338                 return err;
1339
1340         if (!key.p.key)
1341                 return -EINVAL;
1342
1343         if (info->attrs[NL80211_ATTR_MAC])
1344                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1345
1346         rtnl_lock();
1347
1348         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1349         if (err)
1350                 goto unlock_rtnl;
1351
1352         if (!rdev->ops->add_key) {
1353                 err = -EOPNOTSUPP;
1354                 goto out;
1355         }
1356
1357         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1358                 err = -EINVAL;
1359                 goto out;
1360         }
1361
1362         wdev_lock(dev->ieee80211_ptr);
1363         err = nl80211_key_allowed(dev->ieee80211_ptr);
1364         if (!err)
1365                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1366                                          mac_addr, &key.p);
1367         wdev_unlock(dev->ieee80211_ptr);
1368
1369  out:
1370         cfg80211_unlock_rdev(rdev);
1371         dev_put(dev);
1372  unlock_rtnl:
1373         rtnl_unlock();
1374
1375         return err;
1376 }
1377
1378 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1379 {
1380         struct cfg80211_registered_device *rdev;
1381         int err;
1382         struct net_device *dev;
1383         u8 *mac_addr = NULL;
1384         struct key_parse key;
1385
1386         err = nl80211_parse_key(info, &key);
1387         if (err)
1388                 return err;
1389
1390         if (info->attrs[NL80211_ATTR_MAC])
1391                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1392
1393         rtnl_lock();
1394
1395         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1396         if (err)
1397                 goto unlock_rtnl;
1398
1399         if (!rdev->ops->del_key) {
1400                 err = -EOPNOTSUPP;
1401                 goto out;
1402         }
1403
1404         wdev_lock(dev->ieee80211_ptr);
1405         err = nl80211_key_allowed(dev->ieee80211_ptr);
1406         if (!err)
1407                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1408
1409 #ifdef CONFIG_WIRELESS_EXT
1410         if (!err) {
1411                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1412                         dev->ieee80211_ptr->wext.default_key = -1;
1413                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1414                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1415         }
1416 #endif
1417         wdev_unlock(dev->ieee80211_ptr);
1418
1419  out:
1420         cfg80211_unlock_rdev(rdev);
1421         dev_put(dev);
1422
1423  unlock_rtnl:
1424         rtnl_unlock();
1425
1426         return err;
1427 }
1428
1429 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1430 {
1431         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1432                     struct beacon_parameters *info);
1433         struct cfg80211_registered_device *rdev;
1434         int err;
1435         struct net_device *dev;
1436         struct beacon_parameters params;
1437         int haveinfo = 0;
1438
1439         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1440                 return -EINVAL;
1441
1442         rtnl_lock();
1443
1444         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1445         if (err)
1446                 goto unlock_rtnl;
1447
1448         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1449                 err = -EOPNOTSUPP;
1450                 goto out;
1451         }
1452
1453         switch (info->genlhdr->cmd) {
1454         case NL80211_CMD_NEW_BEACON:
1455                 /* these are required for NEW_BEACON */
1456                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1457                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1458                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1459                         err = -EINVAL;
1460                         goto out;
1461                 }
1462
1463                 call = rdev->ops->add_beacon;
1464                 break;
1465         case NL80211_CMD_SET_BEACON:
1466                 call = rdev->ops->set_beacon;
1467                 break;
1468         default:
1469                 WARN_ON(1);
1470                 err = -EOPNOTSUPP;
1471                 goto out;
1472         }
1473
1474         if (!call) {
1475                 err = -EOPNOTSUPP;
1476                 goto out;
1477         }
1478
1479         memset(&params, 0, sizeof(params));
1480
1481         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1482                 params.interval =
1483                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1484                 haveinfo = 1;
1485         }
1486
1487         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1488                 params.dtim_period =
1489                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1490                 haveinfo = 1;
1491         }
1492
1493         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1494                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1495                 params.head_len =
1496                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1497                 haveinfo = 1;
1498         }
1499
1500         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1501                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1502                 params.tail_len =
1503                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1504                 haveinfo = 1;
1505         }
1506
1507         if (!haveinfo) {
1508                 err = -EINVAL;
1509                 goto out;
1510         }
1511
1512         err = call(&rdev->wiphy, dev, &params);
1513
1514  out:
1515         cfg80211_unlock_rdev(rdev);
1516         dev_put(dev);
1517  unlock_rtnl:
1518         rtnl_unlock();
1519
1520         return err;
1521 }
1522
1523 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1524 {
1525         struct cfg80211_registered_device *rdev;
1526         int err;
1527         struct net_device *dev;
1528
1529         rtnl_lock();
1530
1531         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1532         if (err)
1533                 goto unlock_rtnl;
1534
1535         if (!rdev->ops->del_beacon) {
1536                 err = -EOPNOTSUPP;
1537                 goto out;
1538         }
1539
1540         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1541                 err = -EOPNOTSUPP;
1542                 goto out;
1543         }
1544         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1545
1546  out:
1547         cfg80211_unlock_rdev(rdev);
1548         dev_put(dev);
1549  unlock_rtnl:
1550         rtnl_unlock();
1551
1552         return err;
1553 }
1554
1555 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1556         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1557         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1558         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1559         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1560 };
1561
1562 static int parse_station_flags(struct genl_info *info,
1563                                struct station_parameters *params)
1564 {
1565         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1566         struct nlattr *nla;
1567         int flag;
1568
1569         /*
1570          * Try parsing the new attribute first so userspace
1571          * can specify both for older kernels.
1572          */
1573         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1574         if (nla) {
1575                 struct nl80211_sta_flag_update *sta_flags;
1576
1577                 sta_flags = nla_data(nla);
1578                 params->sta_flags_mask = sta_flags->mask;
1579                 params->sta_flags_set = sta_flags->set;
1580                 if ((params->sta_flags_mask |
1581                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1582                         return -EINVAL;
1583                 return 0;
1584         }
1585
1586         /* if present, parse the old attribute */
1587
1588         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1589         if (!nla)
1590                 return 0;
1591
1592         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1593                              nla, sta_flags_policy))
1594                 return -EINVAL;
1595
1596         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1597         params->sta_flags_mask &= ~1;
1598
1599         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1600                 if (flags[flag])
1601                         params->sta_flags_set |= (1<<flag);
1602
1603         return 0;
1604 }
1605
1606 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1607 {
1608         int modulation, streams, bitrate;
1609
1610         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1611                 return rate->legacy;
1612
1613         /* the formula below does only work for MCS values smaller than 32 */
1614         if (rate->mcs >= 32)
1615                 return 0;
1616
1617         modulation = rate->mcs & 7;
1618         streams = (rate->mcs >> 3) + 1;
1619
1620         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1621                         13500000 : 6500000;
1622
1623         if (modulation < 4)
1624                 bitrate *= (modulation + 1);
1625         else if (modulation == 4)
1626                 bitrate *= (modulation + 2);
1627         else
1628                 bitrate *= (modulation + 3);
1629
1630         bitrate *= streams;
1631
1632         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1633                 bitrate = (bitrate / 9) * 10;
1634
1635         /* do NOT round down here */
1636         return (bitrate + 50000) / 100000;
1637 }
1638
1639 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1640                                 int flags, struct net_device *dev,
1641                                 u8 *mac_addr, struct station_info *sinfo)
1642 {
1643         void *hdr;
1644         struct nlattr *sinfoattr, *txrate;
1645         u16 bitrate;
1646
1647         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1648         if (!hdr)
1649                 return -1;
1650
1651         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1652         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1653
1654         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1655         if (!sinfoattr)
1656                 goto nla_put_failure;
1657         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1658                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1659                             sinfo->inactive_time);
1660         if (sinfo->filled & STATION_INFO_RX_BYTES)
1661                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1662                             sinfo->rx_bytes);
1663         if (sinfo->filled & STATION_INFO_TX_BYTES)
1664                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1665                             sinfo->tx_bytes);
1666         if (sinfo->filled & STATION_INFO_LLID)
1667                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1668                             sinfo->llid);
1669         if (sinfo->filled & STATION_INFO_PLID)
1670                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1671                             sinfo->plid);
1672         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1673                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1674                             sinfo->plink_state);
1675         if (sinfo->filled & STATION_INFO_SIGNAL)
1676                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1677                            sinfo->signal);
1678         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1679                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1680                 if (!txrate)
1681                         goto nla_put_failure;
1682
1683                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1684                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1685                 if (bitrate > 0)
1686                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1687
1688                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1689                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1690                                     sinfo->txrate.mcs);
1691                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1692                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1693                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1694                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1695
1696                 nla_nest_end(msg, txrate);
1697         }
1698         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1699                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1700                             sinfo->rx_packets);
1701         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1702                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1703                             sinfo->tx_packets);
1704         nla_nest_end(msg, sinfoattr);
1705
1706         return genlmsg_end(msg, hdr);
1707
1708  nla_put_failure:
1709         genlmsg_cancel(msg, hdr);
1710         return -EMSGSIZE;
1711 }
1712
1713 static int nl80211_dump_station(struct sk_buff *skb,
1714                                 struct netlink_callback *cb)
1715 {
1716         struct station_info sinfo;
1717         struct cfg80211_registered_device *dev;
1718         struct net_device *netdev;
1719         u8 mac_addr[ETH_ALEN];
1720         int ifidx = cb->args[0];
1721         int sta_idx = cb->args[1];
1722         int err;
1723
1724         if (!ifidx) {
1725                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1726                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1727                                   nl80211_policy);
1728                 if (err)
1729                         return err;
1730
1731                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1732                         return -EINVAL;
1733
1734                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1735                 if (!ifidx)
1736                         return -EINVAL;
1737         }
1738
1739         rtnl_lock();
1740
1741         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1742         if (!netdev) {
1743                 err = -ENODEV;
1744                 goto out_rtnl;
1745         }
1746
1747         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1748         if (IS_ERR(dev)) {
1749                 err = PTR_ERR(dev);
1750                 goto out_rtnl;
1751         }
1752
1753         if (!dev->ops->dump_station) {
1754                 err = -EOPNOTSUPP;
1755                 goto out_err;
1756         }
1757
1758         while (1) {
1759                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1760                                              mac_addr, &sinfo);
1761                 if (err == -ENOENT)
1762                         break;
1763                 if (err)
1764                         goto out_err;
1765
1766                 if (nl80211_send_station(skb,
1767                                 NETLINK_CB(cb->skb).pid,
1768                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1769                                 netdev, mac_addr,
1770                                 &sinfo) < 0)
1771                         goto out;
1772
1773                 sta_idx++;
1774         }
1775
1776
1777  out:
1778         cb->args[1] = sta_idx;
1779         err = skb->len;
1780  out_err:
1781         cfg80211_unlock_rdev(dev);
1782  out_rtnl:
1783         rtnl_unlock();
1784
1785         return err;
1786 }
1787
1788 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1789 {
1790         struct cfg80211_registered_device *rdev;
1791         int err;
1792         struct net_device *dev;
1793         struct station_info sinfo;
1794         struct sk_buff *msg;
1795         u8 *mac_addr = NULL;
1796
1797         memset(&sinfo, 0, sizeof(sinfo));
1798
1799         if (!info->attrs[NL80211_ATTR_MAC])
1800                 return -EINVAL;
1801
1802         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1803
1804         rtnl_lock();
1805
1806         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1807         if (err)
1808                 goto out_rtnl;
1809
1810         if (!rdev->ops->get_station) {
1811                 err = -EOPNOTSUPP;
1812                 goto out;
1813         }
1814
1815         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1816         if (err)
1817                 goto out;
1818
1819         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1820         if (!msg)
1821                 goto out;
1822
1823         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1824                                  dev, mac_addr, &sinfo) < 0)
1825                 goto out_free;
1826
1827         err = genlmsg_reply(msg, info);
1828         goto out;
1829
1830  out_free:
1831         nlmsg_free(msg);
1832  out:
1833         cfg80211_unlock_rdev(rdev);
1834         dev_put(dev);
1835  out_rtnl:
1836         rtnl_unlock();
1837
1838         return err;
1839 }
1840
1841 /*
1842  * Get vlan interface making sure it is on the right wiphy.
