SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72
  73         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  74         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  76
  77         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  78         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79
  80         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  81         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  82                                     .len = WLAN_MAX_KEY_LEN },
  83         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  84         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  85         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  86         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  87
  88         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  89         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  90         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  91                                        .len = IEEE80211_MAX_DATA_LEN },
  92         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  95         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  96         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  98                                                .len = NL80211_MAX_SUPP_RATES },
  99         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 100         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 101         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 102         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 103                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 104         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 105
 106         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 107         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 108
 109         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 110         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 113                                            .len = NL80211_MAX_SUPP_RATES },
 114
 115         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 116
 117         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 118                                          .len = NL80211_HT_CAPABILITY_LEN },
 119
 120         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 122                               .len = IEEE80211_MAX_DATA_LEN },
 123         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 124         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 127                                 .len = IEEE80211_MAX_SSID_LEN },
 128         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 129         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 130         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_STA_FLAGS2] = {
 134                 .len = sizeof(struct nl80211_sta_flag_update),
 135         },
 136         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 139         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 140         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 141         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 142 };
 143
 144 /* policy for the attributes */
 145 static struct nla_policy
 146 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 147         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 148         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 149         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 150         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 151         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 152         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 153 };
 154
 155 /* ifidx get helper */
 156 static int nl80211_get_ifidx(struct netlink_callback *cb)
 157 {
 158         int res;
 159
 160         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 161                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 162                           nl80211_policy);
 163         if (res)
 164                 return res;
 165
 166         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 167                 return -EINVAL;
 168
 169         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 170         if (!res)
 171                 return -EINVAL;
 172         return res;
 173 }
 174
 175 /* IE validation */
 176 static bool is_valid_ie_attr(const struct nlattr *attr)
 177 {
 178         const u8 *pos;
 179         int len;
 180
 181         if (!attr)
 182                 return true;
 183
 184         pos = nla_data(attr);
 185         len = nla_len(attr);
 186
 187         while (len) {
 188                 u8 elemlen;
 189
 190                 if (len < 2)
 191                         return false;
 192                 len -= 2;
 193
 194                 elemlen = pos[1];
 195                 if (elemlen > len)
 196                         return false;
 197
 198                 len -= elemlen;
 199                 pos += 2 + elemlen;
 200         }
 201
 202         return true;
 203 }
 204
 205 /* message building helper */
 206 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 207                                    int flags, u8 cmd)
 208 {
 209         /* since there is no private header just add the generic one */
 210         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 211 }
 212
 213 static int nl80211_msg_put_channel(struct sk_buff *msg,
 214                                    struct ieee80211_channel *chan)
 215 {
 216         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 217                     chan->center_freq);
 218
 219         if (chan->flags & IEEE80211_CHAN_DISABLED)
 220                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 221         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 222                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 223         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 224                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 225         if (chan->flags & IEEE80211_CHAN_RADAR)
 226                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 227
 228         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 229                     DBM_TO_MBM(chan->max_power));
 230
 231         return 0;
 232
 233  nla_put_failure:
 234         return -ENOBUFS;
 235 }
 236
 237 /* netlink command implementations */
 238
 239 struct key_parse {
 240         struct key_params p;
 241         int idx;
 242         bool def, defmgmt;
 243 };
 244
 245 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 246 {
 247         struct nlattr *tb[NL80211_KEY_MAX + 1];
 248         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 249                                    nl80211_key_policy);
 250         if (err)
 251                 return err;
 252
 253         k->def = !!tb[NL80211_KEY_DEFAULT];
 254         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 255
 256         if (tb[NL80211_KEY_IDX])
 257                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 258
 259         if (tb[NL80211_KEY_DATA]) {
 260                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 261                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 262         }
 263
 264         if (tb[NL80211_KEY_SEQ]) {
 265                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 266                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 267         }
 268
 269         if (tb[NL80211_KEY_CIPHER])
 270                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 271
 272         return 0;
 273 }
 274
 275 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 276 {
 277         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 278                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 279                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 280         }
 281
 282         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 283                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 284                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 285         }
 286
 287         if (info->attrs[NL80211_ATTR_KEY_IDX])
 288                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 289
 290         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 291                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 292
 293         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 294         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 295
 296         return 0;
 297 }
 298
 299 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 300 {
 301         int err;
 302
 303         memset(k, 0, sizeof(*k));
 304         k->idx = -1;
 305
 306         if (info->attrs[NL80211_ATTR_KEY])
 307                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 308         else
 309                 err = nl80211_parse_key_old(info, k);
 310
 311         if (err)
 312                 return err;
 313
 314         if (k->def && k->defmgmt)
 315                 return -EINVAL;
 316
 317         if (k->idx != -1) {
 318                 if (k->defmgmt) {
 319                         if (k->idx < 4 || k->idx > 5)
 320                                 return -EINVAL;
 321                 } else if (k->def) {
 322                         if (k->idx < 0 || k->idx > 3)
 323                                 return -EINVAL;
 324                 } else {
 325                         if (k->idx < 0 || k->idx > 5)
 326                                 return -EINVAL;
 327                 }
 328         }
 329
 330         return 0;
 331 }
 332
 333 static struct cfg80211_cached_keys *
 334 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 335                        struct nlattr *keys)
 336 {
 337         struct key_parse parse;
 338         struct nlattr *key;
 339         struct cfg80211_cached_keys *result;
 340         int rem, err, def = 0;
 341
 342         result = kzalloc(sizeof(*result), GFP_KERNEL);
 343         if (!result)
 344                 return ERR_PTR(-ENOMEM);
 345
 346         result->def = -1;
 347         result->defmgmt = -1;
 348
 349         nla_for_each_nested(key, keys, rem) {
 350                 memset(&parse, 0, sizeof(parse));
 351                 parse.idx = -1;
 352
 353                 err = nl80211_parse_key_new(key, &parse);
 354                 if (err)
 355                         goto error;
 356                 err = -EINVAL;
 357                 if (!parse.p.key)
 358                         goto error;
 359                 if (parse.idx < 0 || parse.idx > 4)
 360                         goto error;
 361                 if (parse.def) {
 362                         if (def)
 363                                 goto error;
 364                         def = 1;
 365                         result->def = parse.idx;
 366                 } else if (parse.defmgmt)
 367                         goto error;
 368                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 369                                                      parse.idx, NULL);
 370                 if (err)
 371                         goto error;
 372                 result->params[parse.idx].cipher = parse.p.cipher;
 373                 result->params[parse.idx].key_len = parse.p.key_len;
 374                 result->params[parse.idx].key = result->data[parse.idx];
 375                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 376         }
 377
 378         return result;
 379  error:
 380         kfree(result);
 381         return ERR_PTR(err);
 382 }
 383
 384 static int nl80211_key_allowed(struct wireless_dev *wdev)
 385 {
 386         ASSERT_WDEV_LOCK(wdev);
 387
 388         if (!netif_running(wdev->netdev))
 389                 return -ENETDOWN;
 390
 391         switch (wdev->iftype) {
 392         case NL80211_IFTYPE_AP:
 393         case NL80211_IFTYPE_AP_VLAN:
 394                 break;
 395         case NL80211_IFTYPE_ADHOC:
 396                 if (!wdev->current_bss)
 397                         return -ENOLINK;
 398                 break;
 399         case NL80211_IFTYPE_STATION:
 400                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 401                         return -ENOLINK;
 402                 break;
 403         default:
 404                 return -EINVAL;
 405         }
 406
 407         return 0;
 408 }
 409
 410 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 411                               struct cfg80211_registered_device *dev)
 412 {
 413         void *hdr;
 414         struct nlattr *nl_bands, *nl_band;
 415         struct nlattr *nl_freqs, *nl_freq;
 416         struct nlattr *nl_rates, *nl_rate;
 417         struct nlattr *nl_modes;
 418         struct nlattr *nl_cmds;
 419         enum ieee80211_band band;
 420         struct ieee80211_channel *chan;
 421         struct ieee80211_rate *rate;
 422         int i;
 423         u16 ifmodes = dev->wiphy.interface_modes;
 424
 425         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 426         if (!hdr)
 427                 return -1;
 428
 429         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 430         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 431
 432         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 433                     cfg80211_rdev_list_generation);
 434
 435         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 436                    dev->wiphy.retry_short);
 437         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 438                    dev->wiphy.retry_long);
 439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 440                     dev->wiphy.frag_threshold);
 441         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 442                     dev->wiphy.rts_threshold);
 443
 444         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 445                    dev->wiphy.max_scan_ssids);
 446         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 447                     dev->wiphy.max_scan_ie_len);
 448
 449         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 450                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 451                 dev->wiphy.cipher_suites);
 452
 453         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 454         if (!nl_modes)
 455                 goto nla_put_failure;
 456
 457         i = 0;
 458         while (ifmodes) {
 459                 if (ifmodes & 1)
 460                         NLA_PUT_FLAG(msg, i);
 461                 ifmodes >>= 1;
 462                 i++;
 463         }
 464
 465         nla_nest_end(msg, nl_modes);
 466
 467         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 468         if (!nl_bands)
 469                 goto nla_put_failure;
 470
 471         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 472                 if (!dev->wiphy.bands[band])
 473                         continue;
 474
 475                 nl_band = nla_nest_start(msg, band);
 476                 if (!nl_band)
 477                         goto nla_put_failure;
 478
 479                 /* add HT info */
 480                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 481                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 482                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 483                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 484                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 485                                 dev->wiphy.bands[band]->ht_cap.cap);
 486                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 487                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 488                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 489                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 490                 }
 491
 492                 /* add frequencies */
 493                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 494                 if (!nl_freqs)
 495                         goto nla_put_failure;
 496
 497                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 498                         nl_freq = nla_nest_start(msg, i);
 499                         if (!nl_freq)
 500                                 goto nla_put_failure;
 501
 502                         chan = &dev->wiphy.bands[band]->channels[i];
 503
 504                         if (nl80211_msg_put_channel(msg, chan))
 505                                 goto nla_put_failure;
 506
 507                         nla_nest_end(msg, nl_freq);
 508                 }
 509
 510                 nla_nest_end(msg, nl_freqs);
 511
 512                 /* add bitrates */
 513                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 514                 if (!nl_rates)
 515                         goto nla_put_failure;
 516
 517                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 518                         nl_rate = nla_nest_start(msg, i);
 519                         if (!nl_rate)
 520                                 goto nla_put_failure;
 521
 522                         rate = &dev->wiphy.bands[band]->bitrates[i];
 523                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 524                                     rate->bitrate);
 525                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 526                                 NLA_PUT_FLAG(msg,
 527                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 528
 529                         nla_nest_end(msg, nl_rate);
 530                 }
 531
 532                 nla_nest_end(msg, nl_rates);
 533
 534                 nla_nest_end(msg, nl_band);
 535         }
 536         nla_nest_end(msg, nl_bands);
 537
 538         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 539         if (!nl_cmds)
 540                 goto nla_put_failure;
 541
 542         i = 0;
 543 #define CMD(op, n)                                              \
 544          do {                                                   \
 545                 if (dev->ops->op) {                             \
 546                         i++;                                    \
 547                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 548                 }                                               \
 549         } while (0)
 550
 551         CMD(add_virtual_intf, NEW_INTERFACE);
 552         CMD(change_virtual_intf, SET_INTERFACE);
 553         CMD(add_key, NEW_KEY);
 554         CMD(add_beacon, NEW_BEACON);
 555         CMD(add_station, NEW_STATION);
 556         CMD(add_mpath, NEW_MPATH);
 557         CMD(set_mesh_params, SET_MESH_PARAMS);
 558         CMD(change_bss, SET_BSS);
 559         CMD(auth, AUTHENTICATE);
 560         CMD(assoc, ASSOCIATE);
 561         CMD(deauth, DEAUTHENTICATE);
 562         CMD(disassoc, DISASSOCIATE);
 563         CMD(join_ibss, JOIN_IBSS);
 564         if (dev->wiphy.netnsok) {
 565                 i++;
 566                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 567         }
 568
 569 #undef CMD
 570
 571         if (dev->ops->connect || dev->ops->auth) {
 572                 i++;
 573                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 574         }
 575
 576         if (dev->ops->disconnect || dev->ops->deauth) {
 577                 i++;
 578                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 579         }
 580
 581         nla_nest_end(msg, nl_cmds);
 582
 583         return genlmsg_end(msg, hdr);
 584
 585  nla_put_failure:
 586         genlmsg_cancel(msg, hdr);
 587         return -EMSGSIZE;
 588 }
 589
 590 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 591 {
 592         int idx = 0;
 593         int start = cb->args[0];
 594         struct cfg80211_registered_device *dev;
 595
 596         mutex_lock(&cfg80211_mutex);
 597         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 598                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 599                         continue;
 600                 if (++idx <= start)
 601                         continue;
 602                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 603                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 604                                        dev) < 0) {
 605                         idx--;
 606                         break;
 607                 }
 608         }
 609         mutex_unlock(&cfg80211_mutex);
 610
 611         cb->args[0] = idx;
 612
 613         return skb->len;
 614 }
 615
 616 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 617 {
 618         struct sk_buff *msg;
 619         struct cfg80211_registered_device *dev;
 620
 621         dev = cfg80211_get_dev_from_info(info);
 622         if (IS_ERR(dev))
 623                 return PTR_ERR(dev);
 624
 625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 626         if (!msg)
 627                 goto out_err;
 628
 629         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 630                 goto out_free;
 631
 632         cfg80211_unlock_rdev(dev);
 633
 634         return genlmsg_reply(msg, info);
 635
 636  out_free:
 637         nlmsg_free(msg);
 638  out_err:
 639         cfg80211_unlock_rdev(dev);
 640         return -ENOBUFS;
 641 }
 642
 643 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 644         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 645         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 646         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 647         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 648         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 649 };
 650
 651 static int parse_txq_params(struct nlattr *tb[],
 652                             struct ieee80211_txq_params *txq_params)
 653 {
 654         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 655             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 656             !tb[NL80211_TXQ_ATTR_AIFS])
 657                 return -EINVAL;
 658
 659         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 660         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 661         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 662         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 663         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 664
 665         return 0;
 666 }
 667
 668 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 669 {
 670         struct cfg80211_registered_device *rdev;
 671         int result = 0, rem_txq_params = 0;
 672         struct nlattr *nl_txq_params;
 673         u32 changed;
 674         u8 retry_short = 0, retry_long = 0;
 675         u32 frag_threshold = 0, rts_threshold = 0;
 676
 677         rtnl_lock();
 678
 679         mutex_lock(&cfg80211_mutex);
 680
 681         rdev = __cfg80211_rdev_from_info(info);
 682         if (IS_ERR(rdev)) {
 683                 mutex_unlock(&cfg80211_mutex);
 684                 result = PTR_ERR(rdev);
 685                 goto unlock;
 686         }
 687
 688         mutex_lock(&rdev->mtx);
 689
 690         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 691                 result = cfg80211_dev_rename(
 692                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 693
 694         mutex_unlock(&cfg80211_mutex);
 695
 696         if (result)
 697                 goto bad_res;
 698
 699         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 700                 struct ieee80211_txq_params txq_params;
 701                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 702
 703                 if (!rdev->ops->set_txq_params) {
 704                         result = -EOPNOTSUPP;
 705                         goto bad_res;
 706                 }
 707
 708                 nla_for_each_nested(nl_txq_params,
 709                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 710                                     rem_txq_params) {
 711                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 712                                   nla_data(nl_txq_params),
 713                                   nla_len(nl_txq_params),
 714                                   txq_params_policy);
 715                         result = parse_txq_params(tb, &txq_params);
 716                         if (result)
 717                                 goto bad_res;
 718
 719                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 720                                                            &txq_params);
 721                         if (result)
 722                                 goto bad_res;
 723                 }
 724         }
 725
 726         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 727                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 728                 u32 freq;
 729
 730                 result = -EINVAL;
 731
 732                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 733                         channel_type = nla_get_u32(info->attrs[
 734                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 735                         if (channel_type != NL80211_CHAN_NO_HT &&
 736                             channel_type != NL80211_CHAN_HT20 &&
 737                             channel_type != NL80211_CHAN_HT40PLUS &&
 738                             channel_type != NL80211_CHAN_HT40MINUS)
 739                                 goto bad_res;
 740                 }
 741
 742                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 743
 744                 mutex_lock(&rdev->devlist_mtx);
 745                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 746                 mutex_unlock(&rdev->devlist_mtx);
 747                 if (result)
 748                         goto bad_res;
 749         }
 750
 751         changed = 0;
 752
 753         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 754                 retry_short = nla_get_u8(
 755                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 756                 if (retry_short == 0) {
 757                         result = -EINVAL;
 758                         goto bad_res;
 759                 }
 760                 changed |= WIPHY_PARAM_RETRY_SHORT;
 761         }
 762
 763         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 764                 retry_long = nla_get_u8(
 765                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 766                 if (retry_long == 0) {
 767                         result = -EINVAL;
 768                         goto bad_res;
 769                 }
 770                 changed |= WIPHY_PARAM_RETRY_LONG;
 771         }
 772
 773         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 774                 frag_threshold = nla_get_u32(
 775                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 776                 if (frag_threshold < 256) {
 777                         result = -EINVAL;
 778                         goto bad_res;
 779                 }
 780                 if (frag_threshold != (u32) -1) {
 781                         /*
 782                          * Fragments (apart from the last one) are required to
 783                          * have even length. Make the fragmentation code
 784                          * simpler by stripping LSB should someone try to use
 785                          * odd threshold value.
 786                          */
 787                         frag_threshold &= ~0x1;
 788                 }
 789                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 790         }
 791
 792         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 793                 rts_threshold = nla_get_u32(
 794                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 795                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 796         }
 797
 798         if (changed) {
 799                 u8 old_retry_short, old_retry_long;
 800                 u32 old_frag_threshold, old_rts_threshold;
 801
 802                 if (!rdev->ops->set_wiphy_params) {
 803                         result = -EOPNOTSUPP;
 804                         goto bad_res;
 805                 }
 806
 807                 old_retry_short = rdev->wiphy.retry_short;
 808                 old_retry_long = rdev->wiphy.retry_long;
 809                 old_frag_threshold = rdev->wiphy.frag_threshold;
 810                 old_rts_threshold = rdev->wiphy.rts_threshold;
 811
 812                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 813                         rdev->wiphy.retry_short = retry_short;
 814                 if (changed & WIPHY_PARAM_RETRY_LONG)
 815                         rdev->wiphy.retry_long = retry_long;
 816                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 817                         rdev->wiphy.frag_threshold = frag_threshold;
 818                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 819                         rdev->wiphy.rts_threshold = rts_threshold;
 820
 821                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 822                 if (result) {
 823                         rdev->wiphy.retry_short = old_retry_short;
 824                         rdev->wiphy.retry_long = old_retry_long;
 825                         rdev->wiphy.frag_threshold = old_frag_threshold;
 826                         rdev->wiphy.rts_threshold = old_rts_threshold;
 827                 }
 828         }
 829
 830  bad_res:
 831         mutex_unlock(&rdev->mtx);
 832  unlock:
 833         rtnl_unlock();
 834         return result;
 835 }
 836
 837
 838 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 839                               struct cfg80211_registered_device *rdev,
 840                               struct net_device *dev)
 841 {
 842         void *hdr;
 843
 844         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 845         if (!hdr)
 846                 return -1;
 847
 848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 849         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 850         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 851         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 852
 853         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 854                     rdev->devlist_generation ^
 855                         (cfg80211_rdev_list_generation << 2));
 856
 857         return genlmsg_end(msg, hdr);
 858
 859  nla_put_failure:
 860         genlmsg_cancel(msg, hdr);
 861         return -EMSGSIZE;
 862 }
 863
 864 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 865 {
 866         int wp_idx = 0;
 867         int if_idx = 0;
 868         int wp_start = cb->args[0];
 869         int if_start = cb->args[1];
 870         struct cfg80211_registered_device *rdev;
 871         struct wireless_dev *wdev;
 872
 873         mutex_lock(&cfg80211_mutex);
 874         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 875                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 876                         continue;
 877                 if (wp_idx < wp_start) {
 878                         wp_idx++;
 879                         continue;
 880                 }
 881                 if_idx = 0;
 882
 883                 mutex_lock(&rdev->devlist_mtx);
 884                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 885                         if (if_idx < if_start) {
 886                                 if_idx++;
 887                                 continue;
 888                         }
 889                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 890                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 891                                                rdev, wdev->netdev) < 0) {
 892                                 mutex_unlock(&rdev->devlist_mtx);
 893                                 goto out;
 894                         }
 895                         if_idx++;
 896                 }
 897                 mutex_unlock(&rdev->devlist_mtx);
 898
 899                 wp_idx++;
 900         }
 901  out:
 902         mutex_unlock(&cfg80211_mutex);
 903
 904         cb->args[0] = wp_idx;
 905         cb->args[1] = if_idx;
 906
 907         return skb->len;
 908 }
 909
 910 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 911 {
 912         struct sk_buff *msg;
 913         struct cfg80211_registered_device *dev;
 914         struct net_device *netdev;
 915         int err;
 916
 917         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 918         if (err)
 919                 return err;
 920
 921         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 922         if (!msg)
 923                 goto out_err;
 924
 925         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 926                                dev, netdev) < 0)
 927                 goto out_free;
 928
 929         dev_put(netdev);
 930         cfg80211_unlock_rdev(dev);
 931
 932         return genlmsg_reply(msg, info);
 933
 934  out_free:
 935         nlmsg_free(msg);
 936  out_err:
 937         dev_put(netdev);
 938         cfg80211_unlock_rdev(dev);
 939         return -ENOBUFS;
 940 }
 941
 942 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 943         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 944         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 945         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 946         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 947         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 948 };
 949
 950 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 951 {
 952         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 953         int flag;
 954
 955         *mntrflags = 0;
 956
 957         if (!nla)
 958                 return -EINVAL;
 959
 960         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 961                              nla, mntr_flags_policy))
 962                 return -EINVAL;
 963
 964         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 965                 if (flags[flag])
 966                         *mntrflags |= (1<<flag);
 967
 968         return 0;
 969 }
 970
 971 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 972 {
 973         struct cfg80211_registered_device *rdev;
 974         struct vif_params params;
 975         int err;
 976         enum nl80211_iftype otype, ntype;
 977         struct net_device *dev;
 978         u32 _flags, *flags = NULL;
 979         bool change = false;
 980
 981         memset(&params, 0, sizeof(params));
 982
 983         rtnl_lock();
 984
 985         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
 986         if (err)
 987                 goto unlock_rtnl;
 988
 989         otype = ntype = dev->ieee80211_ptr->iftype;
 990
 991         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 992                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 993                 if (otype != ntype)
 994                         change = true;
 995                 if (ntype > NL80211_IFTYPE_MAX) {
 996                         err = -EINVAL;
 997                         goto unlock;
 998                 }
 999         }
1000
1001         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1002                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1003                         err = -EINVAL;
1004                         goto unlock;
1005                 }
1006                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1007                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1008                 change = true;
1009         }
1010
1011         if (info->attrs[NL80211_ATTR_4ADDR]) {
1012                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1013                 change = true;
1014         } else {
1015                 params.use_4addr = -1;
1016         }
1017
1018         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1019                 if (ntype != NL80211_IFTYPE_MONITOR) {
1020                         err = -EINVAL;
1021                         goto unlock;
1022                 }
1023                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1024                                           &_flags);
1025                 if (err)
1026                         goto unlock;
1027
1028                 flags = &_flags;
1029                 change = true;
1030         }
1031
1032         if (change)
1033                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1034         else
1035                 err = 0;
1036
1037  unlock:
1038         dev_put(dev);
1039         cfg80211_unlock_rdev(rdev);
1040  unlock_rtnl:
1041         rtnl_unlock();
1042         return err;
1043 }
1044
1045 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1046 {
1047         struct cfg80211_registered_device *rdev;
1048         struct vif_params params;
1049         int err;
1050         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1051         u32 flags;
1052
1053         memset(&params, 0, sizeof(params));
1054
1055         if (!info->attrs[NL80211_ATTR_IFNAME])
1056                 return -EINVAL;
1057
1058         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1059                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1060                 if (type > NL80211_IFTYPE_MAX)
1061                         return -EINVAL;
1062         }
1063
1064         rtnl_lock();
1065
1066         rdev = cfg80211_get_dev_from_info(info);
1067         if (IS_ERR(rdev)) {
1068                 err = PTR_ERR(rdev);
1069                 goto unlock_rtnl;
1070         }
1071
1072         if (!rdev->ops->add_virtual_intf ||
1073             !(rdev->wiphy.interface_modes & (1 << type))) {
1074                 err = -EOPNOTSUPP;
1075                 goto unlock;
1076         }
1077
1078         if (type == NL80211_IFTYPE_MESH_POINT &&
1079             info->attrs[NL80211_ATTR_MESH_ID]) {
1080                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1081                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1082         }
1083
1084         if (info->attrs[NL80211_ATTR_4ADDR])
1085                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1086
1087         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1088                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1089                                   &flags);
1090         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1091                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1092                 type, err ? NULL : &flags, &params);
1093
1094  unlock:
1095         cfg80211_unlock_rdev(rdev);
1096  unlock_rtnl:
1097         rtnl_unlock();
1098         return err;
1099 }
1100
1101 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1102 {
1103         struct cfg80211_registered_device *rdev;
1104         int err;
1105         struct net_device *dev;
1106
1107         rtnl_lock();
1108
1109         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1110         if (err)
1111                 goto unlock_rtnl;
1112
1113         if (!rdev->ops->del_virtual_intf) {
1114                 err = -EOPNOTSUPP;
1115                 goto out;
1116         }
1117
1118         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1119
1120  out:
1121         cfg80211_unlock_rdev(rdev);
1122         dev_put(dev);
1123  unlock_rtnl:
1124         rtnl_unlock();
1125         return err;
1126 }
1127
1128 struct get_key_cookie {
1129         struct sk_buff *msg;
1130         int error;
1131         int idx;
1132 };
1133
1134 static void get_key_callback(void *c, struct key_params *params)
1135 {
1136         struct nlattr *key;
1137         struct get_key_cookie *cookie = c;
1138
1139         if (params->key)
1140                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1141                         params->key_len, params->key);
1142
1143         if (params->seq)
1144                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1145                         params->seq_len, params->seq);
1146
1147         if (params->cipher)
1148                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1149                             params->cipher);
1150
1151         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1152         if (!key)
1153                 goto nla_put_failure;
1154
1155         if (params->key)
1156                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1157                         params->key_len, params->key);
1158
1159         if (params->seq)
1160                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1161                         params->seq_len, params->seq);
1162
1163         if (params->cipher)
1164                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1165                             params->cipher);
1166
1167         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1168
1169         nla_nest_end(cookie->msg, key);
1170
1171         return;
1172  nla_put_failure:
1173         cookie->error = 1;
1174 }
1175
1176 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1177 {
1178         struct cfg80211_registered_device *rdev;
1179         int err;
1180         struct net_device *dev;
1181         u8 key_idx = 0;
1182         u8 *mac_addr = NULL;
1183         struct get_key_cookie cookie = {
1184                 .error = 0,
1185         };
1186         void *hdr;
1187         struct sk_buff *msg;
1188
1189         if (info->attrs[NL80211_ATTR_KEY_IDX])
1190                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1191
1192         if (key_idx > 5)
1193                 return -EINVAL;
1194
1195         if (info->attrs[NL80211_ATTR_MAC])
1196                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1197
1198         rtnl_lock();
1199
1200         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1201         if (err)
1202                 goto unlock_rtnl;
1203
1204         if (!rdev->ops->get_key) {
1205                 err = -EOPNOTSUPP;
1206                 goto out;
1207         }
1208
1209         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1210         if (!msg) {
1211                 err = -ENOMEM;
1212                 goto out;
1213         }
1214
1215         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1216                              NL80211_CMD_NEW_KEY);
1217
1218         if (IS_ERR(hdr)) {
1219                 err = PTR_ERR(hdr);
1220                 goto free_msg;
1221         }
1222
1223         cookie.msg = msg;
1224         cookie.idx = key_idx;
1225
1226         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1227         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1228         if (mac_addr)
1229                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1230
1231         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1232                                 &cookie, get_key_callback);
1233
1234         if (err)
1235                 goto free_msg;
1236
1237         if (cookie.error)
1238                 goto nla_put_failure;
1239
1240         genlmsg_end(msg, hdr);
1241         err = genlmsg_reply(msg, info);
1242         goto out;
1243
1244  nla_put_failure:
1245         err = -ENOBUFS;
1246  free_msg:
1247         nlmsg_free(msg);
1248  out:
1249         cfg80211_unlock_rdev(rdev);
1250         dev_put(dev);
1251  unlock_rtnl:
1252         rtnl_unlock();
1253
1254         return err;
1255 }
1256
1257 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1258 {
1259         struct cfg80211_registered_device *rdev;
1260         struct key_parse key;
1261         int err;
1262         struct net_device *dev;
1263         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1264                     u8 key_index);
1265
1266         err = nl80211_parse_key(info, &key);
1267         if (err)
1268                 return err;
1269
1270         if (key.idx < 0)
1271                 return -EINVAL;
1272
1273         /* only support setting default key */
1274         if (!key.def && !key.defmgmt)
1275                 return -EINVAL;
1276
1277         rtnl_lock();
1278
1279         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1280         if (err)
1281                 goto unlock_rtnl;
1282
1283         if (key.def)
1284                 func = rdev->ops->set_default_key;
1285         else
1286                 func = rdev->ops->set_default_mgmt_key;
1287
1288         if (!func) {
1289                 err = -EOPNOTSUPP;
1290                 goto out;
1291         }
1292
1293         wdev_lock(dev->ieee80211_ptr);
1294         err = nl80211_key_allowed(dev->ieee80211_ptr);
1295         if (!err)
1296                 err = func(&rdev->wiphy, dev, key.idx);
1297
1298 #ifdef CONFIG_CFG80211_WEXT
1299         if (!err) {
1300                 if (func == rdev->ops->set_default_key)
1301                         dev->ieee80211_ptr->wext.default_key = key.idx;
1302                 else
1303                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1304         }