1843  */
1844 static int get_vlan(struct genl_info *info,
1845                     struct cfg80211_registered_device *rdev,
1846                     struct net_device **vlan)
1847 {
1848         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1849         *vlan = NULL;
1850
1851         if (vlanattr) {
1852                 *vlan = dev_get_by_index(genl_info_net(info),
1853                                          nla_get_u32(vlanattr));
1854                 if (!*vlan)
1855                         return -ENODEV;
1856                 if (!(*vlan)->ieee80211_ptr)
1857                         return -EINVAL;
1858                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1859                         return -EINVAL;
1860         }
1861         return 0;
1862 }
1863
1864 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1865 {
1866         struct cfg80211_registered_device *rdev;
1867         int err;
1868         struct net_device *dev;
1869         struct station_parameters params;
1870         u8 *mac_addr = NULL;
1871
1872         memset(&params, 0, sizeof(params));
1873
1874         params.listen_interval = -1;
1875
1876         if (info->attrs[NL80211_ATTR_STA_AID])
1877                 return -EINVAL;
1878
1879         if (!info->attrs[NL80211_ATTR_MAC])
1880                 return -EINVAL;
1881
1882         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1883
1884         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1885                 params.supported_rates =
1886                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1887                 params.supported_rates_len =
1888                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1889         }
1890
1891         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1892                 params.listen_interval =
1893                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1894
1895         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1896                 params.ht_capa =
1897                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1898
1899         if (parse_station_flags(info, &params))
1900                 return -EINVAL;
1901
1902         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1903                 params.plink_action =
1904                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1905
1906         rtnl_lock();
1907
1908         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1909         if (err)
1910                 goto out_rtnl;
1911
1912         err = get_vlan(info, rdev, &params.vlan);
1913         if (err)
1914                 goto out;
1915
1916         /* validate settings */
1917         err = 0;
1918
1919         switch (dev->ieee80211_ptr->iftype) {
1920         case NL80211_IFTYPE_AP:
1921         case NL80211_IFTYPE_AP_VLAN:
1922                 /* disallow mesh-specific things */
1923                 if (params.plink_action)
1924                         err = -EINVAL;
1925                 break;
1926         case NL80211_IFTYPE_STATION:
1927                 /* disallow everything but AUTHORIZED flag */
1928                 if (params.plink_action)
1929                         err = -EINVAL;
1930                 if (params.vlan)
1931                         err = -EINVAL;
1932                 if (params.supported_rates)
1933                         err = -EINVAL;
1934                 if (params.ht_capa)
1935                         err = -EINVAL;
1936                 if (params.listen_interval >= 0)
1937                         err = -EINVAL;
1938                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1939                         err = -EINVAL;
1940                 break;
1941         case NL80211_IFTYPE_MESH_POINT:
1942                 /* disallow things mesh doesn't support */
1943                 if (params.vlan)
1944                         err = -EINVAL;
1945                 if (params.ht_capa)
1946                         err = -EINVAL;
1947                 if (params.listen_interval >= 0)
1948                         err = -EINVAL;
1949                 if (params.supported_rates)
1950                         err = -EINVAL;
1951                 if (params.sta_flags_mask)
1952                         err = -EINVAL;
1953                 break;
1954         default:
1955                 err = -EINVAL;
1956         }
1957
1958         if (err)
1959                 goto out;
1960
1961         if (!rdev->ops->change_station) {
1962                 err = -EOPNOTSUPP;
1963                 goto out;
1964         }
1965
1966         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1967
1968  out:
1969         if (params.vlan)
1970                 dev_put(params.vlan);
1971         cfg80211_unlock_rdev(rdev);
1972         dev_put(dev);
1973  out_rtnl:
1974         rtnl_unlock();
1975
1976         return err;
1977 }
1978
1979 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1980 {
1981         struct cfg80211_registered_device *rdev;
1982         int err;
1983         struct net_device *dev;
1984         struct station_parameters params;
1985         u8 *mac_addr = NULL;
1986
1987         memset(&params, 0, sizeof(params));
1988
1989         if (!info->attrs[NL80211_ATTR_MAC])
1990                 return -EINVAL;
1991
1992         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1993                 return -EINVAL;
1994
1995         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1996                 return -EINVAL;
1997
1998         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1999         params.supported_rates =
2000                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2001         params.supported_rates_len =
2002                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2003         params.listen_interval =
2004                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2005
2006         if (info->attrs[NL80211_ATTR_STA_AID]) {
2007                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2008                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
2009                         return -EINVAL;
2010         }
2011
2012         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2013                 params.ht_capa =
2014                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2015
2016         if (parse_station_flags(info, &params))
2017                 return -EINVAL;
2018
2019         rtnl_lock();
2020
2021         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2022         if (err)
2023                 goto out_rtnl;
2024
2025         err = get_vlan(info, rdev, &params.vlan);
2026         if (err)
2027                 goto out;
2028
2029         /* validate settings */
2030         err = 0;
2031
2032         switch (dev->ieee80211_ptr->iftype) {
2033         case NL80211_IFTYPE_AP:
2034         case NL80211_IFTYPE_AP_VLAN:
2035                 /* all ok but must have AID */
2036                 if (!params.aid)
2037                         err = -EINVAL;
2038                 break;
2039         case NL80211_IFTYPE_MESH_POINT:
2040                 /* disallow things mesh doesn't support */
2041                 if (params.vlan)
2042                         err = -EINVAL;
2043                 if (params.aid)
2044                         err = -EINVAL;
2045                 if (params.ht_capa)
2046                         err = -EINVAL;
2047                 if (params.listen_interval >= 0)
2048                         err = -EINVAL;
2049                 if (params.supported_rates)
2050                         err = -EINVAL;
2051                 if (params.sta_flags_mask)
2052                         err = -EINVAL;
2053                 break;
2054         default:
2055                 err = -EINVAL;
2056         }
2057
2058         if (err)
2059                 goto out;
2060
2061         if (!rdev->ops->add_station) {
2062                 err = -EOPNOTSUPP;
2063                 goto out;
2064         }
2065
2066         if (!netif_running(dev)) {
2067                 err = -ENETDOWN;
2068                 goto out;
2069         }
2070
2071         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2072
2073  out:
2074         if (params.vlan)
2075                 dev_put(params.vlan);
2076         cfg80211_unlock_rdev(rdev);
2077         dev_put(dev);
2078  out_rtnl:
2079         rtnl_unlock();
2080
2081         return err;
2082 }
2083
2084 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2085 {
2086         struct cfg80211_registered_device *rdev;
2087         int err;
2088         struct net_device *dev;
2089         u8 *mac_addr = NULL;
2090
2091         if (info->attrs[NL80211_ATTR_MAC])
2092                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2093
2094         rtnl_lock();
2095
2096         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2097         if (err)
2098                 goto out_rtnl;
2099
2100         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2101             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2103                 err = -EINVAL;
2104                 goto out;
2105         }
2106
2107         if (!rdev->ops->del_station) {
2108                 err = -EOPNOTSUPP;
2109                 goto out;
2110         }
2111
2112         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2113
2114  out:
2115         cfg80211_unlock_rdev(rdev);
2116         dev_put(dev);
2117  out_rtnl:
2118         rtnl_unlock();
2119
2120         return err;
2121 }
2122
2123 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2124                                 int flags, struct net_device *dev,
2125                                 u8 *dst, u8 *next_hop,
2126                                 struct mpath_info *pinfo)
2127 {
2128         void *hdr;
2129         struct nlattr *pinfoattr;
2130
2131         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2132         if (!hdr)
2133                 return -1;
2134
2135         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2136         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2137         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2138
2139         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2140         if (!pinfoattr)
2141                 goto nla_put_failure;
2142         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2143                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2144                             pinfo->frame_qlen);
2145         if (pinfo->filled & MPATH_INFO_DSN)
2146                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
2147                             pinfo->dsn);
2148         if (pinfo->filled & MPATH_INFO_METRIC)
2149                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2150                             pinfo->metric);
2151         if (pinfo->filled & MPATH_INFO_EXPTIME)
2152                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2153                             pinfo->exptime);
2154         if (pinfo->filled & MPATH_INFO_FLAGS)
2155                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2156                             pinfo->flags);
2157         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2158                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2159                             pinfo->discovery_timeout);
2160         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2161                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2162                             pinfo->discovery_retries);
2163
2164         nla_nest_end(msg, pinfoattr);
2165
2166         return genlmsg_end(msg, hdr);
2167
2168  nla_put_failure:
2169         genlmsg_cancel(msg, hdr);
2170         return -EMSGSIZE;
2171 }
2172
2173 static int nl80211_dump_mpath(struct sk_buff *skb,
2174                               struct netlink_callback *cb)
2175 {
2176         struct mpath_info pinfo;
2177         struct cfg80211_registered_device *dev;
2178         struct net_device *netdev;
2179         u8 dst[ETH_ALEN];
2180         u8 next_hop[ETH_ALEN];
2181         int ifidx = cb->args[0];
2182         int path_idx = cb->args[1];
2183         int err;
2184
2185         if (!ifidx) {
2186                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2187                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2188                                   nl80211_policy);
2189                 if (err)
2190                         return err;
2191
2192                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2193                         return -EINVAL;
2194
2195                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2196                 if (!ifidx)
2197                         return -EINVAL;
2198         }
2199
2200         rtnl_lock();
2201
2202         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2203         if (!netdev) {
2204                 err = -ENODEV;
2205                 goto out_rtnl;
2206         }
2207
2208         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2209         if (IS_ERR(dev)) {
2210                 err = PTR_ERR(dev);
2211                 goto out_rtnl;
2212         }
2213
2214         if (!dev->ops->dump_mpath) {
2215                 err = -EOPNOTSUPP;
2216                 goto out_err;
2217         }
2218
2219         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2220                 err = -EOPNOTSUPP;
2221                 goto out;
2222         }
2223
2224         while (1) {
2225                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2226                                            dst, next_hop, &pinfo);
2227                 if (err == -ENOENT)
2228                         break;
2229                 if (err)
2230                         goto out_err;
2231
2232                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2233                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2234                                        netdev, dst, next_hop,
2235                                        &pinfo) < 0)
2236                         goto out;
2237
2238                 path_idx++;
2239         }
2240
2241
2242  out:
2243         cb->args[1] = path_idx;
2244         err = skb->len;
2245  out_err:
2246         cfg80211_unlock_rdev(dev);
2247  out_rtnl:
2248         rtnl_unlock();
2249
2250         return err;
2251 }
2252
2253 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2254 {
2255         struct cfg80211_registered_device *rdev;
2256         int err;
2257         struct net_device *dev;
2258         struct mpath_info pinfo;
2259         struct sk_buff *msg;
2260         u8 *dst = NULL;
2261         u8 next_hop[ETH_ALEN];
2262
2263         memset(&pinfo, 0, sizeof(pinfo));
2264
2265         if (!info->attrs[NL80211_ATTR_MAC])
2266                 return -EINVAL;
2267
2268         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2269
2270         rtnl_lock();
2271
2272         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2273         if (err)
2274                 goto out_rtnl;
2275
2276         if (!rdev->ops->get_mpath) {
2277                 err = -EOPNOTSUPP;
2278                 goto out;
2279         }
2280
2281         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2282                 err = -EOPNOTSUPP;
2283                 goto out;
2284         }
2285
2286         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2287         if (err)
2288                 goto out;
2289
2290         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2291         if (!msg)