1305 #endif
1306         wdev_unlock(dev->ieee80211_ptr);
1307
1308  out:
1309         cfg80211_unlock_rdev(rdev);
1310         dev_put(dev);
1311
1312  unlock_rtnl:
1313         rtnl_unlock();
1314
1315         return err;
1316 }
1317
1318 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1319 {
1320         struct cfg80211_registered_device *rdev;
1321         int err;
1322         struct net_device *dev;
1323         struct key_parse key;
1324         u8 *mac_addr = NULL;
1325
1326         err = nl80211_parse_key(info, &key);
1327         if (err)
1328                 return err;
1329
1330         if (!key.p.key)
1331                 return -EINVAL;
1332
1333         if (info->attrs[NL80211_ATTR_MAC])
1334                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1335
1336         rtnl_lock();
1337
1338         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1339         if (err)
1340                 goto unlock_rtnl;
1341
1342         if (!rdev->ops->add_key) {
1343                 err = -EOPNOTSUPP;
1344                 goto out;
1345         }
1346
1347         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1348                 err = -EINVAL;
1349                 goto out;
1350         }
1351
1352         wdev_lock(dev->ieee80211_ptr);
1353         err = nl80211_key_allowed(dev->ieee80211_ptr);
1354         if (!err)
1355                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1356                                          mac_addr, &key.p);
1357         wdev_unlock(dev->ieee80211_ptr);
1358
1359  out:
1360         cfg80211_unlock_rdev(rdev);
1361         dev_put(dev);
1362  unlock_rtnl:
1363         rtnl_unlock();
1364
1365         return err;
1366 }
1367
1368 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1369 {
1370         struct cfg80211_registered_device *rdev;
1371         int err;
1372         struct net_device *dev;
1373         u8 *mac_addr = NULL;
1374         struct key_parse key;
1375
1376         err = nl80211_parse_key(info, &key);
1377         if (err)
1378                 return err;
1379
1380         if (info->attrs[NL80211_ATTR_MAC])
1381                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1382
1383         rtnl_lock();
1384
1385         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1386         if (err)
1387                 goto unlock_rtnl;
1388
1389         if (!rdev->ops->del_key) {
1390                 err = -EOPNOTSUPP;
1391                 goto out;
1392         }
1393
1394         wdev_lock(dev->ieee80211_ptr);
1395         err = nl80211_key_allowed(dev->ieee80211_ptr);
1396         if (!err)
1397                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1398
1399 #ifdef CONFIG_CFG80211_WEXT
1400         if (!err) {
1401                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1402                         dev->ieee80211_ptr->wext.default_key = -1;
1403                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1404                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1405         }
1406 #endif
1407         wdev_unlock(dev->ieee80211_ptr);
1408
1409  out:
1410         cfg80211_unlock_rdev(rdev);
1411         dev_put(dev);
1412
1413  unlock_rtnl:
1414         rtnl_unlock();
1415
1416         return err;
1417 }
1418
1419 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1420 {
1421         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1422                     struct beacon_parameters *info);
1423         struct cfg80211_registered_device *rdev;
1424         int err;
1425         struct net_device *dev;
1426         struct beacon_parameters params;
1427         int haveinfo = 0;
1428
1429         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1430                 return -EINVAL;
1431
1432         rtnl_lock();
1433
1434         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1435         if (err)
1436                 goto unlock_rtnl;
1437
1438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1439                 err = -EOPNOTSUPP;
1440                 goto out;
1441         }
1442
1443         switch (info->genlhdr->cmd) {
1444         case NL80211_CMD_NEW_BEACON:
1445                 /* these are required for NEW_BEACON */
1446                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1447                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1448                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1449                         err = -EINVAL;
1450                         goto out;
1451                 }
1452
1453                 call = rdev->ops->add_beacon;
1454                 break;
1455         case NL80211_CMD_SET_BEACON:
1456                 call = rdev->ops->set_beacon;
1457                 break;
1458         default:
1459                 WARN_ON(1);
1460                 err = -EOPNOTSUPP;
1461                 goto out;
1462         }
1463
1464         if (!call) {
1465                 err = -EOPNOTSUPP;
1466                 goto out;
1467         }
1468
1469         memset(&params, 0, sizeof(params));
1470
1471         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1472                 params.interval =
1473                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1474                 haveinfo = 1;
1475         }
1476
1477         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1478                 params.dtim_period =
1479                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1480                 haveinfo = 1;
1481         }
1482
1483         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1484                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1485                 params.head_len =
1486                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1487                 haveinfo = 1;
1488         }
1489
1490         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1491                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1492                 params.tail_len =
1493                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1494                 haveinfo = 1;
1495         }
1496
1497         if (!haveinfo) {
1498                 err = -EINVAL;
1499                 goto out;
1500         }
1501
1502         err = call(&rdev->wiphy, dev, &params);
1503
1504  out:
1505         cfg80211_unlock_rdev(rdev);
1506         dev_put(dev);
1507  unlock_rtnl:
1508         rtnl_unlock();
1509
1510         return err;
1511 }
1512
1513 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1514 {
1515         struct cfg80211_registered_device *rdev;
1516         int err;
1517         struct net_device *dev;
1518
1519         rtnl_lock();
1520
1521         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1522         if (err)
1523                 goto unlock_rtnl;
1524
1525         if (!rdev->ops->del_beacon) {
1526                 err = -EOPNOTSUPP;
1527                 goto out;
1528         }
1529
1530         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1531                 err = -EOPNOTSUPP;
1532                 goto out;
1533         }
1534         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1535
1536  out:
1537         cfg80211_unlock_rdev(rdev);
1538         dev_put(dev);
1539  unlock_rtnl:
1540         rtnl_unlock();
1541
1542         return err;
1543 }
1544
1545 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1546         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1547         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1548         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1549         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1550 };
1551
1552 static int parse_station_flags(struct genl_info *info,
1553                                struct station_parameters *params)
1554 {
1555         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1556         struct nlattr *nla;
1557         int flag;
1558
1559         /*
1560          * Try parsing the new attribute first so userspace
1561          * can specify both for older kernels.
1562          */
1563         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1564         if (nla) {
1565                 struct nl80211_sta_flag_update *sta_flags;
1566
1567                 sta_flags = nla_data(nla);
1568                 params->sta_flags_mask = sta_flags->mask;
1569                 params->sta_flags_set = sta_flags->set;
1570                 if ((params->sta_flags_mask |
1571                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1572                         return -EINVAL;
1573                 return 0;
1574         }
1575
1576         /* if present, parse the old attribute */
1577
1578         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1579         if (!nla)
1580                 return 0;
1581
1582         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1583                              nla, sta_flags_policy))
1584                 return -EINVAL;
1585
1586         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1587         params->sta_flags_mask &= ~1;
1588
1589         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1590                 if (flags[flag])
1591                         params->sta_flags_set |= (1<<flag);
1592
1593         return 0;
1594 }
1595
1596 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1597 {
1598         int modulation, streams, bitrate;
1599
1600         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1601                 return rate->legacy;
1602
1603         /* the formula below does only work for MCS values smaller than 32 */
1604         if (rate->mcs >= 32)
1605                 return 0;
1606
1607         modulation = rate->mcs & 7;
1608         streams = (rate->mcs >> 3) + 1;
1609
1610         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1611                         13500000 : 6500000;
1612
1613         if (modulation < 4)
1614                 bitrate *= (modulation + 1);
1615         else if (modulation == 4)
1616                 bitrate *= (modulation + 2);
1617         else
1618                 bitrate *= (modulation + 3);
1619
1620         bitrate *= streams;
1621
1622         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1623                 bitrate = (bitrate / 9) * 10;
1624
1625         /* do NOT round down here */
1626         return (bitrate + 50000) / 100000;
1627 }
1628
1629 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1630                                 int flags, struct net_device *dev,
1631                                 u8 *mac_addr, struct station_info *sinfo)
1632 {
1633         void *hdr;
1634         struct nlattr *sinfoattr, *txrate;
1635         u16 bitrate;
1636
1637         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1638         if (!hdr)
1639                 return -1;
1640
1641         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1642         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1643
1644         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1645
1646         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1647         if (!sinfoattr)
1648                 goto nla_put_failure;
1649         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1650                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1651                             sinfo->inactive_time);
1652         if (sinfo->filled & STATION_INFO_RX_BYTES)
1653                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1654                             sinfo->rx_bytes);
1655         if (sinfo->filled & STATION_INFO_TX_BYTES)
1656                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1657                             sinfo->tx_bytes);
1658         if (sinfo->filled & STATION_INFO_LLID)
1659                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1660                             sinfo->llid);
1661         if (sinfo->filled & STATION_INFO_PLID)
1662                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1663                             sinfo->plid);
1664         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1665                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1666                             sinfo->plink_state);
1667         if (sinfo->filled & STATION_INFO_SIGNAL)
1668                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1669                            sinfo->signal);
1670         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1671                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1672                 if (!txrate)
1673                         goto nla_put_failure;
1674
1675                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1676                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1677                 if (bitrate > 0)
1678                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1679
1680                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1681                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1682                                     sinfo->txrate.mcs);
1683                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1684                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1685                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1686                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1687
1688                 nla_nest_end(msg, txrate);
1689         }
1690         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1691                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1692                             sinfo->rx_packets);
1693         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1694                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1695                             sinfo->tx_packets);
1696         nla_nest_end(msg, sinfoattr);
1697
1698         return genlmsg_end(msg, hdr);
1699
1700  nla_put_failure:
1701         genlmsg_cancel(msg, hdr);
1702         return -EMSGSIZE;
1703 }
1704
1705 static int nl80211_dump_station(struct sk_buff *skb,
1706                                 struct netlink_callback *cb)
1707 {
1708         struct station_info sinfo;
1709         struct cfg80211_registered_device *dev;
1710         struct net_device *netdev;
1711         u8 mac_addr[ETH_ALEN];
1712         int ifidx = cb->args[0];
1713         int sta_idx = cb->args[1];
1714         int err;
1715
1716         if (!ifidx)
1717                 ifidx = nl80211_get_ifidx(cb);
1718         if (ifidx < 0)
1719                 return ifidx;
1720
1721         rtnl_lock();
1722
1723         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1724         if (!netdev) {
1725                 err = -ENODEV;
1726                 goto out_rtnl;
1727         }
1728
1729         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1730         if (IS_ERR(dev)) {
1731                 err = PTR_ERR(dev);
1732                 goto out_rtnl;
1733         }
1734
1735         if (!dev->ops->dump_station) {
1736                 err = -EOPNOTSUPP;
1737                 goto out_err;
1738         }
1739
1740         while (1) {
1741                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1742                                              mac_addr, &sinfo);
1743                 if (err == -ENOENT)
1744                         break;
1745                 if (err)
1746                         goto out_err;
1747
1748                 if (nl80211_send_station(skb,
1749                                 NETLINK_CB(cb->skb).pid,
1750                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1751                                 netdev, mac_addr,
1752                                 &sinfo) < 0)
1753                         goto out;
1754
1755                 sta_idx++;
1756         }
1757
1758
1759  out:
1760         cb->args[1] = sta_idx;
1761         err = skb->len;
1762  out_err:
1763         cfg80211_unlock_rdev(dev);
1764  out_rtnl:
1765         rtnl_unlock();
1766
1767         return err;
1768 }
1769
1770 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1771 {
1772         struct cfg80211_registered_device *rdev;
1773         int err;
1774         struct net_device *dev;
1775         struct station_info sinfo;
1776         struct sk_buff *msg;
1777         u8 *mac_addr = NULL;
1778
1779         memset(&sinfo, 0, sizeof(sinfo));
1780
1781         if (!info->attrs[NL80211_ATTR_MAC])
1782                 return -EINVAL;
1783
1784         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1785
1786         rtnl_lock();
1787
1788         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1789         if (err)
1790                 goto out_rtnl;
1791
1792         if (!rdev->ops->get_station) {
1793                 err = -EOPNOTSUPP;
1794                 goto out;
1795         }
1796
1797         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1798         if (err)
1799                 goto out;
1800
1801         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1802         if (!msg)
1803                 goto out;
1804
1805         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1806                                  dev, mac_addr, &sinfo) < 0)
1807                 goto out_free;
1808
1809         err = genlmsg_reply(msg, info);
1810         goto out;
1811
1812  out_free:
1813         nlmsg_free(msg);
1814  out:
1815         cfg80211_unlock_rdev(rdev);
1816         dev_put(dev);
1817  out_rtnl:
1818         rtnl_unlock();
1819
1820         return err;
1821 }
1822
1823 /*
1824  * Get vlan interface making sure it is running and on the right wiphy.
1825  */
1826 static int get_vlan(struct genl_info *info,
1827                     struct cfg80211_registered_device *rdev,
1828                     struct net_device **vlan)
1829 {
1830         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1831         *vlan = NULL;
1832
1833         if (vlanattr) {
1834                 *vlan = dev_get_by_index(genl_info_net(info),
1835                                          nla_get_u32(vlanattr));
1836                 if (!*vlan)
1837                         return -ENODEV;
1838                 if (!(*vlan)->ieee80211_ptr)
1839                         return -EINVAL;
1840                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1841                         return -EINVAL;
1842                 if (!netif_running(*vlan))
1843                         return -ENETDOWN;
1844         }
1845         return 0;
1846 }
1847
1848 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1849 {
1850         struct cfg80211_registered_device *rdev;
1851         int err;
1852         struct net_device *dev;
1853         struct station_parameters params;
1854         u8 *mac_addr = NULL;
1855
1856         memset(&params, 0, sizeof(params));
1857
1858         params.listen_interval = -1;
1859
1860         if (info->attrs[NL80211_ATTR_STA_AID])
1861                 return -EINVAL;
1862
1863         if (!info->attrs[NL80211_ATTR_MAC])
1864                 return -EINVAL;
1865
1866         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1867
1868         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1869                 params.supported_rates =
1870                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1871                 params.supported_rates_len =
1872                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1873         }
1874
1875         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1876                 params.listen_interval =
1877                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1878
1879         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1880                 params.ht_capa =
1881                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1882
1883         if (parse_station_flags(info, &params))
1884                 return -EINVAL;
1885
1886         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1887                 params.plink_action =
1888                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1889
1890         rtnl_lock();
1891
1892         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1893         if (err)
1894                 goto out_rtnl;
1895
1896         err = get_vlan(info, rdev, &params.vlan);
1897         if (err)
1898                 goto out;
1899
1900         /* validate settings */
1901         err = 0;
1902
1903         switch (dev->ieee80211_ptr->iftype) {
1904         case NL80211_IFTYPE_AP:
1905         case NL80211_IFTYPE_AP_VLAN:
1906                 /* disallow mesh-specific things */
1907                 if (params.plink_action)
1908                         err = -EINVAL;
1909                 break;
1910         case NL80211_IFTYPE_STATION:
1911                 /* disallow everything but AUTHORIZED flag */
1912                 if (params.plink_action)
1913                         err = -EINVAL;
1914                 if (params.vlan)
1915                         err = -EINVAL;
1916                 if (params.supported_rates)
1917                         err = -EINVAL;
1918                 if (params.ht_capa)
1919                         err = -EINVAL;
1920                 if (params.listen_interval >= 0)
1921                         err = -EINVAL;
1922                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1923                         err = -EINVAL;
1924                 break;
1925         case NL80211_IFTYPE_MESH_POINT:
1926                 /* disallow things mesh doesn't support */
1927                 if (params.vlan)
1928                         err = -EINVAL;
1929                 if (params.ht_capa)
1930                         err = -EINVAL;
1931                 if (params.listen_interval >= 0)
1932                         err = -EINVAL;
1933                 if (params.supported_rates)
1934                         err = -EINVAL;
1935                 if (params.sta_flags_mask)
1936                         err = -EINVAL;
1937                 break;
1938         default:
1939                 err = -EINVAL;
1940         }
1941
1942         if (err)
1943                 goto out;
1944
1945         if (!rdev->ops->change_station) {
1946                 err = -EOPNOTSUPP;
1947                 goto out;
1948         }
1949
1950         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1951
1952  out:
1953         if (params.vlan)
1954                 dev_put(params.vlan);
1955         cfg80211_unlock_rdev(rdev);
1956         dev_put(dev);
1957  out_rtnl:
1958         rtnl_unlock();
1959
1960         return err;
1961 }
1962
1963 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1964 {
1965         struct cfg80211_registered_device *rdev;
1966         int err;
1967         struct net_device *dev;
1968         struct station_parameters params;
1969         u8 *mac_addr = NULL;
1970
1971         memset(&params, 0, sizeof(params));
1972
1973         if (!info->attrs[NL80211_ATTR_MAC])
1974                 return -EINVAL;
1975
1976         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1977                 return -EINVAL;
1978
1979         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1980                 return -EINVAL;
1981
1982         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1983         params.supported_rates =
1984                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1985         params.supported_rates_len =
1986                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1987         params.listen_interval =
1988                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1989
1990         if (info->attrs[NL80211_ATTR_STA_AID]) {
1991                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1992                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1993                         return -EINVAL;
1994         }
1995
1996         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1997                 params.ht_capa =
1998                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1999
2000         if (parse_station_flags(info, &params))
2001                 return -EINVAL;
2002
2003         rtnl_lock();
2004
2005         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2006         if (err)
2007                 goto out_rtnl;
2008
2009         err = get_vlan(info, rdev, &params.vlan);
2010         if (err)
2011                 goto out;
2012
2013         /* validate settings */
2014         err = 0;
2015
2016         switch (dev->ieee80211_ptr->iftype) {
2017         case NL80211_IFTYPE_AP:
2018         case NL80211_IFTYPE_AP_VLAN:
2019                 /* all ok but must have AID */
2020                 if (!params.aid)
2021                         err = -EINVAL;
2022                 break;
2023         case NL80211_IFTYPE_MESH_POINT:
2024                 /* disallow things mesh doesn't support */
2025                 if (params.vlan)
2026                         err = -EINVAL;
2027                 if (params.aid)
2028                         err = -EINVAL;
2029                 if (params.ht_capa)
2030                         err = -EINVAL;
2031                 if (params.listen_interval >= 0)
2032                         err = -EINVAL;
2033                 if (params.supported_rates)
2034                         err = -EINVAL;
2035                 if (params.sta_flags_mask)
2036                         err = -EINVAL;
2037                 break;
2038         default:
2039                 err = -EINVAL;
2040         }
2041
2042         if (err)
2043                 goto out;
2044
2045         if (!rdev->ops->add_station) {
2046                 err = -EOPNOTSUPP;
2047                 goto out;
2048         }
2049
2050         if (!netif_running(dev)) {
2051                 err = -ENETDOWN;
2052                 goto out;
2053         }
2054
2055         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2056
2057  out:
2058         if (params.vlan)
2059                 dev_put(params.vlan);
2060         cfg80211_unlock_rdev(rdev);
2061         dev_put(dev);
2062  out_rtnl:
2063         rtnl_unlock();
2064
2065         return err;
2066 }
2067
2068 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2069 {
2070         struct cfg80211_registered_device *rdev;
2071         int err;
2072         struct net_device *dev;
2073         u8 *mac_addr = NULL;
2074
2075         if (info->attrs[NL80211_ATTR_MAC])
2076                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2077
2078         rtnl_lock();
2079
2080         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2081         if (err)
2082                 goto out_rtnl;
2083
2084         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2085             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2086             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2087                 err = -EINVAL;
2088                 goto out;
2089         }
2090
2091         if (!rdev->ops->del_station) {
2092                 err = -EOPNOTSUPP;
2093                 goto out;
2094         }
2095
2096         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2097
2098  out:
2099         cfg80211_unlock_rdev(rdev);
2100         dev_put(dev);
2101  out_rtnl:
2102         rtnl_unlock();
2103
2104         return err;
2105 }
2106
2107 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2108                                 int flags, struct net_device *dev,
2109                                 u8 *dst, u8 *next_hop,
2110                                 struct mpath_info *pinfo)
2111 {
2112         void *hdr;
2113         struct nlattr *pinfoattr;
2114
2115         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2116         if (!hdr)
2117                 return -1;
2118
2119         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2120         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2121         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2122
2123         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2124
2125         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2126         if (!pinfoattr)
2127                 goto nla_put_failure;
2128         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2129                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2130                             pinfo->frame_qlen);
2131         if (pinfo->filled & MPATH_INFO_SN)
2132                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2133                             pinfo->sn);
2134         if (pinfo->filled & MPATH_INFO_METRIC)
2135                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2136                             pinfo->metric);
2137         if (pinfo->filled & MPATH_INFO_EXPTIME)
2138                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2139                             pinfo->exptime);
2140         if (pinfo->filled & MPATH_INFO_FLAGS)
2141                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2142                             pinfo->flags);
2143         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2144                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2145                             pinfo->discovery_timeout);
2146         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2147                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2148                             pinfo->discovery_retries);
2149
2150         nla_nest_end(msg, pinfoattr);
2151
2152         return genlmsg_end(msg, hdr);
2153
2154  nla_put_failure:
2155         genlmsg_cancel(msg, hdr);
2156         return -EMSGSIZE;
2157 }
2158
2159 static int nl80211_dump_mpath(struct sk_buff *skb,
2160                               struct netlink_callback *cb)
2161 {
2162         struct mpath_info pinfo;
2163         struct cfg80211_registered_device *dev;
2164         struct net_device *netdev;
2165         u8 dst[ETH_ALEN];
2166         u8 next_hop[ETH_ALEN];
2167         int ifidx = cb->args[0];
2168         int path_idx = cb->args[1];
2169         int err;
2170
2171         if (!ifidx)
2172                 ifidx = nl80211_get_ifidx(cb);
2173         if (ifidx < 0)
2174                 return ifidx;
2175
2176         rtnl_lock();
2177
2178         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2179         if (!netdev) {
2180                 err = -ENODEV;
2181                 goto out_rtnl;
2182         }
2183
2184         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2185         if (IS_ERR(dev)) {
2186                 err = PTR_ERR(dev);
2187                 goto out_rtnl;
2188         }
2189
2190         if (!dev->ops->dump_mpath) {
2191                 err = -EOPNOTSUPP;
2192                 goto out_err;
2193         }
2194
2195         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2196                 err = -EOPNOTSUPP;
2197                 goto out_err;
2198         }
2199
2200         while (1) {
2201                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2202                                            dst, next_hop, &pinfo);
2203                 if (err == -ENOENT)
2204                         break;
2205                 if (err)
2206                         goto out_err;
2207
2208                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2209                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2210                                        netdev, dst, next_hop,
2211                                        &pinfo) < 0)
2212                         goto out;
2213
2214                 path_idx++;
2215         }
2216
2217
2218  out:
2219         cb->args[1] = path_idx;
2220         err = skb->len;
2221  out_err:
2222         cfg80211_unlock_rdev(dev);
2223  out_rtnl:
2224         rtnl_unlock();
2225
2226         return err;
2227 }
2228
2229 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2230 {
2231         struct cfg80211_registered_device *rdev;
2232         int err;
2233         struct net_device *dev;
2234         struct mpath_info pinfo;
2235         struct sk_buff *msg;
2236         u8 *dst = NULL;
2237         u8 next_hop[ETH_ALEN];
2238
2239         memset(&pinfo, 0, sizeof(pinfo));
2240
2241         if (!info->attrs[NL80211_ATTR_MAC])
2242                 return -EINVAL;
2243
2244         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2245
2246         rtnl_lock();
2247
2248         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2249         if (err)
2250                 goto out_rtnl;
2251
2252         if (!rdev->ops->get_mpath) {
2253                 err = -EOPNOTSUPP;
2254                 goto out;
2255         }
2256
2257         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2258                 err = -EOPNOTSUPP;
2259                 goto out;
2260         }
2261
2262         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2263         if (err)
2264                 goto out;
2265
2266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2267         if (!msg)
2268                 goto out;
2269
2270         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2271                                  dev, dst, next_hop, &pinfo) < 0)
2272                 goto out_free;
2273
2274         err = genlmsg_reply(msg, info);
2275         goto out;
2276
2277  out_free:
2278         nlmsg_free(msg);
2279  out:
2280         cfg80211_unlock_rdev(rdev);
2281         dev_put(dev);
2282  out_rtnl:
2283         rtnl_unlock();
2284
2285         return err;
2286 }
2287
2288 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2289 {
2290         struct cfg80211_registered_device *rdev;
2291         int err;
2292         struct net_device *dev;
2293         u8 *dst = NULL;
2294         u8 *next_hop = NULL;
2295
2296         if (!info->attrs[NL80211_ATTR_MAC])
2297                 return -EINVAL;
2298
2299         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2300                 return -EINVAL;
2301
2302         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2303         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2304
2305         rtnl_lock();
2306
2307         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2308         if (err)
2309                 goto out_rtnl;
2310
2311         if (!rdev->ops->change_mpath) {
2312                 err = -EOPNOTSUPP;
2313                 goto out;
2314         }
2315
2316         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2317                 err = -EOPNOTSUPP;
2318                 goto out;
2319         }
2320
2321         if (!netif_running(dev)) {
2322                 err = -ENETDOWN;
2323                 goto out;
2324         }
2325
2326         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2327
2328  out:
2329         cfg80211_unlock_rdev(rdev);
2330         dev_put(dev);
2331  out_rtnl:
2332         rtnl_unlock();
2333
2334         return err;
2335 }
2336 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2337 {
2338         struct cfg80211_registered_device *rdev;
2339         int err;
2340         struct net_device *dev;
2341         u8 *dst = NULL;
2342         u8 *next_hop = NULL;
2343
2344         if (!info->attrs[NL80211_ATTR_MAC])
2345                 return -EINVAL;
2346
2347         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2348                 return -EINVAL;
2349
2350         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2351         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2352
2353         rtnl_lock();
2354
2355         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2356         if (err)
2357                 goto out_rtnl;
2358
2359         if (!rdev->ops->add_mpath) {
2360                 err = -EOPNOTSUPP;
2361                 goto out;
2362         }
2363
2364         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2365                 err = -EOPNOTSUPP;
2366                 goto out;
2367         }
2368
2369         if (!netif_running(dev)) {
2370                 err = -ENETDOWN;
2371                 goto out;
2372         }
2373
2374         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2375
2376  out:
2377         cfg80211_unlock_rdev(rdev);
2378         dev_put(dev);
2379  out_rtnl:
2380         rtnl_unlock();
2381
2382         return err;
2383 }
2384
2385 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2386 {
2387         struct cfg80211_registered_device *rdev;
2388         int err;
2389         struct net_device *dev;
2390         u8 *dst = NULL;
2391
2392         if (info->attrs[NL80211_ATTR_MAC])
2393                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2394
2395         rtnl_lock();
2396
2397         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2398         if (err)
2399                 goto out_rtnl;
2400
2401         if (!rdev->ops->del_mpath) {
2402                 err = -EOPNOTSUPP;
2403                 goto out;
2404         }
2405
2406         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2407
2408  out:
2409         cfg80211_unlock_rdev(rdev);
2410         dev_put(dev);
2411  out_rtnl:
2412         rtnl_unlock();
2413
2414         return err;
2415 }
2416
2417 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2418 {
2419         struct cfg80211_registered_device *rdev;
2420         int err;
2421         struct net_device *dev;
2422         struct bss_parameters params;
2423
2424         memset(&params, 0, sizeof(params));
2425         /* default to not changing parameters */
2426         params.use_cts_prot = -1;
2427         params.use_short_preamble = -1;
2428         params.use_short_slot_time = -1;
2429
2430         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2431                 params.use_cts_prot =
2432                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2433         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2434                 params.use_short_preamble =
2435                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2436         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2437                 params.use_short_slot_time =
2438                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2439         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2440                 params.basic_rates =
2441                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2442                 params.basic_rates_len =
2443                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2444         }
2445
2446         rtnl_lock();
2447
2448         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2449         if (err)
2450                 goto out_rtnl;
2451
2452         if (!rdev->ops->change_bss) {
2453                 err = -EOPNOTSUPP;
2454                 goto out;
2455         }
2456
2457         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2458                 err = -EOPNOTSUPP;
2459                 goto out;
2460         }
2461
2462         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2463
2464  out:
2465         cfg80211_unlock_rdev(rdev);
2466         dev_put(dev);
2467  out_rtnl:
2468         rtnl_unlock();
2469
2470         return err;
2471 }
2472
2473 static const struct nla_policy
2474         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2475         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2476         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2477         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2478         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2479         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2480         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2481 };
2482
2483 static int parse_reg_rule(struct nlattr *tb[],
2484         struct ieee80211_reg_rule *reg_rule)
2485 {
2486         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2487         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2488
2489         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2490                 return -EINVAL;
2491         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2492                 return -EINVAL;
2493         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2494                 return -EINVAL;
2495         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2496                 return -EINVAL;
2497         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2498                 return -EINVAL;
2499
2500         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2501
2502         freq_range->start_freq_khz =
2503                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2504         freq_range->end_freq_khz =
2505                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2506         freq_range->max_bandwidth_khz =
2507                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2508
2509         power_rule->max_eirp =
2510                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2511
2512         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2513                 power_rule->max_antenna_gain =
2514                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2515
2516         return 0;
2517 }
2518
2519 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2520 {
2521         int r;
2522         char *data = NULL;
2523
2524         /*
2525          * You should only get this when cfg80211 hasn't yet initialized
2526          * completely when built-in to the kernel right between the time
2527          * window between nl80211_init() and regulatory_init(), if that is
2528          * even possible.