2292                 goto out;
2293
2294         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2295                                  dev, dst, next_hop, &pinfo) < 0)
2296                 goto out_free;
2297
2298         err = genlmsg_reply(msg, info);
2299         goto out;
2300
2301  out_free:
2302         nlmsg_free(msg);
2303  out:
2304         cfg80211_unlock_rdev(rdev);
2305         dev_put(dev);
2306  out_rtnl:
2307         rtnl_unlock();
2308
2309         return err;
2310 }
2311
2312 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2313 {
2314         struct cfg80211_registered_device *rdev;
2315         int err;
2316         struct net_device *dev;
2317         u8 *dst = NULL;
2318         u8 *next_hop = NULL;
2319
2320         if (!info->attrs[NL80211_ATTR_MAC])
2321                 return -EINVAL;
2322
2323         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2324                 return -EINVAL;
2325
2326         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2327         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2328
2329         rtnl_lock();
2330
2331         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2332         if (err)
2333                 goto out_rtnl;
2334
2335         if (!rdev->ops->change_mpath) {
2336                 err = -EOPNOTSUPP;
2337                 goto out;
2338         }
2339
2340         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2341                 err = -EOPNOTSUPP;
2342                 goto out;
2343         }
2344
2345         if (!netif_running(dev)) {
2346                 err = -ENETDOWN;
2347                 goto out;
2348         }
2349
2350         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2351
2352  out:
2353         cfg80211_unlock_rdev(rdev);
2354         dev_put(dev);
2355  out_rtnl:
2356         rtnl_unlock();
2357
2358         return err;
2359 }
2360 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2361 {
2362         struct cfg80211_registered_device *rdev;
2363         int err;
2364         struct net_device *dev;
2365         u8 *dst = NULL;
2366         u8 *next_hop = NULL;
2367
2368         if (!info->attrs[NL80211_ATTR_MAC])
2369                 return -EINVAL;
2370
2371         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2372                 return -EINVAL;
2373
2374         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2375         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2376
2377         rtnl_lock();
2378
2379         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2380         if (err)
2381                 goto out_rtnl;
2382
2383         if (!rdev->ops->add_mpath) {
2384                 err = -EOPNOTSUPP;
2385                 goto out;
2386         }
2387
2388         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2389                 err = -EOPNOTSUPP;
2390                 goto out;
2391         }
2392
2393         if (!netif_running(dev)) {
2394                 err = -ENETDOWN;
2395                 goto out;
2396         }
2397
2398         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2399
2400  out:
2401         cfg80211_unlock_rdev(rdev);
2402         dev_put(dev);
2403  out_rtnl:
2404         rtnl_unlock();
2405
2406         return err;
2407 }
2408
2409 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2410 {
2411         struct cfg80211_registered_device *rdev;
2412         int err;
2413         struct net_device *dev;
2414         u8 *dst = NULL;
2415
2416         if (info->attrs[NL80211_ATTR_MAC])
2417                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2418
2419         rtnl_lock();
2420
2421         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2422         if (err)
2423                 goto out_rtnl;
2424
2425         if (!rdev->ops->del_mpath) {
2426                 err = -EOPNOTSUPP;
2427                 goto out;
2428         }
2429
2430         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2431
2432  out:
2433         cfg80211_unlock_rdev(rdev);
2434         dev_put(dev);
2435  out_rtnl:
2436         rtnl_unlock();
2437
2438         return err;
2439 }
2440
2441 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2442 {
2443         struct cfg80211_registered_device *rdev;
2444         int err;
2445         struct net_device *dev;
2446         struct bss_parameters params;
2447
2448         memset(&params, 0, sizeof(params));
2449         /* default to not changing parameters */
2450         params.use_cts_prot = -1;
2451         params.use_short_preamble = -1;
2452         params.use_short_slot_time = -1;
2453
2454         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2455                 params.use_cts_prot =
2456                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2457         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2458                 params.use_short_preamble =
2459                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2460         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2461                 params.use_short_slot_time =
2462                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2463         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2464                 params.basic_rates =
2465                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2466                 params.basic_rates_len =
2467                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2468         }
2469
2470         rtnl_lock();
2471
2472         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2473         if (err)
2474                 goto out_rtnl;
2475
2476         if (!rdev->ops->change_bss) {
2477                 err = -EOPNOTSUPP;
2478                 goto out;
2479         }
2480
2481         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2482                 err = -EOPNOTSUPP;
2483                 goto out;
2484         }
2485
2486         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2487
2488  out:
2489         cfg80211_unlock_rdev(rdev);
2490         dev_put(dev);
2491  out_rtnl:
2492         rtnl_unlock();
2493
2494         return err;
2495 }
2496
2497 static const struct nla_policy
2498         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2499         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2500         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2501         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2502         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2503         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2504         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2505 };
2506
2507 static int parse_reg_rule(struct nlattr *tb[],
2508         struct ieee80211_reg_rule *reg_rule)
2509 {
2510         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2511         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2512
2513         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2514                 return -EINVAL;
2515         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2516                 return -EINVAL;
2517         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2518                 return -EINVAL;
2519         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2520                 return -EINVAL;
2521         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2522                 return -EINVAL;
2523
2524         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2525
2526         freq_range->start_freq_khz =
2527                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2528         freq_range->end_freq_khz =
2529                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2530         freq_range->max_bandwidth_khz =
2531                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2532
2533         power_rule->max_eirp =
2534                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2535
2536         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2537                 power_rule->max_antenna_gain =
2538                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2539
2540         return 0;
2541 }
2542
2543 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2544 {
2545         int r;
2546         char *data = NULL;
2547
2548         /*
2549          * You should only get this when cfg80211 hasn't yet initialized
2550          * completely when built-in to the kernel right between the time
2551          * window between nl80211_init() and regulatory_init(), if that is
2552          * even possible.
2553          */
2554         mutex_lock(&cfg80211_mutex);
2555         if (unlikely(!cfg80211_regdomain)) {
2556                 mutex_unlock(&cfg80211_mutex);
2557                 return -EINPROGRESS;
2558         }
2559         mutex_unlock(&cfg80211_mutex);
2560
2561         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2562                 return -EINVAL;
2563
2564         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2565
2566 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2567         /* We ignore world regdom requests with the old regdom setup */
2568         if (is_world_regdom(data))
2569                 return -EINVAL;
2570 #endif
2571
2572         r = regulatory_hint_user(data);
2573
2574         return r;
2575 }
2576
2577 static int nl80211_get_mesh_params(struct sk_buff *skb,
2578         struct genl_info *info)
2579 {
2580         struct cfg80211_registered_device *rdev;
2581         struct mesh_config cur_params;
2582         int err;
2583         struct net_device *dev;
2584         void *hdr;
2585         struct nlattr *pinfoattr;
2586         struct sk_buff *msg;
2587
2588         rtnl_lock();
2589
2590         /* Look up our device */
2591         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2592         if (err)
2593                 goto out_rtnl;
2594
2595         if (!rdev->ops->get_mesh_params) {
2596                 err = -EOPNOTSUPP;
2597                 goto out;
2598         }
2599
2600         /* Get the mesh params */
2601         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2602         if (err)
2603                 goto out;
2604
2605         /* Draw up a netlink message to send back */
2606         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2607         if (!msg) {
2608                 err = -ENOBUFS;
2609                 goto out;
2610         }
2611         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2612                              NL80211_CMD_GET_MESH_PARAMS);
2613         if (!hdr)
2614                 goto nla_put_failure;
2615         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2616         if (!pinfoattr)
2617                 goto nla_put_failure;
2618         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2619         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2620                         cur_params.dot11MeshRetryTimeout);
2621         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2622                         cur_params.dot11MeshConfirmTimeout);
2623         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2624                         cur_params.dot11MeshHoldingTimeout);
2625         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2626                         cur_params.dot11MeshMaxPeerLinks);
2627         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2628                         cur_params.dot11MeshMaxRetries);
2629         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2630                         cur_params.dot11MeshTTL);
2631         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2632                         cur_params.auto_open_plinks);
2633         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2634                         cur_params.dot11MeshHWMPmaxPREQretries);
2635         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2636                         cur_params.path_refresh_time);
2637         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2638                         cur_params.min_discovery_timeout);
2639         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2640                         cur_params.dot11MeshHWMPactivePathTimeout);
2641         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2642                         cur_params.dot11MeshHWMPpreqMinInterval);
2643         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2644                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2645         nla_nest_end(msg, pinfoattr);
2646         genlmsg_end(msg, hdr);
2647         err = genlmsg_reply(msg, info);
2648         goto out;
2649
2650  nla_put_failure:
2651         genlmsg_cancel(msg, hdr);
2652         err = -EMSGSIZE;
2653  out:
2654         /* Cleanup */
2655         cfg80211_unlock_rdev(rdev);
2656         dev_put(dev);
2657  out_rtnl:
2658         rtnl_unlock();
2659
2660         return err;
2661 }
2662
2663 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2664 do {\
2665         if (table[attr_num]) {\
2666                 cfg.param = nla_fn(table[attr_num]); \
2667                 mask |= (1 << (attr_num - 1)); \
2668         } \
2669 } while (0);\
2670
2671 static struct nla_policy
2672 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2673         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2674         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2675         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2676         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2677         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2678         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2679         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2680
2681         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2682         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2683         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2684         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2685         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2686         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2687 };
2688
2689 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2690 {
2691         int err;
2692         u32 mask;
2693         struct cfg80211_registered_device *rdev;
2694         struct net_device *dev;
2695         struct mesh_config cfg;
2696         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2697         struct nlattr *parent_attr;
2698
2699         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2700         if (!parent_attr)
2701                 return -EINVAL;
2702         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2703                         parent_attr, nl80211_meshconf_params_policy))
2704                 return -EINVAL;
2705
2706         rtnl_lock();
2707
2708         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2709         if (err)
2710                 goto out_rtnl;
2711
2712         if (!rdev->ops->set_mesh_params) {
2713                 err = -EOPNOTSUPP;
2714                 goto out;
2715         }
2716
2717         /* This makes sure that there aren't more than 32 mesh config
2718          * parameters (otherwise our bitfield scheme would not work.) */
2719         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2720
2721         /* Fill in the params struct */
2722         mask = 0;