2529          */
2530         mutex_lock(&cfg80211_mutex);
2531         if (unlikely(!cfg80211_regdomain)) {
2532                 mutex_unlock(&cfg80211_mutex);
2533                 return -EINPROGRESS;
2534         }
2535         mutex_unlock(&cfg80211_mutex);
2536
2537         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2538                 return -EINVAL;
2539
2540         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2541
2542 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2543         /* We ignore world regdom requests with the old regdom setup */
2544         if (is_world_regdom(data))
2545                 return -EINVAL;
2546 #endif
2547
2548         r = regulatory_hint_user(data);
2549
2550         return r;
2551 }
2552
2553 static int nl80211_get_mesh_params(struct sk_buff *skb,
2554         struct genl_info *info)
2555 {
2556         struct cfg80211_registered_device *rdev;
2557         struct mesh_config cur_params;
2558         int err;
2559         struct net_device *dev;
2560         void *hdr;
2561         struct nlattr *pinfoattr;
2562         struct sk_buff *msg;
2563
2564         rtnl_lock();
2565
2566         /* Look up our device */
2567         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2568         if (err)
2569                 goto out_rtnl;
2570
2571         if (!rdev->ops->get_mesh_params) {
2572                 err = -EOPNOTSUPP;
2573                 goto out;
2574         }
2575
2576         /* Get the mesh params */
2577         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2578         if (err)
2579                 goto out;
2580
2581         /* Draw up a netlink message to send back */
2582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2583         if (!msg) {
2584                 err = -ENOBUFS;
2585                 goto out;
2586         }
2587         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2588                              NL80211_CMD_GET_MESH_PARAMS);
2589         if (!hdr)
2590                 goto nla_put_failure;
2591         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2592         if (!pinfoattr)
2593                 goto nla_put_failure;
2594         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2595         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2596                         cur_params.dot11MeshRetryTimeout);
2597         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2598                         cur_params.dot11MeshConfirmTimeout);
2599         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2600                         cur_params.dot11MeshHoldingTimeout);
2601         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2602                         cur_params.dot11MeshMaxPeerLinks);
2603         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2604                         cur_params.dot11MeshMaxRetries);
2605         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2606                         cur_params.dot11MeshTTL);
2607         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2608                         cur_params.auto_open_plinks);
2609         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2610                         cur_params.dot11MeshHWMPmaxPREQretries);
2611         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2612                         cur_params.path_refresh_time);
2613         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2614                         cur_params.min_discovery_timeout);
2615         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2616                         cur_params.dot11MeshHWMPactivePathTimeout);
2617         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2618                         cur_params.dot11MeshHWMPpreqMinInterval);
2619         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2620                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2621         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2622                         cur_params.dot11MeshHWMPRootMode);
2623         nla_nest_end(msg, pinfoattr);
2624         genlmsg_end(msg, hdr);
2625         err = genlmsg_reply(msg, info);
2626         goto out;
2627
2628  nla_put_failure:
2629         genlmsg_cancel(msg, hdr);
2630         err = -EMSGSIZE;
2631  out:
2632         /* Cleanup */
2633         cfg80211_unlock_rdev(rdev);
2634         dev_put(dev);
2635  out_rtnl:
2636         rtnl_unlock();
2637
2638         return err;
2639 }
2640
2641 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2642 do {\
2643         if (table[attr_num]) {\
2644                 cfg.param = nla_fn(table[attr_num]); \
2645                 mask |= (1 << (attr_num - 1)); \
2646         } \
2647 } while (0);\
2648
2649 static struct nla_policy
2650 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2651         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2652         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2653         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2654         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2655         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2656         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2657         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2658
2659         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2660         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2661         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2663         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2664         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2665 };
2666
2667 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2668 {
2669         int err;
2670         u32 mask;
2671         struct cfg80211_registered_device *rdev;
2672         struct net_device *dev;
2673         struct mesh_config cfg;
2674         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2675         struct nlattr *parent_attr;
2676
2677         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2678         if (!parent_attr)
2679                 return -EINVAL;
2680         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2681                         parent_attr, nl80211_meshconf_params_policy))
2682                 return -EINVAL;
2683
2684         rtnl_lock();
2685
2686         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2687         if (err)
2688                 goto out_rtnl;
2689
2690         if (!rdev->ops->set_mesh_params) {
2691                 err = -EOPNOTSUPP;
2692                 goto out;
2693         }
2694
2695         /* This makes sure that there aren't more than 32 mesh config
2696          * parameters (otherwise our bitfield scheme would not work.) */
2697         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2698
2699         /* Fill in the params struct */
2700         mask = 0;
2701         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2702                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2703         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2704                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2705         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2706                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2708                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2710                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2712                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2714                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2716                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2717                         nla_get_u8);
2718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2719                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2721                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2722                         nla_get_u16);
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2724                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2725                         nla_get_u32);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2727                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2728                         nla_get_u16);
2729         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2730                         dot11MeshHWMPnetDiameterTraversalTime,
2731                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2732                         nla_get_u16);
2733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2734                         dot11MeshHWMPRootMode, mask,
2735                         NL80211_MESHCONF_HWMP_ROOTMODE,
2736                         nla_get_u8);
2737
2738         /* Apply changes */
2739         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2740
2741  out:
2742         /* cleanup */
2743         cfg80211_unlock_rdev(rdev);
2744         dev_put(dev);
2745  out_rtnl:
2746         rtnl_unlock();
2747
2748         return err;
2749 }
2750
2751 #undef FILL_IN_MESH_PARAM_IF_SET
2752
2753 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2754 {
2755         struct sk_buff *msg;
2756         void *hdr = NULL;
2757         struct nlattr *nl_reg_rules;
2758         unsigned int i;
2759         int err = -EINVAL;
2760
2761         mutex_lock(&cfg80211_mutex);
2762
2763         if (!cfg80211_regdomain)
2764                 goto out;
2765
2766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2767         if (!msg) {
2768                 err = -ENOBUFS;
2769                 goto out;
2770         }
2771
2772         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2773                              NL80211_CMD_GET_REG);
2774         if (!hdr)
2775                 goto nla_put_failure;
2776
2777         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2778                 cfg80211_regdomain->alpha2);
2779
2780         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2781         if (!nl_reg_rules)
2782                 goto nla_put_failure;
2783
2784         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2785                 struct nlattr *nl_reg_rule;
2786                 const struct ieee80211_reg_rule *reg_rule;
2787                 const struct ieee80211_freq_range *freq_range;
2788                 const struct ieee80211_power_rule *power_rule;
2789
2790                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2791                 freq_range = &reg_rule->freq_range;
2792                 power_rule = &reg_rule->power_rule;
2793
2794                 nl_reg_rule = nla_nest_start(msg, i);
2795                 if (!nl_reg_rule)
2796                         goto nla_put_failure;
2797
2798                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2799                         reg_rule->flags);
2800                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2801                         freq_range->start_freq_khz);
2802                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2803                         freq_range->end_freq_khz);
2804                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2805                         freq_range->max_bandwidth_khz);
2806                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2807                         power_rule->max_antenna_gain);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2809                         power_rule->max_eirp);
2810
2811                 nla_nest_end(msg, nl_reg_rule);
2812         }
2813
2814         nla_nest_end(msg, nl_reg_rules);
2815
2816         genlmsg_end(msg, hdr);
2817         err = genlmsg_reply(msg, info);
2818         goto out;
2819
2820 nla_put_failure:
2821         genlmsg_cancel(msg, hdr);
2822         err = -EMSGSIZE;
2823 out:
2824         mutex_unlock(&cfg80211_mutex);
2825         return err;
2826 }
2827
2828 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2829 {
2830         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2831         struct nlattr *nl_reg_rule;
2832         char *alpha2 = NULL;
2833         int rem_reg_rules = 0, r = 0;
2834         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2835         struct ieee80211_regdomain *rd = NULL;
2836
2837         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2838                 return -EINVAL;
2839
2840         if (!info->attrs[NL80211_ATTR_REG_RULES])
2841                 return -EINVAL;
2842
2843         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2844
2845         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2846                         rem_reg_rules) {
2847                 num_rules++;
2848                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2849                         return -EINVAL;
2850         }
2851
2852         mutex_lock(&cfg80211_mutex);
2853
2854         if (!reg_is_valid_request(alpha2)) {
2855                 r = -EINVAL;
2856                 goto bad_reg;
2857         }
2858
2859         size_of_regd = sizeof(struct ieee80211_regdomain) +
2860                 (num_rules * sizeof(struct ieee80211_reg_rule));
2861
2862         rd = kzalloc(size_of_regd, GFP_KERNEL);
2863         if (!rd) {
2864                 r = -ENOMEM;
2865                 goto bad_reg;
2866         }
2867
2868         rd->n_reg_rules = num_rules;
2869         rd->alpha2[0] = alpha2[0];
2870         rd->alpha2[1] = alpha2[1];
2871
2872         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2873                         rem_reg_rules) {
2874                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2875                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2876                         reg_rule_policy);
2877                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2878                 if (r)
2879                         goto bad_reg;
2880
2881                 rule_idx++;
2882
2883                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2884                         r = -EINVAL;
2885                         goto bad_reg;
2886                 }
2887         }
2888
2889         BUG_ON(rule_idx != num_rules);
2890
2891         r = set_regdom(rd);
2892
2893         mutex_unlock(&cfg80211_mutex);
2894
2895         return r;
2896
2897  bad_reg:
2898         mutex_unlock(&cfg80211_mutex);
2899         kfree(rd);
2900         return r;
2901 }
2902
2903 static int validate_scan_freqs(struct nlattr *freqs)
2904 {
2905         struct nlattr *attr1, *attr2;
2906         int n_channels = 0, tmp1, tmp2;
2907
2908         nla_for_each_nested(attr1, freqs, tmp1) {
2909                 n_channels++;
2910                 /*
2911                  * Some hardware has a limited channel list for
2912                  * scanning, and it is pretty much nonsensical
2913                  * to scan for a channel twice, so disallow that
2914                  * and don't require drivers to check that the
2915                  * channel list they get isn't longer than what
2916                  * they can scan, as long as they can scan all
2917                  * the channels they registered at once.
2918                  */
2919                 nla_for_each_nested(attr2, freqs, tmp2)
2920                         if (attr1 != attr2 &&
2921                             nla_get_u32(attr1) == nla_get_u32(attr2))
2922                                 return 0;
2923         }
2924
2925         return n_channels;
2926 }
2927
2928 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2929 {
2930         struct cfg80211_registered_device *rdev;
2931         struct net_device *dev;
2932         struct cfg80211_scan_request *request;
2933         struct cfg80211_ssid *ssid;
2934         struct ieee80211_channel *channel;
2935         struct nlattr *attr;
2936         struct wiphy *wiphy;
2937         int err, tmp, n_ssids = 0, n_channels, i;
2938         enum ieee80211_band band;
2939         size_t ie_len;
2940
2941         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2942                 return -EINVAL;
2943
2944         rtnl_lock();
2945
2946         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2947         if (err)
2948                 goto out_rtnl;
2949
2950         wiphy = &rdev->wiphy;
2951
2952         if (!rdev->ops->scan) {
2953                 err = -EOPNOTSUPP;
2954                 goto out;
2955         }
2956
2957         if (!netif_running(dev)) {
2958                 err = -ENETDOWN;
2959                 goto out;
2960         }
2961
2962         if (rdev->scan_req) {
2963                 err = -EBUSY;
2964                 goto out;
2965         }
2966
2967         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2968                 n_channels = validate_scan_freqs(
2969                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2970                 if (!n_channels) {
2971                         err = -EINVAL;
2972                         goto out;
2973                 }
2974         } else {
2975                 n_channels = 0;
2976
2977                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2978                         if (wiphy->bands[band])
2979                                 n_channels += wiphy->bands[band]->n_channels;
2980         }
2981
2982         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2983                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2984                         n_ssids++;
2985
2986         if (n_ssids > wiphy->max_scan_ssids) {
2987                 err = -EINVAL;
2988                 goto out;
2989         }
2990
2991         if (info->attrs[NL80211_ATTR_IE])
2992                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2993         else
2994                 ie_len = 0;
2995
2996         if (ie_len > wiphy->max_scan_ie_len) {
2997                 err = -EINVAL;
2998                 goto out;
2999         }
3000
3001         request = kzalloc(sizeof(*request)
3002                         + sizeof(*ssid) * n_ssids
3003                         + sizeof(channel) * n_channels
3004                         + ie_len, GFP_KERNEL);
3005         if (!request) {
3006                 err = -ENOMEM;
3007                 goto out;
3008         }
3009
3010         if (n_ssids)
3011                 request->ssids = (void *)&request->channels[n_channels];
3012         request->n_ssids = n_ssids;
3013         if (ie_len) {
3014                 if (request->ssids)
3015                         request->ie = (void *)(request->ssids + n_ssids);
3016                 else
3017                         request->ie = (void *)(request->channels + n_channels);
3018         }
3019
3020         i = 0;
3021         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3022                 /* user specified, bail out if channel not found */
3023                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3024                         struct ieee80211_channel *chan;
3025
3026                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3027
3028                         if (!chan) {
3029                                 err = -EINVAL;
3030                                 goto out_free;
3031                         }
3032
3033                         /* ignore disabled channels */
3034                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3035                                 continue;
3036
3037                         request->channels[i] = chan;
3038                         i++;
3039                 }
3040         } else {
3041                 /* all channels */
3042                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3043                         int j;
3044                         if (!wiphy->bands[band])
3045                                 continue;
3046                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3047                                 struct ieee80211_channel *chan;
3048
3049                                 chan = &wiphy->bands[band]->channels[j];
3050
3051                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3052                                         continue;
3053
3054                                 request->channels[i] = chan;
3055                                 i++;
3056                         }
3057                 }
3058         }
3059
3060         if (!i) {
3061                 err = -EINVAL;
3062                 goto out_free;
3063         }
3064
3065         request->n_channels = i;
3066
3067         i = 0;
3068         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3069                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3070                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3071                                 err = -EINVAL;
3072                                 goto out_free;
3073                         }
3074                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3075                         request->ssids[i].ssid_len = nla_len(attr);
3076                         i++;
3077                 }
3078         }
3079
3080         if (info->attrs[NL80211_ATTR_IE]) {
3081                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3082                 memcpy((void *)request->ie,
3083                        nla_data(info->attrs[NL80211_ATTR_IE]),
3084                        request->ie_len);
3085         }
3086
3087         request->dev = dev;
3088         request->wiphy = &rdev->wiphy;
3089
3090         rdev->scan_req = request;
3091         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3092
3093         if (!err) {
3094                 nl80211_send_scan_start(rdev, dev);
3095                 dev_hold(dev);
3096         }
3097
3098  out_free:
3099         if (err) {
3100                 rdev->scan_req = NULL;
3101                 kfree(request);
3102         }
3103  out:
3104         cfg80211_unlock_rdev(rdev);
3105         dev_put(dev);
3106  out_rtnl:
3107         rtnl_unlock();
3108
3109         return err;
3110 }
3111
3112 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3113                             struct cfg80211_registered_device *rdev,
3114                             struct wireless_dev *wdev,
3115                             struct cfg80211_internal_bss *intbss)
3116 {
3117         struct cfg80211_bss *res = &intbss->pub;
3118         void *hdr;
3119         struct nlattr *bss;
3120         int i;
3121
3122         ASSERT_WDEV_LOCK(wdev);
3123
3124         hdr = nl80211hdr_put(msg, pid, seq, flags,
3125                              NL80211_CMD_NEW_SCAN_RESULTS);
3126         if (!hdr)
3127                 return -1;
3128
3129         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3130         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3131
3132         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3133         if (!bss)
3134                 goto nla_put_failure;
3135         if (!is_zero_ether_addr(res->bssid))
3136                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3137         if (res->information_elements && res->len_information_elements)
3138                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3139                         res->len_information_elements,
3140                         res->information_elements);
3141         if (res->tsf)
3142                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3143         if (res->beacon_interval)
3144                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3145         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3146         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3147         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3148                 jiffies_to_msecs(jiffies - intbss->ts));
3149
3150         switch (rdev->wiphy.signal_type) {
3151         case CFG80211_SIGNAL_TYPE_MBM:
3152                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3153                 break;
3154         case CFG80211_SIGNAL_TYPE_UNSPEC:
3155                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3156                 break;
3157         default:
3158                 break;
3159         }
3160
3161         switch (wdev->iftype) {
3162         case NL80211_IFTYPE_STATION:
3163                 if (intbss == wdev->current_bss)
3164                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3165                                     NL80211_BSS_STATUS_ASSOCIATED);
3166                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3167                         if (intbss != wdev->auth_bsses[i])
3168                                 continue;
3169                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3170                                     NL80211_BSS_STATUS_AUTHENTICATED);
3171                         break;
3172                 }
3173                 break;
3174         case NL80211_IFTYPE_ADHOC:
3175                 if (intbss == wdev->current_bss)
3176                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3177                                     NL80211_BSS_STATUS_IBSS_JOINED);
3178                 break;
3179         default:
3180                 break;
3181         }
3182
3183         nla_nest_end(msg, bss);
3184
3185         return genlmsg_end(msg, hdr);
3186
3187  nla_put_failure:
3188         genlmsg_cancel(msg, hdr);
3189         return -EMSGSIZE;
3190 }
3191
3192 static int nl80211_dump_scan(struct sk_buff *skb,
3193                              struct netlink_callback *cb)
3194 {
3195         struct cfg80211_registered_device *rdev;
3196         struct net_device *dev;
3197         struct cfg80211_internal_bss *scan;
3198         struct wireless_dev *wdev;
3199         int ifidx = cb->args[0];
3200         int start = cb->args[1], idx = 0;
3201         int err;
3202
3203         if (!ifidx)
3204                 ifidx = nl80211_get_ifidx(cb);
3205         if (ifidx < 0)
3206                 return ifidx;
3207         cb->args[0] = ifidx;
3208
3209         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3210         if (!dev)
3211                 return -ENODEV;
3212
3213         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3214         if (IS_ERR(rdev)) {
3215                 err = PTR_ERR(rdev);
3216                 goto out_put_netdev;
3217         }
3218
3219         wdev = dev->ieee80211_ptr;
3220
3221         wdev_lock(wdev);
3222         spin_lock_bh(&rdev->bss_lock);
3223         cfg80211_bss_expire(rdev);
3224
3225         list_for_each_entry(scan, &rdev->bss_list, list) {
3226                 if (++idx <= start)
3227                         continue;
3228                 if (nl80211_send_bss(skb,
3229                                 NETLINK_CB(cb->skb).pid,
3230                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3231                                 rdev, wdev, scan) < 0) {
3232                         idx--;
3233                         goto out;
3234                 }
3235         }
3236
3237  out:
3238         spin_unlock_bh(&rdev->bss_lock);
3239         wdev_unlock(wdev);
3240
3241         cb->args[1] = idx;
3242         err = skb->len;
3243         cfg80211_unlock_rdev(rdev);
3244  out_put_netdev:
3245         dev_put(dev);
3246
3247         return err;
3248 }
3249
3250 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3251                                 int flags, struct net_device *dev,
3252                                 struct survey_info *survey)
3253 {
3254         void *hdr;
3255         struct nlattr *infoattr;
3256
3257         /* Survey without a channel doesn't make sense */
3258         if (!survey->channel)
3259                 return -EINVAL;
3260
3261         hdr = nl80211hdr_put(msg, pid, seq, flags,
3262                              NL80211_CMD_NEW_SURVEY_RESULTS);
3263         if (!hdr)
3264                 return -ENOMEM;
3265
3266         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3267
3268         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3269         if (!infoattr)
3270                 goto nla_put_failure;
3271
3272         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3273                     survey->channel->center_freq);
3274         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3275                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3276                             survey->noise);
3277
3278         nla_nest_end(msg, infoattr);
3279
3280         return genlmsg_end(msg, hdr);
3281
3282  nla_put_failure:
3283         genlmsg_cancel(msg, hdr);
3284         return -EMSGSIZE;
3285 }
3286
3287 static int nl80211_dump_survey(struct sk_buff *skb,
3288                         struct netlink_callback *cb)
3289 {
3290         struct survey_info survey;
3291         struct cfg80211_registered_device *dev;
3292         struct net_device *netdev;
3293         int ifidx = cb->args[0];
3294         int survey_idx = cb->args[1];
3295         int res;
3296
3297         if (!ifidx)
3298                 ifidx = nl80211_get_ifidx(cb);
3299         if (ifidx < 0)
3300                 return ifidx;
3301         cb->args[0] = ifidx;
3302
3303         rtnl_lock();
3304
3305         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3306         if (!netdev) {
3307                 res = -ENODEV;
3308                 goto out_rtnl;
3309         }
3310
3311         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3312         if (IS_ERR(dev)) {
3313                 res = PTR_ERR(dev);
3314                 goto out_rtnl;
3315         }
3316
3317         if (!dev->ops->dump_survey) {
3318                 res = -EOPNOTSUPP;
3319                 goto out_err;
3320         }
3321
3322         while (1) {
3323                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3324                                             &survey);
3325                 if (res == -ENOENT)
3326                         break;
3327                 if (res)
3328                         goto out_err;
3329
3330                 if (nl80211_send_survey(skb,
3331                                 NETLINK_CB(cb->skb).pid,
3332                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3333                                 netdev,
3334                                 &survey) < 0)
3335                         goto out;
3336                 survey_idx++;
3337         }
3338
3339  out:
3340         cb->args[1] = survey_idx;
3341         res = skb->len;
3342  out_err:
3343         cfg80211_unlock_rdev(dev);
3344  out_rtnl:
3345         rtnl_unlock();
3346
3347         return res;
3348 }
3349
3350 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3351 {
3352         return auth_type <= NL80211_AUTHTYPE_MAX;
3353 }
3354
3355 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3356 {
3357         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3358                                   NL80211_WPA_VERSION_2));
3359 }
3360
3361 static bool nl80211_valid_akm_suite(u32 akm)
3362 {
3363         return akm == WLAN_AKM_SUITE_8021X ||
3364                 akm == WLAN_AKM_SUITE_PSK;
3365 }
3366
3367 static bool nl80211_valid_cipher_suite(u32 cipher)
3368 {
3369         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3370                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3371                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3372                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3373                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3374 }
3375
3376
3377 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3378 {
3379         struct cfg80211_registered_device *rdev;
3380         struct net_device *dev;
3381         struct ieee80211_channel *chan;
3382         const u8 *bssid, *ssid, *ie = NULL;
3383         int err, ssid_len, ie_len = 0;
3384         enum nl80211_auth_type auth_type;
3385         struct key_parse key;
3386
3387         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3388                 return -EINVAL;
3389
3390         if (!info->attrs[NL80211_ATTR_MAC])
3391                 return -EINVAL;
3392
3393         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3394                 return -EINVAL;
3395
3396         if (!info->attrs[NL80211_ATTR_SSID])
3397                 return -EINVAL;
3398
3399         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3400                 return -EINVAL;
3401
3402         err = nl80211_parse_key(info, &key);
3403         if (err)
3404                 return err;
3405
3406         if (key.idx >= 0) {
3407                 if (!key.p.key || !key.p.key_len)
3408                         return -EINVAL;
3409                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3410                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3411                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3412                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3413                         return -EINVAL;
3414                 if (key.idx > 4)
3415                         return -EINVAL;
3416         } else {
3417                 key.p.key_len = 0;
3418                 key.p.key = NULL;
3419         }
3420
3421         rtnl_lock();
3422
3423         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3424         if (err)
3425                 goto unlock_rtnl;
3426
3427         if (!rdev->ops->auth) {
3428                 err = -EOPNOTSUPP;
3429                 goto out;
3430         }
3431
3432         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3433                 err = -EOPNOTSUPP;
3434                 goto out;
3435         }
3436
3437         if (!netif_running(dev)) {
3438                 err = -ENETDOWN;
3439                 goto out;
3440         }
3441
3442         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3443         chan = ieee80211_get_channel(&rdev->wiphy,
3444                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3445         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3446                 err = -EINVAL;
3447                 goto out;
3448         }
3449
3450         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3451         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3452
3453         if (info->attrs[NL80211_ATTR_IE]) {
3454                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3455                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3456         }
3457
3458         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3459         if (!nl80211_valid_auth_type(auth_type)) {
3460                 err = -EINVAL;
3461                 goto out;
3462         }
3463
3464         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3465                                  ssid, ssid_len, ie, ie_len,
3466                                  key.p.key, key.p.key_len, key.idx);
3467
3468 out:
3469         cfg80211_unlock_rdev(rdev);
3470         dev_put(dev);
3471 unlock_rtnl:
3472         rtnl_unlock();
3473         return err;
3474 }
3475
3476 static int nl80211_crypto_settings(struct genl_info *info,
3477                                    struct cfg80211_crypto_settings *settings,
3478                                    int cipher_limit)
3479 {
3480         memset(settings, 0, sizeof(*settings));
3481
3482         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3483
3484         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3485                 void *data;
3486                 int len, i;
3487
3488                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3489                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3490                 settings->n_ciphers_pairwise = len / sizeof(u32);
3491
3492                 if (len % sizeof(u32))
3493                         return -EINVAL;
3494
3495                 if (settings->n_ciphers_pairwise > cipher_limit)
3496                         return -EINVAL;
3497
3498                 memcpy(settings->ciphers_pairwise, data, len);
3499
3500                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3501                         if (!nl80211_valid_cipher_suite(
3502                                         settings->ciphers_pairwise[i]))
3503                                 return -EINVAL;
3504         }
3505
3506         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3507                 settings->cipher_group =
3508                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3509                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3510                         return -EINVAL;
3511         }
3512
3513         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3514                 settings->wpa_versions =
3515                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3516                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3517                         return -EINVAL;
3518         }
3519
3520         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3521                 void *data;
3522                 int len, i;
3523
3524                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3525                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3526                 settings->n_akm_suites = len / sizeof(u32);
3527
3528                 if (len % sizeof(u32))
3529                         return -EINVAL;
3530
3531                 memcpy(settings->akm_suites, data, len);
3532
3533                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3534                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3535                                 return -EINVAL;
3536         }
3537
3538         return 0;
3539 }
3540
3541 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3542 {
3543         struct cfg80211_registered_device *rdev;
3544         struct net_device *dev;
3545         struct cfg80211_crypto_settings crypto;
3546         struct ieee80211_channel *chan, *fixedchan;
3547         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3548         int err, ssid_len, ie_len = 0;
3549         bool use_mfp = false;
3550
3551         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3552                 return -EINVAL;
3553
3554         if (!info->attrs[NL80211_ATTR_MAC] ||
3555             !info->attrs[NL80211_ATTR_SSID] ||
3556             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3557                 return -EINVAL;
3558
3559         rtnl_lock();
3560
3561         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3562         if (err)
3563                 goto unlock_rtnl;
3564
3565         if (!rdev->ops->assoc) {
3566                 err = -EOPNOTSUPP;
3567                 goto out;
3568         }
3569
3570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3571                 err = -EOPNOTSUPP;
3572                 goto out;
3573         }
3574
3575         if (!netif_running(dev)) {
3576                 err = -ENETDOWN;
3577                 goto out;
3578         }
3579
3580         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3581
3582         chan = ieee80211_get_channel(&rdev->wiphy,
3583                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3584         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3585                 err = -EINVAL;
3586                 goto out;
3587         }
3588
3589         mutex_lock(&rdev->devlist_mtx);
3590         fixedchan = rdev_fixed_channel(rdev, NULL);
3591         if (fixedchan && chan != fixedchan) {
3592                 err = -EBUSY;
3593                 mutex_unlock(&rdev->devlist_mtx);
3594                 goto out;
3595         }
3596         mutex_unlock(&rdev->devlist_mtx);
3597
3598         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3599         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3600
3601         if (info->attrs[NL80211_ATTR_IE]) {
3602                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3603                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3604         }
3605
3606         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3607                 enum nl80211_mfp mfp =
3608                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3609                 if (mfp == NL80211_MFP_REQUIRED)
3610                         use_mfp = true;
3611                 else if (mfp != NL80211_MFP_NO) {
3612                         err = -EINVAL;
3613                         goto out;
3614                 }
3615         }
3616
3617         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3618                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3619
3620         err = nl80211_crypto_settings(info, &crypto, 1);
3621         if (!err)
3622                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3623                                           ssid, ssid_len, ie, ie_len, use_mfp,
3624                                           &crypto);
3625
3626 out:
3627         cfg80211_unlock_rdev(rdev);
3628         dev_put(dev);
3629 unlock_rtnl:
3630         rtnl_unlock();
3631         return err;
3632 }
3633
3634 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3635 {
3636         struct cfg80211_registered_device *rdev;
3637         struct net_device *dev;
3638         const u8 *ie = NULL, *bssid;
3639         int err, ie_len = 0;
3640         u16 reason_code;
3641
3642         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3643                 return -EINVAL;
3644
3645         if (!info->attrs[NL80211_ATTR_MAC])
3646                 return -EINVAL;
3647
3648         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3649                 return -EINVAL;
3650
3651         rtnl_lock();
3652
3653         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3654         if (err)
3655                 goto unlock_rtnl;
3656
3657         if (!rdev->ops->deauth) {
3658                 err = -EOPNOTSUPP;
3659                 goto out;
3660         }
3661
3662         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3663                 err = -EOPNOTSUPP;
3664                 goto out;
3665         }
3666
3667         if (!netif_running(dev)) {
3668                 err = -ENETDOWN;
3669                 goto out;
3670         }
3671
3672         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3673
3674         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3675         if (reason_code == 0) {
3676                 /* Reason Code 0 is reserved */
3677                 err = -EINVAL;
3678                 goto out;
3679         }
3680
3681         if (info->attrs[NL80211_ATTR_IE]) {
3682                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3683                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3684         }
3685
3686         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3687
3688 out:
3689         cfg80211_unlock_rdev(rdev);
3690         dev_put(dev);
3691 unlock_rtnl:
3692         rtnl_unlock();
3693         return err;
3694 }
3695
3696 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3697 {
3698         struct cfg80211_registered_device *rdev;
3699         struct net_device *dev;
3700         const u8 *ie = NULL, *bssid;
3701         int err, ie_len = 0;
3702         u16 reason_code;
3703
3704         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3705                 return -EINVAL;
3706
3707         if (!info->attrs[NL80211_ATTR_MAC])
3708                 return -EINVAL;
3709
3710         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3711                 return -EINVAL;
3712
3713         rtnl_lock();
3714
3715         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3716         if (err)
3717                 goto unlock_rtnl;
3718
3719         if (!rdev->ops->disassoc) {
3720                 err = -EOPNOTSUPP;
3721                 goto out;
3722         }
3723
3724         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3725                 err = -EOPNOTSUPP;
3726                 goto out;
3727         }
3728
3729         if (!netif_running(dev)) {
3730                 err = -ENETDOWN;
3731                 goto out;
3732         }
3733
3734         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3735
3736         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3737         if (reason_code == 0) {
3738                 /* Reason Code 0 is reserved */
3739                 err = -EINVAL;
3740                 goto out;
3741         }
3742
3743         if (info->attrs[NL80211_ATTR_IE]) {
3744                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3745                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3746         }
3747
3748         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3749
3750 out:
3751         cfg80211_unlock_rdev(rdev);
3752         dev_put(dev);
3753 unlock_rtnl:
3754         rtnl_unlock();
3755         return err;
3756 }
3757
3758 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3759 {
3760         struct cfg80211_registered_device *rdev;
3761         struct net_device *dev;
3762         struct cfg80211_ibss_params ibss;
3763         struct wiphy *wiphy;
3764         struct cfg80211_cached_keys *connkeys = NULL;
3765         int err;
3766
3767         memset(&ibss, 0, sizeof(ibss));
3768
3769         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3770                 return -EINVAL;
3771
3772         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3773             !info->attrs[NL80211_ATTR_SSID] ||
3774             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3775                 return -EINVAL;
3776
3777         ibss.beacon_interval = 100;
3778
3779         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3780                 ibss.beacon_interval =
3781                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3782                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3783                         return -EINVAL;
3784         }
3785
3786         rtnl_lock();
3787
3788         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3789         if (err)
3790                 goto unlock_rtnl;
3791
3792         if (!rdev->ops->join_ibss) {
3793                 err = -EOPNOTSUPP;
3794                 goto out;
3795         }
3796
3797         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3798                 err = -EOPNOTSUPP;
3799                 goto out;
3800         }
3801
3802         if (!netif_running(dev)) {
3803                 err = -ENETDOWN;
3804                 goto out;
3805         }
3806
3807         wiphy = &rdev->wiphy;
3808
3809         if (info->attrs[NL80211_ATTR_MAC])
3810                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3811         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3812         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3813
3814         if (info->attrs[NL80211_ATTR_IE]) {
3815                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3816                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3817         }
3818
3819         ibss.channel = ieee80211_get_channel(wiphy,
3820                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3821         if (!ibss.channel ||
3822             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3823             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3824                 err = -EINVAL;
3825                 goto out;
3826         }
3827
3828         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3829         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3830
3831         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3832                 connkeys = nl80211_parse_connkeys(rdev,
3833                                         info->attrs[NL80211_ATTR_KEYS]);
3834                 if (IS_ERR(connkeys)) {
3835                         err = PTR_ERR(connkeys);
3836                         connkeys = NULL;
3837                         goto out;
3838                 }
3839         }
3840
3841         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3842
3843 out:
3844         cfg80211_unlock_rdev(rdev);
3845         dev_put(dev);
3846 unlock_rtnl:
3847         if (err)
3848                 kfree(connkeys);
3849         rtnl_unlock();
3850         return err;
3851 }
3852
3853 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3854 {
3855         struct cfg80211_registered_device *rdev;
3856         struct net_device *dev;
3857         int err;
3858
3859         rtnl_lock();
3860
3861         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3862         if (err)
3863                 goto unlock_rtnl;
3864
3865         if (!rdev->ops->leave_ibss) {
3866                 err = -EOPNOTSUPP;
3867                 goto out;
3868         }
3869
3870         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3871                 err = -EOPNOTSUPP;
3872                 goto out;
3873         }
3874
3875         if (!netif_running(dev)) {
3876                 err = -ENETDOWN;
3877                 goto out;