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2724                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2726                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2728                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2729         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2730                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2732                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2734                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2736                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2738                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2739                         nla_get_u8);
2740         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2741                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2742         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2743                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2744                         nla_get_u16);
2745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2746                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2747                         nla_get_u32);
2748         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2749                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2750                         nla_get_u16);
2751         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2752                         dot11MeshHWMPnetDiameterTraversalTime,
2753                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2754                         nla_get_u16);
2755
2756         /* Apply changes */
2757         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2758
2759  out:
2760         /* cleanup */
2761         cfg80211_unlock_rdev(rdev);
2762         dev_put(dev);
2763  out_rtnl:
2764         rtnl_unlock();
2765
2766         return err;
2767 }
2768
2769 #undef FILL_IN_MESH_PARAM_IF_SET
2770
2771 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2772 {
2773         struct sk_buff *msg;
2774         void *hdr = NULL;
2775         struct nlattr *nl_reg_rules;
2776         unsigned int i;
2777         int err = -EINVAL;
2778
2779         mutex_lock(&cfg80211_mutex);
2780
2781         if (!cfg80211_regdomain)
2782                 goto out;
2783
2784         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2785         if (!msg) {
2786                 err = -ENOBUFS;
2787                 goto out;
2788         }
2789
2790         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2791                              NL80211_CMD_GET_REG);
2792         if (!hdr)
2793                 goto nla_put_failure;
2794
2795         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2796                 cfg80211_regdomain->alpha2);
2797
2798         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2799         if (!nl_reg_rules)
2800                 goto nla_put_failure;
2801
2802         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2803                 struct nlattr *nl_reg_rule;
2804                 const struct ieee80211_reg_rule *reg_rule;
2805                 const struct ieee80211_freq_range *freq_range;
2806                 const struct ieee80211_power_rule *power_rule;
2807
2808                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2809                 freq_range = &reg_rule->freq_range;
2810                 power_rule = &reg_rule->power_rule;
2811
2812                 nl_reg_rule = nla_nest_start(msg, i);
2813                 if (!nl_reg_rule)
2814                         goto nla_put_failure;
2815
2816                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2817                         reg_rule->flags);
2818                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2819                         freq_range->start_freq_khz);
2820                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2821                         freq_range->end_freq_khz);
2822                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2823                         freq_range->max_bandwidth_khz);
2824                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2825                         power_rule->max_antenna_gain);
2826                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2827                         power_rule->max_eirp);
2828
2829                 nla_nest_end(msg, nl_reg_rule);
2830         }
2831
2832         nla_nest_end(msg, nl_reg_rules);
2833
2834         genlmsg_end(msg, hdr);
2835         err = genlmsg_reply(msg, info);
2836         goto out;
2837
2838 nla_put_failure:
2839         genlmsg_cancel(msg, hdr);
2840         err = -EMSGSIZE;
2841 out:
2842         mutex_unlock(&cfg80211_mutex);
2843         return err;
2844 }
2845
2846 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2847 {
2848         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2849         struct nlattr *nl_reg_rule;
2850         char *alpha2 = NULL;
2851         int rem_reg_rules = 0, r = 0;
2852         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2853         struct ieee80211_regdomain *rd = NULL;
2854
2855         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2856                 return -EINVAL;
2857
2858         if (!info->attrs[NL80211_ATTR_REG_RULES])
2859                 return -EINVAL;
2860
2861         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2862
2863         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2864                         rem_reg_rules) {
2865                 num_rules++;
2866                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2867                         return -EINVAL;
2868         }
2869
2870         mutex_lock(&cfg80211_mutex);
2871
2872         if (!reg_is_valid_request(alpha2)) {
2873                 r = -EINVAL;
2874                 goto bad_reg;
2875         }
2876
2877         size_of_regd = sizeof(struct ieee80211_regdomain) +
2878                 (num_rules * sizeof(struct ieee80211_reg_rule));
2879
2880         rd = kzalloc(size_of_regd, GFP_KERNEL);
2881         if (!rd) {
2882                 r = -ENOMEM;
2883                 goto bad_reg;
2884         }
2885
2886         rd->n_reg_rules = num_rules;
2887         rd->alpha2[0] = alpha2[0];
2888         rd->alpha2[1] = alpha2[1];
2889
2890         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2891                         rem_reg_rules) {
2892                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2893                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2894                         reg_rule_policy);
2895                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2896                 if (r)
2897                         goto bad_reg;
2898
2899                 rule_idx++;
2900
2901                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2902                         r = -EINVAL;
2903                         goto bad_reg;
2904                 }
2905         }
2906
2907         BUG_ON(rule_idx != num_rules);
2908
2909         r = set_regdom(rd);
2910
2911         mutex_unlock(&cfg80211_mutex);
2912
2913         return r;
2914
2915  bad_reg:
2916         mutex_unlock(&cfg80211_mutex);
2917         kfree(rd);
2918         return r;
2919 }
2920
2921 static int validate_scan_freqs(struct nlattr *freqs)
2922 {
2923         struct nlattr *attr1, *attr2;
2924         int n_channels = 0, tmp1, tmp2;
2925
2926         nla_for_each_nested(attr1, freqs, tmp1) {
2927                 n_channels++;
2928                 /*
2929                  * Some hardware has a limited channel list for
2930                  * scanning, and it is pretty much nonsensical
2931                  * to scan for a channel twice, so disallow that
2932                  * and don't require drivers to check that the
2933                  * channel list they get isn't longer than what
2934                  * they can scan, as long as they can scan all
2935                  * the channels they registered at once.
2936                  */
2937                 nla_for_each_nested(attr2, freqs, tmp2)
2938                         if (attr1 != attr2 &&
2939                             nla_get_u32(attr1) == nla_get_u32(attr2))
2940                                 return 0;
2941         }
2942
2943         return n_channels;
2944 }
2945
2946 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2947 {
2948         struct cfg80211_registered_device *rdev;
2949         struct net_device *dev;
2950         struct cfg80211_scan_request *request;
2951         struct cfg80211_ssid *ssid;
2952         struct ieee80211_channel *channel;
2953         struct nlattr *attr;
2954         struct wiphy *wiphy;
2955         int err, tmp, n_ssids = 0, n_channels, i;
2956         enum ieee80211_band band;
2957         size_t ie_len;
2958
2959         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2960                 return -EINVAL;
2961
2962         rtnl_lock();
2963
2964         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2965         if (err)
2966                 goto out_rtnl;
2967
2968         wiphy = &rdev->wiphy;
2969
2970         if (!rdev->ops->scan) {
2971                 err = -EOPNOTSUPP;
2972                 goto out;
2973         }
2974
2975         if (!netif_running(dev)) {
2976                 err = -ENETDOWN;
2977                 goto out;
2978         }
2979
2980         if (rdev->scan_req) {
2981                 err = -EBUSY;
2982                 goto out;
2983         }
2984
2985         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2986                 n_channels = validate_scan_freqs(
2987                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2988                 if (!n_channels) {
2989                         err = -EINVAL;
2990                         goto out;
2991                 }
2992         } else {
2993                 n_channels = 0;
2994
2995                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2996                         if (wiphy->bands[band])
2997                                 n_channels += wiphy->bands[band]->n_channels;
2998         }
2999
3000         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3001                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3002                         n_ssids++;
3003
3004         if (n_ssids > wiphy->max_scan_ssids) {
3005                 err = -EINVAL;
3006                 goto out;
3007         }
3008
3009         if (info->attrs[NL80211_ATTR_IE])
3010                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3011         else
3012                 ie_len = 0;
3013
3014         if (ie_len > wiphy->max_scan_ie_len) {
3015                 err = -EINVAL;
3016                 goto out;
3017         }
3018
3019         request = kzalloc(sizeof(*request)
3020                         + sizeof(*ssid) * n_ssids
3021                         + sizeof(channel) * n_channels
3022                         + ie_len, GFP_KERNEL);
3023         if (!request) {
3024                 err = -ENOMEM;
3025                 goto out;
3026         }
3027
3028         request->channels = (void *)((char *)request + sizeof(*request));
3029         request->n_channels = n_channels;
3030         if (n_ssids)
3031                 request->ssids = (void *)(request->channels + n_channels);
3032         request->n_ssids = n_ssids;
3033         if (ie_len) {
3034                 if (request->ssids)
3035                         request->ie = (void *)(request->ssids + n_ssids);
3036                 else
3037                         request->ie = (void *)(request->channels + n_channels);
3038         }
3039
3040         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3041                 /* user specified, bail out if channel not found */
3042                 request->n_channels = n_channels;
3043                 i = 0;
3044                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3045                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3046                         if (!request->channels[i]) {
3047                                 err = -EINVAL;
3048                                 goto out_free;
3049                         }
3050                         i++;
3051                 }
3052         } else {
3053                 /* all channels */
3054                 i = 0;
3055                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3056                         int j;
3057                         if (!wiphy->bands[band])
3058                                 continue;
3059                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3060                                 request->channels[i] = &wiphy->bands[band]->channels[j];
3061                                 i++;
3062                         }
3063                 }
3064         }
3065
3066         i = 0;
3067         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3068                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3069                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3070                                 err = -EINVAL;
3071                                 goto out_free;
3072                         }
3073                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3074                         request->ssids[i].ssid_len = nla_len(attr);
3075                         i++;
3076                 }
3077         }
3078
3079         if (info->attrs[NL80211_ATTR_IE]) {
3080                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3081                 memcpy((void *)request->ie,
3082                        nla_data(info->attrs[NL80211_ATTR_IE]),
3083                        request->ie_len);
3084         }
3085
3086         request->dev = dev;
3087         request->wiphy = &rdev->wiphy;
3088
3089         rdev->scan_req = request;
3090         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3091
3092         if (!err) {
3093                 nl80211_send_scan_start(rdev, dev);
3094                 dev_hold(dev);
3095         }
3096
3097  out_free:
3098         if (err) {
3099                 rdev->scan_req = NULL;
3100                 kfree(request);
3101         }
3102  out:
3103         cfg80211_unlock_rdev(rdev);
3104         dev_put(dev);
3105  out_rtnl:
3106         rtnl_unlock();
3107
3108         return err;
3109 }
3110
3111 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3112                             struct cfg80211_registered_device *rdev,
3113                             struct wireless_dev *wdev,
3114                             struct cfg80211_internal_bss *intbss)
3115 {
3116         struct cfg80211_bss *res = &intbss->pub;
3117         void *hdr;
3118         struct nlattr *bss;
3119         int i;
3120
3121         ASSERT_WDEV_LOCK(wdev);
3122
3123         hdr = nl80211hdr_put(msg, pid, seq, flags,
3124                              NL80211_CMD_NEW_SCAN_RESULTS);
3125         if (!hdr)
3126                 return -1;
3127
3128         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
3129                     rdev->bss_generation);
3130         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3131
3132         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3133         if (!bss)
3134                 goto nla_put_failure;
3135         if (!is_zero_ether_addr(res->bssid))
3136                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3137         if (res->information_elements && res->len_information_elements)
3138                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3139                         res->len_information_elements,
3140                         res->information_elements);