3878         }
3879
3880         err = cfg80211_leave_ibss(rdev, dev, false);
3881
3882 out:
3883         cfg80211_unlock_rdev(rdev);
3884         dev_put(dev);
3885 unlock_rtnl:
3886         rtnl_unlock();
3887         return err;
3888 }
3889
3890 #ifdef CONFIG_NL80211_TESTMODE
3891 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3892         .name = "testmode",
3893 };
3894
3895 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3896 {
3897         struct cfg80211_registered_device *rdev;
3898         int err;
3899
3900         if (!info->attrs[NL80211_ATTR_TESTDATA])
3901                 return -EINVAL;
3902
3903         rtnl_lock();
3904
3905         rdev = cfg80211_get_dev_from_info(info);
3906         if (IS_ERR(rdev)) {
3907                 err = PTR_ERR(rdev);
3908                 goto unlock_rtnl;
3909         }
3910
3911         err = -EOPNOTSUPP;
3912         if (rdev->ops->testmode_cmd) {
3913                 rdev->testmode_info = info;
3914                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3915                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3916                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3917                 rdev->testmode_info = NULL;
3918         }
3919
3920         cfg80211_unlock_rdev(rdev);
3921
3922  unlock_rtnl:
3923         rtnl_unlock();
3924         return err;
3925 }
3926
3927 static struct sk_buff *
3928 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3929                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3930 {
3931         struct sk_buff *skb;
3932         void *hdr;
3933         struct nlattr *data;
3934
3935         skb = nlmsg_new(approxlen + 100, gfp);
3936         if (!skb)
3937                 return NULL;
3938
3939         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3940         if (!hdr) {
3941                 kfree_skb(skb);
3942                 return NULL;
3943         }
3944
3945         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3946         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3947
3948         ((void **)skb->cb)[0] = rdev;
3949         ((void **)skb->cb)[1] = hdr;
3950         ((void **)skb->cb)[2] = data;
3951
3952         return skb;
3953
3954  nla_put_failure:
3955         kfree_skb(skb);
3956         return NULL;
3957 }
3958
3959 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3960                                                   int approxlen)
3961 {
3962         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3963
3964         if (WARN_ON(!rdev->testmode_info))
3965                 return NULL;
3966
3967         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3968                                 rdev->testmode_info->snd_pid,
3969                                 rdev->testmode_info->snd_seq,
3970                                 GFP_KERNEL);
3971 }
3972 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3973
3974 int cfg80211_testmode_reply(struct sk_buff *skb)
3975 {
3976         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3977         void *hdr = ((void **)skb->cb)[1];
3978         struct nlattr *data = ((void **)skb->cb)[2];
3979
3980         if (WARN_ON(!rdev->testmode_info)) {
3981                 kfree_skb(skb);
3982                 return -EINVAL;
3983         }
3984
3985         nla_nest_end(skb, data);
3986         genlmsg_end(skb, hdr);
3987         return genlmsg_reply(skb, rdev->testmode_info);
3988 }
3989 EXPORT_SYMBOL(cfg80211_testmode_reply);
3990
3991 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3992                                                   int approxlen, gfp_t gfp)
3993 {
3994         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3995
3996         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3997 }
3998 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3999
4000 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4001 {
4002         void *hdr = ((void **)skb->cb)[1];
4003         struct nlattr *data = ((void **)skb->cb)[2];
4004
4005         nla_nest_end(skb, data);
4006         genlmsg_end(skb, hdr);
4007         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4008 }
4009 EXPORT_SYMBOL(cfg80211_testmode_event);
4010 #endif
4011
4012 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4013 {
4014         struct cfg80211_registered_device *rdev;
4015         struct net_device *dev;
4016         struct cfg80211_connect_params connect;
4017         struct wiphy *wiphy;
4018         struct cfg80211_cached_keys *connkeys = NULL;
4019         int err;
4020
4021         memset(&connect, 0, sizeof(connect));
4022
4023         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4024                 return -EINVAL;
4025
4026         if (!info->attrs[NL80211_ATTR_SSID] ||
4027             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4028                 return -EINVAL;
4029
4030         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4031                 connect.auth_type =
4032                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4033                 if (!nl80211_valid_auth_type(connect.auth_type))
4034                         return -EINVAL;
4035         } else
4036                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4037
4038         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4039
4040         err = nl80211_crypto_settings(info, &connect.crypto,
4041                                       NL80211_MAX_NR_CIPHER_SUITES);
4042         if (err)
4043                 return err;
4044         rtnl_lock();
4045
4046         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4047         if (err)
4048                 goto unlock_rtnl;
4049
4050         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4051                 err = -EOPNOTSUPP;
4052                 goto out;
4053         }
4054
4055         if (!netif_running(dev)) {
4056                 err = -ENETDOWN;
4057                 goto out;
4058         }
4059
4060         wiphy = &rdev->wiphy;
4061
4062         if (info->attrs[NL80211_ATTR_MAC])
4063                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4064         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4065         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4066
4067         if (info->attrs[NL80211_ATTR_IE]) {
4068                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4069                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4070         }
4071
4072         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4073                 connect.channel =
4074                         ieee80211_get_channel(wiphy,
4075                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4076                 if (!connect.channel ||
4077                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4078                         err = -EINVAL;
4079                         goto out;
4080                 }
4081         }
4082
4083         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4084                 connkeys = nl80211_parse_connkeys(rdev,
4085                                         info->attrs[NL80211_ATTR_KEYS]);
4086                 if (IS_ERR(connkeys)) {
4087                         err = PTR_ERR(connkeys);
4088                         connkeys = NULL;
4089                         goto out;
4090                 }
4091         }
4092
4093         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4094
4095 out:
4096         cfg80211_unlock_rdev(rdev);
4097         dev_put(dev);
4098 unlock_rtnl:
4099         if (err)
4100                 kfree(connkeys);
4101         rtnl_unlock();
4102         return err;
4103 }
4104
4105 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4106 {
4107         struct cfg80211_registered_device *rdev;
4108         struct net_device *dev;
4109         int err;
4110         u16 reason;
4111
4112         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4113                 reason = WLAN_REASON_DEAUTH_LEAVING;
4114         else
4115                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4116
4117         if (reason == 0)
4118                 return -EINVAL;
4119
4120         rtnl_lock();
4121
4122         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4123         if (err)
4124                 goto unlock_rtnl;
4125
4126         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4127                 err = -EOPNOTSUPP;
4128                 goto out;
4129         }
4130
4131         if (!netif_running(dev)) {
4132                 err = -ENETDOWN;
4133                 goto out;
4134         }
4135
4136         err = cfg80211_disconnect(rdev, dev, reason, true);
4137
4138 out:
4139         cfg80211_unlock_rdev(rdev);
4140         dev_put(dev);
4141 unlock_rtnl:
4142         rtnl_unlock();
4143         return err;
4144 }
4145
4146 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4147 {
4148         struct cfg80211_registered_device *rdev;
4149         struct net *net;
4150         int err;
4151         u32 pid;
4152
4153         if (!info->attrs[NL80211_ATTR_PID])
4154                 return -EINVAL;
4155
4156         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4157
4158         rtnl_lock();
4159
4160         rdev = cfg80211_get_dev_from_info(info);
4161         if (IS_ERR(rdev)) {
4162                 err = PTR_ERR(rdev);
4163                 goto out_rtnl;
4164         }
4165
4166         net = get_net_ns_by_pid(pid);
4167         if (IS_ERR(net)) {
4168                 err = PTR_ERR(net);
4169                 goto out;
4170         }
4171
4172         err = 0;
4173
4174         /* check if anything to do */
4175         if (net_eq(wiphy_net(&rdev->wiphy), net))
4176                 goto out_put_net;
4177
4178         err = cfg80211_switch_netns(rdev, net);
4179  out_put_net:
4180         put_net(net);
4181  out:
4182         cfg80211_unlock_rdev(rdev);
4183  out_rtnl:
4184         rtnl_unlock();
4185         return err;
4186 }
4187
4188 static struct genl_ops nl80211_ops[] = {
4189         {
4190                 .cmd = NL80211_CMD_GET_WIPHY,
4191                 .doit = nl80211_get_wiphy,
4192                 .dumpit = nl80211_dump_wiphy,
4193                 .policy = nl80211_policy,
4194                 /* can be retrieved by unprivileged users */
4195         },
4196         {
4197                 .cmd = NL80211_CMD_SET_WIPHY,
4198                 .doit = nl80211_set_wiphy,
4199                 .policy = nl80211_policy,
4200                 .flags = GENL_ADMIN_PERM,
4201         },
4202         {
4203                 .cmd = NL80211_CMD_GET_INTERFACE,
4204                 .doit = nl80211_get_interface,
4205                 .dumpit = nl80211_dump_interface,
4206                 .policy = nl80211_policy,
4207                 /* can be retrieved by unprivileged users */
4208         },
4209         {
4210                 .cmd = NL80211_CMD_SET_INTERFACE,
4211                 .doit = nl80211_set_interface,
4212                 .policy = nl80211_policy,
4213                 .flags = GENL_ADMIN_PERM,
4214         },
4215         {
4216                 .cmd = NL80211_CMD_NEW_INTERFACE,
4217                 .doit = nl80211_new_interface,
4218                 .policy = nl80211_policy,
4219                 .flags = GENL_ADMIN_PERM,
4220         },
4221         {
4222                 .cmd = NL80211_CMD_DEL_INTERFACE,
4223                 .doit = nl80211_del_interface,
4224                 .policy = nl80211_policy,
4225                 .flags = GENL_ADMIN_PERM,
4226         },
4227         {
4228                 .cmd = NL80211_CMD_GET_KEY,
4229                 .doit = nl80211_get_key,
4230                 .policy = nl80211_policy,
4231                 .flags = GENL_ADMIN_PERM,
4232         },
4233         {
4234                 .cmd = NL80211_CMD_SET_KEY,
4235                 .doit = nl80211_set_key,
4236                 .policy = nl80211_policy,
4237                 .flags = GENL_ADMIN_PERM,
4238         },
4239         {
4240                 .cmd = NL80211_CMD_NEW_KEY,
4241                 .doit = nl80211_new_key,
4242                 .policy = nl80211_policy,
4243                 .flags = GENL_ADMIN_PERM,
4244         },
4245         {
4246                 .cmd = NL80211_CMD_DEL_KEY,
4247                 .doit = nl80211_del_key,
4248                 .policy = nl80211_policy,
4249                 .flags = GENL_ADMIN_PERM,
4250         },
4251         {
4252                 .cmd = NL80211_CMD_SET_BEACON,
4253                 .policy = nl80211_policy,
4254                 .flags = GENL_ADMIN_PERM,
4255                 .doit = nl80211_addset_beacon,
4256         },
4257         {
4258                 .cmd = NL80211_CMD_NEW_BEACON,
4259                 .policy = nl80211_policy,
4260                 .flags = GENL_ADMIN_PERM,
4261                 .doit = nl80211_addset_beacon,
4262         },
4263         {
4264                 .cmd = NL80211_CMD_DEL_BEACON,
4265                 .policy = nl80211_policy,
4266                 .flags = GENL_ADMIN_PERM,
4267                 .doit = nl80211_del_beacon,
4268         },
4269         {
4270                 .cmd = NL80211_CMD_GET_STATION,
4271                 .doit = nl80211_get_station,
4272                 .dumpit = nl80211_dump_station,
4273                 .policy = nl80211_policy,
4274         },
4275         {
4276                 .cmd = NL80211_CMD_SET_STATION,
4277                 .doit = nl80211_set_station,
4278                 .policy = nl80211_policy,
4279                 .flags = GENL_ADMIN_PERM,
4280         },
4281         {
4282                 .cmd = NL80211_CMD_NEW_STATION,
4283                 .doit = nl80211_new_station,
4284                 .policy = nl80211_policy,
4285                 .flags = GENL_ADMIN_PERM,
4286         },
4287         {
4288                 .cmd = NL80211_CMD_DEL_STATION,
4289                 .doit = nl80211_del_station,
4290                 .policy = nl80211_policy,
4291                 .flags = GENL_ADMIN_PERM,
4292         },
4293         {
4294                 .cmd = NL80211_CMD_GET_MPATH,
4295                 .doit = nl80211_get_mpath,
4296                 .dumpit = nl80211_dump_mpath,
4297                 .policy = nl80211_policy,
4298                 .flags = GENL_ADMIN_PERM,
4299         },
4300         {
4301                 .cmd = NL80211_CMD_SET_MPATH,
4302                 .doit = nl80211_set_mpath,
4303                 .policy = nl80211_policy,
4304                 .flags = GENL_ADMIN_PERM,
4305         },
4306         {
4307                 .cmd = NL80211_CMD_NEW_MPATH,
4308                 .doit = nl80211_new_mpath,
4309                 .policy = nl80211_policy,
4310                 .flags = GENL_ADMIN_PERM,
4311         },
4312         {
4313                 .cmd = NL80211_CMD_DEL_MPATH,
4314                 .doit = nl80211_del_mpath,
4315                 .policy = nl80211_policy,
4316                 .flags = GENL_ADMIN_PERM,
4317         },
4318         {
4319                 .cmd = NL80211_CMD_SET_BSS,
4320                 .doit = nl80211_set_bss,
4321                 .policy = nl80211_policy,
4322                 .flags = GENL_ADMIN_PERM,
4323         },
4324         {
4325                 .cmd = NL80211_CMD_GET_REG,
4326                 .doit = nl80211_get_reg,
4327                 .policy = nl80211_policy,
4328                 /* can be retrieved by unprivileged users */
4329         },
4330         {
4331                 .cmd = NL80211_CMD_SET_REG,
4332                 .doit = nl80211_set_reg,
4333                 .policy = nl80211_policy,
4334                 .flags = GENL_ADMIN_PERM,
4335         },
4336         {
4337                 .cmd = NL80211_CMD_REQ_SET_REG,
4338                 .doit = nl80211_req_set_reg,
4339                 .policy = nl80211_policy,
4340                 .flags = GENL_ADMIN_PERM,
4341         },
4342         {
4343                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4344                 .doit = nl80211_get_mesh_params,
4345                 .policy = nl80211_policy,
4346                 /* can be retrieved by unprivileged users */
4347         },
4348         {
4349                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4350                 .doit = nl80211_set_mesh_params,
4351                 .policy = nl80211_policy,
4352                 .flags = GENL_ADMIN_PERM,
4353         },
4354         {
4355                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4356                 .doit = nl80211_trigger_scan,
4357                 .policy = nl80211_policy,
4358                 .flags = GENL_ADMIN_PERM,
4359         },
4360         {
4361                 .cmd = NL80211_CMD_GET_SCAN,
4362                 .policy = nl80211_policy,
4363                 .dumpit = nl80211_dump_scan,
4364         },
4365         {
4366                 .cmd = NL80211_CMD_AUTHENTICATE,
4367                 .doit = nl80211_authenticate,
4368                 .policy = nl80211_policy,
4369                 .flags = GENL_ADMIN_PERM,
4370         },
4371         {
4372                 .cmd = NL80211_CMD_ASSOCIATE,
4373                 .doit = nl80211_associate,
4374                 .policy = nl80211_policy,
4375                 .flags = GENL_ADMIN_PERM,
4376         },
4377         {
4378                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4379                 .doit = nl80211_deauthenticate,
4380                 .policy = nl80211_policy,
4381                 .flags = GENL_ADMIN_PERM,
4382         },
4383         {
4384                 .cmd = NL80211_CMD_DISASSOCIATE,
4385                 .doit = nl80211_disassociate,
4386                 .policy = nl80211_policy,
4387                 .flags = GENL_ADMIN_PERM,
4388         },
4389         {
4390                 .cmd = NL80211_CMD_JOIN_IBSS,
4391                 .doit = nl80211_join_ibss,
4392                 .policy = nl80211_policy,
4393                 .flags = GENL_ADMIN_PERM,
4394         },
4395         {
4396                 .cmd = NL80211_CMD_LEAVE_IBSS,
4397                 .doit = nl80211_leave_ibss,
4398                 .policy = nl80211_policy,
4399                 .flags = GENL_ADMIN_PERM,
4400         },
4401 #ifdef CONFIG_NL80211_TESTMODE
4402         {
4403                 .cmd = NL80211_CMD_TESTMODE,
4404                 .doit = nl80211_testmode_do,
4405                 .policy = nl80211_policy,
4406                 .flags = GENL_ADMIN_PERM,
4407         },
4408 #endif
4409         {
4410                 .cmd = NL80211_CMD_CONNECT,
4411                 .doit = nl80211_connect,
4412                 .policy = nl80211_policy,
4413                 .flags = GENL_ADMIN_PERM,
4414         },
4415         {
4416                 .cmd = NL80211_CMD_DISCONNECT,
4417                 .doit = nl80211_disconnect,
4418                 .policy = nl80211_policy,
4419                 .flags = GENL_ADMIN_PERM,
4420         },
4421         {
4422                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4423                 .doit = nl80211_wiphy_netns,
4424                 .policy = nl80211_policy,
4425                 .flags = GENL_ADMIN_PERM,
4426         },
4427         {
4428                 .cmd = NL80211_CMD_GET_SURVEY,
4429                 .policy = nl80211_policy,
4430                 .dumpit = nl80211_dump_survey,
4431         },
4432 };
4433 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4434         .name = "mlme",
4435 };
4436
4437 /* multicast groups */
4438 static struct genl_multicast_group nl80211_config_mcgrp = {
4439         .name = "config",
4440 };
4441 static struct genl_multicast_group nl80211_scan_mcgrp = {
4442         .name = "scan",
4443 };
4444 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4445         .name = "regulatory",
4446 };
4447
4448 /* notification functions */
4449
4450 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4451 {
4452         struct sk_buff *msg;
4453
4454         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4455         if (!msg)
4456                 return;
4457
4458         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4459                 nlmsg_free(msg);
4460                 return;
4461         }
4462
4463         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4464                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4465 }
4466
4467 static int nl80211_add_scan_req(struct sk_buff *msg,
4468                                 struct cfg80211_registered_device *rdev)
4469 {
4470         struct cfg80211_scan_request *req = rdev->scan_req;
4471         struct nlattr *nest;
4472         int i;
4473
4474         ASSERT_RDEV_LOCK(rdev);
4475
4476         if (WARN_ON(!req))
4477                 return 0;
4478
4479         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4480         if (!nest)
4481                 goto nla_put_failure;
4482         for (i = 0; i < req->n_ssids; i++)
4483                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4484         nla_nest_end(msg, nest);
4485
4486         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4487         if (!nest)
4488                 goto nla_put_failure;
4489         for (i = 0; i < req->n_channels; i++)
4490                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4491         nla_nest_end(msg, nest);
4492
4493         if (req->ie)
4494                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4495
4496         return 0;
4497  nla_put_failure:
4498         return -ENOBUFS;
4499 }
4500
4501 static int nl80211_send_scan_msg(struct sk_buff *msg,
4502                                  struct cfg80211_registered_device *rdev,
4503                                  struct net_device *netdev,
4504                                  u32 pid, u32 seq, int flags,
4505                                  u32 cmd)
4506 {
4507         void *hdr;
4508
4509         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4510         if (!hdr)
4511                 return -1;
4512
4513         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4514         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4515
4516         /* ignore errors and send incomplete event anyway */
4517         nl80211_add_scan_req(msg, rdev);
4518
4519         return genlmsg_end(msg, hdr);
4520
4521  nla_put_failure:
4522         genlmsg_cancel(msg, hdr);
4523         return -EMSGSIZE;
4524 }
4525
4526 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4527                              struct net_device *netdev)
4528 {
4529         struct sk_buff *msg;
4530
4531         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4532         if (!msg)
4533                 return;
4534
4535         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4536                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4537                 nlmsg_free(msg);
4538                 return;
4539         }
4540
4541         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4542                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4543 }
4544
4545 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4546                             struct net_device *netdev)
4547 {
4548         struct sk_buff *msg;
4549
4550         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4551         if (!msg)
4552                 return;
4553
4554         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4555                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4556                 nlmsg_free(msg);
4557                 return;
4558         }
4559
4560         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4561                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4562 }
4563
4564 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4565                                struct net_device *netdev)
4566 {
4567         struct sk_buff *msg;
4568
4569         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4570         if (!msg)
4571                 return;
4572
4573         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4574                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4575                 nlmsg_free(msg);
4576                 return;
4577         }
4578
4579         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4580                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4581 }
4582
4583 /*
4584  * This can happen on global regulatory changes or device specific settings
4585  * based on custom world regulatory domains.
4586  */
4587 void nl80211_send_reg_change_event(struct regulatory_request *request)
4588 {
4589         struct sk_buff *msg;
4590         void *hdr;
4591
4592         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4593         if (!msg)
4594                 return;
4595
4596         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4597         if (!hdr) {
4598                 nlmsg_free(msg);
4599                 return;
4600         }
4601
4602         /* Userspace can always count this one always being set */
4603         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4604
4605         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4606                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4607                            NL80211_REGDOM_TYPE_WORLD);
4608         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4609                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4610                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4611         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4612                  request->intersect)
4613                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4614                            NL80211_REGDOM_TYPE_INTERSECTION);
4615         else {
4616                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4617                            NL80211_REGDOM_TYPE_COUNTRY);
4618                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4619         }
4620
4621         if (wiphy_idx_valid(request->wiphy_idx))
4622                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4623
4624         if (genlmsg_end(msg, hdr) < 0) {
4625                 nlmsg_free(msg);
4626                 return;
4627         }
4628
4629         rcu_read_lock();
4630         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4631                                 GFP_ATOMIC);
4632         rcu_read_unlock();
4633
4634         return;
4635
4636 nla_put_failure:
4637         genlmsg_cancel(msg, hdr);
4638         nlmsg_free(msg);
4639 }
4640
4641 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4642                                     struct net_device *netdev,
4643                                     const u8 *buf, size_t len,
4644                                     enum nl80211_commands cmd, gfp_t gfp)
4645 {
4646         struct sk_buff *msg;
4647         void *hdr;
4648
4649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4650         if (!msg)
4651                 return;
4652
4653         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4654         if (!hdr) {
4655                 nlmsg_free(msg);
4656                 return;
4657         }
4658
4659         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4660         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4661         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4662
4663         if (genlmsg_end(msg, hdr) < 0) {
4664                 nlmsg_free(msg);
4665                 return;
4666         }
4667
4668         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4669                                 nl80211_mlme_mcgrp.id, gfp);
4670         return;
4671
4672  nla_put_failure:
4673         genlmsg_cancel(msg, hdr);
4674         nlmsg_free(msg);
4675 }
4676
4677 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4678                           struct net_device *netdev, const u8 *buf,
4679                           size_t len, gfp_t gfp)
4680 {
4681         nl80211_send_mlme_event(rdev, netdev, buf, len,
4682                                 NL80211_CMD_AUTHENTICATE, gfp);
4683 }
4684
4685 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4686                            struct net_device *netdev, const u8 *buf,
4687                            size_t len, gfp_t gfp)
4688 {
4689         nl80211_send_mlme_event(rdev, netdev, buf, len,
4690                                 NL80211_CMD_ASSOCIATE, gfp);
4691 }
4692
4693 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4694                          struct net_device *netdev, const u8 *buf,
4695                          size_t len, gfp_t gfp)
4696 {
4697         nl80211_send_mlme_event(rdev, netdev, buf, len,
4698                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4699 }
4700
4701 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4702                            struct net_device *netdev, const u8 *buf,
4703                            size_t len, gfp_t gfp)
4704 {
4705         nl80211_send_mlme_event(rdev, netdev, buf, len,
4706                                 NL80211_CMD_DISASSOCIATE, gfp);
4707 }
4708
4709 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4710                                       struct net_device *netdev, int cmd,
4711                                       const u8 *addr, gfp_t gfp)
4712 {
4713         struct sk_buff *msg;
4714         void *hdr;
4715
4716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4717         if (!msg)
4718                 return;
4719
4720         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4721         if (!hdr) {
4722                 nlmsg_free(msg);
4723                 return;
4724         }
4725
4726         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4727         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4728         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4729         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4730
4731         if (genlmsg_end(msg, hdr) < 0) {
4732                 nlmsg_free(msg);
4733                 return;
4734         }
4735
4736         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4737                                 nl80211_mlme_mcgrp.id, gfp);
4738         return;
4739
4740  nla_put_failure:
4741         genlmsg_cancel(msg, hdr);
4742         nlmsg_free(msg);
4743 }
4744
4745 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4746                                struct net_device *netdev, const u8 *addr,
4747                                gfp_t gfp)
4748 {
4749         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4750                                   addr, gfp);
4751 }
4752
4753 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4754                                 struct net_device *netdev, const u8 *addr,
4755                                 gfp_t gfp)
4756 {
4757         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4758                                   addr, gfp);
4759 }
4760
4761 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4762                                  struct net_device *netdev, const u8 *bssid,
4763                                  const u8 *req_ie, size_t req_ie_len,
4764                                  const u8 *resp_ie, size_t resp_ie_len,
4765                                  u16 status, gfp_t gfp)
4766 {
4767         struct sk_buff *msg;
4768         void *hdr;
4769
4770         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4771         if (!msg)
4772                 return;
4773
4774         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4775         if (!hdr) {
4776                 nlmsg_free(msg);
4777                 return;
4778         }
4779
4780         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4781         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4782         if (bssid)
4783                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4784         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4785         if (req_ie)
4786                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4787         if (resp_ie)
4788                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4789
4790         if (genlmsg_end(msg, hdr) < 0) {
4791                 nlmsg_free(msg);
4792                 return;
4793         }
4794
4795         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4796                                 nl80211_mlme_mcgrp.id, gfp);
4797         return;
4798
4799  nla_put_failure:
4800         genlmsg_cancel(msg, hdr);
4801         nlmsg_free(msg);
4802
4803 }
4804
4805 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4806                          struct net_device *netdev, const u8 *bssid,
4807                          const u8 *req_ie, size_t req_ie_len,
4808                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4809 {
4810         struct sk_buff *msg;
4811         void *hdr;
4812
4813         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4814         if (!msg)
4815                 return;
4816
4817         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4818         if (!hdr) {
4819                 nlmsg_free(msg);
4820                 return;
4821         }
4822
4823         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4824         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4825         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4826         if (req_ie)
4827                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4828         if (resp_ie)
4829                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4830
4831         if (genlmsg_end(msg, hdr) < 0) {
4832                 nlmsg_free(msg);
4833                 return;
4834         }
4835
4836         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4837                                 nl80211_mlme_mcgrp.id, gfp);
4838         return;
4839
4840  nla_put_failure:
4841         genlmsg_cancel(msg, hdr);
4842         nlmsg_free(msg);
4843
4844 }
4845
4846 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4847                                struct net_device *netdev, u16 reason,
4848                                const u8 *ie, size_t ie_len, bool from_ap)
4849 {
4850         struct sk_buff *msg;
4851         void *hdr;
4852
4853         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4854         if (!msg)
4855                 return;
4856
4857         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4858         if (!hdr) {
4859                 nlmsg_free(msg);
4860                 return;
4861         }
4862
4863         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4864         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4865         if (from_ap && reason)
4866                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4867         if (from_ap)
4868                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4869         if (ie)
4870                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4871
4872         if (genlmsg_end(msg, hdr) < 0) {
4873                 nlmsg_free(msg);
4874                 return;
4875         }
4876
4877         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4878                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
4879         return;
4880
4881  nla_put_failure:
4882         genlmsg_cancel(msg, hdr);
4883         nlmsg_free(msg);
4884
4885 }
4886
4887 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4888                              struct net_device *netdev, const u8 *bssid,
4889                              gfp_t gfp)
4890 {
4891         struct sk_buff *msg;
4892         void *hdr;
4893
4894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4895         if (!msg)
4896                 return;
4897
4898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4899         if (!hdr) {
4900                 nlmsg_free(msg);
4901                 return;
4902         }
4903
4904         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4905         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4906         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4907
4908         if (genlmsg_end(msg, hdr) < 0) {
4909                 nlmsg_free(msg);
4910                 return;
4911         }
4912
4913         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4914                                 nl80211_mlme_mcgrp.id, gfp);
4915         return;
4916
4917  nla_put_failure:
4918         genlmsg_cancel(msg, hdr);
4919         nlmsg_free(msg);
4920 }
4921
4922 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4923                                  struct net_device *netdev, const u8 *addr,
4924                                  enum nl80211_key_type key_type, int key_id,
4925                                  const u8 *tsc, gfp_t gfp)
4926 {
4927         struct sk_buff *msg;
4928         void *hdr;
4929
4930         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4931         if (!msg)
4932                 return;
4933
4934         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4935         if (!hdr) {
4936                 nlmsg_free(msg);
4937                 return;
4938         }
4939
4940         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4941         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4942         if (addr)
4943                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4944         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4945         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4946         if (tsc)
4947                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4948
4949         if (genlmsg_end(msg, hdr) < 0) {
4950                 nlmsg_free(msg);
4951                 return;
4952         }
4953
4954         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4955                                 nl80211_mlme_mcgrp.id, gfp);
4956         return;
4957
4958  nla_put_failure:
4959         genlmsg_cancel(msg, hdr);
4960         nlmsg_free(msg);
4961 }
4962
4963 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4964                                     struct ieee80211_channel *channel_before,
4965                                     struct ieee80211_channel *channel_after)
4966 {
4967         struct sk_buff *msg;
4968         void *hdr;
4969         struct nlattr *nl_freq;
4970
4971         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4972         if (!msg)
4973                 return;
4974
4975         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4976         if (!hdr) {
4977                 nlmsg_free(msg);
4978                 return;
4979         }
4980
4981         /*
4982          * Since we are applying the beacon hint to a wiphy we know its
4983          * wiphy_idx is valid
4984          */
4985         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4986
4987         /* Before */
4988         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4989         if (!nl_freq)
4990                 goto nla_put_failure;
4991         if (nl80211_msg_put_channel(msg, channel_before))
4992                 goto nla_put_failure;
4993         nla_nest_end(msg, nl_freq);
4994
4995         /* After */
4996         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4997         if (!nl_freq)
4998                 goto nla_put_failure;
4999         if (nl80211_msg_put_channel(msg, channel_after))
5000                 goto nla_put_failure;
5001         nla_nest_end(msg, nl_freq);
5002
5003         if (genlmsg_end(msg, hdr) < 0) {
5004                 nlmsg_free(msg);
5005                 return;
5006         }
5007
5008         rcu_read_lock();
5009         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5010                                 GFP_ATOMIC);
5011         rcu_read_unlock();
5012
5013         return;
5014
5015 nla_put_failure:
5016         genlmsg_cancel(msg, hdr);
5017         nlmsg_free(msg);
5018 }
5019
5020 /* initialisation/exit functions */
5021
5022 int nl80211_init(void)
5023 {
5024         int err;
5025
5026         err = genl_register_family_with_ops(&nl80211_fam,
5027                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5028         if (err)
5029                 return err;
5030
5031         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5032         if (err)
5033                 goto err_out;
5034
5035         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5036         if (err)
5037                 goto err_out;
5038
5039         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5040         if (err)
5041                 goto err_out;
5042
5043         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5044         if (err)
5045                 goto err_out;
5046
5047 #ifdef CONFIG_NL80211_TESTMODE
5048         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5049         if (err)
5050                 goto err_out;
5051 #endif
5052
5053         return 0;
5054  err_out:
5055         genl_unregister_family(&nl80211_fam);
5056         return err;
5057 }
5058
5059 void nl80211_exit(void)
5060 {
5061         genl_unregister_family(&nl80211_fam);
5062 }