3141         if (res->tsf)
3142                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3143         if (res->beacon_interval)
3144                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3145         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3146         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3147
3148         switch (rdev->wiphy.signal_type) {
3149         case CFG80211_SIGNAL_TYPE_MBM:
3150                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3151                 break;
3152         case CFG80211_SIGNAL_TYPE_UNSPEC:
3153                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3154                 break;
3155         default:
3156                 break;
3157         }
3158
3159         switch (wdev->iftype) {
3160         case NL80211_IFTYPE_STATION:
3161                 if (intbss == wdev->current_bss)
3162                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3163                                     NL80211_BSS_STATUS_ASSOCIATED);
3164                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3165                         if (intbss != wdev->auth_bsses[i])
3166                                 continue;
3167                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3168                                     NL80211_BSS_STATUS_AUTHENTICATED);
3169                         break;
3170                 }
3171                 break;
3172         case NL80211_IFTYPE_ADHOC:
3173                 if (intbss == wdev->current_bss)
3174                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3175                                     NL80211_BSS_STATUS_IBSS_JOINED);
3176                 break;
3177         default:
3178                 break;
3179         }
3180
3181         nla_nest_end(msg, bss);
3182
3183         return genlmsg_end(msg, hdr);
3184
3185  nla_put_failure:
3186         genlmsg_cancel(msg, hdr);
3187         return -EMSGSIZE;
3188 }
3189
3190 static int nl80211_dump_scan(struct sk_buff *skb,
3191                              struct netlink_callback *cb)
3192 {
3193         struct cfg80211_registered_device *rdev;
3194         struct net_device *dev;
3195         struct cfg80211_internal_bss *scan;
3196         struct wireless_dev *wdev;
3197         int ifidx = cb->args[0];
3198         int start = cb->args[1], idx = 0;
3199         int err;
3200
3201         if (!ifidx) {
3202                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
3203                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
3204                                   nl80211_policy);
3205                 if (err)
3206                         return err;
3207
3208                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
3209                         return -EINVAL;
3210
3211                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
3212                 if (!ifidx)
3213                         return -EINVAL;
3214                 cb->args[0] = ifidx;
3215         }
3216
3217         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3218         if (!dev)
3219                 return -ENODEV;
3220
3221         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3222         if (IS_ERR(rdev)) {
3223                 err = PTR_ERR(rdev);
3224                 goto out_put_netdev;
3225         }
3226
3227         wdev = dev->ieee80211_ptr;
3228
3229         wdev_lock(wdev);
3230         spin_lock_bh(&rdev->bss_lock);
3231         cfg80211_bss_expire(rdev);
3232
3233         list_for_each_entry(scan, &rdev->bss_list, list) {
3234                 if (++idx <= start)
3235                         continue;
3236                 if (nl80211_send_bss(skb,
3237                                 NETLINK_CB(cb->skb).pid,
3238                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3239                                 rdev, wdev, scan) < 0) {
3240                         idx--;
3241                         goto out;
3242                 }
3243         }
3244
3245  out:
3246         spin_unlock_bh(&rdev->bss_lock);
3247         wdev_unlock(wdev);
3248
3249         cb->args[1] = idx;
3250         err = skb->len;
3251         cfg80211_unlock_rdev(rdev);
3252  out_put_netdev:
3253         dev_put(dev);
3254
3255         return err;
3256 }
3257
3258 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3259 {
3260         return auth_type <= NL80211_AUTHTYPE_MAX;
3261 }
3262
3263 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3264 {
3265         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3266                                   NL80211_WPA_VERSION_2));
3267 }
3268
3269 static bool nl80211_valid_akm_suite(u32 akm)
3270 {
3271         return akm == WLAN_AKM_SUITE_8021X ||
3272                 akm == WLAN_AKM_SUITE_PSK;
3273 }
3274
3275 static bool nl80211_valid_cipher_suite(u32 cipher)
3276 {
3277         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3278                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3279                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3280                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3281                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3282 }
3283
3284
3285 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3286 {
3287         struct cfg80211_registered_device *rdev;
3288         struct net_device *dev;
3289         struct ieee80211_channel *chan;
3290         const u8 *bssid, *ssid, *ie = NULL;
3291         int err, ssid_len, ie_len = 0;
3292         enum nl80211_auth_type auth_type;
3293         struct key_parse key;
3294
3295         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3296                 return -EINVAL;
3297
3298         if (!info->attrs[NL80211_ATTR_MAC])
3299                 return -EINVAL;
3300
3301         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3302                 return -EINVAL;
3303
3304         if (!info->attrs[NL80211_ATTR_SSID])
3305                 return -EINVAL;
3306
3307         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3308                 return -EINVAL;
3309
3310         err = nl80211_parse_key(info, &key);
3311         if (err)
3312                 return err;
3313
3314         if (key.idx >= 0) {
3315                 if (!key.p.key || !key.p.key_len)
3316                         return -EINVAL;
3317                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3318                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3319                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3320                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3321                         return -EINVAL;
3322                 if (key.idx > 4)
3323                         return -EINVAL;
3324         } else {
3325                 key.p.key_len = 0;
3326                 key.p.key = NULL;
3327         }
3328
3329         rtnl_lock();
3330
3331         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3332         if (err)
3333                 goto unlock_rtnl;
3334
3335         if (!rdev->ops->auth) {
3336                 err = -EOPNOTSUPP;
3337                 goto out;
3338         }
3339
3340         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3341                 err = -EOPNOTSUPP;
3342                 goto out;
3343         }
3344
3345         if (!netif_running(dev)) {
3346                 err = -ENETDOWN;
3347                 goto out;
3348         }
3349
3350         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3351         chan = ieee80211_get_channel(&rdev->wiphy,
3352                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3353         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3354                 err = -EINVAL;
3355                 goto out;
3356         }
3357
3358         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3359         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3360
3361         if (info->attrs[NL80211_ATTR_IE]) {
3362                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3363                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3364         }
3365
3366         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3367         if (!nl80211_valid_auth_type(auth_type)) {
3368                 err = -EINVAL;
3369                 goto out;
3370         }
3371
3372         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3373                                  ssid, ssid_len, ie, ie_len,
3374                                  key.p.key, key.p.key_len, key.idx);
3375
3376 out:
3377         cfg80211_unlock_rdev(rdev);
3378         dev_put(dev);
3379 unlock_rtnl:
3380         rtnl_unlock();
3381         return err;
3382 }
3383
3384 static int nl80211_crypto_settings(struct genl_info *info,
3385                                    struct cfg80211_crypto_settings *settings,
3386                                    int cipher_limit)
3387 {
3388         memset(settings, 0, sizeof(*settings));
3389
3390         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3391
3392         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3393                 void *data;
3394                 int len, i;
3395
3396                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3397                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3398                 settings->n_ciphers_pairwise = len / sizeof(u32);
3399
3400                 if (len % sizeof(u32))
3401                         return -EINVAL;
3402
3403                 if (settings->n_ciphers_pairwise > cipher_limit)
3404                         return -EINVAL;
3405
3406                 memcpy(settings->ciphers_pairwise, data, len);
3407
3408                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3409                         if (!nl80211_valid_cipher_suite(
3410                                         settings->ciphers_pairwise[i]))
3411                                 return -EINVAL;
3412         }
3413
3414         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3415                 settings->cipher_group =
3416                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3417                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3418                         return -EINVAL;
3419         }
3420
3421         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3422                 settings->wpa_versions =
3423                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3424                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3425                         return -EINVAL;
3426         }
3427
3428         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3429                 void *data;
3430                 int len, i;
3431
3432                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3433                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3434                 settings->n_akm_suites = len / sizeof(u32);
3435
3436                 if (len % sizeof(u32))
3437                         return -EINVAL;
3438
3439                 memcpy(settings->akm_suites, data, len);
3440
3441                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3442                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3443                                 return -EINVAL;
3444         }
3445
3446         return 0;
3447 }
3448
3449 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3450 {
3451         struct cfg80211_registered_device *rdev;
3452         struct net_device *dev;
3453         struct cfg80211_crypto_settings crypto;
3454         struct ieee80211_channel *chan;
3455         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3456         int err, ssid_len, ie_len = 0;
3457         bool use_mfp = false;
3458
3459         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3460                 return -EINVAL;
3461
3462         if (!info->attrs[NL80211_ATTR_MAC] ||
3463             !info->attrs[NL80211_ATTR_SSID] ||
3464             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3465                 return -EINVAL;
3466
3467         rtnl_lock();
3468
3469         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3470         if (err)
3471                 goto unlock_rtnl;
3472
3473         if (!rdev->ops->assoc) {
3474                 err = -EOPNOTSUPP;
3475                 goto out;
3476         }
3477
3478         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3479                 err = -EOPNOTSUPP;
3480                 goto out;
3481         }
3482
3483         if (!netif_running(dev)) {
3484                 err = -ENETDOWN;
3485                 goto out;
3486         }
3487
3488         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3489
3490         chan = ieee80211_get_channel(&rdev->wiphy,
3491                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3492         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3493                 err = -EINVAL;
3494                 goto out;
3495         }
3496
3497         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3498         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3499
3500         if (info->attrs[NL80211_ATTR_IE]) {
3501                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3502                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3503         }
3504
3505         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3506                 enum nl80211_mfp mfp =
3507                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3508                 if (mfp == NL80211_MFP_REQUIRED)
3509                         use_mfp = true;
3510                 else if (mfp != NL80211_MFP_NO) {
3511                         err = -EINVAL;
3512                         goto out;
3513                 }
3514         }
3515
3516         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3517                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3518
3519         err = nl80211_crypto_settings(info, &crypto, 1);
3520         if (!err)
3521                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3522                                           ssid, ssid_len, ie, ie_len, use_mfp,
3523                                           &crypto);
3524
3525 out:
3526         cfg80211_unlock_rdev(rdev);
3527         dev_put(dev);
3528 unlock_rtnl:
3529         rtnl_unlock();
3530         return err;
3531 }
3532
3533 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3534 {
3535         struct cfg80211_registered_device *rdev;
3536         struct net_device *dev;
3537         const u8 *ie = NULL, *bssid;
3538         int err, ie_len = 0;
3539         u16 reason_code;
3540
3541         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3542                 return -EINVAL;
3543
3544         if (!info->attrs[NL80211_ATTR_MAC])
3545                 return -EINVAL;
3546
3547         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3548                 return -EINVAL;
3549
3550         rtnl_lock();
3551
3552         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3553         if (err)
3554                 goto unlock_rtnl;
3555
3556         if (!rdev->ops->deauth) {
3557                 err = -EOPNOTSUPP;
3558                 goto out;
3559         }
3560
3561         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3562                 err = -EOPNOTSUPP;
3563                 goto out;
3564         }
3565
3566         if (!netif_running(dev)) {
3567                 err = -ENETDOWN;
3568                 goto out;
3569         }
3570
3571         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3572
3573         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3574         if (reason_code == 0) {
3575                 /* Reason Code 0 is reserved */
3576                 err = -EINVAL;
3577                 goto out;
3578         }
3579
3580         if (info->attrs[NL80211_ATTR_IE]) {
3581                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3582                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3583         }
3584
3585         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3586
3587 out:
3588         cfg80211_unlock_rdev(rdev);
3589         dev_put(dev);
3590 unlock_rtnl:
3591         rtnl_unlock();
3592         return err;
3593 }
3594
3595 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3596 {
3597         struct cfg80211_registered_device *rdev;
3598         struct net_device *dev;
3599         const u8 *ie = NULL, *bssid;
3600         int err, ie_len = 0;
3601         u16 reason_code;
3602
3603         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3604                 return -EINVAL;
3605
3606         if (!info->attrs[NL80211_ATTR_MAC])
3607                 return -EINVAL;
3608
3609         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3610                 return -EINVAL;
3611
3612         rtnl_lock();
3613
3614         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3615         if (err)
3616                 goto unlock_rtnl;
3617
3618         if (!rdev->ops->disassoc) {
3619                 err = -EOPNOTSUPP;
3620                 goto out;
3621         }
3622
3623         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3624                 err = -EOPNOTSUPP;
3625                 goto out;
3626         }
3627
3628         if (!netif_running(dev)) {
3629                 err = -ENETDOWN;
3630                 goto out;
3631         }
3632
3633         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3634
3635         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3636         if (reason_code == 0) {
3637                 /* Reason Code 0 is reserved */
3638                 err = -EINVAL;
3639                 goto out;
3640         }
3641
3642         if (info->attrs[NL80211_ATTR_IE]) {
3643                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3644                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3645         }
3646
3647         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3648
3649 out:
3650         cfg80211_unlock_rdev(rdev);
3651         dev_put(dev);
3652 unlock_rtnl:
3653         rtnl_unlock();
3654         return err;
3655 }
3656
3657 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3658 {
3659         struct cfg80211_registered_device *rdev;
3660         struct net_device *dev;
3661         struct cfg80211_ibss_params ibss;
3662         struct wiphy *wiphy;
3663         struct cfg80211_cached_keys *connkeys = NULL;
3664         int err;
3665
3666         memset(&ibss, 0, sizeof(ibss));
3667
3668         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3669                 return -EINVAL;
3670
3671         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3672             !info->attrs[NL80211_ATTR_SSID] ||
3673             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3674                 return -EINVAL;
3675
3676         ibss.beacon_interval = 100;
3677
3678         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3679                 ibss.beacon_interval =
3680                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3681                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3682                         return -EINVAL;
3683         }
3684
3685         rtnl_lock();
3686
3687         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3688         if (err)
3689                 goto unlock_rtnl;
3690
3691         if (!rdev->ops->join_ibss) {
3692                 err = -EOPNOTSUPP;
3693                 goto out;
3694         }
3695
3696         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3697                 err = -EOPNOTSUPP;
3698                 goto out;
3699         }
3700
3701         if (!netif_running(dev)) {
3702                 err = -ENETDOWN;
3703                 goto out;
3704         }
3705
3706         wiphy = &rdev->wiphy;
3707
3708         if (info->attrs[NL80211_ATTR_MAC])
3709                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3710         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3711         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3712
3713         if (info->attrs[NL80211_ATTR_IE]) {
3714                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3715                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3716         }
3717
3718         ibss.channel = ieee80211_get_channel(wiphy,
3719                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3720         if (!ibss.channel ||
3721             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3722             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3723                 err = -EINVAL;
3724                 goto out;
3725         }
3726
3727         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3728         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3729
3730         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3731                 connkeys = nl80211_parse_connkeys(rdev,
3732                                         info->attrs[NL80211_ATTR_KEYS]);
3733                 if (IS_ERR(connkeys)) {
3734                         err = PTR_ERR(connkeys);
3735                         connkeys = NULL;
3736                         goto out;
3737                 }
3738         }
3739
3740         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3741
3742 out:
3743         cfg80211_unlock_rdev(rdev);
3744         dev_put(dev);
3745 unlock_rtnl:
3746         if (err)
3747                 kfree(connkeys);
3748         rtnl_unlock();
3749         return err;
3750 }
3751
3752 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3753 {
3754         struct cfg80211_registered_device *rdev;
3755         struct net_device *dev;
3756         int err;
3757
3758         rtnl_lock();
3759
3760         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3761         if (err)
3762                 goto unlock_rtnl;
3763
3764         if (!rdev->ops->leave_ibss) {
3765                 err = -EOPNOTSUPP;
3766                 goto out;
3767         }
3768
3769         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3770                 err = -EOPNOTSUPP;
3771                 goto out;
3772         }
3773
3774         if (!netif_running(dev)) {
3775                 err = -ENETDOWN;
3776                 goto out;
3777         }
3778
3779         err = cfg80211_leave_ibss(rdev, dev, false);
3780
3781 out:
3782         cfg80211_unlock_rdev(rdev);
3783         dev_put(dev);
3784 unlock_rtnl:
3785         rtnl_unlock();
3786         return err;
3787 }
3788
3789 #ifdef CONFIG_NL80211_TESTMODE
3790 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3791         .name = "testmode",
3792 };
3793
3794 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3795 {
3796         struct cfg80211_registered_device *rdev;
3797         int err;
3798
3799         if (!info->attrs[NL80211_ATTR_TESTDATA])
3800                 return -EINVAL;
3801
3802         rtnl_lock();
3803
3804         rdev = cfg80211_get_dev_from_info(info);
3805         if (IS_ERR(rdev)) {
3806                 err = PTR_ERR(rdev);
3807                 goto unlock_rtnl;
3808         }
3809
3810         err = -EOPNOTSUPP;
3811         if (rdev->ops->testmode_cmd) {
3812                 rdev->testmode_info = info;
3813                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3814                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3815                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3816                 rdev->testmode_info = NULL;
3817         }
3818
3819         cfg80211_unlock_rdev(rdev);
3820
3821  unlock_rtnl:
3822         rtnl_unlock();
3823         return err;
3824 }
3825
3826 static struct sk_buff *
3827 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3828                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3829 {
3830         struct sk_buff *skb;
3831         void *hdr;
3832         struct nlattr *data;
3833
3834         skb = nlmsg_new(approxlen + 100, gfp);
3835         if (!skb)
3836                 return NULL;
3837
3838         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3839         if (!hdr) {
3840                 kfree_skb(skb);
3841                 return NULL;
3842         }
3843
3844         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3845         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3846
3847         ((void **)skb->cb)[0] = rdev;
3848         ((void **)skb->cb)[1] = hdr;
3849         ((void **)skb->cb)[2] = data;
3850
3851         return skb;
3852
3853  nla_put_failure:
3854         kfree_skb(skb);
3855         return NULL;
3856 }
3857
3858 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3859                                                   int approxlen)
3860 {
3861         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3862
3863         if (WARN_ON(!rdev->testmode_info))
3864                 return NULL;
3865
3866         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3867                                 rdev->testmode_info->snd_pid,
3868                                 rdev->testmode_info->snd_seq,
3869                                 GFP_KERNEL);
3870 }
3871 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3872
3873 int cfg80211_testmode_reply(struct sk_buff *skb)
3874 {
3875         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3876         void *hdr = ((void **)skb->cb)[1];
3877         struct nlattr *data = ((void **)skb->cb)[2];
3878
3879         if (WARN_ON(!rdev->testmode_info)) {
3880                 kfree_skb(skb);
3881                 return -EINVAL;
3882         }
3883
3884         nla_nest_end(skb, data);
3885         genlmsg_end(skb, hdr);
3886         return genlmsg_reply(skb, rdev->testmode_info);
3887 }
3888 EXPORT_SYMBOL(cfg80211_testmode_reply);
3889
3890 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3891                                                   int approxlen, gfp_t gfp)
3892 {
3893         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3894
3895         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3896 }
3897 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3898
3899 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3900 {
3901         void *hdr = ((void **)skb->cb)[1];
3902         struct nlattr *data = ((void **)skb->cb)[2];
3903
3904         nla_nest_end(skb, data);
3905         genlmsg_end(skb, hdr);
3906         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3907 }
3908 EXPORT_SYMBOL(cfg80211_testmode_event);
3909 #endif
3910
3911 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3912 {
3913         struct cfg80211_registered_device *rdev;
3914         struct net_device *dev;
3915         struct cfg80211_connect_params connect;
3916         struct wiphy *wiphy;
3917         struct cfg80211_cached_keys *connkeys = NULL;
3918         int err;
3919
3920         memset(&connect, 0, sizeof(connect));
3921
3922         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3923                 return -EINVAL;
3924
3925         if (!info->attrs[NL80211_ATTR_SSID] ||
3926             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3927                 return -EINVAL;
3928
3929         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3930                 connect.auth_type =
3931                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3932                 if (!nl80211_valid_auth_type(connect.auth_type))
3933                         return -EINVAL;
3934         } else
3935                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3936
3937         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3938
3939         err = nl80211_crypto_settings(info, &connect.crypto,
3940                                       NL80211_MAX_NR_CIPHER_SUITES);
3941         if (err)
3942                 return err;
3943         rtnl_lock();
3944
3945         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3946         if (err)
3947                 goto unlock_rtnl;
3948
3949         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3950                 err = -EOPNOTSUPP;
3951                 goto out;
3952         }
3953
3954         if (!netif_running(dev)) {
3955                 err = -ENETDOWN;
3956                 goto out;
3957         }
3958
3959         wiphy = &rdev->wiphy;
3960
3961         if (info->attrs[NL80211_ATTR_MAC])
3962                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3963         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3964         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3965
3966         if (info->attrs[NL80211_ATTR_IE]) {
3967                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3968                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3969         }
3970
3971         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3972                 connect.channel =
3973                         ieee80211_get_channel(wiphy,
3974                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3975                 if (!connect.channel ||
3976                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3977                         err = -EINVAL;
3978                         goto out;
3979                 }
3980         }
3981
3982         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3983                 connkeys = nl80211_parse_connkeys(rdev,
3984                                         info->attrs[NL80211_ATTR_KEYS]);
3985                 if (IS_ERR(connkeys)) {
3986                         err = PTR_ERR(connkeys);
3987                         connkeys = NULL;
3988                         goto out;
3989                 }
3990         }
3991
3992         err = cfg80211_connect(rdev, dev, &connect, connkeys);
3993
3994 out:
3995         cfg80211_unlock_rdev(rdev);
3996         dev_put(dev);
3997 unlock_rtnl:
3998         if (err)
3999                 kfree(connkeys);
4000         rtnl_unlock();
4001         return err;
4002 }
4003
4004 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4005 {
4006         struct cfg80211_registered_device *rdev;
4007         struct net_device *dev;
4008         int err;
4009         u16 reason;
4010
4011         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4012                 reason = WLAN_REASON_DEAUTH_LEAVING;
4013         else
4014                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4015
4016         if (reason == 0)
4017                 return -EINVAL;
4018
4019         rtnl_lock();
4020
4021         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4022         if (err)
4023                 goto unlock_rtnl;
4024
4025         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4026                 err = -EOPNOTSUPP;
4027                 goto out;
4028         }
4029
4030         if (!netif_running(dev)) {
4031                 err = -ENETDOWN;
4032                 goto out;
4033         }
4034
4035         err = cfg80211_disconnect(rdev, dev, reason, true);
4036
4037 out:
4038         cfg80211_unlock_rdev(rdev);
4039         dev_put(dev);
4040 unlock_rtnl:
4041         rtnl_unlock();
4042         return err;
4043 }
4044
4045 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4046 {
4047         struct cfg80211_registered_device *rdev;
4048         struct net *net;
4049         int err;
4050         u32 pid;
4051
4052         if (!info->attrs[NL80211_ATTR_PID])
4053                 return -EINVAL;
4054
4055         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4056
4057         rtnl_lock();
4058
4059         rdev = cfg80211_get_dev_from_info(info);
4060         if (IS_ERR(rdev)) {
4061                 err = PTR_ERR(rdev);
4062                 goto out;
4063         }
4064
4065         net = get_net_ns_by_pid(pid);
4066         if (IS_ERR(net)) {
4067                 err = PTR_ERR(net);
4068                 goto out;
4069         }
4070
4071         err = 0;
4072
4073         /* check if anything to do */
4074         if (net_eq(wiphy_net(&rdev->wiphy), net))
4075                 goto out_put_net;
4076
4077         err = cfg80211_switch_netns(rdev, net);
4078  out_put_net:
4079         put_net(net);
4080  out:
4081         cfg80211_unlock_rdev(rdev);
4082         rtnl_unlock();
4083         return err;
4084 }
4085
4086 static struct genl_ops nl80211_ops[] = {
4087         {
4088                 .cmd = NL80211_CMD_GET_WIPHY,
4089                 .doit = nl80211_get_wiphy,
4090                 .dumpit = nl80211_dump_wiphy,
4091                 .policy = nl80211_policy,
4092                 /* can be retrieved by unprivileged users */
4093         },
4094         {
4095                 .cmd = NL80211_CMD_SET_WIPHY,
4096                 .doit = nl80211_set_wiphy,
4097                 .policy = nl80211_policy,
4098                 .flags = GENL_ADMIN_PERM,
4099         },
4100         {
4101                 .cmd = NL80211_CMD_GET_INTERFACE,
4102                 .doit = nl80211_get_interface,
4103                 .dumpit = nl80211_dump_interface,
4104                 .policy = nl80211_policy,
4105                 /* can be retrieved by unprivileged users */
4106         },
4107         {
4108                 .cmd = NL80211_CMD_SET_INTERFACE,
4109                 .doit = nl80211_set_interface,
4110                 .policy = nl80211_policy,
4111                 .flags = GENL_ADMIN_PERM,
4112         },
4113         {
4114                 .cmd = NL80211_CMD_NEW_INTERFACE,
4115                 .doit = nl80211_new_interface,
4116                 .policy = nl80211_policy,
4117                 .flags = GENL_ADMIN_PERM,
4118         },
4119         {
4120                 .cmd = NL80211_CMD_DEL_INTERFACE,
4121                 .doit = nl80211_del_interface,
4122                 .policy = nl80211_policy,
4123                 .flags = GENL_ADMIN_PERM,
4124         },
4125         {
4126                 .cmd = NL80211_CMD_GET_KEY,
4127                 .doit = nl80211_get_key,
4128                 .policy = nl80211_policy,
4129                 .flags = GENL_ADMIN_PERM,
4130         },
4131         {
4132                 .cmd = NL80211_CMD_SET_KEY,
4133                 .doit = nl80211_set_key,
4134                 .policy = nl80211_policy,
4135                 .flags = GENL_ADMIN_PERM,
4136         },
4137         {
4138                 .cmd = NL80211_CMD_NEW_KEY,
4139                 .doit = nl80211_new_key,
4140                 .policy = nl80211_policy,
4141                 .flags = GENL_ADMIN_PERM,
4142         },
4143         {
4144                 .cmd = NL80211_CMD_DEL_KEY,
4145                 .doit = nl80211_del_key,
4146                 .policy = nl80211_policy,
4147                 .flags = GENL_ADMIN_PERM,
4148         },
4149         {
4150                 .cmd = NL80211_CMD_SET_BEACON,
4151                 .policy = nl80211_policy,
4152                 .flags = GENL_ADMIN_PERM,
4153                 .doit = nl80211_addset_beacon,
4154         },
4155         {
4156                 .cmd = NL80211_CMD_NEW_BEACON,
4157                 .policy = nl80211_policy,
4158                 .flags = GENL_ADMIN_PERM,
4159                 .doit = nl80211_addset_beacon,
4160         },
4161         {
4162                 .cmd = NL80211_CMD_DEL_BEACON,
4163                 .policy = nl80211_policy,
4164                 .flags = GENL_ADMIN_PERM,
4165                 .doit = nl80211_del_beacon,
4166         },
4167         {
4168                 .cmd = NL80211_CMD_GET_STATION,
4169                 .doit = nl80211_get_station,
4170                 .dumpit = nl80211_dump_station,
4171                 .policy = nl80211_policy,
4172         },
4173         {
4174                 .cmd = NL80211_CMD_SET_STATION,
4175                 .doit = nl80211_set_station,
4176                 .policy = nl80211_policy,
4177                 .flags = GENL_ADMIN_PERM,
4178         },
4179         {
4180                 .cmd = NL80211_CMD_NEW_STATION,
4181                 .doit = nl80211_new_station,
4182                 .policy = nl80211_policy,
4183                 .flags = GENL_ADMIN_PERM,
4184         },
4185         {
4186                 .cmd = NL80211_CMD_DEL_STATION,
4187                 .doit = nl80211_del_station,
4188                 .policy = nl80211_policy,
4189                 .flags = GENL_ADMIN_PERM,
4190         },
4191         {
4192                 .cmd = NL80211_CMD_GET_MPATH,
4193                 .doit = nl80211_get_mpath,
4194                 .dumpit = nl80211_dump_mpath,
4195                 .policy = nl80211_policy,
4196                 .flags = GENL_ADMIN_PERM,
4197         },
4198         {
4199                 .cmd = NL80211_CMD_SET_MPATH,
4200                 .doit = nl80211_set_mpath,
4201                 .policy = nl80211_policy,
4202                 .flags = GENL_ADMIN_PERM,
4203         },
4204         {
4205                 .cmd = NL80211_CMD_NEW_MPATH,
4206                 .doit = nl80211_new_mpath,
4207                 .policy = nl80211_policy,
4208                 .flags = GENL_ADMIN_PERM,
4209         },
4210         {
4211                 .cmd = NL80211_CMD_DEL_MPATH,
4212                 .doit = nl80211_del_mpath,
4213                 .policy = nl80211_policy,
4214                 .flags = GENL_ADMIN_PERM,
4215         },
4216         {
4217                 .cmd = NL80211_CMD_SET_BSS,
4218                 .doit = nl80211_set_bss,
4219                 .policy = nl80211_policy,
4220                 .flags = GENL_ADMIN_PERM,
4221         },
4222         {
4223                 .cmd = NL80211_CMD_GET_REG,
4224                 .doit = nl80211_get_reg,
4225                 .policy = nl80211_policy,
4226                 /* can be retrieved by unprivileged users */
4227         },
4228         {
4229                 .cmd = NL80211_CMD_SET_REG,
4230                 .doit = nl80211_set_reg,
4231                 .policy = nl80211_policy,
4232                 .flags = GENL_ADMIN_PERM,
4233         },
4234         {
4235                 .cmd = NL80211_CMD_REQ_SET_REG,
4236                 .doit = nl80211_req_set_reg,
4237                 .policy = nl80211_policy,
4238                 .flags = GENL_ADMIN_PERM,
4239         },
4240         {
4241                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4242                 .doit = nl80211_get_mesh_params,
4243                 .policy = nl80211_policy,
4244                 /* can be retrieved by unprivileged users */
4245         },
4246         {
4247                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4248                 .doit = nl80211_set_mesh_params,
4249                 .policy = nl80211_policy,
4250                 .flags = GENL_ADMIN_PERM,
4251         },
4252         {
4253                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4254                 .doit = nl80211_trigger_scan,
4255                 .policy = nl80211_policy,
4256                 .flags = GENL_ADMIN_PERM,
4257         },
4258         {
4259                 .cmd = NL80211_CMD_GET_SCAN,
4260                 .policy = nl80211_policy,
4261                 .dumpit = nl80211_dump_scan,
4262         },
4263         {
4264                 .cmd = NL80211_CMD_AUTHENTICATE,
4265                 .doit = nl80211_authenticate,
4266                 .policy = nl80211_policy,
4267                 .flags = GENL_ADMIN_PERM,
4268         },
4269         {
4270                 .cmd = NL80211_CMD_ASSOCIATE,
4271                 .doit = nl80211_associate,
4272                 .policy = nl80211_policy,
4273                 .flags = GENL_ADMIN_PERM,
4274         },
4275         {
4276                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4277                 .doit = nl80211_deauthenticate,
4278                 .policy = nl80211_policy,
4279                 .flags = GENL_ADMIN_PERM,
4280         },
4281         {
4282                 .cmd = NL80211_CMD_DISASSOCIATE,
4283                 .doit = nl80211_disassociate,
4284                 .policy = nl80211_policy,
4285                 .flags = GENL_ADMIN_PERM,
4286         },
4287         {
4288                 .cmd = NL80211_CMD_JOIN_IBSS,
4289                 .doit = nl80211_join_ibss,
4290                 .policy = nl80211_policy,
4291                 .flags = GENL_ADMIN_PERM,
4292         },
4293         {
4294                 .cmd = NL80211_CMD_LEAVE_IBSS,
4295                 .doit = nl80211_leave_ibss,
4296                 .policy = nl80211_policy,
4297                 .flags = GENL_ADMIN_PERM,
4298         },
4299 #ifdef CONFIG_NL80211_TESTMODE
4300         {
4301                 .cmd = NL80211_CMD_TESTMODE,
4302                 .doit = nl80211_testmode_do,
4303                 .policy = nl80211_policy,
4304                 .flags = GENL_ADMIN_PERM,
4305         },
4306 #endif
4307         {
4308                 .cmd = NL80211_CMD_CONNECT,
4309                 .doit = nl80211_connect,
4310                 .policy = nl80211_policy,
4311                 .flags = GENL_ADMIN_PERM,
4312         },
4313         {
4314                 .cmd = NL80211_CMD_DISCONNECT,
4315                 .doit = nl80211_disconnect,
4316                 .policy = nl80211_policy,
4317                 .flags = GENL_ADMIN_PERM,
4318         },
4319         {
4320                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4321                 .doit = nl80211_wiphy_netns,
4322                 .policy = nl80211_policy,
4323                 .flags = GENL_ADMIN_PERM,
4324         },
4325 };
4326 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4327         .name = "mlme",
4328 };
4329
4330 /* multicast groups */
4331 static struct genl_multicast_group nl80211_config_mcgrp = {
4332         .name = "config",
4333 };
4334 static struct genl_multicast_group nl80211_scan_mcgrp = {
4335         .name = "scan",
4336 };
4337 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4338         .name = "regulatory",
4339 };
4340
4341 /* notification functions */
4342
4343 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4344 {
4345         struct sk_buff *msg;
4346
4347         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4348         if (!msg)
4349                 return;
4350
4351         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4352                 nlmsg_free(msg);
4353                 return;
4354         }
4355
4356         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4357                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4358 }
4359
4360 static int nl80211_add_scan_req(struct sk_buff *msg,
4361                                 struct cfg80211_registered_device *rdev)
4362 {
4363         struct cfg80211_scan_request *req = rdev->scan_req;
4364         struct nlattr *nest;
4365         int i;
4366
4367         ASSERT_RDEV_LOCK(rdev);
4368
4369         if (WARN_ON(!req))
4370                 return 0;
4371
4372         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4373         if (!nest)
4374                 goto nla_put_failure;
4375         for (i = 0; i < req->n_ssids; i++)
4376                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4377         nla_nest_end(msg, nest);
4378
4379         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4380         if (!nest)
4381                 goto nla_put_failure;
4382         for (i = 0; i < req->n_channels; i++)
4383                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4384         nla_nest_end(msg, nest);
4385
4386         if (req->ie)
4387                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4388
4389         return 0;
4390  nla_put_failure:
4391         return -ENOBUFS;
4392 }
4393
4394 static int nl80211_send_scan_msg(struct sk_buff *msg,
4395                                  struct cfg80211_registered_device *rdev,
4396                                  struct net_device *netdev,
4397                                  u32 pid, u32 seq, int flags,
4398                                  u32 cmd)
4399 {
4400         void *hdr;
4401
4402         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4403         if (!hdr)
4404                 return -1;
4405
4406         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4407         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4408
4409         /* ignore errors and send incomplete event anyway */
4410         nl80211_add_scan_req(msg, rdev);
4411
4412         return genlmsg_end(msg, hdr);
4413
4414  nla_put_failure:
4415         genlmsg_cancel(msg, hdr);
4416         return -EMSGSIZE;
4417 }
4418
4419 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4420                              struct net_device *netdev)
4421 {
4422         struct sk_buff *msg;
4423
4424         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4425         if (!msg)
4426                 return;
4427
4428         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4429                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4430                 nlmsg_free(msg);
4431                 return;
4432         }
4433
4434         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4435                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4436 }
4437
4438 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4439                             struct net_device *netdev)
4440 {
4441         struct sk_buff *msg;
4442
4443         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4444         if (!msg)
4445                 return;
4446
4447         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4448                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4449                 nlmsg_free(msg);
4450                 return;
4451         }
4452
4453         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4454                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4455 }
4456
4457 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4458                                struct net_device *netdev)
4459 {
4460         struct sk_buff *msg;
4461
4462         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4463         if (!msg)
4464                 return;
4465
4466         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4467                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4468                 nlmsg_free(msg);
4469                 return;
4470         }
4471
4472         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4473                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4474 }
4475
4476 /*
4477  * This can happen on global regulatory changes or device specific settings
4478  * based on custom world regulatory domains.
4479  */
4480 void nl80211_send_reg_change_event(struct regulatory_request *request)
4481 {
4482         struct sk_buff *msg;
4483         void *hdr;
4484
4485         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4486         if (!msg)
4487                 return;
4488
4489         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4490         if (!hdr) {
4491                 nlmsg_free(msg);
4492                 return;
4493         }
4494
4495         /* Userspace can always count this one always being set */
4496         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4497
4498         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4499                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4500                            NL80211_REGDOM_TYPE_WORLD);
4501         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4502                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4503                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4504         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4505                  request->intersect)
4506                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4507                            NL80211_REGDOM_TYPE_INTERSECTION);
4508         else {
4509                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4510                            NL80211_REGDOM_TYPE_COUNTRY);
4511                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4512         }
4513
4514         if (wiphy_idx_valid(request->wiphy_idx))
4515                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4516
4517         if (genlmsg_end(msg, hdr) < 0) {
4518                 nlmsg_free(msg);
4519                 return;
4520         }
4521
4522         rcu_read_lock();
4523         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4524                                 GFP_ATOMIC);
4525         rcu_read_unlock();
4526
4527         return;
4528
4529 nla_put_failure:
4530         genlmsg_cancel(msg, hdr);
4531         nlmsg_free(msg);
4532 }
4533
4534 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4535                                     struct net_device *netdev,
4536                                     const u8 *buf, size_t len,
4537                                     enum nl80211_commands cmd, gfp_t gfp)
4538 {
4539         struct sk_buff *msg;
4540         void *hdr;
4541
4542         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4543         if (!msg)
4544                 return;
4545
4546         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4547         if (!hdr) {
4548                 nlmsg_free(msg);
4549                 return;
4550         }
4551
4552         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4554         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4555
4556         if (genlmsg_end(msg, hdr) < 0) {
4557                 nlmsg_free(msg);
4558                 return;
4559         }
4560
4561         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4562                                 nl80211_mlme_mcgrp.id, gfp);
4563         return;
4564
4565  nla_put_failure:
4566         genlmsg_cancel(msg, hdr);
4567         nlmsg_free(msg);
4568 }
4569
4570 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4571                           struct net_device *netdev, const u8 *buf,
4572                           size_t len, gfp_t gfp)
4573 {
4574         nl80211_send_mlme_event(rdev, netdev, buf, len,
4575                                 NL80211_CMD_AUTHENTICATE, gfp);
4576 }
4577
4578 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4579                            struct net_device *netdev, const u8 *buf,
4580                            size_t len, gfp_t gfp)
4581 {
4582         nl80211_send_mlme_event(rdev, netdev, buf, len,
4583                                 NL80211_CMD_ASSOCIATE, gfp);
4584 }
4585
4586 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4587                          struct net_device *netdev, const u8 *buf,
4588                          size_t len, gfp_t gfp)
4589 {
4590         nl80211_send_mlme_event(rdev, netdev, buf, len,
4591                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4592 }
4593
4594 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4595                            struct net_device *netdev, const u8 *buf,
4596                            size_t len, gfp_t gfp)
4597 {
4598         nl80211_send_mlme_event(rdev, netdev, buf, len,
4599                                 NL80211_CMD_DISASSOCIATE, gfp);
4600 }
4601
4602 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4603                                       struct net_device *netdev, int cmd,
4604                                       const u8 *addr, gfp_t gfp)
4605 {
4606         struct sk_buff *msg;
4607         void *hdr;
4608
4609         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4610         if (!msg)
4611                 return;
4612
4613         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4614         if (!hdr) {
4615                 nlmsg_free(msg);
4616                 return;
4617         }
4618
4619         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4620         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4621         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4622         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4623
4624         if (genlmsg_end(msg, hdr) < 0) {
4625                 nlmsg_free(msg);
4626                 return;
4627         }
4628
4629         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4630                                 nl80211_mlme_mcgrp.id, gfp);
4631         return;
4632
4633  nla_put_failure:
4634         genlmsg_cancel(msg, hdr);
4635         nlmsg_free(msg);
4636 }
4637
4638 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4639                                struct net_device *netdev, const u8 *addr,
4640                                gfp_t gfp)
4641 {
4642         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4643                                   addr, gfp);
4644 }
4645
4646 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4647                                 struct net_device *netdev, const u8 *addr,
4648                                 gfp_t gfp)
4649 {
4650         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4651                                   addr, gfp);
4652 }
4653
4654 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4655                                  struct net_device *netdev, const u8 *bssid,
4656                                  const u8 *req_ie, size_t req_ie_len,
4657                                  const u8 *resp_ie, size_t resp_ie_len,
4658                                  u16 status, gfp_t gfp)
4659 {
4660         struct sk_buff *msg;
4661         void *hdr;
4662
4663         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4664         if (!msg)
4665                 return;
4666
4667         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4668         if (!hdr) {
4669                 nlmsg_free(msg);
4670                 return;
4671         }
4672
4673         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4674         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4675         if (bssid)
4676                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4677         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4678         if (req_ie)
4679                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4680         if (resp_ie)
4681                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4682
4683         if (genlmsg_end(msg, hdr) < 0) {
4684                 nlmsg_free(msg);
4685                 return;
4686         }
4687
4688         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4689                                 nl80211_mlme_mcgrp.id, gfp);
4690         return;
4691
4692  nla_put_failure:
4693         genlmsg_cancel(msg, hdr);
4694         nlmsg_free(msg);
4695
4696 }
4697
4698 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4699                          struct net_device *netdev, const u8 *bssid,
4700                          const u8 *req_ie, size_t req_ie_len,
4701                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4702 {
4703         struct sk_buff *msg;
4704         void *hdr;
4705
4706         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4707         if (!msg)
4708                 return;
4709
4710         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4711         if (!hdr) {
4712                 nlmsg_free(msg);
4713                 return;
4714         }
4715
4716         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4717         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4718         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4719         if (req_ie)
4720                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4721         if (resp_ie)
4722                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4723
4724         if (genlmsg_end(msg, hdr) < 0) {
4725                 nlmsg_free(msg);
4726                 return;
4727         }
4728
4729         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4730                                 nl80211_mlme_mcgrp.id, gfp);
4731         return;
4732
4733  nla_put_failure:
4734         genlmsg_cancel(msg, hdr);
4735         nlmsg_free(msg);
4736
4737 }
4738
4739 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4740                                struct net_device *netdev, u16 reason,
4741                                const u8 *ie, size_t ie_len, bool from_ap)
4742 {
4743         struct sk_buff *msg;
4744         void *hdr;
4745
4746         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4747         if (!msg)
4748                 return;
4749
4750         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4751         if (!hdr) {
4752                 nlmsg_free(msg);
4753                 return;
4754         }
4755
4756         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4757         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4758         if (from_ap && reason)
4759                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4760         if (from_ap)
4761                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4762         if (ie)
4763                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4764
4765         if (genlmsg_end(msg, hdr) < 0) {
4766                 nlmsg_free(msg);
4767                 return;
4768         }
4769
4770         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4771                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
4772         return;
4773
4774  nla_put_failure:
4775         genlmsg_cancel(msg, hdr);
4776         nlmsg_free(msg);
4777
4778 }
4779
4780 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4781                              struct net_device *netdev, const u8 *bssid,
4782                              gfp_t gfp)
4783 {
4784         struct sk_buff *msg;
4785         void *hdr;
4786
4787         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4788         if (!msg)
4789                 return;
4790
4791         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4792         if (!hdr) {
4793                 nlmsg_free(msg);
4794                 return;
4795         }
4796
4797         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4798         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4799         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4800
4801         if (genlmsg_end(msg, hdr) < 0) {
4802                 nlmsg_free(msg);
4803                 return;
4804         }
4805
4806         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4807                                 nl80211_mlme_mcgrp.id, gfp);
4808         return;
4809
4810  nla_put_failure:
4811         genlmsg_cancel(msg, hdr);
4812         nlmsg_free(msg);
4813 }
4814
4815 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4816                                  struct net_device *netdev, const u8 *addr,
4817                                  enum nl80211_key_type key_type, int key_id,
4818                                  const u8 *tsc, gfp_t gfp)
4819 {
4820         struct sk_buff *msg;
4821         void *hdr;
4822
4823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4824         if (!msg)
4825                 return;
4826
4827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4828         if (!hdr) {
4829                 nlmsg_free(msg);
4830                 return;
4831         }
4832
4833         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4834         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4835         if (addr)
4836                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4837         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4838         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4839         if (tsc)
4840                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4841
4842         if (genlmsg_end(msg, hdr) < 0) {
4843                 nlmsg_free(msg);
4844                 return;
4845         }
4846
4847         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4848                                 nl80211_mlme_mcgrp.id, gfp);
4849         return;
4850
4851  nla_put_failure:
4852         genlmsg_cancel(msg, hdr);
4853         nlmsg_free(msg);
4854 }
4855
4856 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4857                                     struct ieee80211_channel *channel_before,
4858                                     struct ieee80211_channel *channel_after)
4859 {
4860         struct sk_buff *msg;
4861         void *hdr;
4862         struct nlattr *nl_freq;
4863
4864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4865         if (!msg)
4866                 return;
4867
4868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4869         if (!hdr) {
4870                 nlmsg_free(msg);
4871                 return;
4872         }
4873
4874         /*
4875          * Since we are applying the beacon hint to a wiphy we know its
4876          * wiphy_idx is valid
4877          */
4878         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4879
4880         /* Before */
4881         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4882         if (!nl_freq)
4883                 goto nla_put_failure;
4884         if (nl80211_msg_put_channel(msg, channel_before))
4885                 goto nla_put_failure;
4886         nla_nest_end(msg, nl_freq);
4887
4888         /* After */
4889         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4890         if (!nl_freq)
4891                 goto nla_put_failure;
4892         if (nl80211_msg_put_channel(msg, channel_after))
4893                 goto nla_put_failure;
4894         nla_nest_end(msg, nl_freq);
4895
4896         if (genlmsg_end(msg, hdr) < 0) {
4897                 nlmsg_free(msg);
4898                 return;
4899         }
4900
4901         rcu_read_lock();
4902         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4903                                 GFP_ATOMIC);
4904         rcu_read_unlock();
4905
4906         return;
4907
4908 nla_put_failure:
4909         genlmsg_cancel(msg, hdr);
4910         nlmsg_free(msg);
4911 }
4912
4913 /* initialisation/exit functions */
4914
4915 int nl80211_init(void)
4916 {
4917         int err;
4918
4919         err = genl_register_family_with_ops(&nl80211_fam,
4920                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4921         if (err)
4922                 return err;
4923
4924         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4925         if (err)
4926                 goto err_out;
4927
4928         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4929         if (err)
4930                 goto err_out;
4931
4932         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4933         if (err)
4934                 goto err_out;
4935
4936         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4937         if (err)
4938                 goto err_out;
4939
4940 #ifdef CONFIG_NL80211_TESTMODE
4941         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4942         if (err)
4943                 goto err_out;
4944 #endif
4945
4946         return 0;
4947  err_out:
4948         genl_unregister_family(&nl80211_fam);
4949         return err;
4950 }
4951
4952 void nl80211_exit(void)
4953 {
4954         genl_unregister_family(&nl80211_fam);
4955 }